Implement basic GraphQL endpoint with auth

src/infra/auth_service.rs

@@ -337,6 +337,49 @@ where
     }
 }
 
+pub struct ValidationResults {
+    pub user: String,
+    pub is_admin: bool,
+}
+
+impl ValidationResults {
+    #[cfg(test)]
+    pub fn admin() -> Self {
+        Self {
+            user: "admin".to_string(),
+            is_admin: true,
+        }
+    }
+
+    pub fn can_access(&self, user: &str) -> bool {
+        self.is_admin || self.user == user
+    }
+}
+
+pub(crate) fn check_if_token_is_valid<Backend>(
+    state: &AppState<Backend>,
+    token_str: &str,
+) -> Result<ValidationResults, actix_web::Error> {
+    let token: Token<_> = VerifyWithKey::verify_with_key(token_str, &state.jwt_key)
+        .map_err(|_| ErrorUnauthorized("Invalid JWT"))?;
+    if token.claims().exp.lt(&Utc::now()) {
+        return Err(ErrorUnauthorized("Expired JWT"));
+    }
+    let jwt_hash = {
+        let mut s = DefaultHasher::new();
+        token_str.hash(&mut s);
+        s.finish()
+    };
+    if state.jwt_blacklist.read().unwrap().contains(&jwt_hash) {
+        return Err(ErrorUnauthorized("JWT was logged out"));
+    }
+    let is_admin = token.claims().groups.contains("lldap_admin");
+    Ok(ValidationResults {
+        user: token.claims().user.clone(),
+        is_admin,
+    })
+}
+
 pub async fn token_validator<Backend>(
     req: ServiceRequest,
     credentials: BearerAuth,
@@ -348,24 +391,9 @@ where
     let state = req
         .app_data::<web::Data<AppState<Backend>>>()
         .expect("Invalid app config");
-    let token: Token<_> = VerifyWithKey::verify_with_key(credentials.token(), &state.jwt_key)
-        .map_err(|_| ErrorUnauthorized("Invalid JWT"))?;
-    if token.claims().exp.lt(&Utc::now()) {
-        return Err(ErrorUnauthorized("Expired JWT"));
-    }
-    let jwt_hash = {
-        let mut s = DefaultHasher::new();
-        credentials.token().hash(&mut s);
-        s.finish()
-    };
-    if state.jwt_blacklist.read().unwrap().contains(&jwt_hash) {
-        return Err(ErrorUnauthorized("JWT was logged out"));
-    }
-    let is_admin = token.claims().groups.contains("lldap_admin");
-    if is_admin
-        || (!admin_required && req.match_info().get("user_id") == Some(&token.claims().user))
-    {
-        debug!("Got authorized token for user {}", &token.claims().user);
+    let ValidationResults { user, is_admin } = check_if_token_is_valid(state, credentials.token())?;
+    if is_admin || (!admin_required && req.match_info().get("user_id") == Some(&user)) {
+        debug!("Got authorized token for user {}", &user);
         Ok(req)
     } else {
         Err(ErrorUnauthorized(

