+ """
+ end
+
+ @impl true
+ def handle_event("authenticate", %{"password" => password}, socket) do
+ socket =
+ if LivebookWeb.AppAuthHook.valid_password?(password, socket.assigns.app_settings) do
+ token = LivebookWeb.AppAuthHook.get_auth_token(socket.assigns.app_settings)
+ push_event(socket, "persist_app_auth", %{"slug" => socket.assigns.slug, "token" => token})
+ else
+ assign(socket, password: password, errors: [{"app password is invalid", []}])
+ end
+
+ {:noreply, socket}
+ end
+
+ def handle_event("app_auth_persisted", %{}, socket) do
+ {:noreply, push_navigate(socket, to: Routes.app_path(socket, :page, socket.assigns.slug))}
+ end
+end
diff --git a/lib/livebook_web/live/app_live.ex b/lib/livebook_web/live/app_live.ex
index a5e11cd72..8ac6d2e36 100644
--- a/lib/livebook_web/live/app_live.ex
+++ b/lib/livebook_web/live/app_live.ex
@@ -6,37 +6,41 @@ defmodule LivebookWeb.AppLive do
alias Livebook.Notebook.Cell
@impl true
- def mount(%{"slug" => slug}, _session, socket) do
- case Livebook.Apps.fetch_session_by_slug(slug) do
- {:ok, %{pid: session_pid, id: session_id}} ->
+ def mount(%{"slug" => slug}, _session, socket) when socket.assigns.app_authenticated? do
+ {:ok, %{pid: session_pid, id: session_id}} = Livebook.Apps.fetch_session_by_slug(slug)
+
+ {data, client_id} =
+ if connected?(socket) do
{data, client_id} =
- if connected?(socket) do
- {data, client_id} =
- Session.register_client(session_pid, self(), socket.assigns.current_user)
+ Session.register_client(session_pid, self(), socket.assigns.current_user)
- Session.subscribe(session_id)
+ Session.subscribe(session_id)
- {data, client_id}
- else
- data = Session.get_data(session_pid)
- {data, nil}
- end
+ {data, client_id}
+ else
+ data = Session.get_data(session_pid)
+ {data, nil}
+ end
- session = Session.get_by_pid(session_pid)
+ session = Session.get_by_pid(session_pid)
- {:ok,
- socket
- |> assign(
- slug: slug,
- session: session,
- page_title: get_page_title(data.notebook.name),
- client_id: client_id,
- data_view: data_to_view(data)
- )
- |> assign_private(data: data)}
+ {:ok,
+ socket
+ |> assign(
+ slug: slug,
+ session: session,
+ page_title: get_page_title(data.notebook.name),
+ client_id: client_id,
+ data_view: data_to_view(data)
+ )
+ |> assign_private(data: data)}
+ end
- :error ->
- {:ok, redirect(socket, to: Routes.home_path(socket, :page))}
+ def mount(%{"slug" => slug}, _session, socket) do
+ if connected?(socket) do
+ {:ok, push_navigate(socket, to: Routes.app_auth_path(socket, :page, slug))}
+ else
+ {:ok, socket}
end
end
@@ -49,7 +53,7 @@ defmodule LivebookWeb.AppLive do
end
@impl true
- def render(assigns) do
+ def render(assigns) when assigns.app_authenticated? do
~H"""
+
+
+ """
+ end
+
defp get_page_title(notebook_name) do
"Livebook - #{notebook_name}"
end
diff --git a/lib/livebook_web/live/hooks/app_auth_hook.ex b/lib/livebook_web/live/hooks/app_auth_hook.ex
new file mode 100644
index 000000000..8aaae0757
--- /dev/null
+++ b/lib/livebook_web/live/hooks/app_auth_hook.ex
@@ -0,0 +1,91 @@
+defmodule LivebookWeb.AppAuthHook do
+ import Phoenix.Component
+ import Phoenix.LiveView
+
+ alias LivebookWeb.Router.Helpers, as: Routes
+
+ # For apps with password, we want to store the hashed password
+ # (let's call it token) in the session, as we do for the main auth.
+ # However, the session uses cookies, which have a ~4kb size limit.
+ # We could use multiple cookies, however there are also limits on
+ # the number of cookies, and we don't want the browser to clear
+ # them all at some point. Additionally, accumulating cookies for
+ # all apps would imply larger payloads on every regular request.
+ #
+ # Since we don't have any persistence on the server side, the other
+ # option is to use the browser local storage and manage it through
+ # JavaScript. Therefore, the whole auth is built using LiveView.
