Skip to content
Sign in

flagon-io/g1t

public
0
1,067 linesCodeBlameRaw
1//! The identity service: accounts, sessions, SSH keys and access tokens.
2//!
3//! Reached only through service bindings; see `g1t_contracts::identity` for
4//! the methods and their arguments.
5
6mod access;
7mod admin;
8mod aliases;
9mod avatars;
10mod crypto;
11mod deletion;
12mod deploy_keys;
13mod device;
14mod directory;
15mod email;
16mod emails;
17mod github;
18mod invites;
19mod members;
20mod oauth;
21mod paid;
22mod profiles;
23mod rename;
24mod job_tokens;
25mod run_credentials;
26mod security;
27mod teams;
28mod throttle;
29mod token_reach;
30mod tokens;
31mod two_factor;
32mod workspaces;
33
34use g1t_contracts::identity::*;
35use g1t_contracts::time::{SQL_NOW, rfc3339, sql_after};
36use g1t_contracts::{FailureCode, Outcome, User, Viewer, claimable_namespace, new_id};
37use g1t_kit::{args, now_ms, reply, rpc_method};
38use serde::Deserialize;
39use tokens::TOKEN_PREFIX;
40use worker::wasm_bindgen::JsValue;
41use worker::{Context, D1Database, Env, Request, Response, Result, ScheduleContext, ScheduledEvent, event};
42
43const SESSION_TTL_SECONDS: u64 = 30 * 24 * 60 * 60;
44const VERIFY_TTL_SECONDS: u64 = 24 * 60 * 60;
45const RESET_TTL_SECONDS: u64 = 60 * 60;
46const MIN_PASSWORD_LENGTH: usize = 10;
47const PASSWORD_TOO_SHORT: &str = "Use a password of at least 10 characters.";
48
49/// A user as selected from the database; `verified` arrives as 0 or 1.
50#[derive(Deserialize)]
51struct Account {
52 id: String,
53 username: String,
54 verified: u8,
55 /// Selected only where the person is being shown to themselves.
56 #[serde(default)]
57 avatar: Option<String>,
58}
59
60impl From<Account> for User {
61 fn from(row: Account) -> Self {
62 User {
63 id: row.id,
64 username: row.username,
65 verified: row.verified != 0,
66 avatar: row.avatar,
67 ..User::default()
68 }
69 }
70}
71
72#[derive(Deserialize)]
73struct UserRow {
74 id: String,
75 username: String,
76 password_hash: String,
77 verified: u8,
78}
79
80/// The owner of an emailed token.
81#[derive(Deserialize)]
82struct TokenOwner {
83 id: String,
84 username: String,
85 /// The address a link was sent to; null on links from before accounts
86 /// had several, which are for the primary.
87 #[serde(default)]
88 email_id: Option<String>,
89}
90
91#[derive(Deserialize)]
92struct KeyRow {
93 id: String,
94 title: String,
95 fingerprint: String,
96 created_at: String,
97 #[serde(default)]
98 last_used_at: Option<String>,
99}
100
101impl From<KeyRow> for SshKey {
102 fn from(row: KeyRow) -> Self {
103 SshKey {
104 id: row.id,
105 title: row.title,
106 fingerprint: row.fingerprint,
107 created_at: row.created_at,
108 last_used_at: row.last_used_at,
109 }
110 }
111}
112
113struct Identity {
114 db: D1Database,
115 env: Env,
116}
117
118impl Identity {
119 /// Runs a query that returns at most one user, for showing to others:
120 /// without their workspaces.
121 async fn find_public_user(&self, sql: &str, param: &str) -> Result<Viewer> {
122 Ok(self
123 .db
124 .prepare(sql)
125 .bind(&[JsValue::from(param)])?
126 .first::<Account>(None)
127 .await?
128 .map(User::from))
129 }
130
131 /// Attaches the workspaces a user belongs to, so that any service can
132 /// authorize them without asking again.
133 async fn with_workspaces(&self, user: Viewer) -> Result<Viewer> {
134 let Some(mut user) = user else {
135 return Ok(None);
136 };
137 let memberships = self.memberships_and_policies(&user.id).await?;
138 // Roles on single repositories, under the same policy (access.rs).
139 let grants = self.grants_of(&user.id).await?;
140 // Access to a workspace is used only within its policy; see security.rs.
141 let within = self.within_policy(&user.id, memberships, grants).await?;
142 user.workspaces = within.memberships;
143 user.grants = within.grants;
144 user.held = within.held;
145 Ok(Some(user))
146 }
147
148 /// Runs a query that resolves credentials to at most one user.
149 async fn find_user(&self, sql: &str, param: &str) -> Result<Viewer> {
150 let user = self.find_public_user(sql, param).await?;
151 self.with_workspaces(user).await
152 }
153
154 /// Stores a one-time token of `kind` for the user and returns it.
155 async fn issue_email_token(&self, user_id: &str, kind: &str, ttl: u64) -> Result<String> {
156 let token = crypto::random_hex(32);
157 self.db
158 .prepare(format!(
159 "INSERT INTO email_tokens (id, user_id, kind, expires_at)
160 VALUES (?, ?, ?, {})",
161 sql_after(ttl)
162 ))
163 .bind(&[
164 crypto::sha256_hex(&token).into(),
165 user_id.into(),
166 kind.into(),
167 ])?
168 .run()
169 .await?;
170 Ok(token)
171 }
172
173 /// Consumes a token of `kind`, returning its owner if it was valid.
174 async fn redeem_email_token(&self, token: &str, kind: &str) -> Result<Option<TokenOwner>> {
175 let id = crypto::sha256_hex(token);
176 let owner = self
177 .db
178 .prepare(format!(
179 "SELECT users.id, users.username, email_tokens.email_id FROM email_tokens
180 JOIN users ON users.id = email_tokens.user_id
181 WHERE email_tokens.id = ? AND email_tokens.kind = ?
182 AND email_tokens.expires_at > {SQL_NOW}"
183 ))
184 .bind(&[id.as_str().into(), kind.into()])?
185 .first::<TokenOwner>(None)
186 .await?;
187 if let Some(owner) = &owner {
188 // Every outstanding token of this kind dies with the one used:
189 // every reset link, and every confirmation link for the same
190 // address (another address's links still work).
