itsi-server 0.2.22-aarch64-linux

data/ext/itsi_server/src/server/middleware_stack/middlewares/csp.rs

@@ -0,0 +1,193 @@
+use super::FromValue;
+use crate::{
+    server::http_message_types::{HttpBody, HttpRequest, HttpResponse},
+    services::itsi_http_service::HttpRequestContext,
+};
+use async_trait::async_trait;
+use bytes::{Bytes, BytesMut};
+use either::Either;
+use futures::TryStreamExt;
+use http::{HeaderValue, StatusCode};
+use http_body_util::BodyExt;
+use itsi_error::ItsiError;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use std::{path::PathBuf, sync::OnceLock};
+use tokio::sync::Mutex;
+use tokio::time::{self, Duration};
+use tracing::debug;
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct CspReport {
+    #[serde(rename = "csp-report")]
+    pub report: ReportDetails,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ReportDetails {
+    #[serde(rename = "document-uri")]
+    pub document_uri: String,
+    #[serde(rename = "referrer")]
+    pub referrer: Option<String>,
+    #[serde(rename = "violated-directive")]
+    pub violated_directive: String,
+    #[serde(rename = "original-policy")]
+    pub original_policy: String,
+    #[serde(rename = "blocked-uri")]
+    pub blocked_uri: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CspConfig {
+    pub default_src: Vec<String>,
+    pub script_src: Vec<String>,
+    pub style_src: Vec<String>,
+    pub report_uri: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Csp {
+    pub policy: Option<CspConfig>,
+    pub reporting_enabled: bool,
+    pub report_file: Option<PathBuf>,
+    pub report_endpoint: String,
+    pub flush_interval: f64,
+
+    #[serde(skip)]
+    pub computed_policy: OnceLock<String>,
+    #[serde(skip)]
+    pub pending_reports: Arc<Mutex<Vec<CspReport>>>,
+    #[serde(skip)]
+    pub flush_task: OnceLock<tokio::task::JoinHandle<()>>,
+}
+
+#[async_trait]
+impl super::MiddlewareLayer for Csp {
+    async fn initialize(&self) -> Result<(), magnus::error::Error> {
+        if let Some(policy_config) = &self.policy {
+            let mut parts = Vec::new();
+            if !policy_config.default_src.is_empty() {
+                parts.push(format!(
+                    "default-src {}",
+                    policy_config.default_src.join(" ")
+                ));
+            }
+            if !policy_config.script_src.is_empty() {
+                parts.push(format!("script-src {}", policy_config.script_src.join(" ")));
+            }
+            if !policy_config.style_src.is_empty() {
+                parts.push(format!("style-src {}", policy_config.style_src.join(" ")));
+            }
+            if !policy_config.report_uri.is_empty() {
+                parts.push(format!("report-uri {}", policy_config.report_uri.join(" ")));
+            }
+            let policy = parts.join("; ");
+            debug!(target: "middleware::csp", "Computed CSP policy: {}", policy);
+            self.computed_policy
+                .set(policy)
+                .map_err(|_| ItsiError::new("Failed to set computed CSP policy"))?;
+        }
+
+        if self.reporting_enabled {
+            if let Some(ref report_file) = self.report_file {
+                let flush_interval = self.flush_interval;
+                let report_path = report_file.clone();
+                let pending_reports = Arc::clone(&self.pending_reports);
+                let handle = tokio::spawn(async move {
+                    let mut interval = time::interval(Duration::from_secs_f64(flush_interval));
+                    loop {
+                        interval.tick().await;
+
+                        let mut reports = pending_reports.lock().await;
+                        if !reports.is_empty() {
+                            let mut lines = String::new();
+                            for report in reports.iter() {
+                                if let Ok(line) = serde_json::to_string(report) {
+                                    lines.push_str(&line);
+                                    lines.push('\n');
+                                }
+                            }
+                            reports.clear();
+
+                            debug!("Flushing CSP report to file {:?}", &report_path.display());
+
+                            use tokio::io::AsyncWriteExt;
+
+                            match tokio::fs::OpenOptions::new()
+                                .append(true)
+                                .create(true)
+                                .open(&report_path)
+                                .await
+                            {
+                                Ok(mut file) => {
+                                    if let Err(e) = file.write_all(lines.as_bytes()).await {
