fork download

package security.auth
 
import scala.collection.mutable.Map
import scala.concurrent.Future
import scala.util.{Failure, Success}
import scala.util.control.NonFatal
import scala.collection.JavaConversions._
import scala.reflect.runtime.universe._
import brix.crypto.Secret
import play.api.Logger
import play.api.Play.current
import play.api.Play.configuration
import play.api.libs.concurrent.Execution.Implicits.defaultContext
import play.api.libs.json._
import play.api.mvc._
import play.api.mvc.Results._
import play.api.http.{HeaderNames, HttpVerbs}
import utils.common.ReflectHelper._
import utils.common.Responses._
import utils.auth.AuthErrors._
import models.auth.{Token, PassToken}
import models.auth.TokenType._
 
/**
  * Represents a secured request.
  *
  * @constructor    Initializes a new instance of the [[SecuredRequest]] class.
  * @param token    The JSON Web Token.
  * @param request  The current HTTP request.
  */
class SecuredRequest[A](
  val token: Token,
  request: Request[A]) extends WrappedRequest[A](request) {
 
  import SecuredAction._
 
  /**
    * Applies `authorized` if `condition` evaluates to `true`.
    *
    * @param condition  The function that determines whether or not the
    *                   request is authorized.
    * @param authorized The function that is applied if `condition` evaluates
    *                   to `true`.
    * @return           A `Future` value containing the response to be sent to
    *                   the client.
    * @note             `condition` shall return a tuple containing a Boolean
    *                   value indicating whether or not the request is authorized,
    *                   and optionally a `Result` to be sent to the client if
    *                   authorization is not granted and the subject does not
    *                   have ''admin'' privileges.
    * @note             `authorized` takes a Boolean paramenter indicating
    *                   whether the action is being authorized as ''admin''.
    */
  def authorize(
    condition: Token => Future[(Boolean, Option[Result])],
    authorized: Boolean => Future[Result]
  ): Future[Result] = {
    condition(token).flatMap { r => r._1 match {
      case true =>
        Logger.debug(s"extra condition to authorize request ${request.uri} met")
        authorized(false)
      case _ => r._2 match {
        case Some(simpleResult) =>
          Logger.debug(s"extra condition to authorize request ${request.uri} not met")
          Future.successful(simpleResult)
        case _ =>
          if (token.roles.contains(Role.Admin.id)) {
            Logger.debug(
              s"extra condition to authorize request ${request.uri} not met, still " +
              s"authorization is granted since user ${token.subject} has admin privileges"
            )
            authorized(true)
          } else Future.successful(refuse)
        }
    }}.recover { case e =>
      Logger.error("error authorizing secured request", e)
      InternalServerError(error(errorProcessingRequest(e.getMessage)(request)))
    }
  }
 
  /**
    * Refuses this request.
    * @return A `Future` value containing the response to be sent to the client.
    */
  def refuse = {
    Logger.debug(s"extra condition to authorize request ${request.uri} not met")
    val user = if (token.tokenType == Browse) None else Some(token.subject)
    Unauthorized(error(requestNotAuthorized(user)(request)))
  }
}
 
/**
  * Represents a secured action.
  *
  * @constructor      Initializes a new instance of the [[SecuredAction]] class.
  * @tparam T         The controller type to create a secured action for.
  * @param methodName The name of the method to secure.
  * @param tokenTypes One or more of the [[TokenType]] values.
  */
class SecuredAction[T <: Controller : TypeTag] private(
  private val methodName: String,
  private val tokenTypes: Seq[TokenType]) extends ActionBuilder[SecuredRequest] {
 
  import services.auth.AuthPlugin
  import SecuredAction._
 
  def invokeBlock[A](request: Request[A], block: SecuredRequest[A] => Future[Result]) = {{
    if (tokenTypes.length == 1 && tokenTypes(0) == Pass) None else {
      request.headers.get(HeaderNames.AUTHORIZATION) match {
        case Some(header) => s"""$AuthScheme (.*)""".r.unapplySeq(header).map(_.head.trim)
        case _ => None
      }
    }} match {
      case Some(jwt) =>
        val auth = jwt.split(":") // auth(0) => token, auth(1) => signature
        val f = AuthPlugin.token(auth(0))
 
        /*
         * service tokens (e.g. activation, reset) are discarded immediately after they
         * trigger the action they are associated with
         */
        f.onComplete {
          case Success(token) => if (token.tokenType != Authorization && request.method != HttpVerbs.GET) {
            AuthPlugin.discardToken(token.id)
          }
          case Failure(e) => Logger.error("error deserializing token from request header", e)
        }
 
