xref: /openbmc/bmcweb/features/redfish/lib/redfish_sessions.hpp (revision 1abe55ef9844afcddcab9d862ae06118f3a2390c)

/*
// Copyright (c) 2018 Intel Corporation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
*/
#pragma once

#include "error_messages.hpp"
#include "node.hpp"
#include "persistent_data_middleware.hpp"

namespace redfish
{

class SessionCollection;

class Sessions : public Node
{
  public:
    Sessions(CrowApp& app) :
        Node(app, "/redfish/v1/SessionService/Sessions/<str>/", std::string())
    {
        Node::json["@odata.type"] = "#Session.v1_0_2.Session";
        Node::json["@odata.context"] = "/redfish/v1/$metadata#Session.Session";
        Node::json["Name"] = "User Session";
        Node::json["Description"] = "Manager User Session";

        entityPrivileges = {
            {boost::beast::http::verb::get, {{"Login"}}},
            {boost::beast::http::verb::head, {{"Login"}}},
            {boost::beast::http::verb::patch, {{"ConfigureManager"}}},
            {boost::beast::http::verb::put, {{"ConfigureManager"}}},
            {boost::beast::http::verb::delete_, {{"ConfigureManager"}}},
            {boost::beast::http::verb::post, {{"ConfigureManager"}}}};
    }

  private:
    void doGet(crow::Response& res, const crow::Request& req,
               const std::vector<std::string>& params) override
    {
        auto session =
            crow::persistent_data::SessionStore::getInstance().getSessionByUid(
                params[0]);

        if (session == nullptr)
        {
            messages::addMessageToErrorJson(
                res.jsonValue,
                messages::resourceNotFound("Session", params[0]));

            res.result(boost::beast::http::status::not_found);
            res.end();
            return;
        }

        Node::json["Id"] = session->uniqueId;
        Node::json["UserName"] = session->username;
        Node::json["@odata.id"] =
            "/redfish/v1/SessionService/Sessions/" + session->uniqueId;

        res.jsonValue = Node::json;
        res.end();
    }

    void doDelete(crow::Response& res, const crow::Request& req,
                  const std::vector<std::string>& params) override
    {
        // Need only 1 param which should be id of session to be deleted
        if (params.size() != 1)
        {
            // This should be handled by crow and never happen
            BMCWEB_LOG_ERROR << "Session DELETE has been called with invalid "
                                "number of params";

            res.result(boost::beast::http::status::bad_request);
            messages::addMessageToErrorJson(res.jsonValue,
                                            messages::generalError());

            res.end();
            return;
        }

        auto session =
            crow::persistent_data::SessionStore::getInstance().getSessionByUid(
                params[0]);

        if (session == nullptr)
        {
            messages::addMessageToErrorJson(
                res.jsonValue,
                messages::resourceNotFound("Session", params[0]));

            res.result(boost::beast::http::status::not_found);
            res.end();
            return;
        }

        // DELETE should return representation of object that will be removed
        doGet(res, req, params);

        crow::persistent_data::SessionStore::getInstance().removeSession(
            session);
    }

    /**
     * This allows SessionCollection to reuse this class' doGet method, to
     * maintain consistency of returned data, as Collection's doPost should
     * return data for created member which should match member's doGet result
     * in 100%
     */
    friend SessionCollection;
};

class SessionCollection : public Node
{
  public:
    SessionCollection(CrowApp& app) :
        Node(app, "/redfish/v1/SessionService/Sessions/"), memberSession(app)
    {
        Node::json["@odata.type"] = "#SessionCollection.SessionCollection";
        Node::json["@odata.id"] = "/redfish/v1/SessionService/Sessions/";
        Node::json["@odata.context"] =
            "/redfish/v1/$metadata#SessionCollection.SessionCollection";
        Node::json["Name"] = "Session Collection";
        Node::json["Description"] = "Session Collection";
        Node::json["Members@odata.count"] = 0;
        Node::json["Members"] = nlohmann::json::array();

        entityPrivileges = {
            {boost::beast::http::verb::get, {{"Login"}}},
            {boost::beast::http::verb::head, {{"Login"}}},
            {boost::beast::http::verb::patch, {{"ConfigureManager"}}},
            {boost::beast::http::verb::put, {{"ConfigureManager"}}},
            {boost::beast::http::verb::delete_, {{"ConfigureManager"}}},
            {boost::beast::http::verb::post, {}}};
    }

  private:
    void doGet(crow::Response& res, const crow::Request& req,
               const std::vector<std::string>& params) override
    {
        std::vector<const std::string*> sessionIds =
            crow::persistent_data::SessionStore::getInstance().getUniqueIds(
                false, crow::persistent_data::PersistenceType::TIMEOUT);

        Node::json["Members@odata.count"] = sessionIds.size();
        Node::json["Members"] = nlohmann::json::array();
        for (const std::string* uid : sessionIds)
        {
            Node::json["Members"].push_back(
                {{"@odata.id", "/redfish/v1/SessionService/Sessions/" + *uid}});
        }

        res.jsonValue = Node::json;
        res.end();
    }

    void doPost(crow::Response& res, const crow::Request& req,
                const std::vector<std::string>& params) override
    {
        boost::beast::http::status status;
        std::string username;
        bool userAuthSuccessful =
            authenticateUser(req, status, username, res.jsonValue);
        res.result(status);

        if (!userAuthSuccessful)
        {
            res.end();
            return;
        }

