threshold/internal/servers/controller/handler.go

package controller

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"os"
	"strings"
	"time"

	"github.com/grpc-ecosystem/grpc-gateway/runtime"
	"github.com/hashicorp/vault/internalshared/configutil"
	"github.com/hashicorp/vault/sdk/helper/strutil"
	"github.com/hashicorp/watchtower/api"
	"github.com/hashicorp/watchtower/globals"
	"github.com/hashicorp/watchtower/internal/gen/controller/api/services"
	"github.com/hashicorp/watchtower/internal/perms"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/authenticate"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/groups"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/host_catalogs"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/host_sets"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/hosts"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/orgs"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/projects"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/roles"
	"github.com/hashicorp/watchtower/internal/servers/controller/handlers/users"
	"github.com/hashicorp/watchtower/internal/types/action"
	"github.com/hashicorp/watchtower/internal/types/resource"
	"github.com/hashicorp/watchtower/internal/types/scope"
	"github.com/kr/pretty"
)

type HandlerProperties struct {
	ListenerConfig *configutil.Listener
}

// Handler returns an http.Handler for the services. This can be used on
// its own to mount the Vault API within another web server.
func (c *Controller) handler(props HandlerProperties) (http.Handler, error) {
	// Create the muxer to handle the actual endpoints
	mux := http.NewServeMux()

	h, err := handleGrpcGateway(c)
	if err != nil {
		return nil, err
	}
	mux.Handle("/v1/", h)

	mux.Handle("/", handleUi(c))

	corsWrappedHandler := wrapHandlerWithCors(mux, props)
	commonWrappedHandler := wrapHandlerWithCommonFuncs(corsWrappedHandler, c, props)

	return commonWrappedHandler, nil
}

func handleGrpcGateway(c *Controller) (http.Handler, error) {
	// Register*ServiceHandlerServer methods ignore the passed in ctx.  Using the baseContext now just in case this changes
	// in the future, at which point we'll want to be using the baseContext.
	ctx := c.baseContext
	mux := runtime.NewServeMux(runtime.WithProtoErrorHandler(handlers.ErrorHandler(c.logger)))
	hcs, err := host_catalogs.NewService(c.StaticHostRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create host catalog handler service: %w", err)
	}
	if err := services.RegisterHostCatalogServiceHandlerServer(ctx, mux, hcs); err != nil {
		return nil, fmt.Errorf("failed to register host catalog service handler: %w", err)
	}
	if err := services.RegisterHostSetServiceHandlerServer(ctx, mux, &host_sets.Service{}); err != nil {
		return nil, fmt.Errorf("failed to register host set service handler: %w", err)
	}
	if err := services.RegisterHostServiceHandlerServer(ctx, mux, &hosts.Service{}); err != nil {
		return nil, fmt.Errorf("failed to register host service handler: %w", err)
	}
	auths, err := authenticate.NewService(c.IamRepoFn, c.AuthTokenRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create authentication handler service: %w", err)
	}
	if err := services.RegisterAuthenticationServiceHandlerServer(ctx, mux, auths); err != nil {
		return nil, fmt.Errorf("failed to register authenticate service handler: %w", err)
	}
	os, err := orgs.NewService(c.IamRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create org handler service: %w", err)
	}
	if err := services.RegisterOrgServiceHandlerServer(ctx, mux, os); err != nil {
		return nil, fmt.Errorf("failed to register org service handler: %w", err)
	}
	ps, err := projects.NewService(c.IamRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create project handler service: %w", err)
	}
	if err := services.RegisterProjectServiceHandlerServer(ctx, mux, ps); err != nil {
		return nil, fmt.Errorf("failed to register project service handler: %w", err)
	}
	us, err := users.NewService(c.IamRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create user handler service: %w", err)
	}
	if err := services.RegisterUserServiceHandlerServer(ctx, mux, us); err != nil {
		return nil, fmt.Errorf("failed to register user service handler: %w", err)
	}
	gs, err := groups.NewService(c.IamRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create group handler service: %w", err)
	}
	if err := services.RegisterGroupServiceHandlerServer(ctx, mux, gs); err != nil {
		return nil, fmt.Errorf("failed to register group service handler: %w", err)
	}
	rs, err := roles.NewService(c.IamRepoFn)
	if err != nil {
		return nil, fmt.Errorf("failed to create role handler service: %w", err)
	}
	if err := services.RegisterRoleServiceHandlerServer(ctx, mux, rs); err != nil {
		return nil, fmt.Errorf("failed to register role service handler: %w", err)
	}