+                                        eprintln!("Error writing CSP reports: {:?}", e);
+                                    }
+                                }
+                                Err(e) => {
+                                    eprintln!("Error opening CSP report file: {:?}", e);
+                                }
+                            }
+                        }
+                    }
+                });
+                self.flush_task
+                    .set(handle)
+                    .map_err(|_| ItsiError::new("Failed to set flush task handle"))?;
+            }
+        }
+        Ok(())
+    }
+
+    async fn before(
+        &self,
+        req: HttpRequest,
+        _context: &mut HttpRequestContext,
+    ) -> Result<Either<HttpRequest, HttpResponse>, magnus::error::Error> {
+        if self.reporting_enabled && req.uri().path() == self.report_endpoint {
+            debug!(target: "middleware::csp", "Received CSP report");
+            let full_bytes: Result<Bytes, _> = req
+                .into_body()
+                .into_data_stream()
+                .try_fold(BytesMut::new(), |mut acc, chunk| async move {
+                    acc.extend_from_slice(&chunk);
+                    Ok(acc)
+                })
+                .await
+                .map(|b| b.freeze());
+
+            if let Ok(body_bytes) = full_bytes {
+                if let Ok(report) = serde_json::from_slice::<CspReport>(&body_bytes) {
+                    debug!(target: "middleware::csp", "Report: {:?}", report);
+                    let mut pending = self.pending_reports.lock().await;
+                    pending.push(report);
+                }
+            }
+
+            let mut resp = HttpResponse::new(HttpBody::empty());
+            *resp.status_mut() = StatusCode::NO_CONTENT;
+            return Ok(Either::Right(resp));
+        }
+        Ok(Either::Left(req))
+    }
+
+    async fn after(&self, resp: HttpResponse, _context: &mut HttpRequestContext) -> HttpResponse {
+        if let Some(policy) = self.computed_policy.get() {
+            if !resp.headers().contains_key("Content-Security-Policy") {
+                debug!(target: "middleware::csp", "Adding CSP header");
+                let (mut parts, body) = resp.into_parts();
+                if let Ok(header_value) = HeaderValue::from_str(policy) {
+                    parts
+                        .headers
+                        .insert("Content-Security-Policy", header_value);
+                }
+                return HttpResponse::from_parts(parts, body);
+            } else {
+                debug!(target: "middleware::csp", "CSP header already present");
+            }
+        }
+        resp
+    }
+}
+
+impl FromValue for Csp {}

data/ext/itsi_server/src/server/middleware_stack/middlewares/deny_list.rs

@@ -0,0 +1,64 @@
+use crate::{
+    server::http_message_types::{HttpRequest, HttpResponse, RequestExt},
+    services::itsi_http_service::HttpRequestContext,
+};
+
+use super::{token_source::TokenSource, ErrorResponse, FromValue, MiddlewareLayer};
+use async_trait::async_trait;
+use either::Either;
+use itsi_error::ItsiError;
+use magnus::error::Result;
+use regex::RegexSet;
+use serde::Deserialize;
+use std::{collections::HashMap, sync::OnceLock};
+use tracing::debug;
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct DenyList {
+    #[serde(skip_deserializing)]
+    pub denied_ips: OnceLock<RegexSet>,
+    pub denied_patterns: Vec<String>,
+    pub trusted_proxies: HashMap<String, TokenSource>,
+    #[serde(default = "forbidden_error_response")]
+    pub error_response: ErrorResponse,
+}
+
+fn forbidden_error_response() -> ErrorResponse {
+    ErrorResponse::forbidden()
+}
+
+#[async_trait]
+impl MiddlewareLayer for DenyList {
+    async fn initialize(&self) -> Result<()> {
+        let denied_ips = RegexSet::new(&self.denied_patterns).map_err(ItsiError::new)?;
+        self.denied_ips
+            .set(denied_ips)
+            .map_err(|e| ItsiError::new(format!("Failed to set allowed IPs: {:?}", e)))?;
+        Ok(())
+    }
+
+    async fn before(
+        &self,
+        req: HttpRequest,
+        context: &mut HttpRequestContext,
+    ) -> Result<Either<HttpRequest, HttpResponse>> {
+        let addr = if self.trusted_proxies.contains_key(&context.addr) {
+            let source = self.trusted_proxies.get(&context.addr).unwrap();
+            source.extract_token(&req).unwrap_or(&context.addr)
+        } else {
+            &context.addr
+        };
+        if let Some(denied_ips) = self.denied_ips.get() {
+            if denied_ips.is_match(addr) {
