c80f155602
* dedicated worker * dedicated worker * merge * progress * progress * progress * merge * update * sqlx * fix imports
1106 lines
33 KiB
Rust
1106 lines
33 KiB
Rust
/*
|
|
* Author: Ruben Fiszel
|
|
* Copyright: Windmill Labs, Inc 2022
|
|
* This file and its contents are licensed under the AGPLv3 License.
|
|
* Please see the included NOTICE for copyright information and
|
|
* LICENSE-AGPL for a copy of the license.
|
|
*/
|
|
|
|
use std::sync::Arc;
|
|
use std::{collections::HashMap, fmt::Debug};
|
|
|
|
use anyhow::Context;
|
|
use axum::body::StreamBody;
|
|
use axum::extract::FromRequestParts;
|
|
use axum::http::request::Parts;
|
|
use axum::response::IntoResponse;
|
|
use axum::{
|
|
async_trait,
|
|
body::Bytes,
|
|
extract::{Extension, Path, Query},
|
|
response::Redirect,
|
|
routing::{get, post},
|
|
Json, Router,
|
|
};
|
|
use base64::Engine;
|
|
use hmac::Mac;
|
|
use hyper::{HeaderMap, StatusCode};
|
|
use itertools::Itertools;
|
|
|
|
use oauth2::{Client as OClient, *};
|
|
use reqwest::Client;
|
|
use serde::{de::DeserializeOwned, Deserialize, Serialize};
|
|
use sqlx::{Postgres, Transaction};
|
|
use tower_cookies::{Cookie, Cookies};
|
|
use windmill_audit::{audit_log, ActionKind};
|
|
use windmill_common::db::UserDB;
|
|
use windmill_common::jobs::JobPayload;
|
|
use windmill_common::users::username_to_permissioned_as;
|
|
use windmill_common::utils::{not_found_if_none, now_from_db};
|
|
|
|
use crate::db::ApiAuthed;
|
|
use crate::saml::SamlSsoLogin;
|
|
use crate::users::{login_externally, LoginUserInfo};
|
|
use crate::webhook_util::{InstanceEvent, WebhookShared};
|
|
use crate::{
|
|
db::DB,
|
|
variables::{build_crypt, encrypt},
|
|
workspaces::WorkspaceSettings,
|
|
};
|
|
use crate::{BASE_URL, HTTP_CLIENT, IS_SECURE, OAUTH_CLIENTS, SLACK_SIGNING_SECRET};
|
|
use windmill_common::error::{self, to_anyhow, Error};
|
|
use windmill_common::oauth2::*;
|
|
|
|
use windmill_queue::PushIsolationLevel;
|
|
|
|
use std::{fs, str};
|
|
|
|
pub fn global_service() -> Router {
|
|
Router::new()
|
|
.route("/login/:client", get(login))
|
|
.route("/login_callback/:client", post(login_callback))
|
|
.route("/connect/:client", get(connect))
|
|
.route("/connect_callback/:client", post(connect_callback))
|
|
.route("/connect_slack", get(connect_slack))
|
|
.route(
|
|
"/slack_command",
|
|
post(slack_command).route_layer(axum::middleware::from_extractor::<SlackSig>()),
|
|
)
|
|
.route("/list_supabase", get(list_supabase))
|
|
.route("/list_logins", get(list_logins))
|
|
.route("/list_connects", get(list_connects))
|
|
}
|
|
|
|
pub fn workspaced_service() -> Router {
|
|
Router::new()
|
|
.route("/disconnect/:id", post(disconnect))
|
|
.route("/disconnect_slack", post(disconnect_slack))
|
|
.route("/create_account", post(create_account))
|
|
.route("/delete_account/:id", post(delete_account))
|
|
.route("/refresh_token/:id", post(refresh_token))
|
|
.route("/connect_slack_callback", post(connect_slack_callback))
|
|
}
|
|
|
|
#[derive(Debug)]
|
|
pub struct ClientWithScopes {
|
|
client: OClient,
|
|
scopes: Vec<String>,
|
|
extra_params: Option<HashMap<String, String>>,
|
|
extra_params_callback: Option<HashMap<String, String>>,
|
|
allowed_domains: Option<Vec<String>>,
|
|
userinfo_url: Option<String>,
|
|
}
|
|
|
|
pub type BasicClientsMap = HashMap<String, ClientWithScopes>;
|
|
|
|
#[derive(Clone, Debug, Serialize, Deserialize)]
|
|
pub struct OAuthConfig {
|
|
auth_url: String,
|
|
token_url: String,
|
|
userinfo_url: Option<String>,
|
|
scopes: Option<Vec<String>>,
|
|
extra_params: Option<HashMap<String, String>>,
|
|
extra_params_callback: Option<HashMap<String, String>>,
|
|
req_body_auth: Option<bool>,
|
|
}
|
|
|
|
#[derive(Clone, Debug, Serialize, Deserialize)]
|
|
pub struct OAuthClient {
|
|
id: String,
|
|
secret: String,
|
|
allowed_domains: Option<Vec<String>>,
|
|
connect_config: Option<OAuthConfig>,
|
|
login_config: Option<OAuthConfig>,
|
|
}
|
|
|
|
#[derive(Debug)]
|
|
pub struct AllClients {
|
|
pub logins: BasicClientsMap,
|
|
pub connects: BasicClientsMap,
|
|
pub slack: Option<OClient>,
|
|
}
|
|
|
|
pub fn build_oauth_clients(base_url: &str) -> anyhow::Result<AllClients> {
|
|
let connect_configs = serde_json::from_str::<HashMap<String, OAuthConfig>>(include_str!(
|
|
"../../oauth_connect.json"
|
|
))?;
|
|
let login_configs = serde_json::from_str::<HashMap<String, OAuthConfig>>(include_str!(
|
|
"../../oauth_login.json"
|
|
))?;
|
|
|
|
let path = "./oauth.json";
|
|
let content: String = if let Ok(e) = std::env::var("OAUTH_JSON_AS_BASE64") {
|
|
str::from_utf8(
|
|
&base64::engine::general_purpose::STANDARD
|
|
.decode(e)
|
|
.map_err(to_anyhow)?,
|
|
)?