191 self.db
192 .prepare(
193 "DELETE FROM email_tokens WHERE user_id = ?1 AND kind = ?2
194 AND (?2 = 'reset' OR email_id IS ?3)",
195 )
196 .bind(&[
197 owner.id.as_str().into(),
198 kind.into(),
199 owner.email_id.as_deref().map_or(JsValue::NULL, Into::into),
200 ])?
201 .run()
202 .await?;
203 }
204 Ok(owner)
205 }
206
207 async fn send_verification(&self, user: &User, email: &str) -> Result<()> {
208 let token = self
209 .issue_email_token(&user.id, "verify", VERIFY_TTL_SECONDS)
210 .await?;
211 email::send_verification(&self.env, email, &user.username, &token).await
212 }
213
214 async fn resend_verification(&self, a: UserArgs) -> Result<Outcome<bool>> {
215 if !self.allow(throttle::CONFIRM_ACCOUNT, &a.user.id).await? {
216 return Ok(Outcome::fail(FailureCode::Conflict, "Too many confirmation emails this hour. Check your inbox, or try again later."));
217 }
218 self.resend_primary(&a.user).await
219 }
220
221 async fn verify_email(&self, a: EmailTokenArgs) -> Result<Outcome<User>> {
222 let Some(owner) = self.redeem_email_token(&a.token, "verify").await? else {
223 return Ok(Outcome::fail(
224 FailureCode::Invalid,
225 "This confirmation link is not valid or has expired.",
226 ));
227 };
228 if let Outcome::Fail(failure) = self.confirm_address(&owner.id, owner.email_id.as_deref()).await? {
229 return Ok(Outcome::Fail(failure));
230 }
231 // Whether the account is confirmed: whether its primary is.
232 let verified = self
233 .find_public_user(
234 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE id = ?",
235 &owner.id,
236 )
237 .await?
238 .is_some_and(|user| user.verified);
239 Ok(Outcome::Ok(User {
240 id: owner.id,
241 username: owner.username,
242 verified,
243 ..User::default()
244 }))
245 }
246
247 /// Any confirmed address of an account can ask for a reset; so can the
248 /// unconfirmed address a new account signed up with. See emails.rs.
249 async fn request_password_reset(&self, a: EmailArgs) -> Result<bool> {
250 let allowed = self.allow(throttle::RESET_EMAIL, &a.email).await?
251 && match a.client.as_deref() {
252 Some(client) => self.allow(throttle::RESET_CLIENT, client).await?,
253 None => true,
254 };
255 if allowed && let Some(target) = self.reset_target(&a.email).await? {
256 // A failure from here on happens only for a real account, so it
257 // is logged, never answered: the reply below stays the same.
258 if let Err(error) = self.send_reset(&target).await {
259 worker::console_error!("password reset for a known address failed: {error}");
260 }
261 }
262 // The same answer either way, so addresses cannot be probed.
263 Ok(true)
264 }
265
266 /// Saves a reset link for `target` and mails it, telling the account's
267 /// other addresses.
268 async fn send_reset(&self, target: &emails::ResetTarget) -> Result<()> {
269 {
270 let token = crypto::random_hex(32);
271 self.db
272 .prepare(format!(
273 "INSERT INTO email_tokens (id, user_id, kind, expires_at, email_id)
274 VALUES (?, ?, 'reset', {}, ?)",
275 sql_after(RESET_TTL_SECONDS)
276 ))
277 .bind(&[
278 crypto::sha256_hex(&token).into(),
279 target.user_id.as_str().into(),
280 target.email_id.as_str().into(),
281 ])?
282 .run()
283 .await?;
284 email::send_password_reset(&self.env, &target.display, &target.username, &token).await?;
285 // The primary and the backup hear of it when it went elsewhere.
286 let elsewhere = self.notice_recipients(&target.user_id, false).await?;
287 for address in elsewhere.iter().filter(|address| !address.eq_ignore_ascii_case(&target.display)) {
288 let change = format!("A password reset was asked for through {}", target.display);
289 if let Err(error) = email::send_security_notice(&self.env, address, &target.username, &change).await {
290 worker::console_error!("security notice failed: {error}");
291 }
292 }
293 }
294 Ok(())
295 }
296
297 async fn reset_password(&self, a: ResetPasswordArgs) -> Result<Outcome<User>> {
298 if a.password.chars().count() < MIN_PASSWORD_LENGTH {
299 return Ok(Outcome::fail(FailureCode::Invalid, PASSWORD_TOO_SHORT));
300 }
301 let Some(owner) = self.redeem_email_token(&a.token, "reset").await? else {
302 return Ok(Outcome::fail(
303 FailureCode::Invalid,
304 "This reset link is not valid or has expired.",
305 ));
306 };
307 self.db
308 .prepare("UPDATE users SET password_hash = ? WHERE id = ?")
309 .bind(&[
310 crypto::hash_password(&a.password).into(),
311 owner.id.as_str().into(),
312 ])?
313 .run()
314 .await?;
315 // Following an emailed link also proves the address it went to
316 // (unless another account confirmed it first).
317 let _ = self.confirm_address(&owner.id, owner.email_id.as_deref()).await?;
318 // Anyone signed in with the old password is signed out, and nobody
319 // stays locked out by the wrong guesses before it.
320 self.db
321 .prepare("DELETE FROM sessions WHERE user_id = ?")
322 .bind(&[owner.id.as_str().into()])?
323 .run()
324 .await?;
325 self.clear(&throttle::key(throttle::PASSWORD_ACCOUNT, &owner.id)).await?;
326 self.log_security(&owner.id, "password_changed", None, None).await;
327 self.tell_primary_and_backup(&owner.id, &owner.username, "Your password was changed").await;
328 let verified = self
329 .find_public_user(
330 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE id = ?",
331 &owner.id,
332 )
333 .await?
334 .is_some_and(|user| user.verified);
335 Ok(Outcome::Ok(User {
336 id: owner.id,
337 username: owner.username,
338 verified,
339 ..User::default()
340 }))
341 }
342
343 /// The account a login names: a username, or any confirmed address.
