402 lines
12 KiB
Rust
402 lines
12 KiB
Rust
//! Per-bot login vault. Humans store credentials; the model only sees ids.
|
||
|
||
use aes_gcm::aead::{Aead, KeyInit};
|
||
use aes_gcm::{Aes256Gcm, Nonce};
|
||
use axum::extract::{Path, State};
|
||
use axum::http::StatusCode;
|
||
use axum::routing::{get, patch};
|
||
use axum::{Json, Router};
|
||
use chrono::{DateTime, Utc};
|
||
use rand::RngCore;
|
||
use serde::{Deserialize, Serialize};
|
||
use serde_json::{Value, json};
|
||
use sha2::{Digest, Sha256};
|
||
use sqlx::FromRow;
|
||
use uuid::Uuid;
|
||
|
||
use crate::db::Actor;
|
||
use crate::state::AppState;
|
||
|
||
#[derive(Debug, Clone, Serialize, FromRow)]
|
||
#[serde(rename_all = "camelCase")]
|
||
pub struct VaultAccount {
|
||
pub id: String,
|
||
pub bot_id: String,
|
||
pub site: String,
|
||
pub host: String,
|
||
pub username: String,
|
||
pub notes: String,
|
||
pub created_at: DateTime<Utc>,
|
||
pub updated_at: DateTime<Utc>,
|
||
}
|
||
|
||
#[derive(Debug, Deserialize)]
|
||
#[serde(rename_all = "camelCase")]
|
||
pub struct UpsertAccount {
|
||
pub site: String,
|
||
#[serde(default)]
|
||
pub host: String,
|
||
pub username: String,
|
||
#[serde(default)]
|
||
pub password: String,
|
||
#[serde(default)]
|
||
pub notes: String,
|
||
}
|
||
|
||
pub fn router() -> Router<AppState> {
|
||
Router::new()
|
||
.route(
|
||
"/api/bots/{bot_id}/accounts",
|
||
get(list_accounts).post(create_account),
|
||
)
|
||
.route(
|
||
"/api/bots/{bot_id}/accounts/{account_id}",
|
||
patch(update_account).delete(delete_account),
|
||
)
|
||
}
|
||
|
||
/// An id in a URL is not permission. Anything addressed by `bot_id` checks
|
||
/// that the agent lives in the caller's own workspace first, so guessing an id
|
||
/// cannot reach another person's memory, vault, or schedule.
|
||
async fn assert_bot_is_mine(
|
||
state: &AppState,
|
||
actor: &Actor,
|
||
bot_id: &str,
|
||
) -> Result<(), StatusCode> {
|
||
state
|
||
.db
|
||
.get_bot(actor, bot_id)
|
||
.await
|
||
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
|
||
.ok_or(StatusCode::NOT_FOUND)?;
|
||
Ok(())
|
||
}
|
||
|
||
async fn list_accounts(
|
||
State(state): State<AppState>,
|
||
actor: Actor,
|
||
Path(bot_id): Path<String>,
|
||
) -> Result<Json<Vec<VaultAccount>>, StatusCode> {
|
||
assert_bot_is_mine(&state, &actor, &bot_id).await?;
|
||
list(&state, &actor, &bot_id)
|
||
.await
|
||
.map(Json)
|
||
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
|
||
}
|
||
|
||
async fn create_account(
|
||
State(state): State<AppState>,
|
||
actor: Actor,
|
||
Path(bot_id): Path<String>,
|
||
Json(input): Json<UpsertAccount>,
|
||
) -> Result<Json<VaultAccount>, (StatusCode, Json<Value>)> {
|
||
assert_bot_is_mine(&state, &actor, &bot_id)
|
||
.await
|
||
.map_err(|status| (status, Json(json!({"message":"bot not found"}))))?;
|
||
insert(&state, &actor, &bot_id, input)
|
||
.await
|
||
.map(Json)
|
||
.map_err(|error| (StatusCode::BAD_REQUEST, Json(json!({"message": error}))))
|
||
}
|
||
|
||
async fn update_account(
|
||
State(state): State<AppState>,
|
||
actor: Actor,
|
||
Path((bot_id, account_id)): Path<(String, String)>,
|
||
Json(input): Json<UpsertAccount>,
|
||
) -> Result<Json<VaultAccount>, (StatusCode, Json<Value>)> {
|
||
assert_bot_is_mine(&state, &actor, &bot_id)
|
||
.await
|
||
.map_err(|status| (status, Json(json!({"message":"bot not found"}))))?;
|
||
update_row(&state, &actor, &bot_id, &account_id, input)
|
||
.await
|
||
.map_err(|error| (StatusCode::BAD_REQUEST, Json(json!({"message": error}))))?
