1 #ifndef _ots_Utilities_WebUsers_h_
2 #define _ots_Utilities_WebUsers_h_
4 #include "otsdaq-core/MessageFacility/MessageFacility.h"
5 #include "otsdaq-core/Macros/CoutMacros.h"
6 #include "otsdaq-core/Macros/StringMacros.h"
7 #include "otsdaq-core/SOAPUtilities/SOAPMessenger.h"
8 #include "xgi/Method.h"
13 #include <unordered_map>
15 #define WEB_LOGIN_DB_PATH std::string(getenv("SERVICE_DATA_PATH")) + "/LoginData/"
16 #define WEB_LOGIN_CERTDATA_PATH std::string(getenv("CERT_DATA_PATH"))
17 #define HASHES_DB_PATH "HashesData/"
18 #define USERS_DB_PATH "UsersData/"
19 #define USERS_LOGIN_HISTORY_PATH USERS_DB_PATH + "UserLoginHistoryData/"
20 #define USERS_PREFERENCES_PATH USERS_DB_PATH + "UserPreferencesData/"
21 #define TOOLTIP_DB_PATH USERS_DB_PATH + "/TooltipData/"
27 class HttpXmlDocument;
38 SESSION_ID_LENGTH = 512,
39 COOKIE_CODE_LENGTH = 512,
40 NOT_FOUND_IN_DATABASE = uint64_t(-1),
42 DISPLAY_NAME_LENGTH = 4,
46 using permissionLevel_t = uint8_t;
48 PERMISSION_LEVEL_ADMIN = WebUsers::permissionLevel_t(-1),
49 PERMISSION_LEVEL_EXPERT = 100,
50 PERMISSION_LEVEL_USER = 10,
51 PERMISSION_LEVEL_NOVICE = 1,
52 PERMISSION_LEVEL_INACTIVE = 0,
55 static const std::string DEFAULT_ADMIN_USERNAME;
56 static const std::string DEFAULT_ADMIN_DISPLAY_NAME;
57 static const std::string DEFAULT_ADMIN_EMAIL;
58 static const std::string DEFAULT_ITERATOR_USERNAME;
59 static const std::string DEFAULT_STATECHANGER_USERNAME;
60 static const std::string DEFAULT_USER_GROUP;
62 static const std::string REQ_NO_LOGIN_RESPONSE;
63 static const std::string REQ_NO_PERMISSION_RESPONSE;
64 static const std::string REQ_USER_LOCKOUT_RESPONSE;
65 static const std::string REQ_LOCK_REQUIRED_RESPONSE;
66 static const std::string REQ_ALLOW_NO_USER;
68 static const std::string SECURITY_TYPE_NONE;
69 static const std::string SECURITY_TYPE_DIGEST_ACCESS;
78 const std::string& cookieCode)
79 : requestType_ (requestType)
80 , cookieCode_ (cookieCode)
87 bool setGroupPermissionLevels(
const std::string& groupPermissionLevelsString)
90 if(allowNoUser_)
return false;
92 StringMacros::getMapFromString(
93 groupPermissionLevelsString,
94 groupPermissionLevelMap_);
95 getGroupPermissionLevel();
102 const std::map<std::string ,
103 WebUsers::permissionLevel_t>& getGroupPermissionLevels()
const {
return groupPermissionLevelMap_; }
107 const WebUsers::permissionLevel_t& getGroupPermissionLevel()
109 permissionLevel_ = 0;
114 bool matchedAcceptGroup =
false;
115 for(
const auto& userGroupPair:groupPermissionLevelMap_)
116 if(StringMacros::inWildCardSet(
119 userGroupPair.second > permissionLevel_)
121 permissionLevel_ = userGroupPair.second;
122 matchedAcceptGroup =
true;
126 if(!matchedAcceptGroup && groupsAllowed_.size())
130 __COUT_INFO__ <<
"User (@" << ip_ <<
") has insufficient group permissions: user is in these groups... " <<
131 StringMacros::mapToString(groupPermissionLevelMap_) <<
" and the allowed groups are... " <<
132 StringMacros::setToString(groupsAllowed_) << std::endl;
133 return permissionLevel_;
137 if(!groupsAllowed_.size())
139 for(
const auto& userGroupPair:groupPermissionLevelMap_)
140 if(StringMacros::inWildCardSet(
146 __COUT_INFO__ <<
"User (@" << ip_ <<
") is in a disallowed group: user is in these groups... " <<
147 StringMacros::mapToString(groupPermissionLevelMap_) <<
" and the disallowed groups are... " <<
148 StringMacros::setToString(groupsDisallowed_) << std::endl;
149 return permissionLevel_;
155 auto findIt = groupPermissionLevelMap_.find(WebUsers::DEFAULT_USER_GROUP);
156 if(findIt != groupPermissionLevelMap_.end())
159 permissionLevel_ = findIt->second;
162 return permissionLevel_;
166 inline bool isInactive() {
return permissionLevel_ == WebUsers::PERMISSION_LEVEL_INACTIVE; }
167 inline bool isAdmin() {
return permissionLevel_ == WebUsers::PERMISSION_LEVEL_ADMIN; }
170 const std::string& requestType_;
171 std::string cookieCode_;
173 bool automatedCommand_, NonXMLRequestType_, NoXmlWhiteSpace_;
174 bool checkLock_, requireLock_, allowNoUser_;