344 async fn password_row(&self, login: &str) -> Result<Option<UserRow>> {
345 let login = login.trim().to_lowercase();
346 let (column, value) = if login.contains('@') {
347 match self.user_with_verified_email(&login).await? {
348 Some(id) => ("id", id),
349 None => return Ok(None),
350 }
351 } else {
352 ("username", login)
353 };
354 self.db
355 .prepare(format!(
356 "SELECT id, username, password_hash, email_verified_at IS NOT NULL AS verified FROM users WHERE {column} = ?"
357 ))
358 .bind(&[JsValue::from(value)])?
359 .first::<UserRow>(None)
360 .await
361 }
362
363 /// Checks a password for a login, throttled (see throttle.rs). The
364 /// refusal is one of two messages, the same for every account.
365 async fn checked_password(
366 &self,
367 login: &str,
368 password: &str,
369 client: Option<&str>,
370 ) -> Result<std::result::Result<User, &'static str>> {
371 let row = self.password_row(login).await?;
372 let subject = row.as_ref().map_or_else(|| login.trim().to_lowercase(), |row| row.id.clone());
373 let (account_key, client_key) = Identity::password_keys(&subject, client);
374 if self.password_locked(&account_key, client_key.as_deref()).await? {
375 return Ok(Err(throttle::THROTTLED));
376 }
377 let owner = row.as_ref().map(|row| (row.id.clone(), row.username.clone()));
378 match row.filter(|row| !row.password_hash.is_empty() && crypto::verify_password(password, &row.password_hash)) {
379 Some(row) => {
380 self.clear(&account_key).await?;
381 Ok(Ok(User {
382 id: row.id,
383 username: row.username,
384 verified: row.verified != 0,
385 ..User::default()
386 }))
387 }
388 None => {
389 let owner = owner.as_ref().map(|(id, name)| (id.as_str(), name.as_str()));
390 self.password_failed(&account_key, client_key.as_deref(), owner).await?;
391 Ok(Err("Incorrect username or password."))
392 }
393 }
394 }
395
396 /// Git over HTTPS with the account's password. With two-factor
397 /// authentication on, a password alone is never enough: use an access
398 /// token (two_factor.rs).
399 async fn user_for_password(&self, login: &str, password: &str) -> Result<Viewer> {
400 let user = self.checked_password(login, password, None).await?.ok();
401 if let Some(user) = &user
402 && self.two_factor_enabled(&user.id).await?
403 {
404 return Ok(None);
405 }
406 self.with_workspaces(user).await
407 }
408
409 async fn register(&self, a: RegisterArgs) -> Result<Outcome<SignedIn>> {
410 let username = a.username.trim().to_lowercase();
411 let claimable = claimable_namespace(&username).is_some();
412 let email = a.email.trim().to_lowercase();
413 let invalid = |message: &str| Ok(Outcome::fail(FailureCode::Invalid, message));
414 let invite_code = a.invite_code.as_deref().map(str::trim).filter(|code| !code.is_empty());
415 // The invite first: without one, nothing else on the form matters.
416 if self.invites_required() && invite_code.is_none() {
417 return Ok(Outcome::fail(FailureCode::Forbidden, invites::MISSING));
418 }
419 if !claimable {
420 return invalid(
421 "Usernames use lowercase letters, digits and single hyphens, up to 39 characters, and cannot be a reserved word.",
422 );
423 }
424 let well_formed_email = email
425 .split_once('@')
426 .is_some_and(|(local, domain)| !local.is_empty() && domain.contains('.'))
427 && !email.contains(char::is_whitespace);
428 if !well_formed_email {
429 return invalid("Enter a valid email address.");
430 }
431 if a.password.chars().count() < MIN_PASSWORD_LENGTH {
432 return invalid(PASSWORD_TOO_SHORT);
433 }
434 let taken = self
435 .db
436 // Usernames and workspaces share one namespace, so that a name
437 // means the same thing wherever it appears.
438 // An address is taken once an account has confirmed it; an
439 // unconfirmed one goes to whoever confirms it first (emails.rs).
440 .prepare(
441 "SELECT username FROM users WHERE username = ?
442 UNION ALL SELECT email FROM user_emails WHERE email = ? AND verified_at IS NOT NULL
443 UNION ALL SELECT slug FROM workspaces WHERE slug = ?",
444 )
445 .bind(&[
446 username.as_str().into(),
447 email.as_str().into(),
448 username.as_str().into(),
449 ])?
450 .first::<serde_json::Value>(None)
451 .await?;
452 // A renamed workspace's old slug stays reserved for it a while, and
453 // a deleted workspace's for good.
454 if taken.is_some() || self.slug_held(&username).await? || self.slug_deleted(&username).await? {
455 return Ok(Outcome::fail(
456 FailureCode::Conflict,
457 "That username or email is already registered.",
458 ));
459 }
460 let password_hash = crypto::hash_password(&a.password);
461 let user = match self
462 .create_account(invites::NewAccount {
463 username: &username,
464 email: &email,
465 password_hash: &password_hash,
466 verified: false,
467 invite_code,
468 client: a.client.as_deref(),
469 })
470 .await?
471 {
472 Outcome::Ok(user) => user,
473 Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)),
474 };
475 // The account exists either way; the email can be sent again later.
476 // An invite sent to this address confirmed it already (invites.rs).
477 if !user.verified
478 && let Err(error) = self.send_verification(&user, &email).await
479 {
480 worker::console_error!("verification email failed: {error}");
481 }
482 self.start_session(user).await
483 }
484
485 async fn sign_in(&self, a: SignInArgs) -> Result<Outcome<SignedIn>> {
486 let user = match self.checked_password(&a.username, &a.password, a.client.as_deref()).await? {
487 Ok(user) => user,
488 Err(message) => return Ok(Outcome::fail(FailureCode::Unauthenticated, message)),
489 };
490 let user = self.with_workspaces(Some(user)).await?.unwrap_or_default();
491 self.start_session(user).await
492 }
493
494 /// Starts a session for someone who just proved their password (or
495 /// GitHub account). With two-factor authentication on, it starts none:
496 /// it returns a challenge for `two_factor_sign_in` (two_factor.rs).
