web/

handler.rs

use std::sync::Arc;

use argon2::{Argon2, PasswordHasher};
use axum::{
    Extension, Json,
    extract::State,
    http::{HeaderMap, Response, StatusCode, header},
    response::IntoResponse,
};
use axum_extra::extract::{
    CookieJar,
    cookie::{Cookie, SameSite},
};
use serde_json::json;

use crate::{
    AppState,
    jwt_auth::JWTAuthMiddleware,
    model::{LoginUserSchema, RegisterUserSchema, User},
    response::FilteredUser,
    token::TokenDetails,
};
use rust_i18n::t;

use redis::AsyncCommands;
use server::command::CmdResult;

pub async fn register_user_handler(
    State(_data): State<Arc<AppState>>,
    Json(body): Json<RegisterUserSchema>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    let user_exists = server::command::user::email_taken(&body.email)
        .await
        .map_err(|e| {
            let msg = format!("{} {}", t!("Database error:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "fail",
                "message": msg,
            });
            (StatusCode::INTERNAL_SERVER_ERROR, Json(error_response))
        })?;

    if user_exists {
        let msg = format!("{}", t!("User with that email already exists"));
        log::error!("{msg}");
        let error_response = serde_json::json!({
            "status": "fail",
            "message": msg,
        });
        return Err((StatusCode::CONFLICT, Json(error_response)));
    }

    let hashed_password = Argon2::default()
        .hash_password(body.password.as_bytes())
        .map_err(|e| {
            let msg = format!("{} {}", t!("Error while hashing password:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "fail",
                "message": msg,
            });
            (StatusCode::INTERNAL_SERVER_ERROR, Json(error_response))
        })
        .map(|hash| hash.to_string())?;
    let internal_error = |e: &dyn std::fmt::Display| {
        let msg = format!("{} {}", t!("Database error:"), e);
        log::error!("{msg}");
        let error_response = serde_json::json!({ "status": "fail", "message": msg });
        (StatusCode::INTERNAL_SERVER_ERROR, Json(error_response))
    };

    let user_id = uuid::Uuid::new_v4();
    // Generate the user's signing keypair first (off the request thread); the
    // private half goes into their per-user DB, the public half into the global
    // users row.
    let keypair = server::auth_keys::generate()
        .await
        .map_err(|e| internal_error(&e))?;
    let provisioned = server::provision::provision_user_database(user_id)
        .await
        .map_err(|e| internal_error(&e))?;
    let database_name = provisioned.database_name;

    // Only what this request created may be cleaned up on failure below: if a
    // retry reused an existing database (42P04), its contents are somebody's
    // ledger and dropping it would destroy data we did not make.
    let drop_orphan = |user_id| async move {
        if !provisioned.created {
            return;
        }
        if let Err(drop_err) = server::provision::drop_user_database(user_id).await {
            log::error!(
                "{} {}",
                t!("Failed to clean up provisioned database:"),
                drop_err
            );
        }
    };

    if let Err(e) =
        server::provision::store_user_private_key(&database_name, &keypair.private_pem_b64).await
    {
        // The DB exists but key storage failed; drop the orphan so a retry
        // starts clean.
        drop_orphan(user_id).await;
        return Err(internal_error(&e));
    }

    // `verified` is set here, not left to the column default. Registration is
    // admin-gated (see `create_admin_pages_router`), so the admin creating the
    // account has already vouched for it — and nothing in the codebase ever
    // sets the flag afterwards: there is no verification endpoint and no email
    // flow. Left FALSE, the account authenticates and then fails every
    // authenticated request in `jwt_auth`, which is what happened to the first
    // real registration on 2026-09-06.
    //
    let insert = server::command::user::create_user(server::command::user::NewUser {
        id: user_id,
        name: &body.name,
        email: &body.email,
        password_hash: &hashed_password,
        database_name: &database_name,
        jwt_public_key: &keypair.public_pem_b64,
    })
    .await;

