path: root/include/sessions.hpp

#pragma once

#include <nlohmann/json.hpp>
#include <pam_authenticate.hpp>
#include <webassets.hpp>
#include <random>
#include <crow/app.h>
#include <crow/http_request.h>
#include <crow/http_response.h>
#include <boost/container/flat_map.hpp>
#include <boost/uuid/uuid.hpp>
#include <boost/uuid/uuid_generators.hpp>
#include <boost/uuid/uuid_io.hpp>

namespace crow {

namespace persistent_data {

enum class PersistenceType {
  TIMEOUT,        // User session times out after a predetermined amount of time
  SINGLE_REQUEST  // User times out once this request is completed.
};

struct UserSession {
  std::string uniqueId;
  std::string sessionToken;
  std::string username;
  std::string csrfToken;
  std::chrono::time_point<std::chrono::steady_clock> lastUpdated;
  PersistenceType persistence;

  /**
   * @brief Fills object with data from UserSession's JSON representation
   *
   * This replaces nlohmann's from_json to ensure no-throw approach
   *
   * @param[in] j   JSON object from which data should be loaded
   *
   * @return a shared pointer if data has been loaded properly, nullptr
   * otherwise
   */
  static std::shared_ptr<UserSession> fromJson(const nlohmann::json& j) {
    std::shared_ptr<UserSession> userSession = std::make_shared<UserSession>();
    for (const auto& element : j.items()) {
      const std::string* thisValue =
          element.value().get_ptr<const std::string*>();
      if (thisValue == nullptr) {
        BMCWEB_LOG_ERROR << "Error reading persistent store.  Property "
                         << element.key() << " was not of type string";
        return nullptr;
      }
      if (element.key() == "unique_id") {
        userSession->uniqueId = *thisValue;
      } else if (element.key() == "session_token") {
        userSession->sessionToken = *thisValue;
      } else if (element.key() == "csrf_token") {
        userSession->csrfToken = *thisValue;
      } else if (element.key() == "username") {
        userSession->username = *thisValue;
      } else {
        BMCWEB_LOG_ERROR << "Got unexpected property reading persistent file: "
                         << element.key();
        return nullptr;
      }
    }

    // For now, sessions that were persisted through a reboot get their idle
    // timer reset.  This could probably be overcome with a better understanding
    // of wall clock time and steady timer time, possibly persisting values with
    // wall clock time instead of steady timer, but the tradeoffs of all the
    // corner cases involved are non-trivial, so this is done temporarily
    userSession->lastUpdated = std::chrono::steady_clock::now();
    userSession->persistence = PersistenceType::TIMEOUT;

    return userSession;
  }
};

class Middleware;

class SessionStore {
 public:
  std::shared_ptr<UserSession> generateUserSession(
      const boost::string_view username,
      PersistenceType persistence = PersistenceType::TIMEOUT) {
    // TODO(ed) find a secure way to not generate session identifiers if
    // persistence is set to SINGLE_REQUEST
    static constexpr std::array<char, 62> alphanum = {
        '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'b', 'C',
        'D', 'E', 'F', 'g', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P',
        'Q', 'r', 'S', 'T', 'U', 'v', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c',
        'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p',
        'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'};

    // entropy: 30 characters, 62 possibilities.  log2(62^30) = 178 bits of
    // entropy.  OWASP recommends at least 60
    // https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Session_ID_Entropy
    std::string sessionToken;
    sessionToken.resize(20, '0');
    std::uniform_int_distribution<int> dist(0, alphanum.size() - 1);
    for (int i = 0; i < sessionToken.size(); ++i) {
      sessionToken[i] = alphanum[dist(rd)];
    }
    // Only need csrf tokens for cookie based auth, token doesn't matter
    std::string csrfToken;
    csrfToken.resize(20, '0');
    for (int i = 0; i < csrfToken.size(); ++i) {
      csrfToken[i] = alphanum[dist(rd)];
    }