497 async fn start_session(&self, user: User) -> Result<Outcome<SignedIn>> {
498 if self.two_factor_enabled(&user.id).await? {
499 let challenge = self.issue_challenge(&user.id).await?;
500 return Ok(Outcome::Ok(SignedIn {
501 user: User { workspaces: Vec::new(), grants: Vec::new(), held: Vec::new(), ..user },
502 session_token: String::new(),
503 two_factor_challenge: Some(challenge),
504 }));
505 }
506 self.session_for(user).await
507 }
508
509 /// A new session for `user`, who has proved who they are in full.
510 async fn session_for(&self, user: User) -> Result<Outcome<SignedIn>> {
511 let session_token = crypto::random_hex(32);
512 self.db
513 .prepare(format!(
514 // Signing in is proof it is the person: see security.rs.
515 "INSERT INTO sessions (id, user_id, expires_at, authenticated_at) VALUES (?, ?, {}, {SQL_NOW})",
516 sql_after(SESSION_TTL_SECONDS)
517 ))
518 .bind(&[
519 crypto::sha256_hex(&session_token).into(),
520 user.id.as_str().into(),
521 ])?
522 .run()
523 .await?;
524 Ok(Outcome::Ok(SignedIn {
525 user,
526 session_token,
527 two_factor_challenge: None,
528 }))
529 }
530
531 async fn sign_out(&self, a: SessionArgs) -> Result<()> {
532 self.db
533 .prepare("DELETE FROM sessions WHERE id = ?")
534 .bind(&[crypto::sha256_hex(&a.session_token).into()])?
535 .run()
536 .await?;
537 Ok(())
538 }
539
540 async fn user_for_session(&self, a: SessionArgs) -> Result<Viewer> {
541 self.find_user(
542 &format!(
543 "SELECT users.id, users.username, users.email_verified_at IS NOT NULL AS verified,
544 users.avatar
545 FROM sessions JOIN users ON users.id = sessions.user_id
546 WHERE sessions.id = ? AND sessions.expires_at > {SQL_NOW}"
547 ),
548 &crypto::sha256_hex(&a.session_token),
549 )
550 .await
551 }
552
553 async fn user_for_git_credentials(&self, a: GitCredentialsArgs) -> Result<Viewer> {
554 // Like GitHub, a token alone identifies its user.
555 if a.secret.starts_with(TOKEN_PREFIX) {
556 self.user_for_access_token(&a.secret).await
557 } else {
558 self.user_for_password(&a.username, &a.secret).await
559 }
560 }
561
562 async fn user_for_ssh_key(&self, a: FingerprintArgs) -> Result<Viewer> {
563 self.find_user(
564 "SELECT users.id, users.username, users.email_verified_at IS NOT NULL AS verified FROM ssh_keys
565 JOIN users ON users.id = ssh_keys.user_id
566 WHERE fingerprint = ?",
567 &a.fingerprint,
568 )
569 .await
570 }
571
572 async fn user_by_username(&self, a: UsernameArgs) -> Result<Viewer> {
573 self.find_public_user(
574 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE username = ?",
575 &a.username.to_lowercase(),
576 )
577 .await
578 }
579
580 /// `notify_by_email`: an inbox item, emailed to the person it is for,
581 /// only at a confirmed address and only while they can still read the
582 /// repository it is about. Returns whether it was sent.
583 async fn notify_by_email(&self, a: g1t_contracts::inbox::NotifyByEmailArgs) -> Result<bool> {
584 #[derive(Deserialize)]
585 struct Address {
586 email: Option<String>,
587 }
588 let user = self
589 .find_user(
590 "SELECT id, username, email_verified_at IS NOT NULL AS verified FROM users WHERE username = ?",
591 &a.username.to_lowercase(),
592 )
593 .await?;
594 let Some(user) = user.filter(|user| user.verified) else {
595 return Ok(false);
596 };
597 let readable: Vec<g1t_contracts::repos::Repo> = g1t_kit::call(
598 &self.env.service("REPOS")?,
599 "readable",
600 &g1t_contracts::repos::ReadableArgs {
601 ids: vec![a.repo_id.clone()],
602 viewer: Some(user.clone()),
603 },
604 )
605 .await?;
606 if readable.is_empty() {
607 return Ok(false);
608 }
609 let address = self
610 .db
611 .prepare("SELECT email FROM users WHERE id = ?")
612 .bind(&[user.id.as_str().into()])?
613 .first::<Address>(None)
614 .await?
615 .and_then(|row| row.email)
616 .filter(|email| !email.trim().is_empty());
617 let Some(address) = address else {
618 return Ok(false);
619 };
620 email::send_notification(&self.env, &address, &a).await?;
621 Ok(true)
622 }
623
624 async fn usernames(&self, a: UsernamesArgs) -> Result<std::collections::HashMap<String, String>> {
625 #[derive(serde::Deserialize)]
626 struct Named {
627 id: String,
628 name: String,
629 }
630 let ids: Vec<String> = a.ids.into_iter().take(200).collect();
631 let mut names = std::collections::HashMap::new();
632 if ids.is_empty() {
633 return Ok(names);
634 }
635 let marks = vec!["?"; ids.len()].join(", ");
636 let bind: Vec<worker::wasm_bindgen::JsValue> = ids.iter().map(|id| id.as_str().into()).collect();
637 for sql in [
638 format!("SELECT id, username AS name FROM users WHERE id IN ({marks})"),
639 format!("SELECT id, slug AS name FROM workspaces WHERE id IN ({marks})"),
640 ] {
641 for row in self.db.prepare(sql).bind(&bind)?.all().await?.results::<Named>()? {
642 names.insert(row.id, row.name);
643 }
644 }
645 Ok(names)
646 }
647
648 /// `accounts`: the accounts behind these ids (at most 200), each with
649 /// its username and avatar, for lists that keep ids, such as who
650 /// starred a repository. Ids of no account are left out.