    let user = match insert {
        Ok(account) => User {
            id: account.id,
            name: account.name,
            email: account.email,
            role: account.role,
            photo: account.photo,
            verified: account.verified,
            created_at: account.created_at,
            updated_at: account.updated_at,
        },
        Err(e) => {
            // The per-user database was already created; the user row failed
            // (e.g. a concurrent registration won the UNIQUE(email) race).
            // Drop the orphan so failed registrations don't leak databases.
            drop_orphan(user_id).await;
            let msg = format!("{} {}", t!("Database error:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "fail",
                "message": msg,
            });
            return Err((StatusCode::INTERNAL_SERVER_ERROR, Json(error_response)));
        }
    };

    let user_response = serde_json::json!({"status": "success","data": serde_json::json!({
        "user": filter_user_record(&user)
    })});

    Ok(Json(user_response))
}

struct LoginCookies {
    access: Cookie<'static>,
    refresh: Cookie<'static>,
    logged_in: Cookie<'static>,
    access_token: String,
}

async fn authenticate_user(
    data: &Arc<AppState>,
    email: &str,
    password: &str,
) -> Result<LoginCookies, (StatusCode, Json<serde_json::Value>)> {
    let verified = server::command::user::verify_user_password(email, password)
        .await
        .map_err(|e| {
            let msg = format!("{} {}", t!("Database error:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "error",
                "message": msg,
            });
            (StatusCode::INTERNAL_SERVER_ERROR, Json(error_response))
        })?
        .ok_or_else(|| {
            let msg = format!("{}", t!("Invalid email or password"));
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "fail",
                "message": msg,
            });
            (StatusCode::BAD_REQUEST, Json(error_response))
        })?;

    let access_token_details = mint_token(
        verified.user_id,
        data.conf.access_token_max_age,
        crate::token::TokenType::Access,
        verified.generation,
    )
    .await?;
    let refresh_token_details = mint_token(
        verified.user_id,
        data.conf.refresh_token_max_age,
        crate::token::TokenType::Refresh,
        verified.generation,
    )
    .await?;

    save_token_data_to_redis(data, &access_token_details, data.conf.access_token_max_age).await?;
    save_token_data_to_redis(
        data,
        &refresh_token_details,
        data.conf.refresh_token_max_age,
    )
    .await?;

    let access_cookie = Cookie::build((
        "access_token",
        access_token_details.token.clone().unwrap_or_default(),
    ))
    .path("/")
    .max_age(time::Duration::minutes(data.conf.access_token_max_age))
    .same_site(SameSite::Lax)
    .secure(crate::auth_keys::secure_cookies())
    .http_only(true)
    .build();

    let refresh_cookie = Cookie::build((
        "refresh_token",
        refresh_token_details.token.unwrap_or_default(),
    ))
    .path("/")
    .max_age(time::Duration::minutes(data.conf.refresh_token_max_age))
    .same_site(SameSite::Lax)
    .secure(crate::auth_keys::secure_cookies())
    .http_only(true)
    .build();

    let logged_in_cookie = Cookie::build(("logged_in", "true"))
        .path("/")
        .max_age(time::Duration::minutes(data.conf.access_token_max_age))
        .same_site(SameSite::Lax)
        .http_only(false)
        .build();

    Ok(LoginCookies {
        access: access_cookie,
        refresh: refresh_cookie,
        logged_in: logged_in_cookie,
        access_token: access_token_details.token.unwrap_or_default(),
    })
}