    std::string uniqueId;
    uniqueId.resize(10, '0');
    for (int i = 0; i < uniqueId.size(); ++i) {
      uniqueId[i] = alphanum[dist(rd)];
    }
    auto session = std::make_shared<UserSession>(
        UserSession{uniqueId, sessionToken, std::string(username), csrfToken,
                    std::chrono::steady_clock::now(), persistence});
    auto it = authTokens.emplace(std::make_pair(sessionToken, session));
    // Only need to write to disk if session isn't about to be destroyed.
    needWrite = persistence == PersistenceType::TIMEOUT;
    return it.first->second;
  }

  std::shared_ptr<UserSession> loginSessionByToken(
      const boost::string_view token) {
    applySessionTimeouts();
    auto sessionIt = authTokens.find(std::string(token));
    if (sessionIt == authTokens.end()) {
      return nullptr;
    }
    std::shared_ptr<UserSession> userSession = sessionIt->second;
    userSession->lastUpdated = std::chrono::steady_clock::now();
    return userSession;
  }

  std::shared_ptr<UserSession> getSessionByUid(const boost::string_view uid) {
    applySessionTimeouts();
    // TODO(Ed) this is inefficient
    auto sessionIt = authTokens.begin();
    while (sessionIt != authTokens.end()) {
      if (sessionIt->second->uniqueId == uid) {
        return sessionIt->second;
      }
      sessionIt++;
    }
    return nullptr;
  }

  void removeSession(std::shared_ptr<UserSession> session) {
    authTokens.erase(session->sessionToken);
    needWrite = true;
  }

  std::vector<const std::string*> getUniqueIds(
      bool getAll = true,
      const PersistenceType& type = PersistenceType::SINGLE_REQUEST) {
    applySessionTimeouts();

    std::vector<const std::string*> ret;
    ret.reserve(authTokens.size());
    for (auto& session : authTokens) {
      if (getAll || type == session.second->persistence) {
        ret.push_back(&session.second->uniqueId);
      }
    }
    return ret;
  }

  bool needsWrite() { return needWrite; }
  int getTimeoutInSeconds() const {
    return std::chrono::seconds(timeoutInMinutes).count();
  };

  // Persistent data middleware needs to be able to serialize our authTokens
  // structure, which is private
  friend Middleware;

  static SessionStore& getInstance() {
    static SessionStore sessionStore;
    return sessionStore;
  }

  SessionStore(const SessionStore&) = delete;
  SessionStore& operator=(const SessionStore&) = delete;

 private:
  SessionStore() : timeoutInMinutes(60) {}

  void applySessionTimeouts() {
    auto timeNow = std::chrono::steady_clock::now();
    if (timeNow - lastTimeoutUpdate > std::chrono::minutes(1)) {
      lastTimeoutUpdate = timeNow;
      auto authTokensIt = authTokens.begin();
      while (authTokensIt != authTokens.end()) {
        if (timeNow - authTokensIt->second->lastUpdated >= timeoutInMinutes) {
          authTokensIt = authTokens.erase(authTokensIt);
          needWrite = true;
        } else {
          authTokensIt++;
        }
      }
    }
  }
  std::chrono::time_point<std::chrono::steady_clock> lastTimeoutUpdate;
  boost::container::flat_map<std::string, std::shared_ptr<UserSession>>
      authTokens;
  std::random_device rd;
  bool needWrite{false};
  std::chrono::minutes timeoutInMinutes;
};

}  // namespace persistent_data
}  // namespace crow

// to_json(...) definition for objects of UserSession type
namespace nlohmann {
template <>
struct adl_serializer<std::shared_ptr<crow::persistent_data::UserSession>> {
  static void to_json(
      nlohmann::json& j,
      const std::shared_ptr<crow::persistent_data::UserSession>& p) {
    if (p->persistence !=
        crow::persistent_data::PersistenceType::SINGLE_REQUEST) {
      j = nlohmann::json{{"unique_id", p->uniqueId},
                         {"session_token", p->sessionToken},
                         {"username", p->username},
                         {"csrf_token", p->csrfToken}};
    }
  }
};
}  // namespace nlohmann