|
|
.to_string()
|
|
} else if std::path::Path::new(path).exists() {
|
|
fs::read_to_string(path).map_err(to_anyhow)?
|
|
} else {
|
|
tracing::warn!("oauth.json not found, no OAuth clients loaded");
|
|
return Ok(AllClients { logins: HashMap::new(), connects: HashMap::new(), slack: None });
|
|
};
|
|
|
|
if content.is_empty() {
|
|
tracing::warn!("oauth.json is empty, no OAuth clients loaded");
|
|
return Ok(AllClients { logins: HashMap::new(), connects: HashMap::new(), slack: None });
|
|
};
|
|
let oauths: HashMap<String, OAuthClient> =
|
|
match serde_json::from_str::<HashMap<String, OAuthClient>>(&content) {
|
|
Ok(clients) => clients,
|
|
Err(e) => {
|
|
tracing::error!("deserializing oauth.json: {e}");
|
|
HashMap::new()
|
|
}
|
|
}
|
|
.into_iter()
|
|
.collect();
|
|
|
|
tracing::info!("OAuth loaded clients: {}", oauths.keys().join(", "));
|
|
|
|
let logins = login_configs
|
|
.into_iter()
|
|
.filter_map(|x| oauths.get(&x.0).map(|c| (x.0, (c, x.1))))
|
|
.chain(oauths.iter().filter_map(|x| {
|
|
x.1.login_config
|
|
.as_ref()
|
|
.map(|c| (x.0.clone(), (x.1, c.clone())))
|
|
}))
|
|
.map(|(k, (client_params, config))| {
|
|
let named_client = build_basic_client(
|
|
k.clone(),
|
|
config.clone(),
|
|
client_params.clone(),
|
|
true,
|
|
base_url,
|
|
None,
|
|
);
|
|
(
|
|
named_client.0,
|
|
ClientWithScopes {
|
|
client: named_client.1,
|
|
scopes: config.scopes.unwrap_or(vec![]),
|
|
extra_params: config.extra_params,
|
|
extra_params_callback: config.extra_params_callback,
|
|
allowed_domains: client_params.allowed_domains.clone(),
|
|
userinfo_url: config.userinfo_url,
|
|
},
|
|
)
|
|
})
|
|
.collect();
|
|
|
|
let connects = connect_configs
|
|
.into_iter()
|
|
.filter_map(|x| oauths.get(&x.0).map(|c| (x.0, (c, x.1))))
|
|
.chain(oauths.iter().filter_map(|x| {
|
|
x.1.connect_config
|
|
.as_ref()
|
|
.map(|c| (x.0.clone(), (x.1, c.clone())))
|
|
}))
|
|
.map(|(k, (client_params, config))| {
|
|
let named_client = build_basic_client(
|
|
k.clone(),
|
|
config.clone(),
|
|
client_params.clone(),
|
|
false,
|
|
base_url,
|
|
if k == "supabase_wizard" {
|
|
Some(format!("{base_url}/oauth/callback_supabase"))
|
|
} else {
|
|
None
|
|
},
|
|
);
|
|
(
|
|
named_client.0,
|
|
ClientWithScopes {
|
|
client: named_client.1,
|
|
scopes: config.scopes.unwrap_or(vec![]),
|
|
extra_params: config.extra_params,
|
|
extra_params_callback: config.extra_params_callback,
|
|
allowed_domains: None,
|
|
userinfo_url: None,
|
|
},
|
|
)
|
|
})
|
|
.collect();
|
|
|
|
let slack = oauths.get("slack").map(|v| {
|
|
build_basic_client(
|
|
"slack".to_string(),
|
|
OAuthConfig {
|
|
auth_url: "https://slack.com/oauth/authorize".to_string(),
|
|
token_url: "https://slack.com/api/oauth.access".to_string(),
|
|
userinfo_url: None,
|
|
scopes: None,
|
|
extra_params: None,
|
|
extra_params_callback: None,
|
|
req_body_auth: None,
|
|
},
|
|
v.clone(),
|
|
false,
|
|
base_url,
|
|
Some(format!("{base_url}/oauth/callback_slack")),
|
|
)
|
|
.1
|
|
});
|
|
|
|
Ok(AllClients { logins, connects, slack })
|
|
}
|
|
|
|
pub fn build_basic_client(
|
|
name: String,
|
|
config: OAuthConfig,
|
|
client_params: OAuthClient,
|
|
login: bool,
|
|
base_url: &str,
|
|
override_callback: Option<String>,
|
|
) -> (String, OClient) {
|
|
let auth_url = Url::parse(&config.auth_url).expect("Invalid authorization endpoint URL");
|
|
let token_url = Url::parse(&config.token_url).expect("Invalid token endpoint URL");
|
|
|
|
let redirect_url = if login {
|
|
format!("{base_url}/user/login_callback/{name}")
|
|
} else if let Some(callback) = override_callback {
|
|
callback
|
|
} else {
|
|
format!("{base_url}/oauth/callback/{name}")
|
|
};
|
|
|
|
let mut client = OClient::new(client_params.id, auth_url, token_url);
|
|
if config.req_body_auth.unwrap_or(false) {
|
|
client.set_auth_type(AuthType::RequestBody);
|
|
}
|
|
client.set_client_secret(client_params.secret.clone());
|
|
client.set_redirect_url(Url::parse(&redirect_url).expect("Invalid redirect URL"));
|
|
// Set up the config for the Github OAuth2 process.