	return mux, nil
}

func wrapHandlerWithCommonFuncs(h http.Handler, c *Controller, props HandlerProperties) http.Handler {
	var maxRequestDuration time.Duration
	var maxRequestSize int64
	if props.ListenerConfig != nil {
		maxRequestDuration = props.ListenerConfig.MaxRequestDuration
		maxRequestSize = props.ListenerConfig.MaxRequestSize
	}
	if maxRequestDuration == 0 {
		maxRequestDuration = globals.DefaultMaxRequestDuration
	}
	if maxRequestSize == 0 {
		maxRequestSize = globals.DefaultMaxRequestSize
	}

	logUrls := os.Getenv("WATCHTOWER_LOG_URLS") != ""

	disableAuthzFailures := c.conf.DisableAuthorizationFailures ||
		(c.conf.RawConfig.DevController && os.Getenv("WATCHTOWER_DEV_SKIP_AUTHZ") != "")
	if disableAuthzFailures {
		c.logger.Warn("AUTHORIZATION CHECKING DISABLED")
	}

	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if logUrls {
			c.logger.Trace("request received", "url", r.URL.String())
		}

		// Set the Cache-Control header for all responses returned
		w.Header().Set("Cache-Control", "no-store")

		// Start with the request context and our timeout
		ctx, cancelFunc := context.WithTimeout(r.Context(), maxRequestDuration)
		defer cancelFunc()

		userId := "u_anon"
		var res *perms.Resource
		var act action.Type
		var err error
		var authzResults *perms.ACLResults

		if r.Method == http.MethodOptions {
			// Don't perform authorization checking for preflight requests, at
			// least for now. We could add it later if we wanted as an action on
			// global or something but likely it would just be enabled/disabled
			// per listener instead.
			goto AUTHZ_FINISHED
		}

		// Perform authz checking
		res, act, err = decorateAuthParams(r)
		if err != nil {
			c.logger.Trace("error reading auth parameters from URL", "url", r.URL.Path, "error", err)
			// Maybe this isn't the best option, but a URL we can't parse from
			// an auth perspective is probably just an invalid URL altogether.
			// Treating it as a bad request can be perceived to be less leaky
			// than a 404.
			w.WriteHeader(http.StatusBadRequest)
			return
		}

		// The resource is only nil with no error if the path is something
		// unauthenticated, e.g. the UI serving path.
		if res != nil {
			authzResults, userId, err = c.performAuthzCheck(ctx, r, res, act)
			if err != nil {
				c.logger.Error("error during authz check", "error", err)
				w.WriteHeader(http.StatusForbidden)
				return
			}
			if userId == "" || !authzResults.Allowed {
				// TODO: Decide whether to remove this
				if disableAuthzFailures {
					c.logger.Info("failed authz info for request", "resource", pretty.Sprint(res), "user_id", userId, "action", act.String())
				} else {
					w.WriteHeader(http.StatusForbidden)
					return
				}
			}
		}

	AUTHZ_FINISHED:
		// Add the user ID to the context
		ctx = context.WithValue(ctx, globals.ContextUserIdValue, userId)
		// Add a size limiter if desired
		if maxRequestSize > 0 {
			ctx = context.WithValue(ctx, "max_request_size", maxRequestSize)
		}
		ctx = context.WithValue(ctx, "original_request_path", r.URL.Path)
		r = r.WithContext(ctx)

		h.ServeHTTP(w, r)
	})
}

func wrapHandlerWithCors(h http.Handler, props HandlerProperties) http.Handler {
	allowedMethods := []string{
		http.MethodDelete,
		http.MethodGet,
		http.MethodOptions,
		http.MethodPost,
		http.MethodPatch,
	}

	allowedOrigins := props.ListenerConfig.CorsAllowedOrigins

	allowedHeaders := append([]string{
		"Content-Type",
		"X-Requested-With",
		"Authorization",
	}, props.ListenerConfig.CorsAllowedHeaders...)