|
||
.map(Json)
|
||
.ok_or((
|
||
StatusCode::NOT_FOUND,
|
||
Json(json!({"message":"account not found"})),
|
||
))
|
||
}
|
||
|
||
async fn delete_account(
|
||
State(state): State<AppState>,
|
||
actor: Actor,
|
||
Path((bot_id, account_id)): Path<(String, String)>,
|
||
) -> Result<StatusCode, StatusCode> {
|
||
assert_bot_is_mine(&state, &actor, &bot_id).await?;
|
||
let deleted = sqlx::query(
|
||
"DELETE FROM vault_accounts
|
||
WHERE id=$1 AND bot_id=$2 AND space_id=$3 AND user_id=$4",
|
||
)
|
||
.bind(&account_id)
|
||
.bind(&bot_id)
|
||
.bind(&actor.space_id)
|
||
.bind(&actor.user_id)
|
||
.execute(state.pool())
|
||
.await
|
||
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
|
||
if deleted.rows_affected() == 0 {
|
||
return Err(StatusCode::NOT_FOUND);
|
||
}
|
||
Ok(StatusCode::NO_CONTENT)
|
||
}
|
||
|
||
pub async fn list(
|
||
state: &AppState,
|
||
actor: &Actor,
|
||
bot_id: &str,
|
||
) -> Result<Vec<VaultAccount>, String> {
|
||
list_on(state.pool(), actor, bot_id).await
|
||
}
|
||
|
||
pub async fn list_on(
|
||
pool: &sqlx::PgPool,
|
||
actor: &Actor,
|
||
bot_id: &str,
|
||
) -> Result<Vec<VaultAccount>, String> {
|
||
sqlx::query_as(
|
||
"SELECT id, bot_id, site, host, username, notes, created_at, updated_at
|
||
FROM vault_accounts
|
||
WHERE bot_id=$1 AND space_id=$2 AND user_id=$3
|
||
ORDER BY updated_at DESC",
|
||
)
|
||
.bind(bot_id)
|
||
.bind(&actor.space_id)
|
||
.bind(&actor.user_id)
|
||
.fetch_all(pool)
|
||
.await
|
||
.map_err(|error| error.to_string())
|
||
}
|
||
|
||
/// `get_secret_on` projection: vault columns plus the encrypted password.
|
||
type SecretRow = (
|
||
String,
|
||
String,
|
||
String,
|
||
String,
|
||
String,
|
||
String,
|
||
DateTime<Utc>,
|
||
DateTime<Utc>,
|
||
String,
|
||
);
|
||
|
||
pub async fn get_secret_on(
|
||
pool: &sqlx::PgPool,
|
||
actor: &Actor,
|
||
bot_id: &str,
|
||
account_id: &str,
|
||
) -> Result<Option<(VaultAccount, String, String)>, String> {
|
||
let row: Option<SecretRow> = sqlx::query_as(
|
||
"SELECT id, bot_id, site, host, username, notes, created_at, updated_at, password_ciphertext
|
||
FROM vault_accounts
|
||
WHERE id=$1 AND bot_id=$2 AND space_id=$3 AND user_id=$4",
|
||
)
|
||
.bind(account_id)
|
||
.bind(bot_id)
|
||
.bind(&actor.space_id)
|
||
.bind(&actor.user_id)
|
||
.fetch_optional(pool)
|
||
.await
|
||
.map_err(|error| error.to_string())?;
|
||
let Some(row) = row else {
|
||
return Ok(None);
|
||
};
|
||
let password = decrypt(&row.8)?;
|
||
Ok(Some((
|
||
VaultAccount {
|
||
id: row.0,
|
||
bot_id: row.1,
|
||
site: row.2,
|
||
host: row.3,
|
||
username: row.4.clone(),
|
||
notes: row.5,
|
||
created_at: row.6,
|
||
updated_at: row.7,
|
||
},
|
||
row.4,
|
||
password,
|
||
)))
|
||
}
|
||
|
||
async fn insert(
|
||
state: &AppState,
|
||
actor: &Actor,
|
||
bot_id: &str,
|
||
input: UpsertAccount,
|
||
) -> Result<VaultAccount, String> {
|
||
let site = clean_site(&input.site)?;
|
||
let username = clean_username(&input.username)?;
|
||
if input.password.is_empty() {
|
||
return Err("password is required".into());
|
||
}
|
||
let host = normalize_host(&input.host, &site);
|
||
let id = Uuid::new_v4().to_string();
|
||
let ciphertext = encrypt(&input.password)?;
|
||
sqlx::query_as(