/// Appends one `Set-Cookie` per rendered cookie. A cookie we built ourselves
/// always parses, so a value that somehow does not is dropped rather than
/// panicking the request.
pub(crate) fn append_set_cookies(
    headers: &mut HeaderMap,
    cookies: impl IntoIterator<Item = String>,
) {
    for cookie in cookies {
        if let Ok(value) = cookie.parse() {
            headers.append(header::SET_COOKIE, value);
        }
    }
}

fn build_cookie_headers(cookies: &LoginCookies) -> HeaderMap {
    let mut headers = HeaderMap::new();
    append_set_cookies(
        &mut headers,
        [
            cookies.access.to_string(),
            cookies.refresh.to_string(),
            cookies.logged_in.to_string(),
        ],
    );
    headers
}

pub async fn login_user_handler(
    State(data): State<Arc<AppState>>,
    Json(body): Json<LoginUserSchema>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    let cookies = authenticate_user(&data, &body.email, &body.password).await?;

    let mut response = Response::new(
        json!({"status": "success", "access_token": cookies.access_token}).to_string(),
    );
    let mut headers = build_cookie_headers(&cookies);
    headers.append("HX-Redirect", header::HeaderValue::from_static("/"));
    response.headers_mut().extend(headers);
    Ok(response)
}

pub async fn login_form_handler(
    State(data): State<Arc<AppState>>,
    axum::Form(body): axum::Form<LoginUserSchema>,
) -> impl IntoResponse {
    match authenticate_user(&data, &body.email, &body.password).await {
        Ok(cookies) => {
            let mut headers = build_cookie_headers(&cookies);
            headers.insert(header::LOCATION, header::HeaderValue::from_static("/"));
            (StatusCode::SEE_OTHER, headers, "").into_response()
        }
        Err((status, json_err)) => {
            let msg = json_err
                .get("message")
                .and_then(|v| v.as_str())
                .unwrap_or("Login failed");
            (status, msg.to_string()).into_response()
        }
    }
}

pub async fn refresh_access_token_handler(
    cookie_jar: CookieJar,
    Extension(jwt_auth): Extension<crate::jwt_auth::JWTAuthMiddleware>,
    State(data): State<Arc<AppState>>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    // The middleware ahead of this handler refreshes a dead access token on the
    // way in, consuming the cookie this request still carries: report that
    // refresh instead of redeeming a token that is already gone.
    if jwt_auth.refreshed {
        return Ok(Response::new(
            json!({"status": "success", "refreshed_by": "session"}).to_string(),
        ));
    }

    let message = t!("could not refresh access token");

    let refresh_token = cookie_jar
        .get("refresh_token")
        .map(|cookie| cookie.value().to_string())
        .ok_or_else(|| {
            let error_response = serde_json::json!({
                "status": "fail",
                "message": message
            });
            (StatusCode::FORBIDDEN, Json(error_response))
        })?;

    let refresh_token_details =
        match crate::auth_keys::verify(&refresh_token, crate::token::TokenType::Refresh).await {
            Ok(Some(token_details)) => token_details,
            // An unreadable directory is not an expired session.
            Err(e) => {
                let error_response = serde_json::json!({
                    "status": "error",
                    "message": format!("{} {e}", t!("Database error:")),
                });
                return Err((StatusCode::SERVICE_UNAVAILABLE, Json(error_response)));
            }
            Ok(None) => {
                let error_response = serde_json::json!({
                    "status": "fail",
                    "message": t!("Token is invalid or session has expired")
                });
                return Err((StatusCode::UNAUTHORIZED, Json(error_response)));
            }
        };

    let mut redis_client = data
        .redis_client
        .get_multiplexed_async_connection()
        .await
        .map_err(|e| {
            let msg = format!("{} {}", t!("Redis error:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "error",
                "message": msg,
            });
            (StatusCode::SERVICE_UNAVAILABLE, Json(error_response))
        })?;

    let user_id_uuid = refresh_token_details.user_id;

    // Bind the refresh token to the authenticated principal, as logout does:
    // the rotation deletes the caller's current access session, so a refresh
    // token belonging to someone else must not get that far.
    if user_id_uuid != jwt_auth.user.id {
        let error_response = serde_json::json!({
            "status": "fail",
            "message": t!("Token is invalid or session has expired")
        });
        return Err((StatusCode::UNAUTHORIZED, Json(error_response)));
    }

