mirror of
https://github.com/gravitl/netmaker.git
synced 2024-09-20 15:26:04 +08:00
2e8d95e80e
* user mgmt models * define user roles * define models for new user mgmt and groups * oauth debug log * initialize user role after db conn * print oauth token in debug log * user roles CRUD apis * user groups CRUD Apis * additional api checks * add additional scopes * add additional scopes url * add additional scopes url * rm additional scopes url * setup middlleware permission checks * integrate permission check into middleware * integrate permission check into middleware * check for headers for subjects * refactor user role models * refactor user groups models * add new user to pending user via RAC login * untracked * allow multiple groups for an user * change json tag * add debug headers * refer network controls form roles, add debug headers * refer network controls form roles, add debug headers * replace auth checks, add network id to role model * nodes handler * migration funcs * invoke sync users migration func * add debug logs * comment middleware * fix get all nodes api * add debug logs * fix middleware error nil check * add new func to get username from jwt * fix jwt parsing * abort on error * allow multiple network roles * allow multiple network roles * add migration func * return err if jwt parsing fails * set global check to true when accessing user apis * set netid for acls api calls * set netid for acls api calls * update role and groups routes * add validation checks * add invite flow apis and magic links * add invited user via oauth signup automatically * create invited user on oauth signup, with groups in the invite * add group validation for user invite * update create user handler with new role mgmt * add validation checks * create user invites tables * add error logging for email invite * fix invite singup url * debug log * get query params from url * get query params from url * add query escape * debug log * debug log * fix user signup via invite api * set admin field for backward compatbility * use new role id for user apis * deprecate use of old admin fields * deprecate usage of old user fields * add user role as service user if empty * setup email sender * delete invite after user singup * add plaform user role * redirect on invite verification link * fix invite redirect * temporary redirect * fix invite redirect * point invite link to frontend * fix query params lookup * add resend support, configure email interface types * fix groups and user creation * validate user groups, add check for metrics api in middleware * add invite url to invite model * migrate rac apis to new user mgmt * handle network nodes * add platform user to default role * fix user role migration * add default on rag creation and cleanup after deletion * fix rac apis * change to invite code param * filter nodes and hosts based on user network access * extend create user group req to accomodate users * filter network based on user access * format oauth error * move user roles and groups * fix get user v1 api * move user mgmt func to pro * add user auth type to user model * fix roles init * remove platform role from group object * list only platform roles * add network roles to invite req * create default groups and roles * fix middleware for global access * create default role * fix nodes filter with global network roles * block selfupdate of groups and network roles * delete netID if net roles are empty * validate user roles nd groups on update * set extclient permission scope when rag vpn access is set * allow deletion of roles and groups * replace _ with - in role naming convention * fix failover middleware mgmt * format oauth templates * fetch route temaplate * return err if user wrong login type * check user groups on rac apis * fix rac apis * fix resp msg * add validation checks for admin invite * return oauth type * format group err msg * fix html tag * clean up default groups * create default rag role * add UI name to roles * remove default net group from user when deleted * reorder migration funcs * fix duplicacy of hosts * check old field for migration * from pro to ce make all secondary users admins * from pro to ce make all secondary users admins * revert: from pro to ce make all secondary users admins * make sure downgrades work * fix pending users approval * fix duplicate hosts * fix duplicate hosts entries * fix cache reference issue * feat: configure FRONTEND_URL during installation * disable user vpn access when network roles are modified * rm vpn acces when roles or groups are deleted * add http to frontend url * revert crypto version * downgrade crytpo version * add platform id check on user invites --------- Co-authored-by: the_aceix <aceixsmartx@gmail.com>
177 lines
4.8 KiB
Go
177 lines
4.8 KiB
Go
package logic
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v4"
|
|
|
|
"github.com/gravitl/netmaker/logger"
|
|
"github.com/gravitl/netmaker/models"
|
|