|
||
"INSERT INTO vault_accounts
|
||
(id, space_id, user_id, bot_id, site, host, username, password_ciphertext, notes)
|
||
VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
|
||
RETURNING id, bot_id, site, host, username, notes, created_at, updated_at",
|
||
)
|
||
.bind(&id)
|
||
.bind(&actor.space_id)
|
||
.bind(&actor.user_id)
|
||
.bind(bot_id)
|
||
.bind(site)
|
||
.bind(host)
|
||
.bind(username)
|
||
.bind(ciphertext)
|
||
.bind(input.notes.trim())
|
||
.fetch_one(state.pool())
|
||
.await
|
||
.map_err(|error| error.to_string())
|
||
}
|
||
|
||
async fn update_row(
|
||
state: &AppState,
|
||
actor: &Actor,
|
||
bot_id: &str,
|
||
account_id: &str,
|
||
input: UpsertAccount,
|
||
) -> Result<Option<VaultAccount>, String> {
|
||
let site = clean_site(&input.site)?;
|
||
let username = clean_username(&input.username)?;
|
||
let host = normalize_host(&input.host, &site);
|
||
if input.password.is_empty() {
|
||
sqlx::query_as(
|
||
"UPDATE vault_accounts
|
||
SET site=$1, host=$2, username=$3, notes=$4, updated_at=now()
|
||
WHERE id=$5 AND bot_id=$6 AND space_id=$7 AND user_id=$8
|
||
RETURNING id, bot_id, site, host, username, notes, created_at, updated_at",
|
||
)
|
||
.bind(site)
|
||
.bind(host)
|
||
.bind(username)
|
||
.bind(input.notes.trim())
|
||
.bind(account_id)
|
||
.bind(bot_id)
|
||
.bind(&actor.space_id)
|
||
.bind(&actor.user_id)
|
||
.fetch_optional(state.pool())
|
||
.await
|
||
.map_err(|error| error.to_string())
|
||
} else {
|
||
let ciphertext = encrypt(&input.password)?;
|
||
sqlx::query_as(
|
||
"UPDATE vault_accounts
|
||
SET site=$1, host=$2, username=$3, notes=$4, password_ciphertext=$5, updated_at=now()
|
||
WHERE id=$6 AND bot_id=$7 AND space_id=$8 AND user_id=$9
|
||
RETURNING id, bot_id, site, host, username, notes, created_at, updated_at",
|
||
)
|
||
.bind(site)
|
||
.bind(host)
|
||
.bind(username)
|
||
.bind(input.notes.trim())
|
||
.bind(ciphertext)
|
||
.bind(account_id)
|
||
.bind(bot_id)
|
||
.bind(&actor.space_id)
|
||
.bind(&actor.user_id)
|
||
.fetch_optional(state.pool())
|
||
.await
|
||
.map_err(|error| error.to_string())
|
||
}
|
||
}
|
||
|
||
fn clean_site(site: &str) -> Result<String, String> {
|
||
let value = site.trim();
|
||
if value.is_empty() || value.chars().count() > 80 {
|
||
return Err("site name must be 1–80 characters".into());
|
||
}
|
||
Ok(value.to_string())
|
||
}
|
||
|
||
fn clean_username(username: &str) -> Result<String, String> {
|
||
let value = username.trim();
|
||
if value.is_empty() || value.chars().count() > 200 {
|
||
return Err("username must be 1–200 characters".into());
|
||
}
|
||
Ok(value.to_string())
|
||
}
|
||
|
||
fn normalize_host(host: &str, site: &str) -> String {
|
||
let raw = host.trim();
|
||
if raw.is_empty() {
|
||
return site.to_lowercase();
|
||
}
|
||
raw.trim_start_matches("https://")
|
||
.trim_start_matches("http://")
|
||
.split('/')
|
||
.next()
|
||
.unwrap_or(raw)
|
||
.trim()
|
||
.to_lowercase()
|
||
}
|
||
|
||
fn vault_key() -> Result<[u8; 32], String> {
|
||
// The vault key is its own secret. It used to fall back to the old shared
|
||
// login token, which quietly mixed "who can sign in" with "what can be
|
||
// decrypted"; saved passwords stay locked until it is set on purpose.
