rename frontend to web and update contributing guide (#2509)

* rename frontend to web and update contributing guide

* rename this time

* fix build

* restructure rust code

* update documentation

* update descriptions

* Update CONTRIBUTING.md

Co-authored-by: J H <2364004+Blu-J@users.noreply.github.com>

---------

Co-authored-by: Aiden McClelland <me@drbonez.dev>
Co-authored-by: Aiden McClelland <3732071+dr-bonez@users.noreply.github.com>
Co-authored-by: J H <2364004+Blu-J@users.noreply.github.com>

core/startos/src/middleware/auth.rs

@@ -0,0 +1,284 @@
+use std::borrow::Borrow;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use basic_cookies::Cookie;
+use color_eyre::eyre::eyre;
+use digest::Digest;
+use futures::future::BoxFuture;
+use futures::FutureExt;
+use http::StatusCode;
+use rpc_toolkit::command_helpers::prelude::RequestParts;
+use rpc_toolkit::hyper::header::COOKIE;
+use rpc_toolkit::hyper::http::Error as HttpError;
+use rpc_toolkit::hyper::{Body, Request, Response};
+use rpc_toolkit::rpc_server_helpers::{
+    noop4, to_response, DynMiddleware, DynMiddlewareStage2, DynMiddlewareStage3,
+};
+use rpc_toolkit::yajrc::RpcMethod;
+use rpc_toolkit::Metadata;
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+use tokio::sync::Mutex;
+
+use crate::context::RpcContext;
+use crate::{Error, ResultExt};
+
+pub const LOCAL_AUTH_COOKIE_PATH: &str = "/run/embassy/rpc.authcookie";
+
+pub trait AsLogoutSessionId {
+    fn as_logout_session_id(self) -> String;
+}
+
+/// Will need to know when we have logged out from a route
+#[derive(Serialize, Deserialize)]
+pub struct HasLoggedOutSessions(());
+
+impl HasLoggedOutSessions {
+    pub async fn new(
+        logged_out_sessions: impl IntoIterator<Item = impl AsLogoutSessionId>,
+        ctx: &RpcContext,
+    ) -> Result<Self, Error> {
+        let mut open_authed_websockets = ctx.open_authed_websockets.lock().await;
+        let mut sqlx_conn = ctx.secret_store.acquire().await?;
+        for session in logged_out_sessions {
+            let session = session.as_logout_session_id();
+            sqlx::query!(
+                "UPDATE session SET logged_out = CURRENT_TIMESTAMP WHERE id = $1",
+                session
+            )
+            .execute(sqlx_conn.as_mut())
+            .await?;
+            for socket in open_authed_websockets.remove(&session).unwrap_or_default() {
+                let _ = socket.send(());
+            }
+        }
+        Ok(HasLoggedOutSessions(()))
+    }
+}
+
+/// Used when we need to know that we have logged in with a valid user
+#[derive(Clone, Copy)]
+pub struct HasValidSession(());
+
+impl HasValidSession {
+    pub async fn from_request_parts(
+        request_parts: &RequestParts,
+        ctx: &RpcContext,
+    ) -> Result<Self, Error> {
+        if let Some(cookie_header) = request_parts.headers.get(COOKIE) {
+            let cookies = Cookie::parse(
+                cookie_header
+                    .to_str()
+                    .with_kind(crate::ErrorKind::Authorization)?,
+            )
+            .with_kind(crate::ErrorKind::Authorization)?;
+            if let Some(cookie) = cookies.iter().find(|c| c.get_name() == "local") {
+                if let Ok(s) = Self::from_local(cookie).await {
+                    return Ok(s);
+                }
+            }
+            if let Some(cookie) = cookies.iter().find(|c| c.get_name() == "session") {
+                if let Ok(s) = Self::from_session(&HashSessionToken::from_cookie(cookie), ctx).await
+                {
+                    return Ok(s);
+                }
+            }
+        }
+        Err(Error::new(
+            eyre!("UNAUTHORIZED"),
+            crate::ErrorKind::Authorization,
+        ))
+    }
+
+    pub async fn from_session(session: &HashSessionToken, ctx: &RpcContext) -> Result<Self, Error> {
+        let session_hash = session.hashed();
+        let session = sqlx::query!("UPDATE session SET last_active = CURRENT_TIMESTAMP WHERE id = $1 AND logged_out IS NULL OR logged_out > CURRENT_TIMESTAMP", session_hash)
+            .execute(ctx.secret_store.acquire().await?.as_mut())
+            .await?;
+        if session.rows_affected() == 0 {
+            return Err(Error::new(
+                eyre!("UNAUTHORIZED"),
+                crate::ErrorKind::Authorization,
+            ));
+        }
+        Ok(Self(()))
+    }
+
+    pub async fn from_local(local: &Cookie<'_>) -> Result<Self, Error> {
+        let token = tokio::fs::read_to_string(LOCAL_AUTH_COOKIE_PATH).await?;
+        if local.get_value() == &*token {
+            Ok(Self(()))
+        } else {
+            Err(Error::new(
+                eyre!("UNAUTHORIZED"),
+                crate::ErrorKind::Authorization,
+            ))
+        }
+    }
+}
+
+/// When we have a need to create a new session,
+/// Or when we are using internal valid authenticated service.
+#[derive(Debug, Clone)]
+pub struct HashSessionToken {
+    hashed: String,
+    token: String,
+}
+impl HashSessionToken {
+    pub fn new() -> Self {
+        let token = base32::encode(
+            base32::Alphabet::RFC4648 { padding: false },
+            &rand::random::<[u8; 16]>(),
+        )
+        .to_lowercase();
+        let hashed = Self::hash(&token);
+        Self { hashed, token }
+    }
+    pub fn from_cookie(cookie: &Cookie) -> Self {
+        let token = cookie.get_value().to_owned();
+        let hashed = Self::hash(&token);
+        Self { hashed, token }
+    }
+
+    pub fn from_request_parts(request_parts: &RequestParts) -> Result<Self, Error> {