176 std::set<std::string> groupsAllowed_, groupsDisallowed_;
178 WebUsers::permissionLevel_t permissionLevel_, permissionsThreshold_;
181 std::string username_, displayName_, usernameWithLock_;
182 uint64_t activeUserSessionIndex_;
184 std::map<std::string ,WebUsers::permissionLevel_t> groupPermissionLevelMap_;
189 bool xmlRequestOnGateway(
191 std::ostringstream* out,
198 static void initializeRequestUserInfo(
201 static bool checkRequestAccess(
203 std::ostringstream* out,
206 bool isWizardMode =
false);
208 bool createNewAccount (
const std::string& username,
const std::string& displayName,
const std::string& email);
209 void cleanupExpiredEntries (std::vector<std::string>* loggedOutUsernames = 0);
210 std::string createNewLoginSession (
const std::string& uuid,
const std::string& ip);
212 uint64_t attemptActiveSession (
const std::string& uuid, std::string& jumbledUser,
const std::string& jumbledPw, std::string& newAccountCode,
const std::string& ip);
213 uint64_t attemptActiveSessionWithCert (
const std::string& uuid, std::string& jumbledEmail, std::string& cookieCode, std::string& username,
const std::string& ip);
214 uint64_t isCookieCodeActiveForLogin (
const std::string& uuid, std::string& cookieCode,std::string& username);
215 bool cookieCodeIsActiveForRequest (std::string& cookieCode, std::map<std::string /*groupName*/,WebUsers::permissionLevel_t>* userPermissions = 0, uint64_t* uid = 0,
const std::string& ip =
"0",
bool refresh =
true, std::string* userWithLock = 0, uint64_t* activeUserSessionIndex = 0);
216 uint64_t cookieCodeLogout (
const std::string& cookieCode,
bool logoutOtherUserSessions, uint64_t* uid = 0,
const std::string& ip =
"0");
217 bool checkIpAccess (
const std::string& ip);
219 std::string getUsersDisplayName (uint64_t uid);
220 std::string getUsersUsername (uint64_t uid);
221 uint64_t getActiveSessionCountForUser (uint64_t uid);
222 std::map<std::string ,WebUsers::permissionLevel_t> getPermissionsForUser (uint64_t uid);
223 void insertSettingsForUser (uint64_t uid,
HttpXmlDocument* xmldoc,
bool includeAccounts=
false);
224 std::string getGenericPreference (uint64_t uid,
const std::string& preferenceName,
HttpXmlDocument* xmldoc = 0)
const;
226 void changeSettingsForUser (uint64_t uid,
const std::string& bgcolor,
const std::string& dbcolor,
const std::string& wincolor,
const std::string& layout,
const std::string& syslayout);
227 void setGenericPreference (uint64_t uid,
const std::string& preferenceName,
const std::string& preferenceValue);
228 static void tooltipCheckForUsername (
const std::string& username,
HttpXmlDocument* xmldoc,
const std::string& srcFile,
const std::string& srcFunc,
const std::string& srcId);
229 static void tooltipSetNeverShowForUsername (
const std::string& username,
HttpXmlDocument* xmldoc,
const std::string& srcFile,
const std::string& srcFunc,
const std::string& srcId,
bool doNeverShow,
bool temporarySilence);
231 void modifyAccountSettings (uint64_t actingUid, uint8_t cmd_type,
const std::string& username,
const std::string& displayname,
const std::string& email,
const std::string& permissions);
232 bool setUserWithLock (uint64_t actingUid,
bool lock,
const std::string& username);
233 std::string getUserWithLock (
void) {
return usersUsernameWithLock_; }
235 std::string getActiveUsersString (
void);
237 bool getUserInfoForCookie (std::string& cookieCode, std::string* userName, std::string* displayName = 0, uint64_t* activeSessionIndex = 0);
239 bool isUsernameActive (
const std::string& username)
const;
240 bool isUserIdActive (uint64_t uid)
const;
241 uint64_t getAdminUserID (
void);
242 std::string getSecurity (
void);
244 static void deleteUserData (
void);
245 static void resetAllUserTooltips (
const std::string& userNeedle =
"*");
247 static void NACDisplayThread (
const std::string& nac,
const std::string& user);
249 void saveActiveSessions (
void);
250 void loadActiveSessions (
void);
254 inline WebUsers::permissionLevel_t getPermissionLevelForGroup (std::map<std::string /*groupName*/,WebUsers::permissionLevel_t>& permissionMap,