src/infra/graphql/api.rs

@@ -0,0 +1,70 @@
+use crate::{
+    domain::handler::BackendHandler,
+    infra::{
+        auth_service::{check_if_token_is_valid, ValidationResults},
+        tcp_server::AppState,
+    },
+};
+use actix_web::{web, Error, HttpResponse};
+use actix_web_httpauth::extractors::bearer::BearerAuth;
+use juniper::{EmptyMutation, EmptySubscription, RootNode};
+use juniper_actix::{graphiql_handler, graphql_handler, playground_handler};
+
+use super::query::Query;
+
+pub struct Context<Handler: BackendHandler> {
+    pub handler: Box<Handler>,
+    pub validation_result: ValidationResults,
+}
+
+impl<Handler: BackendHandler> juniper::Context for Context<Handler> {}
+
+type Schema<Handler> = RootNode<
+    'static,
+    Query<Handler>,
+    EmptyMutation<Context<Handler>>,
+    EmptySubscription<Context<Handler>>,
+>;
+
+fn schema<Handler: BackendHandler + Sync>() -> Schema<Handler> {
+    Schema::new(
+        Query::<Handler>::new(),
+        EmptyMutation::<Context<Handler>>::new(),
+        EmptySubscription::<Context<Handler>>::new(),
+    )
+}
+
+async fn graphiql_route() -> Result<HttpResponse, Error> {
+    graphiql_handler("/api/graphql", None).await
+}
+async fn playground_route() -> Result<HttpResponse, Error> {
+    playground_handler("/api/graphql", None).await
+}
+
+async fn graphql_route<Handler: BackendHandler + Sync>(
+    req: actix_web::HttpRequest,
+    mut payload: actix_web::web::Payload,
+    data: web::Data<AppState<Handler>>,
+) -> Result<HttpResponse, Error> {
+    use actix_web::FromRequest;
+    let bearer = BearerAuth::from_request(&req, &mut payload.0).await?;
+    let validation_result = check_if_token_is_valid(&data, bearer.token())?;
+    let context = Context::<Handler> {
+        handler: Box::new(data.backend_handler.clone()),
+        validation_result,
+    };
+    graphql_handler(&schema(), &context, req, payload).await
+}
+
+pub fn configure_endpoint<Backend>(cfg: &mut web::ServiceConfig)
+where
+    Backend: BackendHandler + Sync + 'static,
+{
+    cfg.service(
+        web::resource("/graphql")
+            .route(web::post().to(graphql_route::<Backend>))
+            .route(web::get().to(graphql_route::<Backend>)),
+    );
+    cfg.service(web::resource("/graphql/playground").route(web::get().to(playground_route)));
+    cfg.service(web::resource("/graphql/graphiql").route(web::get().to(graphiql_route)));
+}

src/infra/graphql/mod.rs

@@ -0,0 +1,2 @@
+pub mod api;
+pub mod query;