"github.com/gravitl/netmaker/servercfg"
|
|
)
|
|
|
|
var jwtSecretKey []byte
|
|
|
|
// SetJWTSecret - sets the jwt secret on server startup
|
|
func SetJWTSecret() {
|
|
currentSecret, jwtErr := FetchJWTSecret()
|
|
if jwtErr != nil {
|
|
newValue := RandomString(64)
|
|
jwtSecretKey = []byte(newValue) // 512 bit random password
|
|
if err := StoreJWTSecret(string(jwtSecretKey)); err != nil {
|
|
logger.FatalLog("something went wrong when configuring JWT authentication")
|
|
}
|
|
} else {
|
|
jwtSecretKey = []byte(currentSecret)
|
|
}
|
|
}
|
|
|
|
// CreateJWT func will used to create the JWT while signing in and signing out
|
|
func CreateJWT(uuid string, macAddress string, network string) (response string, err error) {
|
|
expirationTime := time.Now().Add(15 * time.Minute)
|
|
claims := &models.Claims{
|
|
ID: uuid,
|
|
Network: network,
|
|
MacAddress: macAddress,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Issuer: "Netmaker",
|
|
Subject: fmt.Sprintf("node|%s", uuid),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
ExpiresAt: jwt.NewNumericDate(expirationTime),
|
|
},
|
|
}
|
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
tokenString, err := token.SignedString(jwtSecretKey)
|
|
if err == nil {
|
|
return tokenString, nil
|
|
}
|
|
return "", err
|
|
}
|
|
|
|
// CreateUserJWT - creates a user jwt token
|
|
func CreateUserJWT(username string, role models.UserRoleID) (response string, err error) {
|
|
expirationTime := time.Now().Add(servercfg.GetServerConfig().JwtValidityDuration)
|
|
claims := &models.UserClaims{
|
|
UserName: username,
|
|
Role: role,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Issuer: "Netmaker",
|
|
Subject: fmt.Sprintf("user|%s", username),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
ExpiresAt: jwt.NewNumericDate(expirationTime),
|
|
},
|
|
}
|
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
tokenString, err := token.SignedString(jwtSecretKey)
|
|
if err == nil {
|
|
return tokenString, nil
|
|
}
|
|
return "", err
|
|
}
|
|
|
|
// VerifyJWT verifies Auth Header
|
|
func VerifyJWT(bearerToken string) (username string, issuperadmin, isadmin bool, err error) {
|
|
token := ""
|
|
tokenSplit := strings.Split(bearerToken, " ")
|
|
if len(tokenSplit) > 1 {
|
|
token = tokenSplit[1]
|
|
} else {
|
|
return "", false, false, errors.New("invalid auth header")
|
|
}
|
|
return VerifyUserToken(token)
|
|
}
|
|
|
|
func GetUserNameFromToken(authtoken string) (username string, err error) {
|
|
claims := &models.UserClaims{}
|
|
var tokenSplit = strings.Split(authtoken, " ")
|
|
var tokenString = ""
|
|
|
|
if len(tokenSplit) < 2 {
|
|
return "", Unauthorized_Err
|
|
} else {
|
|
tokenString = tokenSplit[1]
|
|
}
|
|
if tokenString == servercfg.GetMasterKey() && servercfg.GetMasterKey() != "" {
|
|
return MasterUser, nil
|
|
}
|
|
|
|
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
|
|
return jwtSecretKey, nil
|
|
})
|
|
if err != nil {
|
|
return "", Unauthorized_Err
|
|
}
|
|
|
|
if token != nil && token.Valid {
|
|
var user *models.User
|
|
// check that user exists
|
|
user, err = GetUser(claims.UserName)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if user.UserName != "" {
|
|
return user.UserName, nil
|
|
}
|
|
if user.PlatformRoleID != claims.Role {
|
|
return "", Unauthorized_Err
|
|
}
|
|
err = errors.New("user does not exist")
|
|
} else {
|
|
err = Unauthorized_Err
|
|
}
|
|
return "", err
|
|
}
|
|
|
|
// VerifyUserToken func will used to Verify the JWT Token while using APIS
|
|
func VerifyUserToken(tokenString string) (username string, issuperadmin, isadmin bool, err error) {
|
|
claims := &models.UserClaims{}
|
|
|
|
if tokenString == servercfg.GetMasterKey() && servercfg.GetMasterKey() != "" {
|
|
return MasterUser, true, true, nil
|
|
}
|
|
|
|
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
|
|
return jwtSecretKey, nil
|
|
})
|
|
|
|
if token != nil && token.Valid {
|
|
var user *models.User
|
|
// check that user exists
|
|
user, err = GetUser(claims.UserName)
|
|
if err != nil {
|
|
return "", false, false, err
|
|
}
|
|
if user.UserName != "" {
|
|
return user.UserName, user.PlatformRoleID == models.SuperAdminRole,
|
|
user.PlatformRoleID == models.AdminRole, nil
|
|
}
|
|
err = errors.New("user does not exist")
|
|
}
|
|
return "", false, false, err
|
|
}
|
|
|
|
// VerifyHostToken - [hosts] Only
|
|
func VerifyHostToken(tokenString string) (hostID string, mac string, network string, err error) {
|
|
claims := &models.Claims{}
|
|
|
|
// this may be a stupid way of serving up a master key
|
|
// TODO: look into a different method. Encryption?
|
|
if tokenString == servercfg.GetMasterKey() && servercfg.GetMasterKey() != "" {
|
|
return "mastermac", "", "", nil
|
|
}
|
|
|
|
token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
|
|
return jwtSecretKey, nil
|
|
})
|
|
|
|
if token != nil {
|
|
return claims.ID, claims.MacAddress, claims.Network, nil
|
|
}
|
|
return "", "", "", err
|
|
}
|