+        if let Some(cookie_header) = request_parts.headers.get(COOKIE) {
+            let cookies = Cookie::parse(
+                cookie_header
+                    .to_str()
+                    .with_kind(crate::ErrorKind::Authorization)?,
+            )
+            .with_kind(crate::ErrorKind::Authorization)?;
+            if let Some(session) = cookies.iter().find(|c| c.get_name() == "session") {
+                return Ok(Self::from_cookie(session));
+            }
+        }
+        Err(Error::new(
+            eyre!("UNAUTHORIZED"),
+            crate::ErrorKind::Authorization,
+        ))
+    }
+
+    pub fn header_value(&self) -> Result<http::HeaderValue, Error> {
+        http::HeaderValue::from_str(&format!(
+            "session={}; Path=/; SameSite=Lax; Expires=Fri, 31 Dec 9999 23:59:59 GMT;",
+            self.token
+        ))
+        .with_kind(crate::ErrorKind::Unknown)
+    }
+
+    pub fn hashed(&self) -> &str {
+        self.hashed.as_str()
+    }
+
+    pub fn as_hash(self) -> String {
+        self.hashed
+    }
+    fn hash(token: &str) -> String {
+        let mut hasher = Sha256::new();
+        hasher.update(token.as_bytes());
+        base32::encode(
+            base32::Alphabet::RFC4648 { padding: false },
+            hasher.finalize().as_slice(),
+        )
+        .to_lowercase()
+    }
+}
+impl AsLogoutSessionId for HashSessionToken {
+    fn as_logout_session_id(self) -> String {
+        self.hashed
+    }
+}
+impl PartialEq for HashSessionToken {
+    fn eq(&self, other: &Self) -> bool {
+        self.hashed == other.hashed
+    }
+}
+impl Eq for HashSessionToken {}
+impl PartialOrd for HashSessionToken {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        self.hashed.partial_cmp(&other.hashed)
+    }
+}
+impl Ord for HashSessionToken {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.hashed.cmp(&other.hashed)
+    }
+}
+impl Borrow<String> for HashSessionToken {
+    fn borrow(&self) -> &String {
+        &self.hashed
+    }
+}
+
+pub fn auth<M: Metadata>(ctx: RpcContext) -> DynMiddleware<M> {
+    let rate_limiter = Arc::new(Mutex::new((0_usize, Instant::now())));
+    Box::new(
+        move |req: &mut Request<Body>,
+              metadata: M|
+              -> BoxFuture<Result<Result<DynMiddlewareStage2, Response<Body>>, HttpError>> {
+            let ctx = ctx.clone();
+            let rate_limiter = rate_limiter.clone();
+            async move {
+                let mut header_stub = Request::new(Body::empty());
+                *header_stub.headers_mut() = req.headers().clone();
+                let m2: DynMiddlewareStage2 = Box::new(move |req, rpc_req| {
+                    async move {
+                        if let Err(e) = HasValidSession::from_request_parts(req, &ctx).await {
+                            if metadata
+                                .get(rpc_req.method.as_str(), "authenticated")
+                                .unwrap_or(true)
+                            {
+                                let (res_parts, _) = Response::new(()).into_parts();
+                                return Ok(Err(to_response(
+                                    &req.headers,
+                                    res_parts,
+                                    Err(e.into()),
+                                    |_| StatusCode::OK,
+                                )?));
+                            } else if rpc_req.method.as_str() == "auth.login" {
+                                let guard = rate_limiter.lock().await;
+                                if guard.1.elapsed() < Duration::from_secs(20) {
+                                    if guard.0 >= 3 {
+                                        let (res_parts, _) = Response::new(()).into_parts();
+                                        return Ok(Err(to_response(
+                                            &req.headers,
+                                            res_parts,
+                                            Err(Error::new(
+                                                eyre!(
+                                                "Please limit login attempts to 3 per 20 seconds."
+                                            ),
+                                                crate::ErrorKind::RateLimited,
+                                            )
+                                            .into()),
+                                            |_| StatusCode::OK,
+                                        )?));
+                                    }
+                                }
+                            }
+                        }
+                        let m3: DynMiddlewareStage3 = Box::new(move |_, res| {
+                            async move {
+                                let mut guard = rate_limiter.lock().await;
+                                if guard.1.elapsed() < Duration::from_secs(20) {
+                                    if res.is_err() {
+                                        guard.0 += 1;
+                                    }
+                                } else {
+                                    guard.0 = 0;
+                                }
+                                guard.1 = Instant::now();
+                                Ok(Ok(noop4()))
+                            }
+                            .boxed()
+                        });
+                        Ok(Ok(m3))
+                    }
+                    .boxed()
+                });
+                Ok(Ok(m2))
+            }
+            .boxed()
+        },
+    )
+}

