rubygems-update 2.6.0 → 3.4.22

data/lib/rubygems/gemcutter_utilities/webauthn_poller.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+##
+# The WebauthnPoller class retrieves an OTP after a user successfully WebAuthns. An instance
+# polls the Gem host for the OTP code. The polling request (api/v1/webauthn_verification/<webauthn_token>/status.json)
+# is sent to the Gem host every 5 seconds and will timeout after 5 minutes. If the status field in the json response
+# is "success", the code field will contain the OTP code.
+#
+# Example usage:
+#
+#   thread = Gem::WebauthnPoller.poll_thread(
+#     {},
+#     "RubyGems.org",
+#     "https://rubygems.org/api/v1/webauthn_verification/odow34b93t6aPCdY",
+#     { email: "email@example.com", password: "password" }
+#   )
+#   thread.join
+#   otp = thread[:otp]
+#   error = thread[:error]
+#
+
+module Gem::GemcutterUtilities
+  class WebauthnPoller
+    include Gem::GemcutterUtilities
+    TIMEOUT_IN_SECONDS = 300
+
+    attr_reader :options, :host
+
+    def initialize(options, host)
+      @options = options
+      @host = host
+    end
+
+    def self.poll_thread(options, host, webauthn_url, credentials)
+      Thread.new do
+        thread = Thread.current
+        thread.abort_on_exception = true
+        thread.report_on_exception = false
+        thread[:otp] = new(options, host).poll_for_otp(webauthn_url, credentials)
+      rescue Gem::WebauthnVerificationError, Timeout::Error => e
+        thread[:error] = e
+      end
+    end
+
+    def poll_for_otp(webauthn_url, credentials)
+      Timeout.timeout(TIMEOUT_IN_SECONDS) do
+        loop do
+          response = webauthn_verification_poll_response(webauthn_url, credentials)
+          raise Gem::WebauthnVerificationError, response.message unless response.is_a?(Net::HTTPSuccess)
+
+          require "json"
+          parsed_response = JSON.parse(response.body)
+          case parsed_response["status"]
+          when "pending"
+            sleep 5
+          when "success"
+            return parsed_response["code"]
+          else
+            raise Gem::WebauthnVerificationError, parsed_response.fetch("message", "Invalid response from server")
+          end
+        end
+      end
+    end
+
+    private
+
+    def webauthn_verification_poll_response(webauthn_url, credentials)
+      webauthn_token = %r{(?<=\/)[^\/]+(?=$)}.match(webauthn_url)[0]
+      rubygems_api_request(:get, "api/v1/webauthn_verification/#{webauthn_token}/status.json") do |request|
+        if credentials.empty?
+          request.add_field "Authorization", api_key
+        else
+          request.basic_auth credentials[:email], credentials[:password]
+        end
+      end
+    end
+  end
+end

data/lib/rubygems/gemcutter_utilities.rb

@@ -1,34 +1,52 @@
 # frozen_string_literal: true
-require 'rubygems/remote_fetcher'
+
+require_relative "remote_fetcher"
+require_relative "text"
+require_relative "gemcutter_utilities/webauthn_listener"
+require_relative "gemcutter_utilities/webauthn_poller"
 
 ##
 # Utility methods for using the RubyGems API.
 
 module Gem::GemcutterUtilities
 
-  # TODO: move to Gem::Command
-  OptionParser.accept Symbol do |value|
-    value.to_sym
-  end
+  ERROR_CODE = 1
+  API_SCOPES = %i[index_rubygems push_rubygem yank_rubygem add_owner remove_owner access_webhooks show_dashboard].freeze
+
+  include Gem::Text
 
   attr_writer :host
+  attr_writer :scope
 
   ##
   # Add the --key option
 
   def add_key_option
-    add_option('-k', '--key KEYNAME', Symbol,
-               'Use the given API key',
-               'from ~/.gem/credentials') do |value,options|
+    add_option("-k", "--key KEYNAME", Symbol,
+               "Use the given API key",
+               "from #{Gem.configuration.credentials_path}") do |value,options|
       options[:key] = value
     end
   end
 