|
|
(name.to_string(), client)
|
|
}
|
|
|
|
#[derive(Clone, Debug, Deserialize, Serialize)]
|
|
pub struct SlackTokenResponse {
|
|
access_token: AccessToken,
|
|
team_id: String,
|
|
team_name: String,
|
|
#[serde(rename = "scope")]
|
|
#[serde(deserialize_with = "helpers::deserialize_space_delimited_vec")]
|
|
#[serde(serialize_with = "helpers::serialize_space_delimited_vec")]
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
#[serde(default)]
|
|
scopes: Option<Vec<Scope>>,
|
|
bot: SlackBotToken,
|
|
}
|
|
|
|
#[derive(Clone, Debug, Deserialize, Serialize)]
|
|
pub struct TokenResponse {
|
|
access_token: AccessToken,
|
|
expires_in: Option<u64>,
|
|
refresh_token: Option<RefreshToken>,
|
|
#[serde(deserialize_with = "helpers::deserialize_space_delimited_vec")]
|
|
#[serde(serialize_with = "helpers::serialize_space_delimited_vec")]
|
|
#[serde(default)]
|
|
scope: Option<Vec<Scope>>,
|
|
}
|
|
|
|
#[derive(Clone, Debug, Deserialize, Serialize)]
|
|
pub struct SlackBotToken {
|
|
bot_access_token: String,
|
|
}
|
|
|
|
async fn connect(
|
|
Path(client_name): Path<String>,
|
|
Query(query): Query<HashMap<String, String>>,
|
|
cookies: Cookies,
|
|
) -> error::Result<Redirect> {
|
|
let mut query = query.clone();
|
|
let connects = &OAUTH_CLIENTS.connects;
|
|
let scopes = query
|
|
.get("scopes")
|
|
.map(|x| x.split('+').map(|x| x.to_owned()).collect());
|
|
query.remove("scopes");
|
|
let extra_params = if query.is_empty() {
|
|
None
|
|
} else {
|
|
Some(query.clone())
|
|
};
|
|
oauth_redirect(
|
|
connects,
|
|
client_name,
|
|
cookies,
|
|
scopes,
|
|
extra_params,
|
|
*IS_SECURE,
|
|
)
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct CreateAccount {
|
|
client: String,
|
|
owner: String,
|
|
refresh_token: Option<String>,
|
|
expires_in: i64,
|
|
}
|
|
async fn create_account(
|
|
authed: ApiAuthed,
|
|
Extension(user_db): Extension<UserDB>,
|
|
Path(w_id): Path<String>,
|
|
Json(payload): Json<CreateAccount>,
|
|
) -> error::Result<String> {
|
|
let mut tx = user_db.begin(&authed).await?;
|
|
|
|
let id = sqlx::query_scalar!(
|
|
"INSERT INTO account (workspace_id, client, owner, expires_at, refresh_token) VALUES ($1, \
|
|
$2, $3, now() + ($4 || ' seconds')::interval, $5) RETURNING id",
|
|
w_id,
|
|
payload.client,
|
|
payload.owner,
|
|
payload.expires_in.to_string(),
|
|
payload.refresh_token
|
|
)
|
|
.fetch_one(&mut *tx)
|
|
.await
|
|
.map_err(|e| Error::InternalErr(format!("creating account in {w_id}: {e}")))?;
|
|
tx.commit().await?;
|
|
Ok(id.to_string())
|
|
}
|
|
|
|
async fn delete_account(
|
|
authed: ApiAuthed,
|
|
Extension(user_db): Extension<UserDB>,
|
|
Query((w_id, id)): Query<(String, i32)>,
|
|
) -> error::Result<String> {
|
|
let mut tx = user_db.begin(&authed).await?;
|
|
|
|
let exists = sqlx::query!(
|
|
"DELETE FROM account WHERE workspace_id = $1 AND id = $2 RETURNING id",
|
|
w_id,
|
|
id,
|
|
)
|
|
.fetch_optional(&mut *tx)
|
|
.await?;
|
|
|
|
let id_str = id.to_string();
|
|
not_found_if_none(exists, "Account", &id_str)?;
|
|
|
|
audit_log(
|
|
&mut *tx,
|
|
&authed.username,
|
|
"account.delete",
|
|
ActionKind::Delete,
|
|
&w_id,
|
|
Some(&id_str),
|
|
None,
|
|
)
|
|
.await?;
|
|
tx.commit().await?;
|
|
Ok(format!("Deleted account id {id}"))
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct Logins {
|
|
oauth: Vec<String>,
|
|
saml: Option<String>,
|
|
}
|
|
async fn list_logins(Extension(sso): Extension<Arc<SamlSsoLogin>>) -> error::JsonResult<Logins> {