core/startos/src/middleware/cors.rs

@@ -0,0 +1,61 @@
+use futures::FutureExt;
+use http::HeaderValue;
+use hyper::header::HeaderMap;
+use rpc_toolkit::hyper::http::Error as HttpError;
+use rpc_toolkit::hyper::{Body, Method, Request, Response};
+use rpc_toolkit::rpc_server_helpers::{
+    DynMiddlewareStage2, DynMiddlewareStage3, DynMiddlewareStage4,
+};
+use rpc_toolkit::Metadata;
+
+fn get_cors_headers(req: &Request<Body>) -> HeaderMap {
+    let mut res = HeaderMap::new();
+    if let Some(origin) = req.headers().get("Origin") {
+        res.insert("Access-Control-Allow-Origin", origin.clone());
+    }
+    if let Some(method) = req.headers().get("Access-Control-Request-Method") {
+        res.insert("Access-Control-Allow-Methods", method.clone());
+    }
+    if let Some(headers) = req.headers().get("Access-Control-Request-Headers") {
+        res.insert("Access-Control-Allow-Headers", headers.clone());
+    }
+    res.insert(
+        "Access-Control-Allow-Credentials",
+        HeaderValue::from_static("true"),
+    );
+    res
+}
+
+pub async fn cors<M: Metadata>(
+    req: &mut Request<Body>,
+    _metadata: M,
+) -> Result<Result<DynMiddlewareStage2, Response<Body>>, HttpError> {
+    let headers = get_cors_headers(req);
+    if req.method() == Method::OPTIONS {
+        Ok(Err({
+            let mut res = Response::new(Body::empty());
+            res.headers_mut().extend(headers.into_iter());
+            res
+        }))
+    } else {
+        Ok(Ok(Box::new(|_, _| {
+            async move {
+                let res: DynMiddlewareStage3 = Box::new(|_, _| {
+                    async move {
+                        let res: DynMiddlewareStage4 = Box::new(|res| {
+                            async move {
+                                res.headers_mut().extend(headers.into_iter());
+                                Ok::<_, HttpError>(())
+                            }
+                            .boxed()
+                        });
+                        Ok::<_, HttpError>(Ok(res))
+                    }
+                    .boxed()
+                });
+                Ok::<_, HttpError>(Ok(res))
+            }
+            .boxed()
+        })))
+    }
+}