        // User is authenticated - create session for him
        auto session = crow::persistent_data::SessionStore::getInstance()
                           .generateUserSession(username);
        res.addHeader("X-Auth-Token", session->sessionToken);

        res.addHeader("Location", "/redfish/v1/SessionService/Sessions/" +
                                      session->uniqueId);

        // Return data for created session
        memberSession.doGet(res, req, {session->uniqueId});

        // No need for res.end(), as it is called by doGet()
    }

    /**
     * @brief Verifies data provided in request and tries to authenticate user
     *
     * @param[in]  req            Crow request containing authentication data
     * @param[out] httpRespCode   HTTP Code that should be returned in response
     * @param[out] user           Retrieved username - not filled on failure
     * @param[out] errJson        JSON to which error messages will be written
     *
     * @return true if authentication was successful, false otherwise
     */
    bool authenticateUser(const crow::Request& req,
                          boost::beast::http::status& httpRespCode,
                          std::string& user, nlohmann::json& errJson)
    {
        // We need only UserName and Password - nothing more, nothing less
        static constexpr const unsigned int numberOfRequiredFieldsInReq = 2;

        // call with exceptions disabled
        auto loginCredentials = nlohmann::json::parse(req.body, nullptr, false);
        if (loginCredentials.is_discarded())
        {
            httpRespCode = boost::beast::http::status::bad_request;

            messages::addMessageToErrorJson(errJson, messages::malformedJSON());

            return false;
        }

        // Check that there are only as many fields as there should be
        if (loginCredentials.size() != numberOfRequiredFieldsInReq)
        {
            httpRespCode = boost::beast::http::status::bad_request;

            messages::addMessageToErrorJson(errJson, messages::malformedJSON());

            return false;
        }

        // Find fields that we need - UserName and Password
        auto userIt = loginCredentials.find("UserName");
        auto passIt = loginCredentials.find("Password");
        if (userIt == loginCredentials.end() ||
            passIt == loginCredentials.end())
        {
            httpRespCode = boost::beast::http::status::bad_request;

            if (userIt == loginCredentials.end())
            {
                messages::addMessageToErrorJson(
                    errJson, messages::propertyMissing("UserName"));
            }

            if (passIt == loginCredentials.end())
            {
                messages::addMessageToErrorJson(
                    errJson, messages::propertyMissing("Password"));
            }

            return false;
        }

        // Check that given data is of valid type (string)
        if (!userIt->is_string() || !passIt->is_string())
        {
            httpRespCode = boost::beast::http::status::bad_request;

            if (!userIt->is_string())
            {
                messages::addMessageToErrorJson(
                    errJson, messages::propertyValueTypeError(userIt->dump(),
                                                              "UserName"));
            }

            if (!passIt->is_string())
            {
                messages::addMessageToErrorJson(
                    errJson, messages::propertyValueTypeError(userIt->dump(),
                                                              "Password"));
            }

            return false;
        }

        // Extract username and password
        std::string username = userIt->get<const std::string>();
        std::string password = passIt->get<const std::string>();

        // Verify that required fields are not empty
        if (username.empty() || password.empty())
        {
            httpRespCode = boost::beast::http::status::bad_request;

            if (username.empty())
            {
                messages::addMessageToErrorJson(
                    errJson, messages::propertyMissing("UserName"));
            }

            if (password.empty())
            {
                messages::addMessageToErrorJson(
                    errJson, messages::propertyMissing("Password"));
            }

            return false;
        }

        // Finally - try to authenticate user
        if (!pamAuthenticateUser(username, password))
        {
            httpRespCode = boost::beast::http::status::unauthorized;

            messages::addMessageToErrorJson(
                errJson,
                messages::resourceAtUriUnauthorized(
                    std::string(req.url), "Invalid username or password"));

            return false;
        }

        // User authenticated successfully
        httpRespCode = boost::beast::http::status::ok;
        user = username;

        return true;
    }

    /**
     * Member session to ensure consistency between collection's doPost and
     * member's doGet, as they should return 100% matching data
     */
    Sessions memberSession;
};

class SessionService : public Node
{
  public:
    SessionService(CrowApp& app) : Node(app, "/redfish/v1/SessionService/")
    {
        Node::json["@odata.type"] = "#SessionService.v1_0_2.SessionService";
        Node::json["@odata.id"] = "/redfish/v1/SessionService/";
        Node::json["@odata.context"] =
            "/redfish/v1/$metadata#SessionService.SessionService";
        Node::json["Name"] = "Session Service";
        Node::json["Id"] = "SessionService";
        Node::json["Description"] = "Session Service";
        Node::json["SessionTimeout"] =
            crow::persistent_data::SessionStore::getInstance()
                .getTimeoutInSeconds();
        Node::json["ServiceEnabled"] = true;

        entityPrivileges = {
            {boost::beast::http::verb::get, {{"Login"}}},
            {boost::beast::http::verb::head, {{"Login"}}},
            {boost::beast::http::verb::patch, {{"ConfigureManager"}}},
            {boost::beast::http::verb::put, {{"ConfigureManager"}}},
            {boost::beast::http::verb::delete_, {{"ConfigureManager"}}},
            {boost::beast::http::verb::post, {{"ConfigureManager"}}}};
    }

  private:
    void doGet(crow::Response& res, const crow::Request& req,
               const std::vector<std::string>& params) override
    {
        res.jsonValue = Node::json;
        res.end();
    }
};

} // namespace redfish