|
|
Ok(Json(Logins {
|
|
oauth: OAUTH_CLIENTS
|
|
.logins
|
|
.keys()
|
|
.map(|x| x.to_owned())
|
|
.collect::<Vec<String>>(),
|
|
saml: sso.0.clone(),
|
|
}))
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct ScopesAndParams {
|
|
scopes: Vec<String>,
|
|
extra_params: Option<HashMap<String, String>>,
|
|
}
|
|
async fn list_connects() -> error::JsonResult<HashMap<String, ScopesAndParams>> {
|
|
Ok(Json(
|
|
(&OAUTH_CLIENTS.connects)
|
|
.into_iter()
|
|
.map(|(k, v)| {
|
|
(
|
|
k.to_owned(),
|
|
ScopesAndParams {
|
|
scopes: v.scopes.clone(),
|
|
extra_params: v.extra_params.clone(),
|
|
},
|
|
)
|
|
})
|
|
.collect::<HashMap<String, ScopesAndParams>>(),
|
|
))
|
|
}
|
|
|
|
async fn connect_slack(cookies: Cookies) -> error::Result<Redirect> {
|
|
let mut client = OAUTH_CLIENTS
|
|
.slack
|
|
.as_ref()
|
|
.ok_or_else(|| {
|
|
error::Error::BadRequest(
|
|
"slack client not setup. See: https://www.windmill.dev/docs/misc/setup_oauth#slack"
|
|
.to_string(),
|
|
)
|
|
})?
|
|
.to_owned();
|
|
let state = State::new_random();
|
|
|
|
client.add_scope("bot");
|
|
client.add_scope("commands");
|
|
let url = client.authorize_url(&state);
|
|
|
|
set_cookie(&state, cookies, *IS_SECURE);
|
|
Ok(Redirect::to(url.as_str()))
|
|
}
|
|
|
|
async fn disconnect(
|
|
authed: ApiAuthed,
|
|
Path((w_id, id)): Path<(String, i32)>,
|
|
Extension(user_db): Extension<UserDB>,
|
|
) -> error::Result<String> {
|
|
let mut tx = user_db.begin(&authed).await?;
|
|
|
|
sqlx::query!(
|
|
"DELETE FROM account WHERE id = $1 AND workspace_id = $2",
|
|
id,
|
|
w_id
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
tx.commit().await?;
|
|
|
|
Ok(format!("account {id} disconnected"))
|
|
}
|
|
|
|
async fn disconnect_slack(
|
|
authed: ApiAuthed,
|
|
Path(w_id): Path<String>,
|
|
Extension(user_db): Extension<UserDB>,
|
|
) -> error::Result<String> {
|
|
let mut tx = user_db.begin(&authed).await?;
|
|
|
|
sqlx::query!(
|
|
"UPDATE workspace_settings
|
|
SET slack_team_id = null, slack_name = null WHERE workspace_id = $1",
|
|
&w_id
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
tx.commit().await?;
|
|
|
|
Ok(format!("slack disconnected"))
|
|
}
|
|
|
|
async fn login(Path(client_name): Path<String>, cookies: Cookies) -> error::Result<Redirect> {
|
|
let clients = &OAUTH_CLIENTS.logins;
|
|
oauth_redirect(clients, client_name, cookies, None, None, *IS_SECURE)
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
struct VariablePath {
|
|
path: String,
|
|
}
|
|
async fn refresh_token(
|
|
authed: ApiAuthed,
|
|
Path((w_id, id)): Path<(String, i32)>,
|
|
Extension(user_db): Extension<UserDB>,
|
|
Json(VariablePath { path }): Json<VariablePath>,
|
|
) -> error::Result<String> {
|
|
let tx = user_db.begin(&authed).await?;
|
|
|
|
_refresh_token(tx, &path, &w_id, id).await?;
|
|
|
|
Ok(format!("Token at path {path} refreshed"))
|
|
}
|
|
|
|
pub async fn _refresh_token<'c>(
|
|
mut tx: Transaction<'c, Postgres>,
|
|
path: &str,
|
|
w_id: &str,
|
|
id: i32,
|
|
) -> error::Result<String> {
|
|
let account = sqlx::query!(
|
|
"SELECT client, refresh_token FROM account WHERE workspace_id = $1 AND id = $2",
|
|
w_id,
|
|
id,
|
|
)
|
|
.fetch_optional(&mut *tx)
|
|
.await?;
|
|
let account = not_found_if_none(account, "Account", &id.to_string())?;
|
|
let client = (&OAUTH_CLIENTS
|
|
.connects
|
|
.get(&account.client)
|
|
.ok_or_else(|| error::Error::BadRequest("invalid client".to_string()))?