core/startos/src/middleware/db.rs

@@ -0,0 +1,50 @@
+use futures::future::BoxFuture;
+use futures::FutureExt;
+use http::HeaderValue;
+use rpc_toolkit::hyper::http::Error as HttpError;
+use rpc_toolkit::hyper::{Body, Request, Response};
+use rpc_toolkit::rpc_server_helpers::{
+    noop4, DynMiddleware, DynMiddlewareStage2, DynMiddlewareStage3,
+};
+use rpc_toolkit::yajrc::RpcMethod;
+use rpc_toolkit::Metadata;
+
+use crate::context::RpcContext;
+
+pub fn db<M: Metadata>(ctx: RpcContext) -> DynMiddleware<M> {
+    Box::new(
+        move |_: &mut Request<Body>,
+              metadata: M|
+              -> BoxFuture<Result<Result<DynMiddlewareStage2, Response<Body>>, HttpError>> {
+            let ctx = ctx.clone();
+            async move {
+                let m2: DynMiddlewareStage2 = Box::new(move |_req, rpc_req| {
+                    async move {
+                        let sync_db = metadata
+                            .get(rpc_req.method.as_str(), "sync_db")
+                            .unwrap_or(false);
+
+                        let m3: DynMiddlewareStage3 = Box::new(move |res, _| {
+                            async move {
+                                if sync_db {
+                                    res.headers.append(
+                                        "X-Patch-Sequence",
+                                        HeaderValue::from_str(
+                                            &ctx.db.sequence().await.to_string(),
+                                        )?,
+                                    );
+                                }
+                                Ok(Ok(noop4()))
+                            }
+                            .boxed()
+                        });
+                        Ok(Ok(m3))
+                    }
+                    .boxed()
+                });
+                Ok(Ok(m2))
+            }
+            .boxed()
+        },
+    )
+}

core/startos/src/middleware/diagnostic.rs

@@ -0,0 +1,39 @@
+use futures::FutureExt;
+use rpc_toolkit::hyper::http::Error as HttpError;
+use rpc_toolkit::hyper::{Body, Request, Response};
+use rpc_toolkit::rpc_server_helpers::{noop4, DynMiddlewareStage2, DynMiddlewareStage3};
+use rpc_toolkit::yajrc::RpcMethod;
+use rpc_toolkit::Metadata;
+
+use crate::Error;
+
+pub async fn diagnostic<M: Metadata>(
+    _req: &mut Request<Body>,
+    _metadata: M,
+) -> Result<Result<DynMiddlewareStage2, Response<Body>>, HttpError> {
+    Ok(Ok(Box::new(|_, rpc_req| {
+        let method = rpc_req.method.as_str().to_owned();
+        async move {
+            let res: DynMiddlewareStage3 = Box::new(|_, rpc_res| {
+                async move {
+                    if let Err(e) = rpc_res {
+                        if e.code == -32601 {
+                            *e = Error::new(
+                                color_eyre::eyre::eyre!(
+                                    "{} is not available on the Diagnostic API",
+                                    method
+                                ),
+                                crate::ErrorKind::DiagnosticMode,
+                            )
+                            .into();
+                        }
+                    }
+                    Ok(Ok(noop4()))
+                }
+                .boxed()
+            });
+            Ok::<_, HttpError>(Ok(res))
+        }
+        .boxed()
+    })))
+}