        f.flatMap {
          case token if (!token.isValid) =>
            Logger.warn(s"request ${request.uri} refused: token ${token.id} has been tampered")
            Future.successful(Forbidden(error(authenticationViolated(token.subject)(request))))
          case token if (token.isExpired) =>
            Logger.debug(s"request ${request.uri} refused: token ${token.id} has expired")
            Future.successful(Forbidden(error(authenticationExpired(token.subject)(request))))
          case token if (!isAuthorized(token)) =>
            if (token.tokenType == Browse) {
              Logger.info(s"request ${request.uri} not authorized: anonym user does not have required privileges")
              Future.successful(Unauthorized(error(requestNotAuthorized(None)(request))))
            } else {
              Logger.info(s"request ${request.uri} not authorized: user ${token.subject} does not have required privileges")
              Future.successful(Unauthorized(error(requestNotAuthorized(Some(token.subject))(request))))
            }
          case token => if (token.apiKey == Token.BootstrapKey) {
              Logger.debug(s"request ${request.uri} authorized for user ${token.subject}")
              block(new SecuredRequest(token, request))
            } else {
              val body = request.body match {
                case json: JsValue => json.toString
                case _ => ""
              }
              Secret(token.apiKey).sign(auth(0) + request.method + request.uri + body) match {
                case Success(signed) => if (signed == auth(1)) {
                    if (token.tokenType == Browse) {
                      Logger.debug(s"request ${request.uri} authorized for anonym user")
                    } else {
                      Logger.debug(s"request ${request.uri} authorized for user ${token.subject}")
                    }
                    block(new SecuredRequest(token, request))
                  } else {
                    Logger.warn(s"request ${request.uri} refused: request has been tampered")
                    Future.successful(Forbidden(error(requestViolated()(request))))
                  }
                case Failure(e) => Future.failed(e)
              }
            }
        }.recover {
          case e: java.text.ParseException =>
            Logger.error("error deserializing token from request header", e)
            BadRequest(error(errorDeserializingToken(e.getMessage)(request)))
          case NonFatal(e) =>
            Logger.error("error processing secured request", e)
            InternalServerError(error(errorProcessingRequest(e.getMessage)(request)))
        }
      case _ => {
        if (tokenTypes.contains(Pass)) {
          Logger.debug(s"request ${request.uri} authorized for anonym user")
          block(new SecuredRequest(PassToken()(request), request))
        } else {
          Logger.debug(s"request ${request.uri} not authorized")
          Future.successful(Unauthorized(
            error(requestNotAuthenticated()(request))
          ).withHeaders(HeaderNames.WWW_AUTHENTICATE -> AuthScheme))
        }
      }
    }
  }
 
  /**
    * Returns a Boolean value indicating whether or not this
    * action is authorized.
    *
    * @param token  The authorization JSON Web Token.
    * @return       `true` if `token` defines the claims that authorize
    *               this action; otherwise, `false`.
    */
  private def isAuthorized(token: Token) = {
    val roles = securityProfiles(operationNickname[T])
    tokenTypes.contains(token.tokenType) && (
      roles.contains(Role.id("any")) ||       // action does not require any specific privileges
      token.roles.contains(Role.Admin.id) ||  // current subject has admin privileges
      token.roles.exists(roles.contains(_))   // current subject has required privileges
    )
  }
 
  /**
    * Returns the fully qualified nickname of the method that handles
    * the current HTTP request.
    *
    * @tparam T The type of the current `Controller`.
    * @return   The fully qualified nickname of the method that handles
    *           the current HTTP request.
    */
  private def operationNickname[T <: Controller : TypeTag] = {
    val clazzAnnotations = classAnnotations[T]
    val api = clazzAnnotations(
      "Api" )( "value"
    ).asInstanceOf[LiteralArgument].value.value.asInstanceOf[String]
 
    val functionAnnotations = methodAnnotations[T]
    val nickname = functionAnnotations(methodName)(
      "ApiOperation" )( "nickname"
    ).asInstanceOf[LiteralArgument].value.value.asInstanceOf[String]
 
    s"$api/$nickname"
  }
}
 
/**
  * Factory class for creating [[SecuredAction]] instances.
  */
object SecuredAction {
 
  final val AuthScheme = "Gok!llo"
  private var securityProfiles = Map[String, List[Int]]().withDefaultValue(List.empty)
 
  configuration.getConfigList("auth.securityProfiles").map { _.toList.map { config =>
    config.getString("operation").map { operation =>
      securityProfiles += (operation -> config.getStringList("roles").map {
        _.toList.map(Role.id(_))
      }.getOrElse(List.empty))
    }
  }}
 
  /**
    * Initializes a new instance of the [[SecuredAction]] class.
    *
    * @tparam T         The controller type to create a secured action for.
    * @param methodName The name of the method to secure.
    */
  def apply[T <: Controller : TypeTag](
    methodName: String
  ): SecuredAction[T] = apply(methodName, Authorization)
 
  /**
    * Initializes a new instance of the [[SecuredAction]] class.
    *
    * @tparam T         The controller type to create a secured action for.
    * @param methodName The name of the method to secure.
    * @param tokenTypes One or more of the [[TokenType]] values.
    */
  def apply[T <: Controller : TypeTag](
    methodName: String,
    tokenTypes: TokenType*
  ): SecuredAction[T] = new SecuredAction[T](methodName, tokenTypes)
}