651 async fn accounts(&self, a: UsernamesArgs) -> Result<std::collections::HashMap<String, g1t_contracts::accounts::EmailOwner>> {
652 #[derive(serde::Deserialize)]
653 struct Row {
654 id: String,
655 username: String,
656 avatar: Option<String>,
657 }
658 let ids: Vec<String> = a.ids.into_iter().take(200).collect();
659 let mut found = std::collections::HashMap::new();
660 if ids.is_empty() {
661 return Ok(found);
662 }
663 let marks = vec!["?"; ids.len()].join(", ");
664 let bind: Vec<worker::wasm_bindgen::JsValue> = ids.iter().map(|id| id.as_str().into()).collect();
665 let rows = self
666 .db
667 .prepare(format!("SELECT id, username, avatar FROM users WHERE id IN ({marks})"))
668 .bind(&bind)?
669 .all()
670 .await?
671 .results::<Row>()?;
672 for row in rows {
673 found.insert(row.id.clone(), g1t_contracts::accounts::EmailOwner { id: row.id, username: row.username, avatar: row.avatar });
674 }
675 Ok(found)
676 }
677
678 async fn list_ssh_keys(&self, a: UserArgs) -> Result<Vec<SshKey>> {
679 let rows = self
680 .db
681 .prepare("SELECT id, title, fingerprint, created_at, last_used_at FROM ssh_keys WHERE user_id = ? ORDER BY id")
682 .bind(&[a.user.id.into()])?
683 .all()
684 .await?
685 .results::<KeyRow>()?;
686 Ok(rows.into_iter().map(SshKey::from).collect())
687 }
688
689 /// The account (user id) that registered each key, by fingerprint
690 /// (`SHA256:…`). At most 100; unknown keys are left out.
691 async fn ssh_key_owners(&self, a: SshKeyOwnersArgs) -> Result<std::collections::HashMap<String, String>> {
692 #[derive(serde::Deserialize)]
693 struct Row {
694 fingerprint: String,
695 user_id: String,
696 }
697 let fingerprints: Vec<&String> = a.fingerprints.iter().take(100).collect();
698 if fingerprints.is_empty() {
699 return Ok(std::collections::HashMap::new());
700 }
701 let marks = vec!["?"; fingerprints.len()].join(", ");
702 let binds: Vec<JsValue> = fingerprints.iter().map(|fingerprint| fingerprint.as_str().into()).collect();
703 Ok(self
704 .db
705 .prepare(format!("SELECT fingerprint, user_id FROM ssh_keys WHERE fingerprint IN ({marks})"))
706 .bind(&binds)?
707 .all()
708 .await?
709 .results::<Row>()?
710 .into_iter()
711 .map(|row| (row.fingerprint, row.user_id))
712 .collect())
713 }
714
715 async fn add_ssh_key(&self, a: AddSshKeyArgs) -> Result<Outcome<SshKey>> {
716 let Some(key) = crypto::parse_ssh_key(&a.public_key) else {
717 return Ok(Outcome::fail(
718 FailureCode::Invalid,
719 "That is not a valid OpenSSH public key.",
720 ));
721 };
722 // Someone's SSH key, or a repository's deploy key (deploy_keys.rs).
723 if self.key_in_use(&key.fingerprint).await? {
724 return Ok(Outcome::fail(FailureCode::Conflict, g1t_contracts::deploy_keys::KEY_IN_USE));
725 }
726 let now = now_ms();
727 let title = [a.title.trim(), key.comment.as_str(), "SSH key"]
728 .into_iter()
729 .find(|candidate| !candidate.is_empty())
730 .unwrap_or_default()
731 .to_owned();
732 let row = KeyRow {
733 id: new_id("key", now),
734 title,
735 fingerprint: key.fingerprint,
736 created_at: rfc3339(now),
737 last_used_at: None,
738 };
739 let inserted = self.db
740 .prepare(
741 "INSERT INTO ssh_keys (id, user_id, title, public_key, fingerprint, created_at)
742 VALUES (?, ?, ?, ?, ?, ?)",
743 )
744 .bind(&[
745 row.id.as_str().into(),
746 a.user.id.as_str().into(),
747 row.title.as_str().into(),
748 key.public_key.into(),
749 row.fingerprint.as_str().into(),
750 row.created_at.as_str().into(),
751 ])?
752 .run()
753 .await;
754 // Added at the same moment elsewhere: the trigger or the unique
755 // index refused it.
756 if let Err(error) = inserted {
757 if self.key_in_use(&row.fingerprint).await? {
758 return Ok(Outcome::fail(FailureCode::Conflict, g1t_contracts::deploy_keys::KEY_IN_USE));
759 }
760 return Err(error);
761 }
762 let shown = format!("{} ({})", row.title, row.fingerprint);
763 self.log_security(&a.user.id, "ssh_key_added", Some(&shown), None).await;
764 self.audit_account(&a.user, "ssh_key.added", &format!("Added SSH key {shown}")).await;
765 Ok(Outcome::Ok(row.into()))
766 }
767
768 /// Deletes one of the person's SSH keys.
769 async fn remove_ssh_key(&self, a: RemoveArgs) -> Result<()> {
770 #[derive(Deserialize)]
771 struct Removed {
772 title: String,
773 fingerprint: String,
774 }
775 let removed = self
776 .db
777 .prepare("DELETE FROM ssh_keys WHERE id = ? AND user_id = ? RETURNING title, fingerprint")
778 .bind(&[a.id.as_str().into(), a.user.id.as_str().into()])?
779 .first::<Removed>(None)
780 .await?;
781 if let Some(removed) = removed {
782 let shown = format!("{} ({})", removed.title, removed.fingerprint);
783 self.log_security(&a.user.id, "ssh_key_removed", Some(&shown), None).await;
784 self.audit_account(&a.user, "ssh_key.removed", &format!("Removed SSH key {shown}")).await;
785 }
786 Ok(())
787 }
788}
789
790/// Every 15 minutes: staff hear about waitlist requests that arrived while
791/// the last summary's window was still open, so none waits on a later one;
792/// and deleted workspaces past their restore window are purged
793/// (deletion.rs).
794#[event(scheduled)]
795async fn scheduled(_event: ScheduledEvent, env: Env, _ctx: ScheduleContext) {
796 let Ok(db) = env.d1("DB") else { return };
797 let identity = Identity { db, env };
798 if let Err(error) = identity.notify_staff_of_requests().await {
799 worker::console_error!("waitlist summary: {error}");
800 }
801 if let Err(error) = identity.purge_due_workspaces().await {
802 worker::console_error!("workspace purge: {error}");
803 }
804 // Once: creators of repositories made before they got Admin (members.rs).