core/startos/src/middleware/encrypt.rs

@@ -0,0 +1,115 @@
+use aes::cipher::{CipherKey, NewCipher, Nonce, StreamCipher};
+use aes::Aes256Ctr;
+use hmac::Hmac;
+use josekit::jwk::Jwk;
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+use tracing::instrument;
+
+pub fn pbkdf2(password: impl AsRef<[u8]>, salt: impl AsRef<[u8]>) -> CipherKey<Aes256Ctr> {
+    let mut aeskey = CipherKey::<Aes256Ctr>::default();
+    pbkdf2::pbkdf2::<Hmac<Sha256>>(
+        password.as_ref(),
+        salt.as_ref(),
+        1000,
+        aeskey.as_mut_slice(),
+    )
+    .unwrap();
+    aeskey
+}
+
+pub fn encrypt_slice(input: impl AsRef<[u8]>, password: impl AsRef<[u8]>) -> Vec<u8> {
+    let prefix: [u8; 32] = rand::random();
+    let aeskey = pbkdf2(password.as_ref(), &prefix[16..]);
+    let ctr = Nonce::<Aes256Ctr>::from_slice(&prefix[..16]);
+    let mut aes = Aes256Ctr::new(&aeskey, ctr);
+    let mut res = Vec::with_capacity(32 + input.as_ref().len());
+    res.extend_from_slice(&prefix[..]);
+    res.extend_from_slice(input.as_ref());
+    aes.apply_keystream(&mut res[32..]);
+    res
+}
+
+pub fn decrypt_slice(input: impl AsRef<[u8]>, password: impl AsRef<[u8]>) -> Vec<u8> {
+    if input.as_ref().len() < 32 {
+        return Vec::new();
+    }
+    let (prefix, rest) = input.as_ref().split_at(32);
+    let aeskey = pbkdf2(password.as_ref(), &prefix[16..]);
+    let ctr = Nonce::<Aes256Ctr>::from_slice(&prefix[..16]);
+    let mut aes = Aes256Ctr::new(&aeskey, ctr);
+    let mut res = rest.to_vec();
+    aes.apply_keystream(&mut res);
+    res
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct EncryptedWire {
+    encrypted: serde_json::Value,
+}
+impl EncryptedWire {
+    #[instrument(skip_all)]
+    pub fn decrypt(self, current_secret: impl AsRef<Jwk>) -> Option<String> {
+        let current_secret = current_secret.as_ref();
+
+        let decrypter = match josekit::jwe::alg::ecdh_es::EcdhEsJweAlgorithm::EcdhEs
+            .decrypter_from_jwk(current_secret)
+        {
+            Ok(a) => a,
+            Err(e) => {
+                tracing::warn!("Could not setup awk");
+                tracing::debug!("{:?}", e);
+                return None;
+            }
+        };
+        let encrypted = match serde_json::to_string(&self.encrypted) {
+            Ok(a) => a,
+            Err(e) => {
+                tracing::warn!("Could not deserialize");
+                tracing::debug!("{:?}", e);
+
+                return None;
+            }
+        };
+        let (decoded, _) = match josekit::jwe::deserialize_json(&encrypted, &decrypter) {
+            Ok(a) => a,
+            Err(e) => {
+                tracing::warn!("Could not decrypt");
+                tracing::debug!("{:?}", e);
+                return None;
+            }
+        };
+        match String::from_utf8(decoded) {
+            Ok(a) => Some(a),
+            Err(e) => {
+                tracing::warn!("Could not decrypt into utf8");
+                tracing::debug!("{:?}", e);
+                return None;
+            }
+        }
+    }
+}
+
+/// We created this test by first making the private key, then restoring from this private key for recreatability.
+/// After this the frontend then encoded an password, then we are testing that the output that we got (hand coded)
+/// will be the shape we want.
+#[test]
+fn test_gen_awk() {
+    let private_key: Jwk = serde_json::from_str(
+        r#"{
+            "kty": "EC",
+            "crv": "P-256",
+            "d": "3P-MxbUJtEhdGGpBCRFXkUneGgdyz_DGZWfIAGSCHOU",
+            "x": "yHTDYSfjU809fkSv9MmN4wuojf5c3cnD7ZDN13n-jz4",
+            "y": "8Mpkn744A5KDag0DmX2YivB63srjbugYZzWc3JOpQXI"
+          }"#,
+    )
+    .unwrap();
+    let encrypted: EncryptedWire =  serde_json::from_str(r#"{
+        "encrypted":     {        "protected": "eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiRUNESC1FUyIsImtpZCI6ImgtZnNXUVh2Tm95dmJEazM5dUNsQ0NUdWc5N3MyZnJockJnWUVBUWVtclUiLCJlcGsiOnsia3R5IjoiRUMiLCJjcnYiOiJQLTI1NiIsIngiOiJmRkF0LXNWYWU2aGNkdWZJeUlmVVdUd3ZvWExaTkdKRHZIWVhIckxwOXNNIiwieSI6IjFvVFN6b00teHlFZC1SLUlBaUFHdXgzS1dJZmNYZHRMQ0JHLUh6MVkzY2sifX0",        "iv": "NbwvfvWOdLpZfYRIZUrkcw",        "ciphertext": "Zc5Br5kYOlhPkIjQKOLMJw",        "tag": "EPoch52lDuCsbUUulzZGfg"    }
+      }"#).unwrap();
+    assert_eq!(
+        "testing12345",
+        &encrypted.decrypt(std::sync::Arc::new(private_key)).unwrap()
+    );
+}

core/startos/src/middleware/mod.rs

@@ -0,0 +1,5 @@
+pub mod auth;
+pub mod cors;
+pub mod db;
+pub mod diagnostic;
+pub mod encrypt;