/opt/scala/bin/scalac: line 50: /dev/null: Permission denied
Main.scala:9: error: not found: object brix
import brix.crypto.Secret
       ^
Main.scala:10: error: not found: object play
import play.api.Logger
       ^
Main.scala:11: error: not found: object play
import play.api.Play.current
       ^
Main.scala:12: error: not found: object play
import play.api.Play.configuration
       ^
Main.scala:13: error: not found: object play
import play.api.libs.concurrent.Execution.Implicits.defaultContext
       ^
Main.scala:14: error: not found: object play
import play.api.libs.json._
       ^
Main.scala:15: error: not found: object play
import play.api.mvc._
       ^
Main.scala:16: error: not found: object play
import play.api.mvc.Results._
       ^
Main.scala:17: error: not found: object play
import play.api.http.{HeaderNames, HttpVerbs}
       ^
Main.scala:18: error: not found: object utils
import utils.common.ReflectHelper._
       ^
Main.scala:19: error: not found: object utils
import utils.common.Responses._
       ^
Main.scala:20: error: not found: object utils
import utils.auth.AuthErrors._
       ^
Main.scala:21: error: not found: object models
import models.auth.{Token, PassToken}
       ^
Main.scala:22: error: not found: object models
import models.auth.TokenType._
       ^
Main.scala:33: error: not found: type WrappedRequest
  request: Request[A]) extends WrappedRequest[A](request) {
                               ^
Main.scala:32: error: not found: type Token
  val token: Token,
             ^
Main.scala:33: error: not found: type Request
  request: Request[A]) extends WrappedRequest[A](request) {
           ^
Main.scala:31: error: too many arguments for constructor Object: ()Object
class SecuredRequest[A](
                       ^
Main.scala:57: error: not found: type Result
  ): Future[Result] = {
            ^
Main.scala:55: error: not found: type Token
    condition: Token => Future[(Boolean, Option[Result])],
               ^
Main.scala:55: error: not found: type Result
    condition: Token => Future[(Boolean, Option[Result])],
                                                ^
Main.scala:56: error: not found: type Result
    authorized: Boolean => Future[Result]
                                  ^
Main.scala:86: error: not found: value Logger
    Logger.debug(s"extra condition to authorize request ${request.uri} not met")
    ^
Main.scala:88: error: not found: value Unauthorized
    Unauthorized(error(requestNotAuthorized(user)(request)))
    ^
Main.scala:60: error: not found: value Logger
        Logger.debug(s"extra condition to authorize request ${request.uri} met")
        ^
Main.scala:102: error: not found: type ActionBuilder
  private val tokenTypes: Seq[TokenType]) extends ActionBuilder[SecuredRequest] {
                                                  ^
Main.scala:100: error: not found: type Controller
class SecuredAction[T <: Controller : TypeTag] private(
                         ^
Main.scala:102: error: not found: type TokenType
  private val tokenTypes: Seq[TokenType]) extends ActionBuilder[SecuredRequest] {
                              ^
Main.scala:104: error: not found: value services
  import services.auth.AuthPlugin
         ^
Main.scala:107: error: not found: type Request
  def invokeBlock[A](request: Request[A], block: SecuredRequest[A] => Future[Result]) = {{
                              ^
Main.scala:116: error: not found: value AuthPlugin
        val f = AuthPlugin.token(auth(0))
                ^
Main.scala:176: error: not found: value Pass
        if (tokenTypes.contains(Pass)) {
                                ^
Main.scala:177: error: not found: value Logger
          Logger.debug(s"request ${request.uri} authorized for anonym user")
          ^
Main.scala:107: error: not found: type Result
  def invokeBlock[A](request: Request[A], block: SecuredRequest[A] => Future[Result]) = {{
                                                                             ^
Main.scala:178: error: not found: value PassToken
          block(new SecuredRequest(PassToken()(request), request))
                                   ^
Main.scala:180: error: not found: value Logger
          Logger.debug(s"request ${request.uri} not authorized")
          ^
Main.scala:181: error: not found: value Unauthorized
          Future.successful(Unauthorized(
                            ^
Main.scala:215: error: not found: value classAnnotations
    val clazzAnnotations = classAnnotations[T]
                           ^
Main.scala:214: error: not found: type Controller
  private def operationNickname[T <: Controller : TypeTag] = {
                                     ^
Main.scala:220: error: not found: value methodAnnotations
    val functionAnnotations = methodAnnotations[T]
                              ^
Main.scala:197: error: not found: type Token
  private def isAuthorized(token: Token) = {
                                  ^
Main.scala:200: error: not found: value Role
      roles.contains(Role.id("any")) ||       // action does not require any specific privileges
                     ^
Main.scala:237: error: not found: value configuration
  configuration.getConfigList("auth.securityProfiles").map { _.toList.map { config =>
  ^
Main.scala:251: error: not found: type Controller
  def apply[T <: Controller : TypeTag](
                 ^
Main.scala:262: error: not found: type Controller
  def apply[T <: Controller : TypeTag](
                 ^
Main.scala:264: error: not found: type TokenType
    tokenTypes: TokenType*
                ^
Main.scala:253: error: not found: value Authorization
  ): SecuredAction[T] = apply(methodName, Authorization)
                                          ^
47 errors found
spoj: The program compiled successfully, but Main.class was not found.
      Class Main should contain method: def main(args: Array[String]).

Standard output is empty