+  ##
+  # Add the --otp option
+
+  def add_otp_option
+    add_option("--otp CODE",
+               "Digit code for multifactor authentication",
+               "You can also use the environment variable GEM_HOST_OTP_CODE") do |value, options|
+      options[:otp] = value
+    end
+  end
+
   ##
   # The API key from the command options or from the user's configuration.
 
   def api_key
-    if options[:key] then
+    if ENV["GEM_HOST_API_KEY"]
+      ENV["GEM_HOST_API_KEY"]
+    elsif options[:key]
       verify_api_key options[:key]
     elsif Gem.configuration.api_keys.key?(host)
       Gem.configuration.api_keys[host]
@@ -37,6 +55,13 @@ module Gem::GemcutterUtilities
     end
   end
 
+  ##
+  # The OTP code from the command options or from the user's configuration.
+
+  def otp
+    options[:otp] || ENV["GEM_HOST_OTP_CODE"]
+  end
+
   ##
   # The host to connect to either from the RUBYGEMS_HOST environment variable
   # or from the user's configuration
@@ -47,11 +72,10 @@ module Gem::GemcutterUtilities
 
     @host ||=
       begin
-        env_rubygems_host = ENV['RUBYGEMS_HOST']
-        env_rubygems_host = nil if
-          env_rubygems_host and env_rubygems_host.empty?
+        env_rubygems_host = ENV["RUBYGEMS_HOST"]
+        env_rubygems_host = nil if env_rubygems_host&.empty?
 
-        env_rubygems_host|| configured_host
+        env_rubygems_host || configured_host
       end
   end
 
@@ -60,13 +84,13 @@ module Gem::GemcutterUtilities
   #
   # If +allowed_push_host+ metadata is present, then it will only allow that host.
 
-  def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, &block)
-    require 'net/http'
+  def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)
+    require "net/http"
 
     self.host = host if host
     unless self.host
       alert_error "You must specify a gem server"
-      terminate_interaction 1 # TODO: question this
+      terminate_interaction(ERROR_CODE)
     end
 
     if allowed_push_host
@@ -75,46 +99,89 @@ module Gem::GemcutterUtilities
 
       unless (host_uri.scheme == allowed_host_uri.scheme) && (host_uri.host == allowed_host_uri.host)
         alert_error "#{self.host.inspect} is not allowed by the gemspec, which only allows #{allowed_push_host.inspect}"
-        terminate_interaction 1
+        terminate_interaction(ERROR_CODE)
       end
     end
 
     uri = URI.parse "#{self.host}/#{path}"
+    response = request_with_otp(method, uri, &block)
 
-    request_method = Net::HTTP.const_get method.to_s.capitalize
+    if mfa_unauthorized?(response)
+      fetch_otp(credentials)
+      response = request_with_otp(method, uri, &block)
+    end
+
+    if api_key_forbidden?(response)
+      update_scope(scope)
+      request_with_otp(method, uri, &block)
+    else
+      response
+    end
+  end
+
+  def mfa_unauthorized?(response)
+    response.is_a?(Net::HTTPUnauthorized) && response.body.start_with?("You have enabled multifactor authentication")
+  end
+
+  def update_scope(scope)
+    sign_in_host        = self.host
+    pretty_host         = pretty_host(sign_in_host)
+    update_scope_params = { scope => true }
+
+    say "The existing key doesn't have access of #{scope} on #{pretty_host}. Please sign in to update access."
+
+    email    = ask "   Email: "
+    password = ask_for_password "Password: "
+
+    response = rubygems_api_request(:put, "api/v1/api_key",
+                                    sign_in_host, scope: scope) do |request|
+      request.basic_auth email, password
+      request["OTP"] = otp if otp
+      request.body = URI.encode_www_form({ :api_key => api_key }.merge(update_scope_params))
+    end
 
