jcoffey-dev
3f40b36032
The impact panel's data. Every successful sign-in over IMAP, POP3,
ManageSieve or SMTP AUTH records, per account and per protocol, one
timestamp -- nothing else: no address, no IP, no client. It is written at
most once an hour per account and protocol, so a mail app polling every
minute costs a read per sign-in and a write an hour. A record that can't be
written is logged and the sign-in goes ahead.
Both switches serve it as a read-only property, recentLegacyUse, as
wouldClose serves the confirmation: a list of {accountId, name, protocol,
lastUsedAt} for sign-ins in the last 30 days, most recent first.
inbuxa:ProtocolPolicy lists every account; inbuxa:TenantProtocolPolicy
lists only its tenant's own (MT-1). Accounts since deleted are left out. It
is computed only when the property is asked for.
The recording sits where the tenant check already runs once the account is
known, which becomes admit_legacy_session: refuse if the account's tenant
has legacy protocols off, otherwise record. A refused sign-in is never
recorded.
The spec leaves the interface to the implementation; a property on each
switch keeps the panel's data behind the same permission as the switch
itself, with no new object.
Unit tests hold the 30-day window to acceptance test 11 (three days ago
listed, forty not), the hourly throttle and the keys. The e2e proves on a
running server that the admin's IMAP and submission sign-ins are listed
with their time, that a second sign-in within the hour isn't written again,
and that a tenant's list holds its own user and nobody outside the tenant.
All 70 checks pass.
162 lines
6.1 KiB
Rust
162 lines
6.1 KiB
Rust
/*
|
|
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
|
|
*
|
|
* SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
|
|
*
|
|
* Modified by Coffey Labs in 2026 for INBUXA.
|
|
*/
|
|
|
|
use crate::core::{Session, SessionData, State};
|
|
use common::{
|
|
auth::AuthRequest,
|
|
network::{SessionStream, legacy::LegacyProtocol, limiter::LimiterResult},
|
|
};
|
|
use directory::Credentials;
|
|
use imap_proto::{
|
|
Command, ResponseCode, StatusResponse,
|
|
protocol::{authenticate::Mechanism, capability::Capability},
|
|
receiver::{self, Request},
|
|
};
|
|
use mail_parser::decoders::base64::base64_decode;
|
|
use registry::schema::enums::Permission;
|
|
use std::sync::Arc;
|
|
|
|
impl<T: SessionStream> Session<T> {
|
|
pub async fn handle_authenticate(&mut self, request: Request<Command>) -> trc::Result<()> {
|
|
let mut args = request.parse_authenticate()?;
|
|
|
|
match args.mechanism {
|
|
Mechanism::Plain | Mechanism::OAuthBearer | Mechanism::XOauth2 => {
|
|
if !args.params.is_empty() {
|
|
let challenge = base64_decode(args.params.pop().unwrap().as_bytes())
|
|
.ok_or_else(|| {
|
|
trc::AuthEvent::Error
|
|
.into_err()
|
|
.details("Failed to decode challenge.")
|
|
.id(args.tag.clone())
|
|
.code(ResponseCode::Parse)
|
|
})?;
|
|
|
|
let credentials = if args.mechanism == Mechanism::Plain {
|
|
Credentials::decode_sasl_challenge_plain(&challenge)
|
|
} else {
|
|
Credentials::decode_sasl_challenge_oauth(&challenge)
|
|
}
|
|
.ok_or_else(|| {
|
|
trc::AuthEvent::Error
|
|
.into_err()
|
|
.details("Invalid SASL challenge.")
|
|
.id(args.tag.clone())
|
|
})?;
|
|
|
|
self.authenticate(credentials, args.tag).await
|
|
} else {
|
|
self.receiver.request = receiver::Request {
|
|
tag: args.tag,
|
|
command: Command::Authenticate,
|
|
tokens: vec![receiver::Token::Argument(args.mechanism.into_bytes())],
|
|
};
|
|
self.receiver.state = receiver::State::Argument { last_ch: b' ' };
|
|
self.write_bytes(b"+ \r\n".to_vec()).await
|
|
}
|
|
}
|
|
_ => Err(trc::AuthEvent::Error
|
|
.into_err()
|
|
.details("Authentication mechanism not supported.")
