fix: implementation

2024-08-20 20:51:40 +12:00 · 2024-06-24 14:12:09 +01:00 · 2024-06-24 14:12:09 +01:00 · 0ea2438069
commit 0ea2438069
parent baf5e5ade0
3 changed files with 136 additions and 118 deletions
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@ -58,114 +58,8 @@ use Utopia\Validator\WhiteList;
 $oauthDefaultSuccess = '/auth/oauth2/success';
 $oauthDefaultFailure = '/auth/oauth2/failure';

-$createSession = function (string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents) {
-    $roles = Authorization::getRoles();
-    $isPrivilegedUser = Auth::isPrivilegedUser($roles);
-    $isAppUser = Auth::isAppUser($roles);
-
-    /** @var Utopia\Database\Document $user */
-    $userFromRequest = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));
-
-    if ($userFromRequest->isEmpty()) {
-        throw new Exception(Exception::USER_INVALID_TOKEN);
-    }
-
-    $verifiedToken = Auth::tokenVerify($userFromRequest->getAttribute('tokens', []), null, $secret);
-
-    if (!$verifiedToken) {
-        throw new Exception(Exception::USER_INVALID_TOKEN);
-    }
-
-    $user->setAttributes($userFromRequest->getArrayCopy());
-
-    $duration = $project->getAttribute('auths', [])['duration'] ?? Auth::TOKEN_EXPIRATION_LOGIN_LONG;
-    $detector = new Detector($request->getUserAgent('UNKNOWN'));
-    $record = $geodb->get($request->getIP());
-    $sessionSecret = Auth::tokenGenerator(Auth::TOKEN_LENGTH_SESSION);
-
-    $factor = (match ($verifiedToken->getAttribute('type')) {
-        Auth::TOKEN_TYPE_MAGIC_URL,
-        Auth::TOKEN_TYPE_OAUTH2,
-        Auth::TOKEN_TYPE_EMAIL => 'email',
-        Auth::TOKEN_TYPE_PHONE => 'phone',
-        Auth::TOKEN_TYPE_GENERIC => 'token',
-        default => throw new Exception(Exception::USER_INVALID_TOKEN)
-    });
-
-    $session = new Document(array_merge(
-        [
-            '$id' => ID::unique(),
-            'userId' => $user->getId(),
-            'userInternalId' => $user->getInternalId(),
-            'provider' => Auth::getSessionProviderByTokenType($verifiedToken->getAttribute('type')),
-            'secret' => Auth::hash($sessionSecret), // One way hash encryption to protect DB leak
-            'userAgent' => $request->getUserAgent('UNKNOWN'),
-            'ip' => $request->getIP(),
-            'factors' => [$factor],
-            'countryCode' => ($record) ? \strtolower($record['country']['iso_code']) : '--',
-            'expire' => DateTime::addSeconds(new \DateTime(), $duration)
-        ],
-        $detector->getOS(),
-        $detector->getClient(),
-        $detector->getDevice()
-    ));
-
-    Authorization::setRole(Role::user($user->getId())->toString());
-
-    $session = $dbForProject->createDocument('sessions', $session
-        ->setAttribute('$permissions', [
-            Permission::read(Role::user($user->getId())),
-            Permission::update(Role::user($user->getId())),
-            Permission::delete(Role::user($user->getId())),
-        ]));
-
-    $dbForProject->purgeCachedDocument('users', $user->getId());
-    Authorization::skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
-    $dbForProject->purgeCachedDocument('users', $user->getId());
-
-    // Magic URL + Email OTP
-    if ($verifiedToken->getAttribute('type') === Auth::TOKEN_TYPE_MAGIC_URL || $verifiedToken->getAttribute('type') === Auth::TOKEN_TYPE_EMAIL) {
-        $user->setAttribute('emailVerification', true);
-    }
-
-    if ($verifiedToken->getAttribute('type') === Auth::TOKEN_TYPE_PHONE) {
-        $user->setAttribute('phoneVerification', true);
-    }
-
-    try {
-        $dbForProject->updateDocument('users', $user->getId(), $user);
-    } catch (\Throwable $th) {
-        throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Failed saving user to DB');
-    }
-
-    $queueForEvents
-        ->setParam('userId', $user->getId())
-        ->setParam('sessionId', $session->getId());
-
-    if (!Config::getParam('domainVerification')) {
-        $response->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($user->getId(), $sessionSecret)]));
-    }
-
-    $expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $duration));
-    $protocol = $request->getProtocol();
-
-    $response
-        ->addCookie(Auth::$cookieName . '_legacy', Auth::encodeSession($user->getId(), $sessionSecret), (new \DateTime($expire))->getTimestamp(), '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, null)
-        ->addCookie(Auth::$cookieName, Auth::encodeSession($user->getId(), $sessionSecret), (new \DateTime($expire))->getTimestamp(), '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, Config::getParam('cookieSamesite'))
-        ->setStatusCode(Response::STATUS_CODE_CREATED);
-
-    $countryName = $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown'));
-
-    $session
-        ->setAttribute('current', true)
-        ->setAttribute('countryName', $countryName)
-        ->setAttribute('expire', $expire)
-        ->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? Auth::encodeSession($user->getId(), $sessionSecret) : '');
-
-    $response->dynamic($session, Response::MODEL_SESSION);
-};
-
-$sendSessionEmail = function (Request $request, Locale $locale, Document $user, Document $project, Reader $geodb, Mail $queueForMails) {
+function sendSessionAlert(Request $request, Locale $locale, Document $user, Document $project, Reader $geodb, Mail $queueForMails)
+{
    $subject = $locale->getText("emails.sessionAlert.subject");
    $customTemplate = $project->getAttribute('templates', [])['email.sessionAlert-' . $locale->default] ?? [];