-    Gem::RemoteFetcher.fetcher.request(uri, request_method, &block)
+    with_response response do |resp|
+      say "Added #{scope} scope to the existing API key"
+    end
   end
 
   ##
   # Signs in with the RubyGems API at +sign_in_host+ and sets the rubygems API
   # key.
 
-  def sign_in sign_in_host = nil
+  def sign_in(sign_in_host = nil, scope: nil)
     sign_in_host ||= self.host
     return if api_key
 
-    pretty_host = if Gem::DEFAULT_HOST == sign_in_host then
-                    'RubyGems.org'
-                  else
-                    sign_in_host
-                  end
+    pretty_host = pretty_host(sign_in_host)
 
     say "Enter your #{pretty_host} credentials."
     say "Don't have an account yet? " +
         "Create one at #{sign_in_host}/sign_up"
 
-    email    =              ask "   Email: "
+    email = ask "   Email: "
     password = ask_for_password "Password: "
     say "\n"
 
-    response = rubygems_api_request(:get, "api/v1/api_key",
-                                    sign_in_host) do |request|
+    key_name     = get_key_name(scope)
+    scope_params = get_scope_params(scope)
+    profile      = get_user_profile(email, password)
+    mfa_params   = get_mfa_params(profile)
+    all_params   = scope_params.merge(mfa_params)
+    warning      = profile["warning"]
+    credentials  = { email: email, password: password }
+
+    say "#{warning}\n" if warning
+
+    response = rubygems_api_request(:post, "api/v1/api_key",
+                                    sign_in_host, credentials: credentials, scope: scope) do |request|
       request.basic_auth email, password
+      request["OTP"] = otp if otp
+      request.body = URI.encode_www_form({ name: key_name }.merge(all_params))
     end
 
     with_response response do |resp|
-      say "Signed in."
+      say "Signed in with API key: #{key_name}."
       set_api_key host, resp.body
     end
   end
@@ -124,11 +191,11 @@ module Gem::GemcutterUtilities
   # an error.
 
   def verify_api_key(key)
-    if Gem.configuration.api_keys.key? key then
+    if Gem.configuration.api_keys.key? key
       Gem.configuration.api_keys[key]
     else
       alert_error "No such API key. Please add it to your configuration (done automatically on initial `gem push`)."
-      terminate_interaction 1 # TODO: question this
+      terminate_interaction(ERROR_CODE)
     end
   end
 
@@ -137,32 +204,169 @@ module Gem::GemcutterUtilities
   # block was given or shows the response body to the user.
   #
   # If the response was not successful, shows an error to the user including
-  # the +error_prefix+ and the response body.
+  # the +error_prefix+ and the response body. If the response was a permanent redirect,
+  # shows an error to the user including the redirect location.
 
-  def with_response response, error_prefix = nil
+  def with_response(response, error_prefix = nil)
     case response
     when Net::HTTPSuccess then
-      if block_given? then
+      if block_given?
         yield response
       else
-        say response.body
+        say clean_text(response.body)
       end
+    when Net::HTTPPermanentRedirect, Net::HTTPRedirection then
+      message = "The request has redirected permanently to #{response["location"]}. Please check your defined push host URL."
+      message = "#{error_prefix}: #{message}" if error_prefix
+
+      say clean_text(message)
+      terminate_interaction(ERROR_CODE)
     else
       message = response.body
       message = "#{error_prefix}: #{message}" if error_prefix
 
-      say message
-      terminate_interaction 1 # TODO: question this
+      say clean_text(message)
+      terminate_interaction(ERROR_CODE)
     end
   end
 
-  def set_api_key host, key
-    if host == Gem::DEFAULT_HOST
+  ##
+  # Returns true when the user has enabled multifactor authentication from
+  # +response+ text and no otp provided by options.
+
+  def set_api_key(host, key)
+    if default_host?
       Gem.configuration.rubygems_api_key = key
     else
       Gem.configuration.set_api_key host, key
     end
   end
 
