root/http/authn.cc

/*  This file is part of Alue, the multiprotocol Internet discussion daemon

    Copyright © 2009, 2010 Antti-Juhani Kaijanaho

    Alue is free software: you can redistribute it and/or modify it
    under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    Alue is distributed in the hope that it will be useful, but
    WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with Alue.  If not, see <http://www.gnu.org/licenses/>.

 */

#include "authn.hh"
#include "error_resource.hh"
#include "redir_resource.hh"
#include "request.hh"
#include "resource.hh"
#include "session.hh"

#include "../db/db.hh"
#include "../html/util.hh"
#include "../server.hh"
#include "../tlate/tlate.hh"
#include "../tlate/string_value.hh"
#include "../tlate/structured_value.hh"
#include "../tlate/user_value.hh"
#include "../util.hh"

#include <boost/shared_ptr.hpp>

namespace
{
        class authn_value : public tlate::structured_value
        {
                db::user::const_ptr u;
                std::string msg;
                std::string ruri;
        public:
                authn_value(db::user::const_ptr u,
                            std::string msg,
                            std::string ruri)
                        : u(u)
                        , msg(msg)
                        , ruri(ruri)
                        {}

                value::const_ptr get(std::string) const;
        };

        tlate::value::const_ptr authn_value::get(std::string var) const
        {
                using tlate::value;
                using tlate::user_value;
                using tlate::string_value;
                tlate::value::ptr rv;
                /**/ if (var == "user" && u)
                        rv.reset(new user_value(u));
                else if (var == "message" && !msg.empty())
                        rv.reset(new string_value(html::quote(msg, false)));
                else if (var == "request-uri")
                        rv.reset(new string_value(html::quote(ruri, false)));
                else if (var == "logout-action")
                        rv.reset(new string_value("/logout"));
                else if (var == "logout-method")
                        rv.reset(new string_value("post"));
                else if (var == "login-action")
                        rv.reset(new string_value("/login"));
                else if (var == "login-method")
                        rv.reset(new string_value("post"));
                else if (var == "enctype")
                        rv.reset(new string_value
                                 ("application/x-www-form-urlencoded"));
                else if (var == "accept-charlist")
                        rv.reset(new string_value("utf8"));
                else if (var == "recovery")
                        rv.reset(new string_value("/recovery"));
                else if (var == "register")
                        rv.reset(new string_value("/register"));
                return rv;
        }
}

namespace http
{
        tlate::value::const_ptr
        authn::tlate_value(boost::shared_ptr<request> req)
        {
                std::string ruri = req->get_path();
                std::string query = req->get_form_as_query();
                if (!query.empty()) ruri += "?" + query;
                tlate::value::ptr rv(new authn_value(req->get_user(),
                                                     req->get_form_field
                                                     ("user.authn.message"),
                                                     ruri));
                return rv;
        }

        boost::shared_ptr<response> authn::operator()
                (boost::shared_ptr<request> req, response::factory rf)
        {
                ::uri redir = req->get_form_field("redirect");

                std::string msg_name = "user.authn.message";
                
                if (req->get_path() == "/login" && req->has_form_field("login"))
                {
                        std::string user = req->get_form_field("userid");
                        std::string pass = req->get_form_field("passwd");
                        boost::shared_ptr<session> sess(new session());
                        sess->authenticate(cb.dbase().lookup_user(user), pass);
                        if (!sess->is_authenticated())
                                redir.replace_query_param
                                        (msg_name,
                                         "User name or password incorrect.");
                        else
                                redir.remove_query_param(msg_name);
                        boost::shared_ptr<resource> rr
                                (new redir_resource(cb, 
                                                    redir.to_string(),
                                                    "303 See other"));
                        boost::shared_ptr<response> resp = (*rr)(req, rf);
                        if (sess->is_authenticated())
                                resp->set_session(req, sess);
                        return resp;
                }
                if (req->get_path() == "/logout")
                {
                        req->get_session().reset();
                        boost::shared_ptr<resource> rr
                                (new redir_resource(cb, redir.to_string(),
                                                    "303 See other"));
                        return (*rr)(req, rf);
                }
                else
                {
                        boost::shared_ptr<resource> er
                                (new error_resource(cb, "404 Not found"));
                        return (*er)(req, rf);
                }
        }

};

namespace
{
        class factory : public server::http_resource_factory
        {
        public:
                factory() {
                        server::register_http_resource("/login", this);
                        server::register_http_resource("/logout", this);
                }
                boost::shared_ptr<http::resource> operator()
                (server::conn_cb cb, std::string) {
                        boost::shared_ptr<http::resource> rv
                                (new http::authn(cb));
                        return rv;
                }
        };
        factory f;
}