@ -252,6 +146,122 @@ $sendSessionEmail = function (Request $request, Locale $locale, Document $user,
        ->trigger();
 };

+
+$createSession = function (string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails) {
+    $roles = Authorization::getRoles();
+    $isPrivilegedUser = Auth::isPrivilegedUser($roles);
+    $isAppUser = Auth::isAppUser($roles);
+
+    /** @var Utopia\Database\Document $user */
+    $userFromRequest = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));
+
+    if ($userFromRequest->isEmpty()) {
+        throw new Exception(Exception::USER_INVALID_TOKEN);
+    }
+
+    $verifiedToken = Auth::tokenVerify($userFromRequest->getAttribute('tokens', []), null, $secret);
+
+    if (!$verifiedToken) {
+        throw new Exception(Exception::USER_INVALID_TOKEN);
+    }
+
+    $user->setAttributes($userFromRequest->getArrayCopy());
+
+    $duration = $project->getAttribute('auths', [])['duration'] ?? Auth::TOKEN_EXPIRATION_LOGIN_LONG;
+    $detector = new Detector($request->getUserAgent('UNKNOWN'));
+    $record = $geodb->get($request->getIP());
+    $sessionSecret = Auth::tokenGenerator(Auth::TOKEN_LENGTH_SESSION);
+
+    $factor = (match ($verifiedToken->getAttribute('type')) {
+        Auth::TOKEN_TYPE_MAGIC_URL,
+        Auth::TOKEN_TYPE_OAUTH2,
+        Auth::TOKEN_TYPE_EMAIL => 'email',
+        Auth::TOKEN_TYPE_PHONE => 'phone',
+        Auth::TOKEN_TYPE_GENERIC => 'token',
+        default => throw new Exception(Exception::USER_INVALID_TOKEN)
+    });
+
+    $session = new Document(array_merge(
+        [
+            '$id' => ID::unique(),
+            'userId' => $user->getId(),
+            'userInternalId' => $user->getInternalId(),
+            'provider' => Auth::getSessionProviderByTokenType($verifiedToken->getAttribute('type')),
+            'secret' => Auth::hash($sessionSecret), // One way hash encryption to protect DB leak
+            'userAgent' => $request->getUserAgent('UNKNOWN'),
+            'ip' => $request->getIP(),
+            'factors' => [$factor],
+            'countryCode' => ($record) ? \strtolower($record['country']['iso_code']) : '--',
+            'expire' => DateTime::addSeconds(new \DateTime(), $duration)
+        ],
+        $detector->getOS(),
+        $detector->getClient(),
+        $detector->getDevice()
+    ));
+
+    Authorization::setRole(Role::user($user->getId())->toString());
+
+    $session = $dbForProject->createDocument('sessions', $session
+        ->setAttribute('$permissions', [
+            Permission::read(Role::user($user->getId())),
+            Permission::update(Role::user($user->getId())),
+            Permission::delete(Role::user($user->getId())),
+        ]));
+
+    $dbForProject->purgeCachedDocument('users', $user->getId());
+    Authorization::skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
+    $dbForProject->purgeCachedDocument('users', $user->getId());
+
+    // Magic URL + Email OTP
+    if ($verifiedToken->getAttribute('type') === Auth::TOKEN_TYPE_MAGIC_URL || $verifiedToken->getAttribute('type') === Auth::TOKEN_TYPE_EMAIL) {
+        $user->setAttribute('emailVerification', true);
+    }
+
+    if ($verifiedToken->getAttribute('type') === Auth::TOKEN_TYPE_PHONE) {
+        $user->setAttribute('phoneVerification', true);
+    }
+
+    try {