-end
+  private
+
+  def request_with_otp(method, uri, &block)
+    request_method = Net::HTTP.const_get method.to_s.capitalize
+
+    Gem::RemoteFetcher.fetcher.request(uri, request_method) do |req|
+      req["OTP"] = otp if otp
+      block.call(req)
+    end
+  end
 
+  def fetch_otp(credentials)
+    options[:otp] = if webauthn_url = webauthn_verification_url(credentials)
+      server = TCPServer.new 0
+      port = server.addr[1].to_s
+
+      url_with_port = "#{webauthn_url}?port=#{port}"
+      say "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."
+
+      threads = [WebauthnListener.listener_thread(host, server), WebauthnPoller.poll_thread(options, host, webauthn_url, credentials)]
+      otp_thread = wait_for_otp_thread(*threads)
+
+      threads.each(&:join)
+
+      if error = otp_thread[:error]
+        alert_error error.message
+        terminate_interaction(1)
+      end
+
+      say "You are verified with a security device. You may close the browser window."
+      otp_thread[:otp]
+    else
+      say "You have enabled multi-factor authentication. Please enter OTP code."
+      ask "Code: "
+    end
+  end
+
+  def wait_for_otp_thread(*threads)
+    loop do
+      threads.each do |otp_thread|
+        return otp_thread unless otp_thread.alive?
+      end
+      sleep 0.1
+    end
+  ensure
+    threads.each(&:exit)
+  end
+
+  def webauthn_verification_url(credentials)
+    response = rubygems_api_request(:post, "api/v1/webauthn_verification") do |request|
+      if credentials.empty?
+        request.add_field "Authorization", api_key
+      else
+        request.basic_auth credentials[:email], credentials[:password]
+      end
+    end
+    response.is_a?(Net::HTTPSuccess) ? response.body : nil
+  end
+
+  def pretty_host(host)
+    if default_host?
+      "RubyGems.org"
+    else
+      host
+    end
+  end
+
+  def get_scope_params(scope)
+    scope_params = {}
+
+    if scope
+      scope_params = { scope => true }
+    else
+      say "Please select scopes you want to enable for the API key (y/n)"
+      API_SCOPES.each do |scope|
+        selected = ask_yes_no("#{scope}", false)
+        scope_params[scope] = true if selected
+      end
+      say "\n"
+    end
+
+    scope_params
+  end
+
+  def default_host?
+    self.host == Gem::DEFAULT_HOST
+  end
+
+  def get_user_profile(email, password)
+    return {} unless default_host?
+
+    response = rubygems_api_request(:get, "api/v1/profile/me.yaml") do |request|
+      request.basic_auth email, password
+    end
+
+    with_response response do |resp|
+      Gem::ConfigFile.load_with_rubygems_config_hash(clean_text(resp.body))
+    end
+  end
+
+  def get_mfa_params(profile)
+    mfa_level = profile["mfa"]
+    params = {}
+    if mfa_level == "ui_only" || mfa_level == "ui_and_gem_signin"
+      selected = ask_yes_no("Would you like to enable MFA for this key? (strongly recommended)")
+      params["mfa"] = true if selected
+    end
+    params
+  end
+
+  def get_key_name(scope)
+    hostname = Socket.gethostname || "unknown-host"
+    user = ENV["USER"] || ENV["USERNAME"] || "unknown-user"
+    ts = Time.now.strftime("%Y%m%d%H%M%S")
+    default_key_name = "#{hostname}-#{user}-#{ts}"
+
+    key_name = ask "API Key name [#{default_key_name}]: " unless scope
+    if key_name.nil? || key_name.empty?
+      default_key_name
+    else
+      key_name
+    end
+  end
+
+  def api_key_forbidden?(response)
+    response.is_a?(Net::HTTPForbidden) && response.body.start_with?("The API key doesn't have access")
+  end
+end