|
||
let material = std::env::var("LAZYBOY_VAULT_KEY")
|
||
.ok()
|
||
.filter(|value| !value.is_empty())
|
||
.ok_or_else(|| "set LAZYBOY_VAULT_KEY to encrypt saved passwords".to_string())?;
|
||
let digest = Sha256::digest(material.as_bytes());
|
||
let mut key = [0u8; 32];
|
||
key.copy_from_slice(&digest);
|
||
Ok(key)
|
||
}
|
||
|
||
fn encrypt(plaintext: &str) -> Result<String, String> {
|
||
let cipher = Aes256Gcm::new_from_slice(&vault_key()?).map_err(|error| error.to_string())?;
|
||
let mut nonce_bytes = [0u8; 12];
|
||
rand::thread_rng().fill_bytes(&mut nonce_bytes);
|
||
let nonce = Nonce::from_slice(&nonce_bytes);
|
||
let encrypted = cipher
|
||
.encrypt(nonce, plaintext.as_bytes())
|
||
.map_err(|error| error.to_string())?;
|
||
let mut packed = Vec::with_capacity(12 + encrypted.len());
|
||
packed.extend_from_slice(&nonce_bytes);
|
||
packed.extend_from_slice(&encrypted);
|
||
Ok(hex::encode(packed))
|
||
}
|
||
|
||
fn decrypt(packed: &str) -> Result<String, String> {
|
||
let bytes = hex::decode(packed).map_err(|error| error.to_string())?;
|
||
if bytes.len() < 13 {
|
||
return Err("corrupt vault entry".into());
|
||
}
|
||
let cipher = Aes256Gcm::new_from_slice(&vault_key()?).map_err(|error| error.to_string())?;
|
||
let nonce = Nonce::from_slice(&bytes[..12]);
|
||
let plain = cipher
|
||
.decrypt(nonce, &bytes[12..])
|
||
.map_err(|_| "could not decrypt vault entry".to_string())?;
|
||
String::from_utf8(plain).map_err(|error| error.to_string())
|
||
}
|
||
|
||
#[cfg(test)]
|
||
mod tests {
|
||
use super::{decrypt, encrypt, normalize_host};
|
||
|
||
#[test]
|
||
// Rust 2024 marks `set_var` unsafe; this only seeds a test-only key and no
|
||
// other test in this binary reads it.
|
||
#[allow(unsafe_code)]
|
||
fn round_trips_a_password() {
|
||
unsafe { std::env::set_var("LAZYBOY_VAULT_KEY", "test-vault-key-for-unit-tests") };
|
||
let packed = encrypt("s3cret!").unwrap();
|
||
assert!(!packed.contains("s3cret"));
|
||
assert_eq!(decrypt(&packed).unwrap(), "s3cret!");
|
||
}
|
||
|
||
#[test]
|
||
fn host_strips_urls() {
|
||
assert_eq!(
|
||
normalize_host("https://mail.google.com/inbox", "Gmail"),
|
||
"mail.google.com"
|
||
);
|
||
assert_eq!(normalize_host("", "Gmail"), "gmail");
|
||
}
|
||
}
|