+ # The flows are:
+ #
+ # * unauthenticated - the auth LiveView shows a regular form and
+ # validates the user-provided password. Once the password is
+ # correct, it pushes an event to the client to store the token.
+ # Once the token is stored it redirects to the app page.
+ #
+ # * authenticated - on dead render the app LiveView renders just
+ # a loading screen. On the client side, provided it's the app
+ # page, we read the token from local storage (if stored) and
+ # send it in mount connect params via the socket. Then on the
+ # server we use that token to authenticate.
+ #
+ # This module defines a hook that sets the `:app_authenticated?`
+ # assign to reflect the current authentication state. For public
+ # apps (or in case the user has full access) it is set to `true`
+ # on both dead and live render.
+
+ def on_mount(:default, %{"slug" => slug}, session, socket) do
+ case Livebook.Apps.fetch_settings_by_slug(slug) do
+ {:ok, %{access_type: :public} = app_settings} ->
+ {:cont, assign(socket, app_authenticated?: true, app_settings: app_settings)}
+
+ {:ok, %{access_type: :protected} = app_settings} ->
+ app_authenticated? =
+ livebook_authenticated?(session, socket) or has_valid_token?(socket, app_settings)
+
+ {:cont,
+ assign(socket, app_authenticated?: app_authenticated?, app_settings: app_settings)}
+
+ :error ->
+ {:halt, redirect(socket, to: Routes.home_path(socket, :page))}
+ end
+ end
+
+ defp livebook_authenticated?(session, socket) do
+ uri = get_connect_info(socket, :uri)
+ LivebookWeb.AuthPlug.authenticated?(session, uri.port, Livebook.Config.auth_mode())
+ end
+
+ defp has_valid_token?(socket, app_settings) do
+ connect_params = get_connect_params(socket) || %{}
+
+ if token = connect_params["app_auth_token"] do
+ valid_auth_token?(token, app_settings)
+ else
+ false
+ end
+ end
+
+ @doc """
+ Generates auth token that can be sent to the client.
+ """
+ @spec get_auth_token(Livebook.Notebook.AppSettings.t()) :: String.t()
+ def get_auth_token(app_settings) do
+ :crypto.hash(:sha256, app_settings.password) |> Base.encode64()
+ end
+
+ @doc """
+ Checks the given token is valid.
+ """
+ @spec valid_auth_token?(String.t(), Livebook.Notebook.AppSettings.t()) :: String.t()
+ def valid_auth_token?(token, app_settings) do
+ Plug.Crypto.secure_compare(token, get_auth_token(app_settings))
+ end
+
+ @doc """
+ Checks if the given password is valid.
+ """
+ @spec valid_password?(String.t(), Livebook.Notebook.AppSettings.t()) :: String.t()
+ def valid_password?(password, app_settings) do
+ Plug.Crypto.secure_compare(password, app_settings.password)
+ end
+end
diff --git a/lib/livebook_web/live/hooks/auth_hook.ex b/lib/livebook_web/live/hooks/auth_hook.ex
index ad7ac9070..1f50eb6da 100644
--- a/lib/livebook_web/live/hooks/auth_hook.ex
+++ b/lib/livebook_web/live/hooks/auth_hook.ex
@@ -1,6 +1,8 @@
defmodule LivebookWeb.AuthHook do
import Phoenix.LiveView
+ alias LivebookWeb.Router.Helpers, as: Routes
+
def on_mount(:default, _params, session, socket) do
uri = get_connect_info(socket, :uri)
auth_mode = Livebook.Config.auth_mode()
@@ -8,7 +10,7 @@ defmodule LivebookWeb.AuthHook do
if LivebookWeb.AuthPlug.authenticated?(session || %{}, uri.port, auth_mode) do
{:cont, socket}
else
- {:halt, socket}
+ {:halt, redirect(socket, to: Routes.home_path(socket, :page))}
end
end
end
diff --git a/lib/livebook_web/live/hub/new/enterprise_component.ex b/lib/livebook_web/live/hub/new/enterprise_component.ex
index 65904f37a..cbe0c56b9 100644
--- a/lib/livebook_web/live/hub/new/enterprise_component.ex
+++ b/lib/livebook_web/live/hub/new/enterprise_component.ex
@@ -49,7 +49,7 @@ defmodule LivebookWeb.Hub.New.EnterpriseComponent do
<.input_wrapper form={f} field={:token} class="flex flex-col space-y-1">
+
+