root/http/recovery.cc

/*  This file is part of Alue, the multiprotocol Internet discussion daemon

    Copyright © 2009, 2010 Antti-Juhani Kaijanaho

    Alue is free software: you can redistribute it and/or modify it
    under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    Alue is distributed in the hope that it will be useful, but
    WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with Alue.  If not, see <http://www.gnu.org/licenses/>.

 */

#include "authn.hh"
#include "error_resource.hh"
#include "redir_resource.hh"
#include "request.hh"
#include "templated_resource.hh"
#include "response.hh"
#include "token.hh"

#include "../config.hh"
#include "../db/db.hh"
#include "../db/user.hh"
#include "../html/util.hh"
#include "../msg/lexutils.hh"
#include "../server.hh"
#include "../smtp_client/smtp_client.hh"
#include "../tlate/tlate.hh"
#include "../util.hh"

#include <boost/shared_ptr.hpp>

namespace http
{
        class recovery : public templated_resource
        {
                void do_post(boost::shared_ptr<request>);
        public:
                recovery(server::conn_cb cb) 
                        : templated_resource(cb, "recovery.html")
                        {}
        protected:
                void set_attributes(boost::shared_ptr<request>,
                                    tlate::data_model::ptr);
        };

        void recovery::set_attributes(boost::shared_ptr<request> req,
                                      tlate::data_model::ptr am)
        {
                if (req->get_method() == "POST") return do_post(req);

                if (req->get_path() != "/recovery")
                {
                        boost::shared_ptr<resource> er
                                (new error_resource(cb, "404 Not found"));
                        throw resource_exception(er);
                }
                
                std::string (*const q)(std::string,bool) = html::quote;
//              std::string (*const p)(std::string) = uri::percent_encode;
//              std::string (*const dep)(std::string) = uri::percent_decode;

                am->insert("action", q("/recovery", false));
                am->insert("method", "post");
                am->insert("enctype", "application/x-www-form-urlencoded");
                am->insert("accept_charlist", "utf8");
        }

        void recovery::do_post(boost::shared_ptr<request> req)
        {
                std::string (*const q)(std::string,bool) = html::quote;
//              std::string (*const p)(std::string) = uri::percent_encode;
//              std::string (*const dep)(std::string) = uri::percent_decode;

                std::string user = req->get_form_field("userid");
                boost::shared_ptr<db::user> u = cb.dbase().lookup_user(user);
                if (u)
                {
                        boost::random_device rand;
                        std::string ton = u->get_display_name();
                        std::string to = u->get_delivery_email();
                        std::string from = 
                                config["alue-name"].as<std::string>() +
                                " <" +
                                config["operator-email"].as<std::string>() +
                                ">";
                                
                        std::string token;
                        for (size_t i = 0; i < 30; i++)
                                token += util::b64_char(rand() % 64);
                        token += "42"; /* just in case the last char
                                          is punctuation, in order to
                                          not confuse users */
                        cb.get_http_token(token).reset
                                (new http::token(u, http::token::PASSWD));

                        std::ostringstream link;
                        link << "https://" << req->get_host();
                        if (req->get_port() != -1)
                                link << ':' << req->get_port();
                        link << "/passwd/" << uri::percent_encode(token);

                        tlate::data_model::ptr mam(new tlate::data_model);

                        mam->insert("from", from);
                        mam->insert("to",
                                    msg::make_phrase(ton) + " <" + to + ">");
                        mam->insert("userid", u->get_userid());
                        mam->insert("link", link.str());
                        mam->insert("request_ip", req->get_peer().to_string());

                        boost::shared_ptr<tlate::tlate> tl =
                                tlate::tlate::parse("recovery.msg");
                        std::ostringstream mos;
                        mos << tl->eval(mam);
                        
                        std::list<std::string> recv;
                        recv.push_back(to);
                                
                        cb.smtpc().send_mail(recv, mos.str());
                }

                boost::shared_ptr<resource> rr
                        (new redir_resource(cb, 
                                            std::string("/recovered?userid=") +
                                            q(user, false),
                                            "303 See other"));
                throw resource_exception(rr);
        }
}

namespace
{
        class factory : public server::http_resource_factory
        {
        public:
                factory() {
                        server::register_http_resource("/recovery", this);
                }
                boost::shared_ptr<http::resource> operator()
                (server::conn_cb cb,std::string) {
                        boost::shared_ptr<http::resource> rv
                                (new http::recovery(cb));
                        return rv;
                }
        };
        factory f;
}