SteamWar/WebsiteBackend/src/de/steamwar/routes/v2/Auth.kt

/*
 *   This file is a part of the SteamWar software.
 *
 *   Copyright (C) 2025 SteamWar.de-Serverteam
 *
 *   This program is free software: you can redistribute it and/or modify
 *   it under the terms of the GNU Affero General Public License as published by
 *   the Free Software Foundation, either version 3 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *   GNU Affero General Public License for more details.
 *
 *   You should have received a copy of the GNU Affero General Public License
 *   along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

package de.steamwar.routes.v2

import de.steamwar.ResponseError
import de.steamwar.plugins.SWAuthPrincipal
import de.steamwar.sql.SWException
import de.steamwar.sql.SteamwarUser
import de.steamwar.sql.Token
import de.steamwar.util.TokenType
import de.steamwar.util.isValid
import de.steamwar.util.lifetime
import de.steamwar.util.type
import io.ktor.http.*
import io.ktor.server.application.*
import io.ktor.server.auth.*
import io.ktor.server.plugins.*
import io.ktor.server.request.*
import io.ktor.server.response.*
import io.ktor.server.routing.*
import kotlinx.serialization.Serializable
import java.time.LocalDateTime
import kotlin.time.Duration
import kotlin.time.toJavaDuration

@Serializable
data class UsernamePassword(val name: String, val password: String, val keepLoggedIn: Boolean = false)

@Serializable
data class ResponseToken(val token: String, val expires: String) {
    constructor(token: String, lifetime: Duration) : this(token, LocalDateTime.now().plus(lifetime.toJavaDuration()).toString())
}

@Serializable
data class AuthTokenResponse(val accessToken: ResponseToken, val refreshToken: ResponseToken? = null)

fun SteamwarUser.createAccessAndRefreshToken(keepLoggedIn: Boolean = false): AuthTokenResponse {
    val code = System.currentTimeMillis() % 1000
    val accessToken = Token.createToken("AT-${userName}-${code}", this)
    val refreshToken = if (keepLoggedIn) Token.createToken("RT-${userName}-${code}", this) else null

    return AuthTokenResponse(ResponseToken(accessToken, TokenType.ACCESS_TOKEN.lifetime), refreshToken?.let { ResponseToken(it, TokenType.REFRESH_TOKEN.lifetime) })
}

fun Route.configureNewAuth() {
    route("/auth") {
        route("/enroll") {
            post("/{userId}") {
                if (call.request.headers.contains("X-Forwarded-For") || call.request.header("Host") != "localhost:1337") {
                    SWException.log("Request to /auth/register from", "Invalid IP")
                    call.respond(HttpStatusCode.Forbidden, ResponseError("Invalid IP", "F_U"))
                    return@post
                }

                val userId = call.parameters["userId"]?.toInt()
                if (userId == null) {
                    call.respond(HttpStatusCode.BadRequest, ResponseError("Missing or invalid userId"))
                    return@post
                }

                val user = SteamwarUser.get(userId)
                if (user == null) {
                    call.respond(HttpStatusCode.BadRequest, ResponseError("Invalid userId"))
                    return@post
                }

                val token = Token.createToken("PT-${user.userName}", user)

                call.respond(HttpStatusCode.OK, ResponseToken(token, TokenType.RESET_PASSWORD.lifetime))
            }
        }

        post("/register") {
            val requester = call.request.header("X-Forwarded-For") ?: call.request.origin.remoteAddress

            val request = call.receive<UsernamePassword>()
            val token = call.principal<SWAuthPrincipal>()

            if (token == null || token.token.type != TokenType.RESET_PASSWORD || !token.token.isValid) {
                SWException.log("$requester tried registering with invalid token", "")
                call.respond(HttpStatusCode.Forbidden, ResponseError("Invalid token", "invalid"))
                return@post
            }

            val user = token.user

            if (user.userName != request.name) {
                SWException.log("$requester tried registering for invalid User", """
                        User: ${user.userName}
                        Request: ${request.name}
                    """.trimIndent())
                call.respond(HttpStatusCode.Forbidden, ResponseError("Invalid username", "invalid"))
                return@post
            }

            user.setPassword(request.password)

            call.respond(HttpStatusCode.OK)
        }
        route("/state") {
            post("/create") {
                val request = call.receive<UsernamePassword>()

                val user = SteamwarUser.get(request.name)
                val valid = user?.verifyPassword(request.password) ?: false

                if (!valid) {
                    call.respond(HttpStatusCode.Forbidden, ResponseError("Invalid username or password", "invalid"))
                    return@post
                }

                call.respond(user.createAccessAndRefreshToken(request.keepLoggedIn))
            }
            post("/refresh") {
                val token = call.principal<SWAuthPrincipal>()

                if (token == null || token.token.type != TokenType.REFRESH_TOKEN) {
                    call.respond(HttpStatusCode.Forbidden, ResponseError("Invalid token type", "invalid"))
                    return@post
                }

                val code = token.token.name.substringAfterLast('-')

                Token.listUser(token.user)
                    .filter { it.type == TokenType.ACCESS_TOKEN }
                    .filter { it.name.endsWith(code) }
                    .forEach { it.delete() }

                call.respond(token.user.createAccessAndRefreshToken(true))
            }
        }
    }
}