|
|
.client)
|
|
.to_owned();
|
|
|
|
let token = _exchange_token(client, &account.refresh_token).await;
|
|
|
|
if let Err(token_err) = token {
|
|
sqlx::query!(
|
|
"UPDATE account SET refresh_error = $1 WHERE workspace_id = $2 AND id = $3",
|
|
token_err.alt(),
|
|
w_id,
|
|
id,
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
tx.commit().await?;
|
|
return Err(error::Error::BadRequest(format!(
|
|
"Error refreshing token: {}",
|
|
token_err.alt()
|
|
)));
|
|
};
|
|
|
|
let token = token.unwrap();
|
|
|
|
let expires_at = now_from_db(&mut *tx).await?
|
|
+ chrono::Duration::seconds(
|
|
token
|
|
.expires_in
|
|
.ok_or_else(|| Error::InternalErr("expires_in exepcted and not found".to_string()))?
|
|
.try_into()
|
|
.unwrap(),
|
|
);
|
|
sqlx::query!(
|
|
"UPDATE account SET refresh_token = $1, expires_at = $2 WHERE workspace_id = $3 AND id = \
|
|
$4",
|
|
token
|
|
.refresh_token
|
|
.map(|x| x.to_string())
|
|
.unwrap_or(account.refresh_token),
|
|
expires_at,
|
|
w_id,
|
|
id
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
|
|
let token_str = token.access_token.to_string();
|
|
let mc = build_crypt(&mut tx, &w_id).await?;
|
|
let encrypted_token = encrypt(&mc, token_str.as_str());
|
|
|
|
sqlx::query!(
|
|
"UPDATE variable SET value = $1 WHERE workspace_id = $2 AND path = $3",
|
|
encrypted_token,
|
|
w_id,
|
|
path
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
tx.commit().await?;
|
|
Ok(token_str)
|
|
}
|
|
|
|
async fn _exchange_token(client: OClient, refresh_token: &str) -> Result<TokenResponse, Error> {
|
|
let token_json = client
|
|
.exchange_refresh_token(&RefreshToken::from(refresh_token.clone()))
|
|
.with_client(&HTTP_CLIENT)
|
|
.execute::<serde_json::Value>()
|
|
.await
|
|
.map_err(to_anyhow)?;
|
|
let token = serde_json::from_value::<TokenResponse>(token_json.clone()).map_err(|e| {
|
|
Error::BadConfig(format!(
|
|
"Error deserializing response as a new token: {e}\nresponse:{token_json}"
|
|
))
|
|
})?;
|
|
Ok(token)
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
pub struct OAuthCallback {
|
|
code: String,
|
|
state: String,
|
|
}
|
|
|
|
async fn connect_callback(
|
|
cookies: Cookies,
|
|
Path(client_name): Path<String>,
|
|
Json(callback): Json<OAuthCallback>,
|
|
) -> error::JsonResult<TokenResponse> {
|
|
let client_w_scopes = OAUTH_CLIENTS
|
|
.connects
|
|
.get(&client_name)
|
|
.ok_or_else(|| error::Error::BadRequest("invalid client".to_string()))?;
|
|
|
|
let client = client_w_scopes.client.to_owned();
|
|
let extra_params = client_w_scopes.extra_params_callback.clone();
|
|
let token_response =
|
|
exchange_code::<TokenResponse>(callback, &cookies, client, &HTTP_CLIENT, extra_params)
|
|
.await?;
|
|
|
|
Ok(Json(token_response))
|
|
}
|
|
|
|
async fn connect_slack_callback(
|
|
Path(w_id): Path<String>,
|
|
authed: ApiAuthed,
|
|
cookies: Cookies,
|
|
Extension(user_db): Extension<UserDB>,
|
|
Json(callback): Json<OAuthCallback>,
|
|
) -> error::Result<String> {
|
|
let client = OAUTH_CLIENTS
|
|
.slack
|
|
.as_ref()
|
|
.ok_or_else(|| {
|
|
error::Error::BadRequest(
|
|
"slack client not setup. See: https://www.windmill.dev/docs/misc/setup_oauth#slack"
|
|
.to_string(),
|
|
)
|
|
})?