805 if let Err(error) = identity.backfill_creator_grants().await {
806 worker::console_error!("creator grants: {error}");
807 }
808}
809
810#[event(fetch)]
811async fn fetch(mut request: Request, env: Env, _ctx: Context) -> Result<Response> {
812 let Some(method) = rpc_method(&request) else {
813 return Response::error("Not found", 404);
814 };
815 // A replica near the caller when it asks for one (crates/kit/src/d1.rs).
816 let (db, served) = g1t_kit::d1::open(&env, "DB", &request)?;
817 let body: serde_json::Value = request.json().await?;
818 let identity = Identity { db, env };
819
820 let answered = match method.as_str() {
821 "register" => {
822 let outcome = identity.register(args(body)?).await?;
823 if let Outcome::Ok(signed_in) = &outcome {
824 identity.announce_user(&signed_in.user.username, Some(&signed_in.user.id)).await;
825 }
826 reply(&outcome)
827 }
828 "sign_in" => reply(&identity.sign_in(args(body)?).await?),
829 "create_workspace" => {
830 let outcome = identity.create_workspace(args(body)?).await?;
831 if let Outcome::Ok(workspace) = &outcome {
832 identity.announce_workspace(&workspace.id, &workspace.slug, None).await;
833 }
834 reply(&outcome)
835 }
836 "get_workspace" => reply(&identity.get_workspace(args(body)?).await?),
837 "list_members" => reply(&identity.list_members(args(body)?).await?),
838 "add_member" => reply(&identity.add_member(args(body)?).await?),
839 "remove_member" => reply(&identity.remove_member(args(body)?).await?),
840 // Owners, roles, leaving and member privileges; see members.rs.
841 "update_member" => reply(&identity.update_member(args(body)?).await?),
842 "transfer_ownership" => reply(&identity.transfer_ownership(args(body)?).await?),
843 "leave_workspace" => reply(&identity.leave_workspace(args(body)?).await?),
844 "set_member_privileges" => reply(&identity.set_member_privileges(args(body)?).await?),
845 "set_two_factor_requirement" => reply(&identity.set_two_factor_requirement(args(body)?).await?),
846 "grant_creator" => reply(&identity.grant_creator(args(body)?).await?),
847 "update_workspace" => {
848 let outcome = identity.update_workspace(args(body)?).await?;
849 if let Outcome::Ok(workspace) = &outcome {
850 identity.announce_workspace(&workspace.id, &workspace.slug, None).await;
851 }
852 reply(&outcome)
853 }
854 "rename_workspace" => reply(&identity.rename_workspace(args(body)?).await?),
855 "check_workspace_rename" => reply(&identity.check_workspace_rename(args(body)?).await?),
856 "resolve_slug" => reply(&identity.resolve_slug(args(body)?).await?),
857 "resolve_alias" => reply(&identity.resolve_alias(args(body)?).await?),
858 "check_workspace_deletion" => reply(&identity.check_workspace_deletion(args(body)?).await?),
859 "delete_workspace" => reply(&identity.delete_workspace(args(body)?).await?),
860 "transfer_repo_scopes" => reply(&identity.transfer_repo_scopes(args(body)?).await?),
861 "set_workspace_avatar" => {
862 let outcome = identity.set_workspace_avatar(args(body)?).await?;
863 if let Outcome::Ok(workspace) = &outcome {
864 identity.announce_workspace(&workspace.id, &workspace.slug, None).await;
865 }
866 reply(&outcome)
867 }
868 "set_user_avatar" => {
869 let a: SetUserAvatarArgs = args(body)?;
870 let (username, id) = (a.user.username.clone(), a.user.id.clone());
871 let outcome = identity.set_user_avatar(a).await?;
872 if matches!(outcome, Outcome::Ok(_)) {
873 identity.announce_user(&username, Some(&id)).await;
874 }
875 reply(&outcome)
876 }
877 "list_workspace_tokens" => reply(&identity.list_workspace_tokens(args(body)?).await?),
878 "create_workspace_token" => reply(&identity.create_workspace_token(args(body)?).await?),
879 "remove_workspace_token" => reply(&identity.remove_workspace_token(args(body)?).await?),
880 // Signing in with GitHub; see github.rs.
881 "github_enabled" => reply(&identity.github_enabled()),
882 "github_start" => reply(&identity.github_start(args(body)?).await?),
883 "github_finish" => reply(&identity.github_finish(args(body)?).await?),
884 "github_pending" => reply(&identity.github_pending(args(body)?).await?),
885 "github_sign_up" => reply(&identity.github_sign_up(args(body)?).await?),
886 "github_claim" => reply(&identity.github_claim(args(body)?).await?),
887 "github_account" => reply(&identity.github_account(args(body)?).await?),
888 "github_unlink" => reply(&identity.github_unlink(args(body)?).await?),
889 "github_user_token" => reply(&identity.github_user_token(args(body)?).await?),
890 "github_revoked" => reply(&identity.github_revoked(args(body)?).await?),
891 "github_usernames" => reply(&identity.github_usernames(args(body)?).await?),
892 "oauth_authorize" => reply(&identity.oauth_authorize(args(body)?).await?),
893 "oauth_exchange" => reply(&identity.oauth_exchange(args(body)?).await?),
894 "oauth_refresh" => reply(&identity.oauth_refresh(args(body)?).await?),
895 "list_oauth_grants" => reply(&identity.list_oauth_grants(args(body)?).await?),
896 "revoke_oauth_grant" => reply(&identity.revoke_oauth_grant(args(body)?).await?),
897 "update_oauth_grant" => reply(&identity.update_oauth_grant(args(body)?).await?),
898 "device_start" => reply(&identity.device_start(args(body)?).await?),
899 "device_lookup" => reply(&identity.device_lookup(args(body)?).await?),
900 "device_resolve" => reply(&identity.device_resolve(args(body)?).await?),
901 "device_claim" => reply(&identity.device_claim(args(body)?).await?),
902 "resend_verification" => reply(&identity.resend_verification(args(body)?).await?),
903 "verify_email" => reply(&identity.verify_email(args(body)?).await?),
904 "request_password_reset" => reply(&identity.request_password_reset(args(body)?).await?),
905 "reset_password" => reply(&identity.reset_password(args(body)?).await?),
906 // A person's email addresses; see emails.rs and security.rs.