	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
		if !props.ListenerConfig.CorsEnabled {
			h.ServeHTTP(w, req)
			return
		}

		origin := req.Header.Get("Origin")

		if origin == "" {
			// Serve directly
			h.ServeHTTP(w, req)
			return
		}

		// Check origin
		var valid bool
		switch {
		case len(allowedOrigins) == 0:
			// not valid

		case len(allowedOrigins) == 1 && allowedOrigins[0] == "*":
			valid = true

		default:
			valid = strutil.StrListContains(allowedOrigins, origin)
		}
		if !valid {
			w.Header().Set("Content-Type", "application/json")
			w.WriteHeader(http.StatusForbidden)

			err := &api.Error{
				Status: http.StatusForbidden,
				Code:   "origin forbidden",
			}

			enc := json.NewEncoder(w)
			enc.Encode(err)
			return
		}

		if req.Method == http.MethodOptions &&
			!strutil.StrListContains(allowedMethods, req.Header.Get("Access-Control-Request-Method")) {
			w.WriteHeader(http.StatusMethodNotAllowed)
			return
		}

		w.Header().Set("Access-Control-Allow-Origin", origin)
		w.Header().Set("Vary", "Origin")

		// Apply headers for preflight requests
		if req.Method == http.MethodOptions {
			w.Header().Set("Access-Control-Allow-Methods", strings.Join(allowedMethods, ", "))
			w.Header().Set("Access-Control-Allow-Headers", strings.Join(allowedHeaders, ", "))
			w.Header().Set("Access-Control-Max-Age", "300")
			w.WriteHeader(http.StatusNoContent)
			return
		}

		h.ServeHTTP(w, req)
	})
}

func decorateAuthParams(r *http.Request) (*perms.Resource, action.Type, error) {
	if r == nil {
		return nil, action.Unknown, errors.New("decorate auth params: incoming request is nil")
	}

	// Remove trailing and leading slashes
	trimmedPath := strings.Trim(r.URL.Path, "/")
	if !strings.HasPrefix(trimmedPath, "v1") {
		// Don't look for auth params for requests to fetch the UI
		return nil, action.Unknown, nil
	}
	splitPath := strings.Split(strings.TrimPrefix(trimmedPath, "v1"), "/")
	splitLen := len(splitPath)
	if splitLen == 0 {
		return nil, action.Unknown, fmt.Errorf("decorate auth params: invalid path")
	}

	var act action.Type
	var typStr string
	scp := scope.Global
	res := &perms.Resource{
		ScopeId: scope.Global.String(),
	}

	// Handle non-custom types. We'll deal with custom types, including list,
	// after parsing the path.
	switch r.Method {
	case "GET":
		act = action.Read
	case "POST":
		act = action.Create
	case "PATCH":
		act = action.Update
	case "DELETE":
		act = action.Delete
	default:
		return nil, action.Unknown, fmt.Errorf("decorate auth params: unknown method %q", r.Method)
	}

	// Look for a custom action
	colonSplit := strings.Split(splitPath[splitLen-1], ":")
	switch len(colonSplit) {
	case 1:
		// No custom action specified
	case 2:
		actStr := colonSplit[len(colonSplit)-1]
		act = action.Map[actStr]
		if act == action.Unknown || act == action.All {
			return nil, action.Unknown, fmt.Errorf("decorate auth params: unknown action %q", actStr)
		}
		// Keep going with the logic without the custom action
		splitPath[splitLen-1] = colonSplit[0]
	default:
		return nil, action.Unknown, fmt.Errorf("decorate auth params: unexpected number of colons in last segment %q", colonSplit[len(colonSplit)-1])
	}

	// Walk backwards. As we walk backwards we look for scopes and figure out if
	// we're operating on a resource or a collection. We also populate the pin.
	// The rules for the pin are as follows:
	//
	// * If the last segment is a collection, the pin is the immediately
	// preceding ID
	//
	// * If the last segment is an ID, the pin is the immediately preceding ID
	// not including the last segment
	//
	// * If at the end of the logic the pin is the id of a scope ("global",
	// "o_...", "p_...") then there is no pin. The scopes are already enclosing
	// so a pin is redundant.
	nextIdIsPin := true
	for i := splitLen - 1; i >= 0; i-- {
		segment := splitPath[i]

		// Collections don't contain underscores; every resource ID does.
		segmentIsCollection := !strings.Contains(segment, "_")

		if !segmentIsCollection && i != splitLen-1 && nextIdIsPin {
			res.Pin = segment
			nextIdIsPin = false
		}

