129 lines
4.3 KiB
Ruby
129 lines
4.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module Authn
|
|
module TokenField
|
|
class Encrypted < Base
|
|
def token_fields
|
|
super + [encrypted_field]
|
|
end
|
|
|
|
def find_token_authenticatable(token, unscoped = false)
|
|
return if token.blank?
|
|
|
|
token_owner_record =
|
|
if required?
|
|
find_by_encrypted_token(token, unscoped)
|
|
elsif optional?
|
|
find_by_encrypted_token(token, unscoped) ||
|
|
find_by_plaintext_token(token, unscoped)
|
|
elsif migrating?
|
|
find_by_plaintext_token(token, unscoped)
|
|
end
|
|
|
|
token_owner_record if token_owner_record && matches_prefix?(token_owner_record, token)
|
|
end
|
|
|
|
def ensure_token(token_owner_record)
|
|
# TODO, tech debt, because some specs are testing migrations, but are still
|
|
# using factory bot to create resources, it might happen that a database
|
|
# schema does not have "#{token_name}_encrypted" field yet, however a bunch
|
|
# of models call `ensure_#{token_name}` in `before_save`.
|
|
#
|
|
# In that case we are using insecure strategy, but this should only happen
|
|
# in tests, because otherwise `encrypted_field` is going to exist.
|
|
#
|
|
# Another use case is when we are caching resources / columns, like we do
|
|
# in case of ApplicationSetting.
|
|
|
|
return super if token_owner_record.has_attribute?(encrypted_field)
|
|
|
|
if required? # rubocop:disable Style/GuardClause -- Multiple guard clauses + guard clause with `if` modifier is messy
|
|
raise ArgumentError, _('Using required encryption strategy when encrypted field is missing!')
|
|
else
|
|
insecure_strategy.ensure_token(token_owner_record)
|
|
end
|
|
end
|
|
|
|
def get_token(token_owner_record)
|
|
return insecure_strategy.get_token(token_owner_record) if migrating?
|
|
|
|
get_encrypted_token(token_owner_record)
|
|
end
|
|
|
|
def encode(token)
|
|
Authn::TokenField::EncryptionHelper.encrypt_token(token)
|
|
end
|
|
|
|
def set_token(token_owner_record, token)
|
|
raise ArgumentError unless token.present?
|
|
|
|
token_owner_record[encrypted_field] = encode(token)
|
|
token_owner_record[token_field] = token if migrating?
|
|
token_owner_record[token_field] = nil if optional?
|
|
token
|
|
end
|
|
|
|
def required?
|
|
encrypted_strategy == :required
|
|
end
|
|
|
|
def migrating?
|
|
encrypted_strategy == :migrating
|
|
end
|
|
|
|
def optional?
|
|
encrypted_strategy == :optional
|
|
end
|
|
|
|
protected
|
|
|
|
def get_encrypted_token(token_owner_record)
|
|
encrypted_token = token_owner_record.read_attribute(encrypted_field)
|
|
token = Authn::TokenField::EncryptionHelper.decrypt_token(encrypted_token)
|
|
token || (insecure_strategy.get_token(token_owner_record) if optional?)
|
|
end
|
|
|
|
def encrypted_strategy
|
|
value = options[:encrypted]
|
|
value = value.call if value.is_a?(Proc)
|
|
|
|
unless value.in?([:required, :optional, :migrating])
|
|
raise ArgumentError, _('encrypted: needs to be a :required, :optional or :migrating!')
|
|
end
|
|
|
|
value
|
|
end
|
|
|
|
def find_by_plaintext_token(token, unscoped)
|
|
insecure_strategy.find_token_authenticatable(token, unscoped)
|
|
end
|
|
|
|
def find_by_encrypted_token(token, unscoped)
|
|
encrypted_value = encode(token)
|
|
token_encrypted_with_static_iv = Gitlab::CryptoHelper.aes256_gcm_encrypt(token)
|
|
relation(unscoped).find_by(encrypted_field => [encrypted_value, token_encrypted_with_static_iv]) # rubocop:disable CodeReuse/ActiveRecord: -- This is meant to be used in AR models.
|
|
end
|
|
|
|
def insecure_strategy
|
|
@insecure_strategy ||= Authn::TokenField::Insecure
|
|
.new(klass, token_field, options)
|
|
end
|
|
|
|
def matches_prefix?(token_owner_record, token)
|
|
!options[:require_prefix_for_validation] || token.start_with?(prefix_for(token_owner_record))
|
|
end
|
|
|
|
def token_set?(token_owner_record)
|
|
token = get_encrypted_token(token_owner_record)
|
|
token ||= insecure_strategy.get_token(token_owner_record) unless required?
|
|
|
|
token.present? && matches_prefix?(token_owner_record, token)
|
|
end
|
|
|
|
def encrypted_field
|
|
@encrypted_field ||= "#{@token_field}_encrypted"
|
|
end
|
|
end
|
|
end
|
|
end
|