|
|
.to_owned();
|
|
let token =
|
|
exchange_code::<SlackTokenResponse>(callback, &cookies, client, &HTTP_CLIENT, None).await?;
|
|
|
|
let mut tx = user_db.begin(&authed).await?;
|
|
|
|
sqlx::query!(
|
|
"INSERT INTO workspace_settings
|
|
(workspace_id, slack_team_id, slack_name, slack_email)
|
|
VALUES ($1, $2, $3, $4) ON CONFLICT (workspace_id) DO UPDATE SET slack_team_id = $2, \
|
|
slack_name = $3, slack_email = $4",
|
|
&w_id,
|
|
token.team_id,
|
|
token.team_name,
|
|
authed.email
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
sqlx::query_as!(
|
|
Group,
|
|
"INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES ($1, $2, $3, $4) ON CONFLICT DO NOTHING",
|
|
w_id,
|
|
"slack",
|
|
"The group slack commands act on belhalf of",
|
|
serde_json::json!({username_to_permissioned_as(&authed.username): true})
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
|
|
sqlx::query!(
|
|
"INSERT INTO folder
|
|
(workspace_id, name, display_name, owners, extra_perms)
|
|
VALUES ($1, $2, $3, $4, $5) ON CONFLICT DO NOTHING",
|
|
&w_id,
|
|
"slack_bot",
|
|
"Slack bot",
|
|
&["g/slack".to_string()],
|
|
serde_json::json!({"g/slack": true})
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
|
|
let token_path = "f/slack_bot/bot_token";
|
|
let mc = build_crypt(&mut tx, &w_id).await?;
|
|
let value = encrypt(&mc, &token.bot.bot_access_token);
|
|
sqlx::query!(
|
|
"INSERT INTO variable
|
|
(workspace_id, path, value, is_secret, description, account, is_oauth)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7)
|
|
ON CONFLICT (workspace_id, path) DO UPDATE SET value = $3",
|
|
&w_id,
|
|
token_path,
|
|
value,
|
|
true,
|
|
"The slack bot token to act on behalf of the installed app of the connected workspace",
|
|
None::<i32>,
|
|
true,
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
|
|
sqlx::query!(
|
|
"INSERT INTO resource
|
|
(workspace_id, path, value, description, resource_type)
|
|
VALUES ($1, $2, $3, $4, $5) ON CONFLICT (workspace_id, path) DO UPDATE SET value = $3",
|
|
w_id,
|
|
token_path,
|
|
serde_json::json!({ "token": format!("$var:{token_path}") }),
|
|
"The slack bot token to act on behalf of the installed app of the connected workspace",
|
|
"slack",
|
|
)
|
|
.execute(&mut *tx)
|
|
.await?;
|
|
tx.commit().await?;
|
|
Ok("slack workspace connected".to_string())
|
|
}
|
|
|
|
#[derive(Deserialize, Debug)]
|
|
pub struct SlackCommand {
|
|
team_id: String,
|
|
user_name: String,
|
|
text: String,
|
|
response_url: String,
|
|
}
|
|
|
|
#[derive(Clone, Debug)]
|
|
pub struct SlackSig {
|
|
sig: String,
|
|
ts: String,
|
|
}
|
|
|
|
#[async_trait]
|
|
impl<S> FromRequestParts<S> for SlackSig
|
|
where
|
|
S: Send + Sync,
|
|
{
|
|
type Rejection = (StatusCode, String);
|
|
|
|
async fn from_request_parts(
|
|
parts: &mut Parts,
|
|
_state: &S,
|
|
) -> std::result::Result<Self, Self::Rejection> {
|
|
let hm = &parts.headers;
|
|
Ok(Self {
|
|
sig: hm
|
|
.get("X-Slack-Signature")
|
|
.map(|x| x.to_str().unwrap_or(""))
|
|
.unwrap_or("")
|
|
.to_string(),
|
|
ts: hm
|
|
.get("X-Slack-Request-Timestamp")
|
|
.map(|x| x.to_str().unwrap_or(""))
|
|
.unwrap_or("")
|
|
.to_string(),
|
|
})
|
|
}
|
|
}
|
|
|
|
async fn slack_command(
|
|
SlackSig { sig, ts }: SlackSig,
|
|
Extension(db): Extension<DB>,
|
|
Extension(rsmq): Extension<Option<rsmq_async::MultiplexedRsmq>>,
|
|
body: Bytes,
|
|
) -> error::Result<String> {
|
|
let form: SlackCommand = serde_urlencoded::from_bytes(&body)
|
|
.map_err(|_| error::Error::BadRequest("invalid payload".to_string()))?;
|
|
|
|
let body = String::from_utf8_lossy(&body);
|
|
if let Some(sv) = SLACK_SIGNING_SECRET.as_ref() {
|
|
if sv.verify(&ts, &body, &sig).ok().is_none() {
|
|
return Err(error::Error::BadRequest("verification failed".to_owned()));
|
|
}
|
|
}
|
|
|
|
let settings = sqlx::query_as!(
|
|
WorkspaceSettings,
|
|
"SELECT * FROM workspace_settings WHERE slack_team_id = $1",
|
|
form.team_id,
|
|
)
|
|
.fetch_optional(&db)
|
|
.await?;
|
|
|
|
if let Some(settings) = settings {
|
|
if let Some(path) = &settings.slack_command_script {
|
|
let (payload, tag) = if let Some(path) = path.strip_prefix("flow/") {
|
|
(JobPayload::Flow(path.to_string()), None)
|
|
} else {
|
|
let path = path.strip_prefix("script/").unwrap_or_else(|| path);
|
|
let (
|
|
script_hash,
|
|
tag,
|
|
concurrent_limit,
|
|
concurrency_time_window_s,
|
|
cache_ttl,
|
|
language,
|
|
dedicated_worker,
|
|
) = windmill_common::get_latest_deployed_hash_for_path(
|
|
&db,
|
|
&settings.workspace_id,
|
|
path,
|
|
)
|
|
.await?;
|
|
(
|
|
JobPayload::ScriptHash {
|
|
hash: script_hash,
|
|
path: path.to_owned(),
|
|
concurrent_limit,
|
|
concurrency_time_window_s,
|
|
cache_ttl,
|
|
language,
|
|
dedicated_worker,
|
|
},
|
|
tag,
|
|
)
|
|
};
|
|
let mut map = serde_json::Map::new();
|
|
map.insert("text".to_string(), serde_json::Value::String(form.text));
|
|
map.insert(
|
|
"response_url".to_string(),
|
|
serde_json::Value::String(form.response_url),
|
|
);
|
|
let tx = PushIsolationLevel::IsolatedRoot(db.clone(), rsmq);
|
|
|
|
let (uuid, tx) = windmill_queue::push(
|
|
&db,
|
|
tx,
|
|
&settings.workspace_id,
|
|
payload,
|
|
map,
|
|
&form.user_name,
|
|
&settings.slack_email,
|
|
"g/slack".to_string(),
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
None,
|
|
false,
|
|
false,
|
|
None,
|
|
true,
|
|
tag,
|
|
None,
|
|
None,
|
|
)
|
|
.await?;
|
|
let url = BASE_URL.to_owned();
|
|
tx.commit().await?;
|
|
return Ok(format!(
|
|
"Job launched. See details at {url}/run/{uuid}?workspace={}",
|
|
&settings.workspace_id
|
|
));
|
|
}
|
|
}
|
|
|
|
return Ok(format!(
|
|
"workspace not properly configured (did you set the script to trigger in the settings?)"