+                debug!(target: "middleware::deny_list", "IP address {} is not allowed", addr);
+                return Ok(Either::Right(
+                    self.error_response
+                        .to_http_response(req.accept().into())
+                        .await,
+                ));
+            }
+        }
+        Ok(Either::Left(req))
+    }
+}
+impl FromValue for DenyList {}

data/ext/itsi_server/src/server/middleware_stack/middlewares/error_response/default_responses.rs

@@ -0,0 +1,188 @@
+use super::{ContentSource, DefaultFormat, ErrorResponse};
+use crate::server::http_message_types::{HttpBody, ResponseFormat};
+use bytes::Bytes;
+
+impl DefaultFormat {
+    pub fn response_for_code(&self, code: u16) -> ContentSource {
+        match self {
+            DefaultFormat::Plaintext => match code {
+                500 => ContentSource::Static("500 Internal Error".into()),
+                404 => ContentSource::Static("404 Not Found".into()),
+                401 => ContentSource::Static("401 Unauthorized".into()),
+                403 => ContentSource::Static("403 Forbidden".into()),
+                413 => ContentSource::Static("413 Payload Too Large".into()),
+                429 => ContentSource::Static("429 Too Many Requests".into()),
+                502 => ContentSource::Static("502 Bad Gateway".into()),
+                503 => ContentSource::Static("503 Service Unavailable".into()),
+                504 => ContentSource::Static("504 Gateway Timeout".into()),
+                _ => ContentSource::Static("Unexpected Error".into()),
+            },
+            DefaultFormat::Html => match code {
+                500 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/500.html").into(),
+                ),
+                404 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/404.html").into(),
+                ),
+                401 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/401.html").into(),
+                ),
+                403 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/403.html").into(),
+                ),
+                413 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/413.html").into(),
+                ),
+                429 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/429.html").into(),
+                ),
+                502 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/502.html").into(),
+                ),
+                503 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/503.html").into(),
+                ),
+                504 => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/504.html").into(),
+                ),
+                _ => ContentSource::Static(
+                    include_str!("../../../../default_responses/html/500.html").into(),
+                ),
+            },
+            DefaultFormat::Json => match code {
+                500 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/500.json").into(),
+                ),
+                404 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/404.json").into(),
+                ),
+                401 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/401.json").into(),
+                ),
+                403 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/403.json").into(),
+                ),
+                413 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/413.json").into(),
+                ),
+                429 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/429.json").into(),
+                ),
+                502 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/502.json").into(),
+                ),
+                503 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/503.json").into(),
+                ),
+                504 => ContentSource::Static(
+                    include_str!("../../../../default_responses/json/504.json").into(),
+                ),
+                _ => ContentSource::Static("Unexpected Error".into()),
+            },
+        }
+    }
+}
+impl ErrorResponse {
+    pub fn fallback_body_for(code: u16, accept: ResponseFormat) -> HttpBody {
+        let source = match accept {
+            ResponseFormat::TEXT => DefaultFormat::Plaintext.response_for_code(code),
+            ResponseFormat::HTML => DefaultFormat::Html.response_for_code(code),
+            ResponseFormat::JSON => DefaultFormat::Json.response_for_code(code),
+            ResponseFormat::UNKNOWN => ContentSource::Inline("Unexpected Error".to_owned()),
+        };
+        match source {
+            ContentSource::Inline(bytes) => HttpBody::full(Bytes::from(bytes)),
+            ContentSource::Static(bytes) => HttpBody::full(bytes),