const std::string& groupName = WebUsers::DEFAULT_USER_GROUP);
255 inline bool isInactiveForGroup (std::map<std::string /*groupName*/,WebUsers::permissionLevel_t>& permissionMap,
const std::string& groupName = WebUsers::DEFAULT_USER_GROUP);
256 inline bool isAdminForGroup (std::map<std::string /*groupName*/,WebUsers::permissionLevel_t>& permissionMap,
const std::string& groupName = WebUsers::DEFAULT_USER_GROUP);
258 void loadSecuritySelection (
void);
259 void loadUserWithLock (
void);
260 unsigned int hexByteStrToInt (
const char* h);
261 void intToHexStr (uint8_t i,
char* h);
262 std::string sha512 (
const std::string& user,
const std::string& password, std::string& salt);
263 std::string dejumble (
const std::string& jumbledUser,
const std::string& sessionId);
264 std::string createNewActiveSession (uint64_t uid,
const std::string& ip =
"0", uint64_t asIndex = 0);
265 bool addToHashesDatabase (
const std::string& hash);
266 std::string genCookieCode (
void);
267 std::string refreshCookieCode (
unsigned int i,
bool enableRefresh =
true);
268 void removeActiveSessionEntry (
unsigned int i);
269 void removeLoginSessionEntry (
unsigned int i);
270 bool deleteAccount (
const std::string& username,
const std::string& displayName);
271 void incrementIpBlacklistCount (
const std::string& ip);
273 void saveToDatabase (FILE* fp,
const std::string& field,
const std::string& value, uint8_t type = DB_SAVE_OPEN_AND_CLOSE,
bool addNewLine =
true);
274 bool saveDatabaseToFile (uint8_t db);
275 bool loadDatabases (
void);
277 uint64_t searchUsersDatabaseForUsername (
const std::string& username)
const;
278 uint64_t searchUsersDatabaseForUserEmail (
const std::string& useremail)
const;
279 uint64_t searchUsersDatabaseForUserId (uint64_t uid)
const;
280 uint64_t searchLoginSessionDatabaseForUUID (
const std::string& uuid)
const;
281 uint64_t searchHashesDatabaseForHash (
const std::string& hash);
282 uint64_t searchActiveSessionDatabaseForCookie (
const std::string& cookieCode)
const;
284 static std::string getTooltipFilename (
const std::string& username,
const std::string& srcFile,
const std::string& srcFunc,
const std::string& srcId);
285 std::string getUserEmailFromFingerprint (
const std::string& fingerprint);
300 DB_SAVE_OPEN_AND_CLOSE,
305 std::unordered_map<std::string, std::string> certFingerprints_;
307 std::vector<std::string> UsersDatabaseEntryFields,HashesDatabaseEntryFields;
308 bool CareAboutCookieCodes_;
309 std::string securityType_;
318 std::vector<std::string> LoginSessionIdVector, LoginSessionUUIDVector, LoginSessionIpVector;
319 std::vector<time_t> LoginSessionStartTimeVector;
320 std::vector<uint8_t> LoginSessionAttemptsVector;
322 LOGIN_SESSION_EXPIRATION_TIME = 5*60,
323 LOGIN_SESSION_ATTEMPTS_MAX = 5,
335 std::vector<std::string> ActiveSessionCookieCodeVector, ActiveSessionIpVector;
336 std::vector<uint64_t> ActiveSessionUserIdVector, ActiveSessionIndex;
337 std::vector<time_t> ActiveSessionStartTimeVector;
339 ACTIVE_SESSION_EXPIRATION_TIME = 120*60,
340 ACTIVE_SESSION_COOKIE_OVERLAP_TIME = 10*60,
341 ACTIVE_SESSION_STALE_COOKIE_LIMIT = 10,
363 std::vector<std::string> UsersUsernameVector, UsersUserEmailVector, UsersDisplayNameVector, UsersSaltVector, UsersLastModifierUsernameVector;
364 std::vector< std::map<std::string ,WebUsers::permissionLevel_t> > UsersPermissionsVector;
365 std::vector<uint64_t> UsersUserIdVector;
366 std::vector<time_t> UsersLastLoginAttemptVector, UsersAccountCreatedTimeVector, UsersLastModifiedTimeVector;
367 std::vector<uint8_t> UsersLoginFailureCountVector;
368 uint64_t usersNextUserId_;
370 USERS_LOGIN_HISTORY_SIZE = 20,
371 USERS_GLOBAL_HISTORY_SIZE = 1000,
372 USERS_MAX_LOGIN_FAILURES = 20,
374 std::string usersUsernameWithLock_;
376 std::vector<std::string> UsersLoggedOutUsernames_;
380 std::vector<std::string> HashesVector;
381 std::vector<time_t> HashesAccessTimeVector;
384 IP_BLACKLIST_COUNT_THRESHOLD = 200,
386 std::map<std::string , uint32_t > ipBlacklistCounts_;