AppPasswordController.php 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2018, Roeland Jago Douma <roeland@famdouma.nl>
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Daniel Kesselberg <mail@danielkesselberg.de>
  8. * @author Roeland Jago Douma <roeland@famdouma.nl>
  9. *
  10. * @license GNU AGPL version 3 or any later version
  11. *
  12. * This program is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License as
  14. * published by the Free Software Foundation, either version 3 of the
  15. * License, or (at your option) any later version.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  24. *
  25. */
  26. namespace OC\Core\Controller;
  27. use OC\Authentication\Events\AppPasswordCreatedEvent;
  28. use OC\Authentication\Exceptions\InvalidTokenException;
  29. use OC\Authentication\Token\IProvider;
  30. use OC\Authentication\Token\IToken;
  31. use OCP\AppFramework\Http\DataResponse;
  32. use OCP\AppFramework\OCS\OCSForbiddenException;
  33. use OCP\Authentication\Exceptions\CredentialsUnavailableException;
  34. use OCP\Authentication\Exceptions\PasswordUnavailableException;
  35. use OCP\Authentication\LoginCredentials\IStore;
  36. use OCP\EventDispatcher\IEventDispatcher;
  37. use OCP\IRequest;
  38. use OCP\ISession;
  39. use OCP\Security\ISecureRandom;
  40. class AppPasswordController extends \OCP\AppFramework\OCSController {
  41. private ISession $session;
  42. private ISecureRandom $random;
  43. private IProvider $tokenProvider;
  44. private IStore $credentialStore;
  45. private IEventDispatcher $eventDispatcher;
  46. public function __construct(string $appName,
  47. IRequest $request,
  48. ISession $session,
  49. ISecureRandom $random,
  50. IProvider $tokenProvider,
  51. IStore $credentialStore,
  52. IEventDispatcher $eventDispatcher) {
  53. parent::__construct($appName, $request);
  54. $this->session = $session;
  55. $this->random = $random;
  56. $this->tokenProvider = $tokenProvider;
  57. $this->credentialStore = $credentialStore;
  58. $this->eventDispatcher = $eventDispatcher;
  59. }
  60. /**
  61. * @NoAdminRequired
  62. * @PasswordConfirmationRequired
  63. *
  64. * @throws OCSForbiddenException
  65. */
  66. public function getAppPassword(): DataResponse {
  67. // We do not allow the creation of new tokens if this is an app password
  68. if ($this->session->exists('app_password')) {
  69. throw new OCSForbiddenException('You cannot request an new apppassword with an apppassword');
  70. }
  71. try {
  72. $credentials = $this->credentialStore->getLoginCredentials();
  73. } catch (CredentialsUnavailableException $e) {
  74. throw new OCSForbiddenException();
  75. }
  76. try {
  77. $password = $credentials->getPassword();
  78. } catch (PasswordUnavailableException $e) {
  79. $password = null;
  80. }
  81. $userAgent = $this->request->getHeader('USER_AGENT');
  82. $token = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
  83. $generatedToken = $this->tokenProvider->generateToken(
  84. $token,
  85. $credentials->getUID(),
  86. $credentials->getLoginName(),
  87. $password,
  88. $userAgent,
  89. IToken::PERMANENT_TOKEN,
  90. IToken::DO_NOT_REMEMBER
  91. );
  92. $this->eventDispatcher->dispatchTyped(
  93. new AppPasswordCreatedEvent($generatedToken)
  94. );
  95. return new DataResponse([
  96. 'apppassword' => $token
  97. ]);
  98. }
  99. /**
  100. * @NoAdminRequired
  101. */
  102. public function deleteAppPassword(): DataResponse {
  103. if (!$this->session->exists('app_password')) {
  104. throw new OCSForbiddenException('no app password in use');
  105. }
  106. $appPassword = $this->session->get('app_password');
  107. try {
  108. $token = $this->tokenProvider->getToken($appPassword);
  109. } catch (InvalidTokenException $e) {
  110. throw new OCSForbiddenException('could not remove apptoken');
  111. }
  112. $this->tokenProvider->invalidateTokenById($token->getUID(), $token->getId());
  113. return new DataResponse();
  114. }
  115. /**
  116. * @NoAdminRequired
  117. */
  118. public function rotateAppPassword(): DataResponse {
  119. if (!$this->session->exists('app_password')) {
  120. throw new OCSForbiddenException('no app password in use');
  121. }
  122. $appPassword = $this->session->get('app_password');
  123. try {
  124. $token = $this->tokenProvider->getToken($appPassword);
  125. } catch (InvalidTokenException $e) {
  126. throw new OCSForbiddenException('could not rotate apptoken');
  127. }
  128. $newToken = $this->random->generate(72, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_DIGITS);
  129. $this->tokenProvider->rotate($token, $appPassword, $newToken);
  130. return new DataResponse([
  131. 'apppassword' => $newToken,
  132. ]);
  133. }
  134. }