+        $dbForProject->updateDocument('users', $user->getId(), $user);
+    } catch (\Throwable $th) {
+        throw new Exception(Exception::GENERAL_SERVER_ERROR, 'Failed saving user to DB');
+    }
+
+    if (
+        in_array($verifiedToken->getAttribute('type'), [Auth::TOKEN_TYPE_MAGIC_URL, Auth::TOKEN_TYPE_EMAIL]) &&
+        $project->getAttribute('auths', [])['sessionAlerts'] ?? false &&
+        $user->getAttribute('emailVerification')
+    ) {
+        sendSessionAlert($request, $locale, $user, $project, $geodb, $queueForMails);
+    }
+
+    $queueForEvents
+        ->setParam('userId', $user->getId())
+        ->setParam('sessionId', $session->getId());
+
+    if (!Config::getParam('domainVerification')) {
+        $response->addHeader('X-Fallback-Cookies', \json_encode([Auth::$cookieName => Auth::encodeSession($user->getId(), $sessionSecret)]));
+    }
+
+    $expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $duration));
+    $protocol = $request->getProtocol();
+
+    $response
+        ->addCookie(Auth::$cookieName . '_legacy', Auth::encodeSession($user->getId(), $sessionSecret), (new \DateTime($expire))->getTimestamp(), '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, null)
+        ->addCookie(Auth::$cookieName, Auth::encodeSession($user->getId(), $sessionSecret), (new \DateTime($expire))->getTimestamp(), '/', Config::getParam('cookieDomain'), ('https' == $protocol), true, Config::getParam('cookieSamesite'))
+        ->setStatusCode(Response::STATUS_CODE_CREATED);
+
+    $countryName = $locale->getText('countries.' . strtolower($session->getAttribute('countryCode')), $locale->getText('locale.country.unknown'));
+
+    $session
+        ->setAttribute('current', true)
+        ->setAttribute('countryName', $countryName)
+        ->setAttribute('expire', $expire)
+        ->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? Auth::encodeSession($user->getId(), $sessionSecret) : '');
+
+    $response->dynamic($session, Response::MODEL_SESSION);
+};
+
 App::post('/v1/account')
    ->desc('Create account')
    ->groups(['api', 'account', 'auth'])
@ -805,8 +815,9 @@ App::post('/v1/account/sessions/email')
    ->inject('locale')
    ->inject('geodb')
    ->inject('queueForEvents')
+    ->inject('queueForMails')
    ->inject('hooks')
-    ->action(function (string $email, string $password, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents, Hooks $hooks) {
+    ->action(function (string $email, string $password, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $queueForEvents, Mail $queueForMails, Hooks $hooks) {
        $email = \strtolower($email);
        $protocol = $request->getProtocol();

@ -895,6 +906,10 @@ App::post('/v1/account/sessions/email')
            ->setParam('userId', $user->getId())
            ->setParam('sessionId', $session->getId());

+        if ($project->getAttribute('auths', [])['sessionAlerts'] ?? false && $user->getAttribute('emailVerification')) {
+            sendSessionAlert($request, $locale, $user, $project, $geodb, $queueForMails);
+        }
+
        $response->dynamic($session, Response::MODEL_SESSION);
    });

@ -1060,6 +1075,7 @@ App::post('/v1/account/sessions/token')
    ->inject('locale')
    ->inject('geodb')
    ->inject('queueForEvents')
+    ->inject('queueForMails')
    ->action($createSession);