+            ContentSource::File(_) => HttpBody::full(Bytes::from("Unexpected error")),
+        }
+    }
+    pub fn internal_server_error() -> Self {
+        ErrorResponse {
+            code: 500,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(500)),
+            html: Some(DefaultFormat::Html.response_for_code(500)),
+            json: Some(DefaultFormat::Json.response_for_code(500)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn not_found() -> Self {
+        ErrorResponse {
+            code: 404,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(404)),
+            html: Some(DefaultFormat::Html.response_for_code(404)),
+            json: Some(DefaultFormat::Json.response_for_code(404)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn unauthorized() -> Self {
+        ErrorResponse {
+            code: 401,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(401)),
+            html: Some(DefaultFormat::Html.response_for_code(401)),
+            json: Some(DefaultFormat::Json.response_for_code(401)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn forbidden() -> Self {
+        ErrorResponse {
+            code: 403,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(403)),
+            html: Some(DefaultFormat::Html.response_for_code(403)),
+            json: Some(DefaultFormat::Json.response_for_code(403)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn payload_too_large() -> Self {
+        ErrorResponse {
+            code: 413,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(413)),
+            html: Some(DefaultFormat::Html.response_for_code(413)),
+            json: Some(DefaultFormat::Json.response_for_code(413)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn too_many_requests() -> Self {
+        ErrorResponse {
+            code: 429,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(429)),
+            html: Some(DefaultFormat::Html.response_for_code(429)),
+            json: Some(DefaultFormat::Json.response_for_code(429)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn bad_gateway() -> Self {
+        ErrorResponse {
+            code: 502,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(502)),
+            html: Some(DefaultFormat::Html.response_for_code(502)),
+            json: Some(DefaultFormat::Json.response_for_code(502)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn service_unavailable() -> Self {
+        ErrorResponse {
+            code: 503,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(503)),
+            html: Some(DefaultFormat::Html.response_for_code(503)),
+            json: Some(DefaultFormat::Json.response_for_code(503)),
+            default: DefaultFormat::Html,
+        }
+    }
+
+    pub fn gateway_timeout() -> Self {
+        ErrorResponse {
+            code: 504,
+            plaintext: Some(DefaultFormat::Plaintext.response_for_code(504)),
+            html: Some(DefaultFormat::Html.response_for_code(504)),
+            json: Some(DefaultFormat::Json.response_for_code(504)),
+            default: DefaultFormat::Html,
+        }
+    }
+}

data/ext/itsi_server/src/server/middleware_stack/middlewares/error_response.rs

@@ -0,0 +1,168 @@
+use bytes::Bytes;
+use http::header::CONTENT_TYPE;
+use http::Response;
+use serde::{Deserialize, Deserializer};
+use std::path::PathBuf;
+use tracing::warn;
+
+use crate::server::http_message_types::{HttpBody, HttpResponse, ResponseFormat};
+use crate::services::static_file_server::ROOT_STATIC_FILE_SERVER;
+mod default_responses;
+
+#[derive(Debug, Clone, Deserialize)]
+pub enum ContentSource {
+    #[serde(rename(deserialize = "inline"))]
+    Inline(String),
+    #[serde(rename(deserialize = "file"))]
+    File(PathBuf),
+    #[serde(rename(deserialize = "static"))]
+    #[serde(skip_deserializing)]
+    Static(Bytes),
+}
+
+#[derive(Debug, Clone, Deserialize, Default)]
+pub enum DefaultFormat {
+    #[serde(rename(deserialize = "plaintext"))]
+    Plaintext,
+    #[default]
+    #[serde(rename(deserialize = "html"))]
+    Html,
+    #[serde(rename(deserialize = "json"))]
+    Json,
+}
+
+#[derive(Debug, Clone)]
+pub struct ErrorResponse {
+    pub code: u16,
+    pub plaintext: Option<ContentSource>,
+    pub html: Option<ContentSource>,
+    pub json: Option<ContentSource>,
+    pub default: DefaultFormat, // must match one of the provided fields
+}
+
+impl<'de> Deserialize<'de> for ErrorResponse {
+    fn deserialize<D>(deserializer: D) -> Result<ErrorResponse, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let def = ErrorResponseDef::deserialize(deserializer)?;
+        Ok(def.into())
+    }
+}
+
+/// An untagged enum to support two input formats:
+/// - A detailed struct with all fields.