		// Update the scope. Set it to org only if it's at global (that way we
		// don't override project with org). We have to check if it's one less
		// than the length of the split because operating on the id of a scope
		// is actually in the enclosing scope (since you're in the parent scope
		// operating on a child scope).
		switch segment {
		case "projects":
			if i < splitLen-2 {
				scp = scope.Project
				res.ScopeId = splitPath[i+1]
			}
		case "orgs":
			if scp == scope.Global {
				if i < splitLen-2 {
					scp = scope.Org
					res.ScopeId = splitPath[i+1]
				}
			}
		}

		if segment == "" {
			// This could be the case if we have an action like
			// /orgs/o_1234/projects/p_1234/:set-defaults to act on the project
			// itself but within its own scope
			continue
		}

		if typStr == "" {
			// The resource check takes place inside the type check because if
			// we've identified the type we have either already identified the
			// right-most resource ID or we're operating on a collection, so
			// this prevents us from finding a different ID earlier in the path.
			//
			// We continue on with the enclosing loop anyways though to ensure
			// we find the right scope.
			if res.Id == "" && !segmentIsCollection {
				res.Id = segment
			} else {
				// Every collection is the plural of the resource type so drop
				// the last 's'
				if !strings.HasSuffix(segment, "s") {
					return nil, action.Unknown, fmt.Errorf("decorate auth params: invalid collection syntax for %q", segment)
				}
				typStr = strings.TrimSuffix(segment, "s")
			}
		}
	}

	if typStr != "" {
		res.Type = resource.Map[typStr]
		if res.Type == resource.Unknown {
			return nil, action.Unknown, fmt.Errorf("decorate auth params: unknown resource type %q", typStr)
		}
	} else if res.Id == "" {
		return nil, action.Unknown, errors.New("decorate auth params: id and type both not found")
	}

	// If we're operating on a collection (that is, the ID is blank) and it's a
	// GET, it's actually a list
	if res.Id == "" && act == action.Read {
		act = action.List
	}

	// If the pin ended up being a scope, nil it out
	if res.Pin != "" {
		if res.Pin == "global" ||
			strings.HasPrefix(res.Pin, "o_") ||
			strings.HasPrefix(res.Pin, "p_") {
			res.Pin = ""
		}
	}

	return res, act, nil
}

type tokenFormat int

const (
	authTokenTypeUnknown tokenFormat = iota
	authTokenTypeBearer
	authTokenTypeSplitCookie
)

const (
	headerAuthMethod    = "Authorization"
	httpOnlyCookieName  = "wt-http-token-cookie"
	jsVisibleCookieName = "wt-js-token-cookie"
)

func (c *Controller) performAuthzCheck(ctx context.Context, req *http.Request, res *perms.Resource, act action.Type) (*perms.ACLResults, string, error) {
	userId := "u_anon"

	if res == nil {
		return nil, userId, errors.New("perform authz check: res is nil")
	}
	var receivedTokenType tokenFormat
	var fullToken, token, publicId string

	// First, get the token, either from the authorization header or from split
	// cookies
	{
		if authHeader := req.Header.Get("Authorization"); authHeader != "" {
			headerSplit := strings.SplitN(strings.TrimSpace(authHeader), " ", 2)
			if len(headerSplit) == 2 && strings.EqualFold(strings.TrimSpace(headerSplit[0]), "bearer") {
				receivedTokenType = authTokenTypeBearer
				fullToken = strings.TrimSpace(headerSplit[1])
			}
		}
		if receivedTokenType != authTokenTypeBearer {
			var httpCookiePayload string
			var jsCookiePayload string
			if hc, err := req.Cookie(httpOnlyCookieName); err == nil {
				httpCookiePayload = hc.Value
			}
			if jc, err := req.Cookie(jsVisibleCookieName); err == nil {
				jsCookiePayload = jc.Value
			}
			if httpCookiePayload != "" && jsCookiePayload != "" {
				receivedTokenType = authTokenTypeSplitCookie
				fullToken = jsCookiePayload + httpCookiePayload
			}
		}

		if receivedTokenType == authTokenTypeUnknown || fullToken == "" {
			// We didn't find auth info or a client screwed up and put in a
			// blank header instead of nothing at all, so carry on as the
			// anonymous user
			goto GRANTSLOOKUP
		}

		splitFullToken := strings.Split(fullToken, "_")
		if len(splitFullToken) != 3 {
			return nil, userId, fmt.Errorf("perform authz check: unexpected number of segments in token, expected %d, found %d", 3, len(splitFullToken))
		}

		token = splitFullToken[2]
		publicId = strings.Join(splitFullToken[0:2], "_")

		if receivedTokenType == authTokenTypeUnknown || token == "" || publicId == "" {
			return nil, userId, fmt.Errorf("perform authz check: after parsing, could not find valid token")
		}
	}