    // Minted BEFORE the rotation: minting touches the tenant database, and a
    // failure after the old session is consumed would log the user out. A
    // token minted and never registered is inert.
    let access_token_details = mint_token(
        user_id_uuid,
        data.conf.access_token_max_age,
        crate::token::TokenType::Access,
        refresh_token_details.generation,
    )
    .await?;
    let new_refresh_details = mint_token(
        user_id_uuid,
        data.conf.refresh_token_max_age,
        crate::token::TokenType::Refresh,
        refresh_token_details.generation,
    )
    .await?;

    let rotated = crate::jwt_auth::rotate_refresh(
        &mut redis_client,
        &crate::jwt_auth::Rotation {
            token_uuid: refresh_token_details.token_uuid,
            owner: user_id_uuid,
            successor: new_refresh_details.token_uuid,
            access_uuid: access_token_details.token_uuid,
            superseded: Some(jwt_auth.access_token_uuid),
            refresh_ttl: (data.conf.refresh_token_max_age * 60) as u64,
            access_ttl: (data.conf.access_token_max_age * 60) as u64,
        },
    )
    .await
    .map_err(|(status, body)| {
        (
            status,
            Json(serde_json::json!({"status": "error", "message": body.0.message})),
        )
    })?;
    if !rotated {
        let msg = format!("{}", t!("Token is invalid or session has expired"));
        log::error!("{msg}");
        return Err((
            StatusCode::UNAUTHORIZED,
            Json(serde_json::json!({"status": "error", "message": msg})),
        ));
    }

    let access_cookie = Cookie::build((
        "access_token",
        access_token_details.token.clone().unwrap_or_default(),
    ))
    .path("/")
    .max_age(time::Duration::minutes(data.conf.access_token_max_age))
    .same_site(SameSite::Lax)
    .secure(crate::auth_keys::secure_cookies())
    .http_only(true);

    let refresh_cookie = Cookie::build((
        "refresh_token",
        new_refresh_details.token.unwrap_or_default(),
    ))
    .path("/")
    .max_age(time::Duration::minutes(data.conf.refresh_token_max_age))
    .same_site(SameSite::Lax)
    .secure(crate::auth_keys::secure_cookies())
    .http_only(true);

    let logged_in_cookie = Cookie::build(("logged_in", "true"))
        .path("/")
        .max_age(time::Duration::minutes(data.conf.access_token_max_age))
        .same_site(SameSite::Lax)
        .http_only(false);

    let mut response = Response::new(
        json!({
            "status": "success",
            "access_token": access_token_details.token.clone().unwrap_or_default(),
        })
        .to_string(),
    );
    let mut headers = HeaderMap::new();
    append_set_cookies(
        &mut headers,
        [
            access_cookie.to_string(),
            refresh_cookie.to_string(),
            logged_in_cookie.to_string(),
        ],
    );

    response.headers_mut().extend(headers);
    Ok(response)
}

/// A session-store failure during logout.
fn redis_failed(e: redis::RedisError) -> (StatusCode, Json<serde_json::Value>) {
    let error_response = serde_json::json!({
        "status": "error",
        "message": format!("{e:?}"),
    });
    (StatusCode::SERVICE_UNAVAILABLE, Json(error_response))
}

pub async fn logout_handler(
    cookie_jar: CookieJar,
    Extension(auth_guard): Extension<JWTAuthMiddleware>,
    State(data): State<Arc<AppState>>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    let message = t!("Token is invalid or session has expired");

    let refresh_token = cookie_jar
        .get("refresh_token")
        .map(|cookie| cookie.value().to_string())
        .ok_or_else(|| {
            let error_response = serde_json::json!({
                "status": "fail",
                "message": message
            });
            (StatusCode::FORBIDDEN, Json(error_response))
        })?;

    let refresh_token_details =
        match crate::auth_keys::verify(&refresh_token, crate::token::TokenType::Refresh).await {
            Ok(Some(token_details)) => token_details,
            // An unreadable directory is not an expired session.
            Err(e) => {
                let error_response = serde_json::json!({
                    "status": "error",
                    "message": format!("{} {e}", t!("Database error:")),
                });
                return Err((StatusCode::SERVICE_UNAVAILABLE, Json(error_response)));
            }
            Ok(None) => {
                let error_response = serde_json::json!({
                    "status": "fail",
                    "message": t!("Token is invalid or session has expired")
                });
                return Err((StatusCode::UNAUTHORIZED, Json(error_response)));
            }
        };