 App::get('/v1/account/sessions/oauth2/:provider')
@ -2213,6 +2229,7 @@ App::put('/v1/account/sessions/magic-url')
    ->inject('locale')
    ->inject('geodb')
    ->inject('queueForEvents')
+    ->inject('queueForMails')
    ->action($createSession);

 App::put('/v1/account/sessions/phone')
@ -2243,6 +2260,7 @@ App::put('/v1/account/sessions/phone')
    ->inject('locale')
    ->inject('geodb')
    ->inject('queueForEvents')
+    ->inject('queueForMails')
    ->action($createSession);

 App::post('/v1/account/tokens/phone')
--- a/app/controllers/api/projects.php
+++ b/app/controllers/api/projects.php
@ -99,7 +99,7 @@ App::post('/v1/projects')
            'passwordHistory' => 0, 'passwordDictionary' => false,
            'duration' => Auth::TOKEN_EXPIRATION_LOGIN_LONG,
            'personalDataCheck' => false,
-            'sessionEmails' => false,
+            'sessionAlerts' => false,
        ];

        foreach ($auth as $index => $method) {
@ -604,21 +604,21 @@ App::patch('/v1/projects/:projectId/oauth2')
        $response->dynamic($project, Response::MODEL_PROJECT);
    });

-App::patch('/v1/projects/:projectId/auth/session-emails')
+App::patch('/v1/projects/:projectId/auth/session-alerts')
    ->desc('Update project sessions emails')
    ->groups(['api', 'projects'])
    ->label('scope', 'projects.write')
    ->label('sdk.auth', [APP_AUTH_TYPE_ADMIN])
    ->label('sdk.namespace', 'projects')
-    ->label('sdk.method', 'updateSessionEmails')
+    ->label('sdk.method', 'updateSessionAlerts')
    ->label('sdk.response.code', Response::STATUS_CODE_OK)
    ->label('sdk.response.type', Response::CONTENT_TYPE_JSON)
    ->label('sdk.response.model', Response::MODEL_PROJECT)
    ->param('projectId', '', new UID(), 'Project unique ID.')
-    ->param('sessionEmails', false, new Boolean(true), 'Set to true to enable session emails.')
+    ->param('sessionAlerts', false, new Boolean(true), 'Set to true to enable session emails.')
    ->inject('response')
    ->inject('dbForConsole')
-    ->action(function (string $projectId, bool $sessionEmails, Response $response, Database $dbForConsole) {
+    ->action(function (string $projectId, bool $sessionAlerts, Response $response, Database $dbForConsole) {

        $project = $dbForConsole->getDocument('projects', $projectId);

@ -627,7 +627,7 @@ App::patch('/v1/projects/:projectId/auth/session-emails')
        }

        $auths = $project->getAttribute('auths', []);
-        $auths['sessionEmails'] = $sessionEmails;
+        $auths['sessionAlerts'] = $sessionAlerts;

        $dbForConsole->updateDocument('projects', $project->getId(), $project
            ->setAttribute('auths', $auths));
--- a/src/Appwrite/Utopia/Response/Model/Project.php
+++ b/src/Appwrite/Utopia/Response/Model/Project.php
@ -138,9 +138,9 @@ class Project extends Model
                'default' => false,
                'example' => true,
            ])
-            ->addRule('authSessionEmails', [
+            ->addRule('authSessionAlerts', [
                'type' => self::TYPE_BOOLEAN,
-                'description' => 'Whether or not to send session emails to users.',
+                'description' => 'Whether or not to send session alert emails to users.',
                'default' => false,
                'example' => true,
            ])
@ -324,7 +324,7 @@ class Project extends Model
        $document->setAttribute('authPasswordHistory', $authValues['passwordHistory'] ?? 0);
        $document->setAttribute('authPasswordDictionary', $authValues['passwordDictionary'] ?? false);
        $document->setAttribute('authPersonalDataCheck', $authValues['personalDataCheck'] ?? false);
-        $document->setAttribute('authSessionEmails', $authValues['sessionEmails'] ?? false);
+        $document->setAttribute('authSessionAlerts', $authValues['sessionAlerts'] ?? false);

        foreach ($auth as $index => $method) {
            $key = $method['key'];