Module: Msf::WebServices::AuthServlet

Defined in:
lib/msf/core/web_services/servlet/auth_servlet.rb

Class Method Summary collapse

Class Method Details

.api_account_path ⇒ Object 



7
8
9
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 7

def self.
  "#{self.api_path}/account"
end

.api_generate_token_path ⇒ Object 



19
20
21
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 19

def self.api_generate_token_path
  "#{self.api_path}/generate-token"
end

.api_login_path ⇒ Object 



11
12
13
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 11

def self.
  "#{self.api_path}/login"
end

.api_logout_path ⇒ Object 



15
16
17
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 15

def self.api_logout_path
  "#{self.api_path}/logout"
end

.api_path ⇒ Object 



3
4
5
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 3

def self.api_path
  '/api/v1/auth'
end

.api_unauthenticated_path ⇒ Object 



23
24
25
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 23

def self.api_unauthenticated_path
  "#{self.api_path}/unauthenticated"
end

.get_api_account ⇒ Object

Get account page



43
44
45
46
47
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 43

def self.
  lambda {
    erb :'auth/account'
  }
end

.get_login ⇒ Object

Get login page



50
51
52
53
54
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 50

def self.
  lambda {
    erb :'auth/login'
  }
end

.get_logout ⇒ Object

Process user log out



70
71
72
73
74
75
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 70

def self.get_logout
  lambda {
    warden.logout
    redirect Msf::WebServices::AuthServlet.
  }
end

.post_generate_token ⇒ Object

Generate a new API token for the current user



78
79
80
81
82
83
84
85
86
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 78

def self.post_generate_token
  lambda {
    # change action to drop the scope param since this is used
    # by XMLHttpRequest (XHR) and we don't want a redirect
    warden.authenticate!(scope: :user, action: Msf::WebServices::AuthServlet.api_unauthenticated_path)
    token = get_db.create_new_user_token(id: warden.user(:user).id, token_length: 40)
    set_json_data_response(response: {message: "Generated new API token.", token: token})
  }
end

.post_login ⇒ Object

Process login request



57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 57

def self.
  lambda {
    warden.authenticate!(scope: :user)

    if session[:return_to].nil? || session[:return_to] == Msf::WebServices::AuthServlet.
      redirect Msf::WebServices::AuthServlet.
    else
      redirect session[:return_to]
    end
  }
end

.post_unauthenticated ⇒ Object

Handle the unauthenticated action for multiple scopes



89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 89

def self.post_unauthenticated
  lambda {
    if !params['scope'].nil? && params['scope'] == 'user'
      session[:return_to] = warden_options[:attempted_path] if session[:return_to].nil?
      redirect Msf::WebServices::AuthServlet.
    end

    msg = warden_options[:message]
    code = warden_options[:code] || 401
    error = {
      code: code,
      message: "#{!msg.nil? ? "#{msg} " : nil}Authenticate to access this resource."
    }
    set_json_error_response(response: error, code: error[:code])
  }
end

.registered(app) ⇒ Object 



27
28
29
30
31
32
33
34
35
36
 
# File 'lib/msf/core/web_services/servlet/auth_servlet.rb', line 27

def self.registered(app)
  app.get self., &

  app.get self., &
  app.post self., &

  app.get self.api_logout_path, &get_logout
  app.post self.api_generate_token_path, &post_generate_token
  app.post "#{self.api_unauthenticated_path}/?:scope?", &post_unauthenticated
end