	// Validate the token and fetch the corresponding user ID
	{
		tokenRepo, err := c.AuthTokenRepoFn()
		if err != nil {
			return nil, userId, fmt.Errorf("perform authz check: failed to get authtoken repo: %w", err)
		}

		at, err := tokenRepo.ValidateToken(ctx, publicId, token)
		if err != nil {
			return nil, userId, fmt.Errorf("perform authz check: failed to validate token: %w", err)
		}
		if at != nil {
			userId = at.GetIamUserId()
		}
	}

GRANTSLOOKUP:
	var parsedGrants []perms.Grant
	var grantPairs []perms.GrantPair
	// Fetch and parse grants for this user ID
	{
		iamRepo, err := c.IamRepoFn()
		if err != nil {
			return nil, userId, fmt.Errorf("perform authz check: failed to get iam repo: %w", err)
		}
		grantPairs, err = iamRepo.GrantsForUser(ctx, userId)
		if err != nil {
			return nil, userId, fmt.Errorf("perform authz check: failed to query for user grants: %w", err)
		}
		parsedGrants = make([]perms.Grant, 0, len(grantPairs))
		for _, pair := range grantPairs {
			parsed, err := perms.Parse(pair.ScopeId, userId, pair.Grant)
			if err != nil {
				return nil, userId, fmt.Errorf("perform authz check: failed to parse grant %#v: %w", pair.Grant, err)
			}
			parsedGrants = append(parsedGrants, parsed)
		}
	}

	acl := perms.NewACL(parsedGrants...)
	allowed := acl.Allowed(*res, act)
	return &allowed, userId, nil
}

/*
func WrapForwardedForHandler(h http.Handler, authorizedAddrs []*sockaddr.SockAddrMarshaler, rejectNotPresent, rejectNonAuthz bool, hopSkips int) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		headers, headersOK := r.Header[textproto.CanonicalMIMEHeaderKey("X-Forwarded-For")]
		if !headersOK || len(headers) == 0 {
			if !rejectNotPresent {
				h.ServeHTTP(w, r)
				return
			}
			respondError(w, http.StatusBadRequest, fmt.Errorf("missing x-forwarded-for header and configured to reject when not present"))
			return
		}

		host, port, err := net.SplitHostPort(r.RemoteAddr)
		if err != nil {
			// If not rejecting treat it like we just don't have a valid
			// header because we can't do a comparison against an address we
			// can't understand
			if !rejectNotPresent {
				h.ServeHTTP(w, r)
				return
			}
			respondError(w, http.StatusBadRequest, errwrap.Wrapf("error parsing client hostport: {{err}}", err))
			return
		}

		addr, err := sockaddr.NewIPAddr(host)
		if err != nil {
			// We treat this the same as the case above
			if !rejectNotPresent {
				h.ServeHTTP(w, r)
				return
			}
			respondError(w, http.StatusBadRequest, errwrap.Wrapf("error parsing client address: {{err}}", err))
			return
		}

		var found bool
		for _, authz := range authorizedAddrs {
			if authz.Contains(addr) {
				found = true
				break
			}
		}
		if !found {
			// If we didn't find it and aren't configured to reject, simply
			// don't trust it
			if !rejectNonAuthz {
				h.ServeHTTP(w, r)
				return
			}
			respondError(w, http.StatusBadRequest, fmt.Errorf("client address not authorized for x-forwarded-for and configured to reject connection"))
			return
		}

		// At this point we have at least one value and it's authorized

		// Split comma separated ones, which are common. This brings it in line
		// to the multiple-header case.
		var acc []string
		for _, header := range headers {
			vals := strings.Split(header, ",")
			for _, v := range vals {
				acc = append(acc, strings.TrimSpace(v))
			}
		}

		indexToUse := len(acc) - 1 - hopSkips
		if indexToUse < 0 {
			// This is likely an error in either configuration or other
			// infrastructure. We could either deny the request, or we
			// could simply not trust the value. Denying the request is
			// "safer" since if this logic is configured at all there may
			// be an assumption it can always be trusted. Given that we can
			// deny accepting the request at all if it's not from an
			// authorized address, if we're at this point the address is
			// authorized (or we've turned off explicit rejection) and we
			// should assume that what comes in should be properly
			// formatted.
			respondError(w, http.StatusBadRequest, fmt.Errorf("malformed x-forwarded-for configuration or request, hops to skip (%d) would skip before earliest chain link (chain length %d)", hopSkips, len(headers)))
			return
		}

		r.RemoteAddr = net.JoinHostPort(acc[indexToUse], port)
		h.ServeHTTP(w, r)
		return
	})
}
*/