907 "list_emails" => reply(&identity.list_emails(args(body)?).await?),
908 "add_email" => reply(&identity.add_email(args(body)?).await?),
909 "remove_email" => reply(&identity.remove_email(args(body)?).await?),
910 "resend_email_verification" => reply(&identity.resend_email_verification(args(body)?).await?),
911 "update_email_settings" => reply(&identity.update_email_settings(args(body)?).await?),
912 "reauthenticate" => reply(&identity.reauthenticate(args(body)?).await?),
913 // Two-factor authentication; see two_factor.rs.
914 "two_factor_status" => reply(&identity.two_factor_status(args(body)?).await?),
915 "two_factor_start" => reply(&identity.two_factor_start(args(body)?).await?),
916 "two_factor_enable" => reply(&identity.two_factor_enable(args(body)?).await?),
917 "two_factor_disable" => reply(&identity.two_factor_disable(args(body)?).await?),
918 "two_factor_recovery_codes" => reply(&identity.two_factor_recovery_codes(args(body)?).await?),
919 "two_factor_sign_in" => reply(&identity.two_factor_sign_in(args(body)?).await?),
920 "security_log" => reply(&identity.security_log(args(body)?).await?),
921 "email_owners" => reply(&identity.email_owners(args(body)?).await?),
922 "commit_identity" => reply(&identity.commit_identity(args(body)?).await?),
923 "push_email_guard" => reply(&identity.push_email_guard(args(body)?).await?),
924 "admin_user" => reply(&identity.admin_user(args(body)?).await?),
925 "admin_remove_email" => reply(&identity.admin_remove_email(args(body)?).await?),
926 "sign_out" => reply(&identity.sign_out(args(body)?).await?),
927 "user_for_session" => reply(&identity.user_for_session(args(body)?).await?),
928 "user_for_git_credentials" => reply(&identity.user_for_git_credentials(args(body)?).await?),
929 "user_for_access_token" => {
930 let a: TokenArgs = args(body)?;
931 reply(&identity.user_for_access_token(&a.token).await?)
932 }
933 "user_for_ssh_key" => reply(&identity.user_for_ssh_key(args(body)?).await?),
934 "user_by_username" => reply(&identity.user_by_username(args(body)?).await?),
935 "usernames" => reply(&identity.usernames(args(body)?).await?),
936 "accounts" => reply(&identity.accounts(args(body)?).await?),
937 "notify_by_email" => reply(&identity.notify_by_email(args(body)?).await?),
938 "profile" => reply(&identity.profile(args(body)?).await?),
939 "update_profile" => {
940 let outcome = identity.update_profile(args(body)?).await?;
941 if let Outcome::Ok(profile) = &outcome {
942 identity.announce_user(&profile.username, None).await;
943 }
944 reply(&outcome)
945 }
946 "directory" => reply(&identity.directory(args(body)?).await?),
947 "profile_workspaces" => reply(&identity.profile_workspaces(args(body)?).await?),
948 "list_ssh_keys" => reply(&identity.list_ssh_keys(args(body)?).await?),
949 // Services only: who registered each key, for verifying commit
950 // signatures (repos' signatures.rs).
951 "ssh_key_owners" => reply(&identity.ssh_key_owners(args(body)?).await?),
952 "add_ssh_key" => reply(&identity.add_ssh_key(args(body)?).await?),
953 "remove_ssh_key" => reply(&identity.remove_ssh_key(args(body)?).await?),
954 // A repository's deploy keys, and who an SSH key signs in as; see
955 // deploy_keys.rs.
956 "list_deploy_keys" => reply(&identity.list_deploy_keys(args(body)?).await?),
957 "get_deploy_key" => reply(&identity.get_deploy_key(args(body)?).await?),
958 "add_deploy_key" => reply(&identity.add_deploy_key(args(body)?).await?),
959 "remove_deploy_key" => reply(&identity.remove_deploy_key(args(body)?).await?),
960 "principal_for_ssh_key" => reply(&identity.principal_for_ssh_key(args(body)?).await?),
961 "list_access_tokens" => reply(&identity.list_access_tokens(args(body)?).await?),
962 "create_access_token" => reply(&identity.create_access_token(args(body)?).await?),
963 "update_access_token" => reply(&identity.update_access_token(args(body)?).await?),
964 // Fine-grained tokens and workspaces' rules for tokens; see token_reach.rs.
965 "create_fine_grained_token" => reply(&identity.create_fine_grained_token(args(body)?).await?),
966 "update_fine_grained_token" => reply(&identity.update_fine_grained_token(args(body)?).await?),
967 "get_token_policy" => reply(&identity.get_token_policy(args(body)?).await?),
968 "set_token_policy" => reply(&identity.set_token_policy(args(body)?).await?),
969 "list_member_tokens" => reply(&identity.list_member_tokens(args(body)?).await?),
970 "review_token_request" => reply(&identity.review_token_request(args(body)?).await?),
971 "revoke_member_token" => reply(&identity.revoke_member_token(args(body)?).await?),
972 "create_agent_token" => reply(&identity.create_agent_token(args(body)?).await?),
973 "agent_scope" => reply(&identity.agent_scope(args(body)?).await?),
974 "create_run_credential" => reply(&identity.create_run_credential(args(body)?).await?),
975 "bind_run_credentials" => reply(&identity.bind_run_credentials(args(body)?).await?),
976 "revoke_run_credentials" => reply(&identity.revoke_run_credentials(args(body)?).await?),
977 "create_job_token" => reply(&identity.create_job_token(args(body)?).await?),
978 "revoke_job_tokens" => reply(&identity.revoke_job_tokens(args(body)?).await?),
979 "remove_access_token" => reply(&identity.remove_access_token(args(body)?).await?),
980 // Invites and the waitlist; see invites.rs.