|
|
.id(args.tag)
|
|
.code(ResponseCode::Cannot)),
|
|
}
|
|
}
|
|
|
|
pub async fn authenticate(&mut self, credentials: Credentials, tag: String) -> trc::Result<()> {
|
|
// inbuxa: legacy-protocols LP-6, before the password is looked at
|
|
self.server
|
|
.refuse_legacy_sign_in(LegacyProtocol::Imap, &credentials)
|
|
.await
|
|
.map_err(|err| err.code(ResponseCode::Alert).id(tag.clone()))?;
|
|
|
|
// Authenticate
|
|
let access_token = self
|
|
.server
|
|
.authenticate(&AuthRequest::from_credentials(
|
|
credentials,
|
|
self.session_id,
|
|
self.remote_addr,
|
|
))
|
|
.await
|
|
.map_err(|err| {
|
|
if err.matches(trc::EventType::Auth(trc::AuthEvent::Failed)) {
|
|
let auth_failures = self.state.auth_failures();
|
|
if auth_failures < self.server.core.imap.max_auth_failures {
|
|
self.state = State::NotAuthenticated {
|
|
auth_failures: auth_failures + 1,
|
|
};
|
|
} else {
|
|
return trc::AuthEvent::TooManyAttempts.into_err().caused_by(err);
|
|
}
|
|
}
|
|
|
|
err.id(tag.clone())
|
|
})
|
|
.and_then(|token| token.assert_has_permission(Permission::ImapAuthenticate))?;
|
|
|
|
// inbuxa: legacy-protocols LP-10 for a bearer token that named no
|
|
// account, and LP-15: the sign-in is recorded for the impact panel
|
|
self.server
|
|
.admit_legacy_session(LegacyProtocol::Imap, &access_token)
|
|
.await
|
|
.map_err(|err| err.code(ResponseCode::Alert).id(tag.clone()))?;
|
|
|
|
// Enforce concurrency limits
|
|
let in_flight = match access_token.is_imap_request_allowed() {
|
|
LimiterResult::Allowed(in_flight) => Some(in_flight),
|
|
LimiterResult::Forbidden => {
|
|
return Err(trc::LimitEvent::ConcurrentRequest
|
|
.into_err()
|
|
.id(tag.clone()));
|
|
}
|
|
LimiterResult::Disabled => None,
|
|
};
|
|
|
|
// Create session
|
|
self.state = State::Authenticated {
|
|
data: Arc::new(
|
|
SessionData::new(self, access_token, in_flight)
|
|
.await
|
|
.map_err(|err| err.id(tag.clone()))?,
|
|
),
|
|
};
|
|
self.write_bytes(
|
|
StatusResponse::ok("Authentication successful")
|
|
.with_code(ResponseCode::Capability {
|
|
capabilities: Capability::all_capabilities(
|
|
true,
|
|
!self.is_tls && self.instance.acceptor.is_tls(),
|
|
true,
|
|
self.server.core.imap.max_messages_per_command,
|
|
self.server.core.imap.max_messages_per_save,
|
|
),
|
|
})
|
|
.with_tag(tag)
|
|
.into_bytes(),
|
|
)
|
|
.await
|
|
}
|
|
|
|
pub async fn handle_unauthenticate(&mut self, request: Request<Command>) -> trc::Result<()> {
|
|
self.state = State::NotAuthenticated { auth_failures: 0 };
|
|
self.is_condstore = false;
|
|
self.is_qresync = false;
|
|
self.is_utf8 = false;
|
|
self.is_objectid = false;
|
|
self.is_uidonly = false;
|
|
|
|
self.write_bytes(
|
|
StatusResponse::completed(Command::Unauthenticate)
|
|
.with_tag(request.tag)
|
|
.into_bytes(),
|
|
)
|
|
.await
|
|
}
|
|
}
|