root/http/passwd.cc

/*  This file is part of Alue, the multiprotocol Internet discussion daemon

    Copyright © 2009, 2010 Antti-Juhani Kaijanaho

    Alue is free software: you can redistribute it and/or modify it
    under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    Alue is distributed in the hope that it will be useful, but
    WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with Alue.  If not, see <http://www.gnu.org/licenses/>.

 */

#include "error_resource.hh"
#include "reauthn_resource.hh"
#include "redir_resource.hh"
#include "request.hh"
#include "templated_resource.hh"
#include "token.hh"

#include "../config.hh"
#include "../db/db.hh"
#include "../db/user.hh"
#include "../html/util.hh"
#include "../msg/lexutils.hh"
#include "../tlate/tlate.hh"
#include "../smtp_client/smtp_client.hh"

#define REQPATH "/passwd"
#define REQPREFIX REQPATH "/"

namespace http
{
        class passwd : public templated_resource
        {
                void chpass(boost::shared_ptr<request>);
        public:
                passwd(server::conn_cb cb) 
                        : templated_resource(cb, "passwd.html")
                        {}
                void set_attributes(boost::shared_ptr<request>,
                                    tlate::data_model::ptr);
        };

        void passwd::chpass(boost::shared_ptr<request> req)
        {
                std::string (*const p)(std::string) = uri::percent_encode;
                std::string (*const dep)(std::string) = uri::percent_decode;

                std::string uid = dep(req->get_form_field("userid"));
                std::string pw1 = dep(req->get_form_field("password"));
                std::string pw2 = dep(req->get_form_field("repass"));
                std::string tokstr = dep(req->get_form_field("token"));
                
                boost::shared_ptr<token> &tok = cb.get_http_token(tokstr);

                boost::shared_ptr<db::user> u;
                if (tokstr.empty())
                {
                        if (!req->is_authenticated())
                        {
                                boost::shared_ptr<resource> er
                                        (new reauthn_resource(cb));
                                throw resource_exception(er);
                        }
                        u = req->get_user();
                        if (u->get_userid() != uid)
                        {
                                boost::shared_ptr<resource> er
                                        (new error_resource
                                         (cb, "403 User id mismatch"));
                                throw resource_exception(er);
                        }
                }
                else
                {
                         if (tok->kind != token::PASSWD)
                         {
                                 boost::shared_ptr<resource> er
                                         (new error_resource
                                          (cb, "404 Not found"));
                                 throw resource_exception(er);
                         }
                         
                         if (tok) u = tok->get_user();
                         if (!u)
                         {
                                 boost::shared_ptr<resource> er
                                         (new error_resource
                                          (cb, "403 Opportunity expired"));
                                 throw resource_exception(er);
                         }
                }
                
                std::string err = db::user::passwd_problems(pw1);

                if (pw1 != pw2) err = "Passwords did not match.";

                if (!err.empty())
                {
                        boost::shared_ptr<resource> rr
                                (new redir_resource(cb, 
                                                    "/passwd/" +
                                                    tokstr +
                                                    "?msg=" +
                                                    p(err),
                                                    "303 See other"));
                        throw resource_exception(rr);
                }

                u->set_password(pw1);

                if (tok) tok.reset();  // invalidate the link

                std::string ton = u->get_display_name();
                std::string to = u->get_delivery_email();
                std::string from = 
                        config["alue-name"].as<std::string>() +
                        " <" +
                        config["operator-email"].as<std::string>() +
                        ">";
                                
                tlate::data_model::ptr am(new tlate::data_model);

                am->insert("from", from);
                am->insert("to", msg::make_phrase(ton) + " <" + to + ">");
                am->insert("userid",u->get_userid());
                am->insert("request_ip", req->get_peer().to_string());
                
                boost::shared_ptr<tlate::tlate> tl =
                        tlate::tlate::parse("pwchanged.msg");
                std::ostringstream mos;
                mos << tl->eval(am);
                
                std::list<std::string> recv;
                recv.push_back(to);
                
                cb.smtpc().send_mail(recv, mos.str());

                boost::shared_ptr<resource> r
                        (new templated_resource(cb, "passwd-changed.html"));
                throw resource_exception(r);
        }

        void passwd::set_attributes(boost::shared_ptr<request> req,
                                    tlate::data_model::ptr am)
        {
                std::string (*const q)(std::string,bool) = html::quote;
                std::string (*const p)(std::string) = uri::percent_encode;
                std::string (*const dep)(std::string) = uri::percent_decode;

                if (req->get_path().length() < sizeof REQPREFIX - 1)
                {
                        boost::shared_ptr<resource> er
                                (new error_resource(cb, "404 Not found"));
                        throw resource_exception(er);
                }

                boost::shared_ptr<db::user> u;
                if (req->get_path().length() == sizeof REQPREFIX - 1)
                {
                        if (req->get_method() == "POST") return chpass(req);
                        if (!req->is_authenticated())
                        {
                                boost::shared_ptr<resource> er
                                        (new reauthn_resource(cb));
                                throw resource_exception(er);
                        }
                        u = req->get_user();
                }

                std::string tokstr;
                boost::shared_ptr<token> tok;
                if (!u)
                {
                        tokstr = dep
                                (req->get_path().substr(sizeof REQPREFIX - 1));
                        tok = cb.get_http_token(tokstr);
                        if (tok) u = tok->get_user();
                }
                
                if (!u)
                {
                        boost::shared_ptr<resource> er
                                (new error_resource
                                 (cb, "410 Link expired or otherwise invalid"));
                        throw resource_exception(er);
                }

                am->insert("userid", q(u->get_userid(), false));
                am->insert("username", q(u->get_display_name(), false));
                if (!tokstr.empty())
                {
                        am->insert("token", q(tokstr,false));
                        am->insert("expiration_time",
                                   q(to_iso_extended_string
                                     (tok->expiration_time()),
                                     false));
                        using boost::lexical_cast;
                        using boost::posix_time::second_clock;
                        boost::posix_time::time_duration ex =
                                tok->expiration_time() -
                                second_clock::universal_time();
                        am->insert("expires_in_hours",
                                   lexical_cast<std::string>(ex.hours()));
                        am->insert("expires_in_minutes", 
                                   lexical_cast<std::string>(ex.minutes()));
                        am->insert("expires_in_seconds",
                                   lexical_cast<std::string>(ex.seconds()));
                }

                am->insert("action", p(REQPREFIX));
                am->insert("method", "post");
                am->insert("enctype", "application/x-www-form-urlencoded");
                am->insert("accept_charlist", q("utf8",false));

                std::string errmsg = dep(req->get_form_field("msg"));
                if (!errmsg.empty()) 
                        am->insert("errmsg", q(errmsg, false));
        }

};

namespace
{
        class factory : public server::http_resource_factory
        {
        public:
                factory() {
                        server::register_http_resource(REQPATH, this);
                }
                boost::shared_ptr<http::resource> operator()
                (server::conn_cb cb, std::string) {
                        boost::shared_ptr<http::resource> rv
                                (new http::passwd(cb));
                        return rv;
                }
        };
        factory f;
}