    let mut redis_client = data
        .redis_client
        .get_multiplexed_async_connection()
        .await
        .map_err(|e| {
            let msg = format!("{} {}", t!("Redis error:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "error",
                "message": msg,
            });
            (StatusCode::SERVICE_UNAVAILABLE, Json(error_response))
        })?;

    // Bind the refresh token to the authenticated principal: the access token
    // (auth_guard) and the refresh token must belong to the same user, so a
    // client can't present user A's access token with user B's refresh token to
    // invalidate B's session.
    if refresh_token_details.user_id != auth_guard.user.id {
        let error_response = serde_json::json!({
            "status": "fail",
            "message": t!("Token is invalid or session has expired")
        });
        return Err((StatusCode::UNAUTHORIZED, Json(error_response)));
    }

    let _: () = redis_client
        .del(&[
            refresh_token_details.token_uuid.to_string(),
            auth_guard.access_token_uuid.to_string(),
        ])
        .await
        .map_err(redis_failed)?;

    let headers = session_end_headers("/");

    let mut response = Response::new(json!({"status": "success"}).to_string());
    response.headers_mut().extend(headers);
    Ok(response)
}

pub async fn get_me_handler(
    Extension(jwtauth): Extension<JWTAuthMiddleware>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    let json_response = serde_json::json!({
        "status":  "success",
        "data": serde_json::json!({
            "user": filter_user_record(&jwtauth.user)
        })
    });

    Ok(Json(json_response))
}

/// Ends the session: expires all three cookies and redirects. Shared by logout
/// and the password change, which revokes the very token that made its request
/// and so must not leave the caller on a page whose every fetch now 401s.
pub fn session_end_headers(target: &'static str) -> HeaderMap {
    let expire = |name: &'static str, value: &'static str, http_only: bool| {
        Cookie::build((name, value))
            .path("/")
            .max_age(time::Duration::minutes(-1))
            .same_site(SameSite::Lax)
            .secure(crate::auth_keys::secure_cookies())
            .http_only(http_only)
            .to_string()
    };

    let mut headers = HeaderMap::new();
    append_set_cookies(
        &mut headers,
        [
            expire("access_token", "", true),
            expire("refresh_token", "", true),
            expire("logged_in", "true", false),
        ],
    );
    headers.append("HX-Redirect", header::HeaderValue::from_static(target));
    headers
}

#[derive(serde::Deserialize)]
pub struct ChangePasswordSchema {
    pub current_password: String,
    pub new_password: String,
    pub confirm_password: String,
}

/// Replaces the caller's password and kills every session including this one.
///
/// The bump invalidates the token that made this request, so the response
/// clears the cookies and the client is expected to log in again — leaving the
/// caller on a page whose every request has just started failing is worse than
/// sending them to `/login`.
pub async fn change_password_handler(
    Extension(jwtauth): Extension<JWTAuthMiddleware>,
    Json(body): Json<ChangePasswordSchema>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    // Confirmed before anything is written: the change revokes every session
    // and there is no self-service recovery, so a single typo would lock the
    // account out until an operator resets it by hand.
    if body.new_password != body.confirm_password {
        return Err((
            StatusCode::BAD_REQUEST,
            Json(serde_json::json!({
                "status": "fail",
                "message": t!("The new passwords do not match").to_string(),
            })),
        ));
    }

    server::command::user::change_password(
        jwtauth.user.id,
        &body.current_password,
        &body.new_password,
    )
    .await
    .map_err(|e| {
        log::warn!(
            "password change refused for user_id={}: {e}",
            jwtauth.user.id
        );
        match e {
            server::command::CmdError::Args(_) => (
                StatusCode::BAD_REQUEST,
                Json(serde_json::json!({
                    "status": "fail",
                    "message": t!("Invalid email or password").to_string(),
                })),
            ),
            // A database outage is not a wrong password; saying so sends the
            // user off retyping a password that was correct.
            _ => (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(serde_json::json!({
                    "status": "error",
                    "message": t!("Database error:").to_string(),
                })),
            ),
        }
    })?;