src/infra/graphql/query.rs

@@ -0,0 +1,340 @@
+use crate::domain::handler::BackendHandler;
+use juniper::{graphql_object, FieldResult, GraphQLInputObject};
+use lldap_model::{ListUsersRequest, UserDetailsRequest};
+use serde::{Deserialize, Serialize};
+use std::convert::TryInto;
+
+use super::api::Context;
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+/// A filter for requests, specifying a boolean expression based on field constraints. Only one of
+/// the fields can be set at a time.
+pub struct RequestFilter {
+    any: Option<Vec<RequestFilter>>,
+    all: Option<Vec<RequestFilter>>,
+    not: Option<Box<RequestFilter>>,
+    eq: Option<EqualityConstraint>,
+}
+
+impl TryInto<lldap_model::RequestFilter> for RequestFilter {
+    type Error = String;
+    fn try_into(self) -> Result<lldap_model::RequestFilter, Self::Error> {
+        let mut field_count = 0;
+        if self.any.is_some() {
+            field_count += 1;
+        }
+        if self.all.is_some() {
+            field_count += 1;
+        }
+        if self.not.is_some() {
+            field_count += 1;
+        }
+        if self.eq.is_some() {
+            field_count += 1;
+        }
+        if field_count == 0 {
+            return Err("No field specified in request filter".to_string());
+        }
+        if field_count > 1 {
+            return Err("Multiple fields specified in request filter".to_string());
+        }
+        if let Some(e) = self.eq {
+            return Ok(lldap_model::RequestFilter::Equality(e.field, e.value));
+        }
+        if let Some(c) = self.any {
+            return Ok(lldap_model::RequestFilter::Or(
+                c.into_iter()
+                    .map(TryInto::try_into)
+                    .collect::<Result<Vec<_>, String>>()?,
+            ));
+        }
+        if let Some(c) = self.all {
+            return Ok(lldap_model::RequestFilter::And(
+                c.into_iter()
+                    .map(TryInto::try_into)
+                    .collect::<Result<Vec<_>, String>>()?,
+            ));
+        }
+        if let Some(c) = self.not {
+            return Ok(lldap_model::RequestFilter::Not(Box::new((*c).try_into()?)));
+        }
+        unreachable!();
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, GraphQLInputObject)]
+pub struct EqualityConstraint {
+    field: String,
+    value: String,
+}
+
+#[derive(PartialEq, Eq, Debug)]
+/// The top-level GraphQL query type.
+pub struct Query<Handler: BackendHandler> {
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+impl<Handler: BackendHandler> Query<Handler> {
+    pub fn new() -> Self {
+        Self {
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler + Sync> Query<Handler> {
+    fn api_version() -> &'static str {
+        "1.0"
+    }
+
+    async fn user(context: &Context<Handler>, user_id: String) -> FieldResult<User<Handler>> {
+        if !context.validation_result.can_access(&user_id) {
+            return Err("Unauthorized access to user data".into());
+        }
+        Ok(context
+            .handler
+            .get_user_details(UserDetailsRequest { user_id })
+            .await
+            .map(Into::into)?)
+    }
+
+    async fn users(
+        context: &Context<Handler>,
+        #[graphql(name = "where")] filters: Option<RequestFilter>,
+    ) -> FieldResult<Vec<User<Handler>>> {
+        if !context.validation_result.is_admin {
+            return Err("Unauthorized access to user list".into());
+        }
+        Ok(context
+            .handler
+            .list_users(ListUsersRequest {
+                filters: match filters {
+                    None => None,
+                    Some(f) => Some(f.try_into()?),
+                },
+            })
+            .await
+            .map(|v| v.into_iter().map(Into::into).collect())?)
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+/// Represents a single user.
+pub struct User<Handler: BackendHandler> {
+    user: lldap_model::User,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+impl<Handler: BackendHandler> Default for User<Handler> {
+    fn default() -> Self {
+        Self {
+            user: lldap_model::User::default(),
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler + Sync> User<Handler> {
+    fn id(&self) -> &str {
+        &self.user.user_id
+    }
+
+    fn email(&self) -> &str {
+        &self.user.email
+    }
+
+    /// The groups to which this user belongs.
+    async fn groups(&self, context: &Context<Handler>) -> FieldResult<Vec<Group<Handler>>> {
+        Ok(context
+            .handler
+            .get_user_groups(self.user.user_id.clone())
+            .await
+            .map(|set| set.into_iter().map(Into::into).collect())?)
+    }
+}
+
+impl<Handler: BackendHandler> From<lldap_model::User> for User<Handler> {
+    fn from(user: lldap_model::User) -> Self {
+        Self {
+            user,
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[derive(PartialEq, Eq, Debug, Serialize, Deserialize)]
+/// Represents a single group.
+pub struct Group<Handler: BackendHandler> {
+    group_id: String,
+    _phantom: std::marker::PhantomData<Box<Handler>>,
+}
+
+#[graphql_object(context = Context<Handler>)]
+impl<Handler: BackendHandler + Sync> Group<Handler> {
+    fn id(&self) -> String {
+        self.group_id.clone()
+    }
+    /// The groups to which this user belongs.
+    async fn users(&self, context: &Context<Handler>) -> FieldResult<Vec<User<Handler>>> {
+        if !context.validation_result.is_admin {
+            return Err("Unauthorized access to group data".into());
+        }
+        unimplemented!()
+    }
+}
+
+impl<Handler: BackendHandler> From<String> for Group<Handler> {
+    fn from(group_id: String) -> Self {
+        Self {
+            group_id,
+            _phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{domain::handler::MockTestBackendHandler, infra::auth_service::ValidationResults};
+    use juniper::{
+        execute, graphql_value, DefaultScalarValue, EmptyMutation, EmptySubscription, GraphQLType,
+        RootNode, Variables,
+    };
+    use mockall::predicate::eq;
+    use std::collections::HashSet;
+
+    fn schema<'q, C, Q>(query_root: Q) -> RootNode<'q, Q, EmptyMutation<C>, EmptySubscription<C>>
+    where
+        Q: GraphQLType<DefaultScalarValue, Context = C, TypeInfo = ()> + 'q,
+    {
+        RootNode::new(
+            query_root,
+            EmptyMutation::<C>::new(),
+            EmptySubscription::<C>::new(),
+        )
+    }
+
+    #[tokio::test]
+    async fn get_user_by_id() {
+        const QUERY: &str = r#"{
+          user(userId: "bob") {
+            id
+            email
+            groups {
+              id
+            }
+          }
+        }"#;
+
+        let mut mock = MockTestBackendHandler::new();
+        mock.expect_get_user_details()
+            .with(eq(UserDetailsRequest {
+                user_id: "bob".to_string(),
+            }))
+            .return_once(|_| {
+                Ok(lldap_model::User {
+                    user_id: "bob".to_string(),
+                    email: "bob@bobbers.on".to_string(),
+                    ..Default::default()
+                })
+            });
+        let mut groups = HashSet::<String>::new();
+        groups.insert("Bobbersons".to_string());
+        mock.expect_get_user_groups()
+            .with(eq("bob".to_string()))
+            .return_once(|_| Ok(groups));
+
+        let context = Context::<MockTestBackendHandler> {
+            handler: Box::new(mock),
+            validation_result: ValidationResults::admin(),
+        };
+
+        let schema = schema(Query::<MockTestBackendHandler>::new());
+        assert_eq!(
+            execute(QUERY, None, &schema, &Variables::new(), &context).await,
+            Ok((
+                graphql_value!(
+                {
+                    "user": {
+                        "id": "bob",
+                        "email": "bob@bobbers.on",
+                        "groups": [{"id": "Bobbersons"}]
+                    }
+                }),
+                vec![]
+            ))
+        );
+    }
+
+    #[tokio::test]
+    async fn list_users() {
+        const QUERY: &str = r#"{
+          users(filters: {
+            any: [
+              {eq: {
+                field: "id"
+                value: "bob"
+              }},
+              {eq: {
+                field: "email"
+                value: "robert@bobbers.on"
+              }}
+            ]}) {
+            id
+            email
+          }
+        }"#;
+
+        let mut mock = MockTestBackendHandler::new();
+        use lldap_model::{RequestFilter, User};
+        mock.expect_list_users()
+            .with(eq(ListUsersRequest {
+                filters: Some(RequestFilter::Or(vec![
+                    RequestFilter::Equality("id".to_string(), "bob".to_string()),
+                    RequestFilter::Equality("email".to_string(), "robert@bobbers.on".to_string()),
+                ])),
+            }))
+            .return_once(|_| {
+                Ok(vec![
+                    User {
+                        user_id: "bob".to_string(),
+                        email: "bob@bobbers.on".to_string(),
+                        ..Default::default()
+                    },
+                    User {
+                        user_id: "robert".to_string(),
+                        email: "robert@bobbers.on".to_string(),
+                        ..Default::default()
+                    },
+                ])
+            });
+
+        let context = Context::<MockTestBackendHandler> {
+            handler: Box::new(mock),
+            validation_result: ValidationResults::admin(),
+        };
+
+        let schema = schema(Query::<MockTestBackendHandler>::new());
+        assert_eq!(
+            execute(QUERY, None, &schema, &Variables::new(), &context).await,
+            Ok((
+                graphql_value!(
+                {
+                    "users": [
+                        {
+                            "id": "bob",
+                            "email": "bob@bobbers.on"
+                        },
+                        {
+                            "id": "robert",
+                            "email": "robert@bobbers.on"
+                        },
+                    ]
+                }),
+                vec![]
+            ))
+        );
+    }
+}