+/// - A string with the name of a default error response.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(untagged)]
+pub enum ErrorResponseDef {
+    Detailed {
+        code: u16,
+        plaintext: Option<ContentSource>,
+        html: Option<ContentSource>,
+        json: Option<ContentSource>,
+        default: DefaultFormat,
+    },
+    Named(String),
+}
+
+impl From<ErrorResponseDef> for ErrorResponse {
+    fn from(def: ErrorResponseDef) -> Self {
+        match def {
+            ErrorResponseDef::Detailed {
+                code,
+                plaintext,
+                html,
+                json,
+                default,
+            } => ErrorResponse {
+                code,
+                plaintext,
+                html,
+                json,
+                default,
+            },
+            ErrorResponseDef::Named(name) => match name.as_str() {
+                "internal_server_error" => ErrorResponse::internal_server_error(),
+                "not_found" => ErrorResponse::not_found(),
+                "unauthorized" => ErrorResponse::unauthorized(),
+                "forbidden" => ErrorResponse::forbidden(),
+                "payload_too_large" => ErrorResponse::payload_too_large(),
+                "too_many_requests" => ErrorResponse::too_many_requests(),
+                "bad_gateway" => ErrorResponse::bad_gateway(),
+                "service_unavailable" => ErrorResponse::service_unavailable(),
+                "gateway_timeout" => ErrorResponse::gateway_timeout(),
+                _ => {
+                    warn!(
+                        "Unknown error response name: {}. Using internal server error.",
+                        name
+                    );
+                    ErrorResponse::internal_server_error()
+                }
+            },
+        }
+    }
+}
+
+impl ErrorResponse {
+    pub(crate) async fn to_http_response(&self, accept: ResponseFormat) -> HttpResponse {
+        let mut resp = Response::builder().status(self.code);
+        let response = match accept {
+            ResponseFormat::TEXT => {
+                resp = resp.header(CONTENT_TYPE, "text/plain");
+                resp.body(Self::get_response_body(self.code, &self.plaintext, accept).await)
+            }
+            ResponseFormat::HTML => {
+                resp = resp.header(CONTENT_TYPE, "text/html");
+                resp.body(Self::get_response_body(self.code, &self.html, accept).await)
+            }
+            ResponseFormat::JSON => {
+                resp = resp.header(CONTENT_TYPE, "application/json");
+                resp.body(Self::get_response_body(self.code, &self.json, accept).await)
+            }
+            ResponseFormat::UNKNOWN => match self.default {
+                DefaultFormat::Plaintext => {
+                    resp = resp.header(CONTENT_TYPE, "text/plain");
+                    resp.body(Self::get_response_body(self.code, &self.plaintext, accept).await)
+                }
+                DefaultFormat::Html => {
+                    resp = resp.header(CONTENT_TYPE, "text/html");
+                    resp.body(Self::get_response_body(self.code, &self.html, accept).await)
+                }
+                DefaultFormat::Json => {
+                    resp = resp.header(CONTENT_TYPE, "application/json");
+                    resp.body(Self::get_response_body(self.code, &self.json, accept).await)
+                }
+            },
+        };
+        response.unwrap()
+    }
+
+    async fn get_response_body(
+        code: u16,
+        source: &Option<ContentSource>,
+        accept: ResponseFormat,
+    ) -> HttpBody {
+        match source {
+            Some(ContentSource::Inline(text)) => {
+                return HttpBody::full(Bytes::from(text.clone()));
+            }
+            Some(ContentSource::Static(text)) => {
+                return HttpBody::full(text.clone());
+            }
+            Some(ContentSource::File(path)) => {
+                // Convert the PathBuf to a &str (assumes valid UTF-8).
+                if let Some(path_str) = path.to_str() {
+                    let response = ROOT_STATIC_FILE_SERVER
+                        .serve_single(path_str, accept, &[])
+                        .await;
+                    if response.status().is_success() {
+                        return response.into_body();
+                    }
+                }
+            }
+            None => {}
+        }
+        ErrorResponse::fallback_body_for(code, accept)
+    }
+}