|
|
));
|
|
}
|
|
|
|
#[allow(non_snake_case)]
|
|
async fn login_callback(
|
|
Path(client_name): Path<String>,
|
|
cookies: Cookies,
|
|
Extension(db): Extension<DB>,
|
|
Extension(webhook): Extension<WebhookShared>,
|
|
Json(callback): Json<OAuthCallback>,
|
|
) -> error::Result<String> {
|
|
let client_w_config = &OAUTH_CLIENTS
|
|
.logins
|
|
.get(&client_name)
|
|
.ok_or_else(|| error::Error::BadRequest("invalid client".to_string()))?;
|
|
let client = client_w_config.client.to_owned();
|
|
let token_res =
|
|
exchange_code::<TokenResponse>(callback, &cookies, client, &HTTP_CLIENT, None).await;
|
|
|
|
if let Ok(token) = token_res {
|
|
let token = &token.access_token.to_string();
|
|
let userinfo_url = client_w_config.userinfo_url.as_ref().ok_or_else(|| {
|
|
Error::BadConfig(format!("Missing userinfo_url in client {client_name}"))
|
|
})?;
|
|
let user = http_get_user_info::<LoginUserInfo>(&HTTP_CLIENT, userinfo_url, token).await?;
|
|
|
|
let email = match client_name.as_str() {
|
|
"github" => http_get_user_info::<Vec<GHEmailInfo>>(
|
|
&HTTP_CLIENT,
|
|
"https://api.github.com/user/emails",
|
|
token,
|
|
)
|
|
.await?
|
|
.iter()
|
|
.find(|x| x.primary && x.verified)
|
|
.ok_or(error::Error::BadRequest(format!(
|
|
"user does not have any primary and verified address"
|
|
)))?
|
|
.email
|
|
.to_string(),
|
|
_ => user.email.clone().ok_or_else(|| {
|
|
error::Error::BadRequest("email address not fetchable from user info".to_string())
|
|
})?,
|
|
}
|
|
.to_lowercase();
|
|
|
|
if let Some(domains) = &client_w_config.allowed_domains {
|
|
if !domains.iter().any(|d| email.ends_with(d)) {
|
|
return Err(error::Error::BadRequest(format!(
|
|
"domain is not in the list of allowed domains: {email}, allowed: {domains:#?}",
|
|
)));
|
|
}
|
|
}
|
|
|
|
login_externally(
|
|
db,
|
|
&email,
|
|
client_name,
|
|
cookies,
|
|
Some(token.to_string()),
|
|
Some(user),
|
|
)
|
|
.await?;
|
|
|
|
webhook.send_instance_event(InstanceEvent::UserSignupOAuth { email: email.clone() });
|
|
|
|
Ok("Successfully logged in".to_string())
|
|
} else {
|
|
Err(error::Error::BadRequest(format!(
|
|
"failed to exchange code: {:?}",
|
|
token_res.err().unwrap()
|
|
)))
|
|
}
|
|
}
|
|
|
|
async fn exchange_code<T: DeserializeOwned>(
|
|
callback: OAuthCallback,
|
|
cookies: &Cookies,
|
|
client: OClient,
|
|
http_client: &Client,
|
|
extra_params: Option<HashMap<String, String>>,
|
|
) -> error::Result<T> {
|
|
let csrf_state = cookies
|
|
.get("csrf")
|
|
.map(|x| x.value().to_string())
|
|
.unwrap_or("".to_string());
|
|
if callback.state != csrf_state {
|
|
return Err(error::Error::BadRequest("csrf did not match".to_string()));
|
|
}
|
|
|
|
let mut token_url = client.exchange_code(callback.code);
|
|
|
|
if let Some(extra_params) = extra_params {
|
|
for (key, value) in extra_params {
|
|
token_url = token_url.param(key, value)
|
|
}
|
|
}
|
|
|
|
token_url
|
|
.with_client(http_client)
|
|
.execute::<T>()
|
|
.await
|
|
.map_err(|e| error::Error::InternalErr(format!("{:?}", e)))
|
|
}
|
|
|
|
async fn list_supabase(headers: HeaderMap) -> impl IntoResponse {
|
|
let token = headers
|
|
.get("X-Supabase-Token")
|
|
.map(|x| x.to_str().unwrap_or(""))
|
|
.unwrap_or("");
|
|
let resp = HTTP_CLIENT
|
|
.get("https://api.supabase.com/v1/projects")
|
|
.bearer_auth(token)
|
|
.send()
|
|
.await
|
|