981 "registration" => reply(&identity.registration_mode()),
982 "list_invites" => reply(&identity.list_invites(args(body)?).await?),
983 "create_invite" => reply(&identity.create_invite(args(body)?).await?),
984 "revoke_invite" => reply(&identity.revoke_invite(args(body)?).await?),
985 "check_invite" => reply(&identity.check_invite(args(body)?).await?),
986 "accept_invite" => reply(&identity.accept_invite(args(body)?).await?),
987 "invite_member" => reply(&identity.invite_member(args(body)?).await?),
988 "workspace_invites" => reply(&identity.workspace_invites(args(body)?).await?),
989 "revoke_workspace_invite" => reply(&identity.revoke_workspace_invite(args(body)?).await?),
990 "request_access" => reply(&identity.request_access(args(body)?).await?),
991 // Who has access to a repository; see access.rs.
992 "repo_access" => reply(&identity.repo_access(args(body)?).await?),
993 "add_collaborator" => reply(&identity.add_collaborator(args(body)?).await?),
994 "set_collaborator_role" => reply(&identity.set_collaborator_role(args(body)?).await?),
995 "remove_collaborator" => reply(&identity.remove_collaborator(args(body)?).await?),
996 "collaborator_permission" => reply(&identity.collaborator_permission(args(body)?).await?),
997 "my_repo_invitations" => reply(&identity.my_repo_invitations(args(body)?).await?),
998 "respond_repo_invitation" => reply(&identity.respond_repo_invitation(args(body)?).await?),
999 "revoke_repo_invitation" => reply(&identity.revoke_repo_invitation(args(body)?).await?),
1000 "set_base_permission" => reply(&identity.set_base_permission(args(body)?).await?),
1001 // Where a workspace keeps its repositories' git data (EU residency).
1002 "workspace_residency" => reply(&identity.workspace_residency(args(body)?).await?),
1003 "set_workspace_residency" => reply(&identity.set_workspace_residency(args(body)?).await?),
1004 "outside_collaborators" => reply(&identity.outside_collaborators(args(body)?).await?),
1005 "forget_repo_access" => {
1006 let a: g1t_contracts::access::ForgetRepoAccessArgs = args(body)?;
1007 // A purged repository's deploy keys go with its access.
1008 identity.forget_deploy_keys(&a.repo_id).await?;
1009 reply(&identity.forget_repo_access(a).await?)
1010 }
1011 // Teams (teams.rs).
1012 "list_teams" => reply(&identity.list_teams(args(body)?).await?),
1013 "get_team" => reply(&identity.get_team(args(body)?).await?),
1014 "create_team" => reply(&identity.create_team(args(body)?).await?),
1015 "set_team_creation" => reply(&identity.set_team_creation(args(body)?).await?),
1016 "update_team" => reply(&identity.update_team(args(body)?).await?),
1017 "delete_team" => reply(&identity.delete_team(args(body)?).await?),
1018 "team_members" => reply(&identity.team_members(args(body)?).await?),
1019 "set_team_member" => reply(&identity.set_team_member(args(body)?).await?),
1020 "remove_team_member" => reply(&identity.remove_team_member(args(body)?).await?),
1021 "child_teams" => reply(&identity.child_teams(args(body)?).await?),
1022 "team_repos" => reply(&identity.team_repos(args(body)?).await?),
1023 "set_team_repo" => reply(&identity.set_team_repo(args(body)?).await?),
1024 "remove_team_repo" => reply(&identity.remove_team_repo(args(body)?).await?),
1025 "user_teams" => reply(&identity.user_teams(args(body)?).await?),
1026 "team_memberships" => reply(&identity.team_memberships(args(body)?).await?),
1027 "resolve_teams" => reply(&identity.resolve_teams(args(body)?).await?),
1028 "resolve_owners" => reply(&identity.resolve_owners(args(body)?).await?),
1029 // Staff only: sudo.g1t.sh, over its service binding. See admin.rs.
1030 "notify_owners" => reply(&identity.notify_owners(args(body)?).await?),
1031 "admin_workspaces" => reply(&identity.admin_workspaces(args(body)?).await?),
1032 "admin_workspace" => reply(&identity.admin_workspace(args(body)?).await?),
1033 "admin_waitlist" => reply(&identity.admin_waitlist(args(body)?).await?),
1034 "admin_decide_waitlist" => reply(&identity.admin_decide_waitlist(args(body)?).await?),
1035 "admin_waitlist_pending" => reply(&identity.admin_waitlist_pending().await?),
1036 "admin_invites" => reply(&identity.admin_invites(args(body)?).await?),
1037 "admin_revoke_invite" => reply(&identity.admin_revoke_invite(args(body)?).await?),
1038 "admin_mint_invite" => reply(&identity.admin_mint_invite(args(body)?).await?),
1039 "admin_grant_invites" => reply(&identity.admin_grant_invites(args(body)?).await?),
1040 "admin_invite_tree" => reply(&identity.admin_invite_tree(args(body)?).await?),
1041 "admin_workspace_invites" => reply(&identity.admin_workspace_invites(args(body)?).await?),
1042 // Deleted workspaces, restored or purged by staff; see deletion.rs.
1043 "admin_deleted_workspaces" => reply(&identity.admin_deleted_workspaces().await?),
1044 "admin_restore_workspace" => reply(&identity.admin_restore_workspace(args(body)?).await?),
1045 "admin_purge_workspace" => reply(&identity.admin_purge_workspace(args(body)?).await?),
1046 // Workspace aliases, set by staff only; see aliases.rs.
1047 "admin_aliases" => reply(&identity.admin_aliases().await?),
1048 "admin_set_alias" => reply(&identity.admin_set_alias(args(body)?).await?),
1049 "admin_remove_alias" => reply(&identity.admin_remove_alias(args(body)?).await?),
1050 _ => Response::error("Unknown method", 404),
1051 };
1052 served.finish(answered)
1053}
1054
1055#[cfg(test)]
1056mod register_tests {
1057 use super::*;
1058
1059 #[test]
1060 fn nobody_registers_as_g1t() {
1061 // What register checks the username with, whatever its case.
1062 for username in ["g1t", "G1T", "g1t-agent", "G1t-Agent"] {
1063 assert_eq!(claimable_namespace(username), None, "{username}");
1064 }
1065 assert_eq!(claimable_namespace("ana").as_deref(), Some("ana"));
1066 }
1067}