    Ok((
        session_end_headers("/login"),
        Json(serde_json::json!({ "status": "success" })),
    ))
}

pub async fn get_version() -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    if let Some(CmdResult::String(version)) = server::command::config::GetVersion::new()
        .run()
        .await
        .map_err(|_| {
            (
                StatusCode::INTERNAL_SERVER_ERROR,
                Json(json!("Can't get version")),
            )
        })?
        && let Some(CmdResult::String(build_date)) = server::command::config::GetBuildDate::new()
            .run()
            .await
            .map_err(|_| {
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    Json(json!("Can't get version")),
                )
            })?
    {
        Ok(Response::new(format!(
            "<span class=\"version\">{version}</span><span class=\"build_date\" data-iso=\"{build_date}\"><script>
    const el = document.currentScript.parentElement;
    el.textContent = new Date(el.dataset.iso.trim()).toLocaleString();
  </script></span>"
        )))
    } else {
        Ok(Response::new("Unversioned".to_string()))
    }
}

pub async fn get_logout_link(
    Extension(jwtauth): Extension<JWTAuthMiddleware>,
) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    // `/register` is admin-gated server-side; showing the link to everyone
    // would only advertise a 401.
    let admin_link = match jwtauth.user.role.as_str() {
        "admin" => "<a href=\"/register\">Register user</a> ",
        _ => "",
    };
    Ok(Response::new(format!(
        "<a href=\"/account/ssh-key\">Account</a> {admin_link}\
         <a hx-get=\"/api/auth/logout\">Logout</a>"
    )))
}

pub async fn get_home_link() -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
    Ok(Response::new("<a href='/'>Back to main</a>".to_string()))
}

fn filter_user_record(user: &User) -> FilteredUser {
    FilteredUser {
        id: user.id.to_string(),
        email: user.email.clone(),
        name: user.name.clone(),
        photo: user.photo.clone(),
        role: user.role.clone(),
        verified: user.verified,
        createdAt: user.created_at.unwrap_or_default(),
        updatedAt: user.updated_at.unwrap_or_default(),
    }
}

async fn mint_token(
    user_id: uuid::Uuid,
    max_age: i64,
    token_type: crate::token::TokenType,
    generation: i32,
) -> Result<TokenDetails, (StatusCode, Json<serde_json::Value>)> {
    crate::auth_keys::mint(user_id, max_age, token_type, generation)
        .await
        .map_err(|e| {
            let msg = format!("{} {}", t!("error generating token:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "error",
                "message": msg,
            });
            (e.status(), Json(error_response))
        })
}

async fn save_token_data_to_redis(
    data: &Arc<AppState>,
    token_details: &TokenDetails,
    max_age: i64,
) -> Result<(), (StatusCode, Json<serde_json::Value>)> {
    let mut redis_client = data
        .redis_client
        .get_multiplexed_async_connection()
        .await
        .map_err(|e| {
            let msg = format!("{} {}", t!("Redis error:"), e);
            log::error!("{msg}");
            let error_response = serde_json::json!({
                "status": "error",
                "message": msg,
            });
            (StatusCode::INTERNAL_SERVER_ERROR, Json(error_response))
        })?;
    let _: bool = redis_client
        .set_ex(
            token_details.token_uuid.to_string(),
            token_details.user_id.to_string(),
            (max_age * 60) as u64,
        )
        .await
        .map_err(|e| {
            let error_response = serde_json::json!({
                "status": "error",
                "message": format_args!("{}", e),
            });
            (StatusCode::UNPROCESSABLE_ENTITY, Json(error_response))
        })?;
    Ok(())
}