src/infra/mod.rs

@@ -2,6 +2,7 @@ pub mod auth_service;
 pub mod cli;
 pub mod configuration;
 pub mod db_cleaner;
+pub mod graphql;
 pub mod jwt_sql_tables;
 pub mod ldap_handler;
 pub mod ldap_server;

src/infra/tcp_api.rs

@@ -62,7 +62,7 @@ where
 
 pub fn api_config<Backend>(cfg: &mut web::ServiceConfig)
 where
-    Backend: TcpBackendHandler + BackendHandler + 'static,
+    Backend: TcpBackendHandler + BackendHandler + Sync + 'static,
 {
     let json_config = web::JsonConfig::default()
         .limit(4096)
@@ -77,6 +77,7 @@ where
             .into()
         });
     cfg.app_data(json_config);
+    super::graphql::api::configure_endpoint::<Backend>(cfg);
     cfg.service(
         web::resource("/user/{user_id}")
             .route(web::get().to(user_details_handler::<Backend>))

src/infra/tcp_server.rs

@@ -47,7 +47,7 @@ fn http_config<Backend>(
     jwt_secret: String,
     jwt_blacklist: HashSet<u64>,
 ) where
-    Backend: TcpBackendHandler + BackendHandler + LoginHandler + OpaqueHandler + 'static,
+    Backend: TcpBackendHandler + BackendHandler + LoginHandler + OpaqueHandler + Sync + 'static,
 {
     cfg.app_data(web::Data::new(AppState::<Backend> {
         backend_handler,
@@ -84,7 +84,7 @@ pub async fn build_tcp_server<Backend>(
     server_builder: ServerBuilder,
 ) -> Result<ServerBuilder>
 where
-    Backend: TcpBackendHandler + BackendHandler + LoginHandler + OpaqueHandler + 'static,
+    Backend: TcpBackendHandler + BackendHandler + LoginHandler + OpaqueHandler + Sync + 'static,
 {
     let jwt_secret = config.jwt_secret.clone();
     let jwt_blacklist = backend_handler.get_jwt_blacklist().await?;