.map_err(to_anyhow)?;
|
|
|
|
let status_code = resp.status();
|
|
let stream = resp.bytes_stream();
|
|
|
|
Ok((status_code, StreamBody::new(stream))) as error::Result<(StatusCode, StreamBody<_>)>
|
|
}
|
|
|
|
#[derive(Deserialize)]
|
|
pub struct GHEmailInfo {
|
|
email: String,
|
|
verified: bool,
|
|
primary: bool,
|
|
}
|
|
|
|
async fn http_get_user_info<T: DeserializeOwned>(
|
|
http_client: &Client,
|
|
url: &str,
|
|
token: &str,
|
|
) -> error::Result<T> {
|
|
let res = http_client
|
|
.get(url)
|
|
.bearer_auth(token)
|
|
.send()
|
|
.await
|
|
.map_err(to_anyhow)
|
|
.context("failed to fetch user info")?;
|
|
if !res.status().is_success() {
|
|
tracing::debug!(
|
|
"The bearer token of the failed oauth user info exchange is: {}",
|
|
token
|
|
);
|
|
return Err(error::Error::BadConfig(format!(
|
|
"The user info endpoint responded with non 200: {}\n{}\n{}",
|
|
res.status(),
|
|
res.headers()
|
|
.iter()
|
|
.map(|x| format!("{}: {}", x.0.as_str(), x.1.to_str().unwrap_or_default()))
|
|
.collect::<Vec<_>>()
|
|
.join("\n"),
|
|
res.text().await.unwrap_or_default(),
|
|
)));
|
|
}
|
|
Ok(res
|
|
.json::<T>()
|
|
.await
|
|
.map_err(to_anyhow)
|
|
.context("failed to decode json from user info")?)
|
|
}
|
|
|
|
fn oauth_redirect(
|
|
clients: &HashMap<String, ClientWithScopes>,
|
|
client_name: String,
|
|
cookies: Cookies,
|
|
scopes: Option<Vec<String>>,
|
|
extra_params: Option<HashMap<String, String>>,
|
|
is_secure: bool,
|
|
) -> error::Result<Redirect> {
|
|
let client_w_scopes = clients
|
|
.get(&client_name)
|
|
.ok_or_else(|| error::Error::BadRequest("client not found".to_string()))?;
|
|
let state = State::new_random();
|
|
let mut client = client_w_scopes.client.clone();
|
|
let scopes_iter = if let Some(scopes) = scopes {
|
|
scopes
|
|
} else {
|
|
client_w_scopes.scopes.clone()
|
|
};
|
|
|
|
for scope in scopes_iter.iter() {
|
|
client.add_scope(scope);
|
|
}
|
|
|
|
let mut auth_url = client.authorize_url(&state);
|
|
|
|
if let Some(extra_params) = extra_params {
|
|
let mut query_string = auth_url.query_pairs_mut();
|
|
for (key, value) in extra_params {
|
|
query_string.append_pair(&key, &value);
|
|
}
|
|
}
|
|
|
|
set_cookie(&state, cookies, is_secure);
|
|
Ok(Redirect::to(auth_url.as_str()))
|
|
}
|
|
|
|
fn set_cookie(state: &State, cookies: Cookies, is_secure: bool) {
|
|
let csrf = state.to_base64();
|
|
let mut cookie = Cookie::new("csrf", csrf);
|
|
cookie.set_secure(is_secure);
|
|
cookie.set_same_site(Some(cookie::SameSite::Lax));
|
|
cookie.set_http_only(true);
|
|
cookie.set_path("/");
|
|
cookies.add(cookie);
|
|
}
|
|
|
|
#[derive(Clone, Debug)]
|
|
pub struct SlackVerifier {
|
|
mac: HmacSha256,
|
|
}
|
|
|
|
impl SlackVerifier {
|
|
pub fn new<S: AsRef<[u8]>>(secret: S) -> anyhow::Result<SlackVerifier> {
|
|
HmacSha256::new_from_slice(secret.as_ref())
|
|
.map(|mac| SlackVerifier { mac })
|
|
.map_err(|_| anyhow::anyhow!("invalid secret"))
|
|
}
|
|
|
|
pub fn verify(&self, ts: &str, body: &str, exp_sig: &str) -> anyhow::Result<()> {
|
|
let basestring = format!("v0:{}:{}", ts, body);
|
|
let mut mac = self.mac.clone();
|
|
|
|
mac.update(basestring.as_bytes());
|
|
let sig = format!("v0={}", hex::encode(mac.finalize().into_bytes()));
|
|
if sig != exp_sig {
|
|
Err(anyhow::anyhow!("signature mismatch"))?;
|
|
}
|
|
Ok(())
|
|
}
|
|
}
|