schleuder 3.2.2 → 3.5.2

data/lib/schleuder-api-daemon/helpers/schleuder-api-daemon-helper.rb

@@ -0,0 +1,143 @@
+module SchleuderApiDaemonHelper
+    def valid_credentials?
+      @auth ||=  Rack::Auth::Basic::Request.new(request.env)
+      if @auth.provided? && @auth.basic? && @auth.credentials.present?
+        username, api_key = @auth.credentials
+        username == 'schleuder' && Conf.api_valid_api_keys.include?(api_key)
+      else
+        false
+      end
+    end
+
+    def authenticate!
+      # Be careful to use path_info() — it can be changed by other filters!
+      return if request.path_info == '/status.json'
+      if ! valid_credentials?
+        headers['WWW-Authenticate'] = 'Basic realm="Schleuder API Daemon"'
+        halt 401, "Not authorized\n"
+      end
+    end
+
+    def list(id_or_email=nil)
+      if id_or_email.blank?
+        if params[:list_id].present?
+          id_or_email = params[:list_id]
+        else
+          client_error "Parameter list_id is required"
+        end
+      end
+      if is_an_integer?(id_or_email)
+        list = List.where(id: id_or_email).first
+      else
+        # list_id is actually an email address
+        list = List.where(email: id_or_email).first
+      end
+      list || halt(404)
+    end
+
+    def subscription(id_or_email)
+      if is_an_integer?(id_or_email)
+        sub = Subscription.where(id: id_or_email.to_i).first
+      else
+        # Email
+        if params[:list_id].blank?
+          client_error "Parameter list_id is required when using email as identifier for subscriptions."
+        else
+          sub = list.subscriptions.where(email: id_or_email).first
+        end
+      end
+      sub || halt(404)
+    end
+
+    def requested_list_id
+      # ActiveResource doesn't want to use query-params with create(), so here
+      # list_id might be included in the request-body.
+      params['list_id'] || parsed_body['list_id'] || client_error('Need list_id')
+    end
+
+    def parsed_body
+      @parsed_body ||= begin
+          b = JSON.parse(request.body.read)
+          logger.debug "parsed body: #{b.inspect}"
+          b
+        end
+    end
+
+    def server_error(msg)
+      logger.warn msg
+      halt(500, json(error: msg))
+    end
+
+    # TODO: unify error messages. This method currently sends an old error format. See <https://github.com/rails/activeresource/blob/d6a5186/lib/active_resource/base.rb#L227>.
+    def client_error(obj_or_msg, http_code=400)
+      text = case obj_or_msg
+             when String, Symbol
+               obj_or_msg.to_s
+             when ActiveRecord::Base
+               obj_or_msg.errors.full_messages
+             else
+               obj_or_msg
+             end
+      logger.error "Sending error to client: #{text.inspect}"
+      halt(http_code, json(errors: text))
+    end
+
+    # poor persons type casting
+    def cast_param_values
+      params.each do |key, value|
+        params[key] =
+            case value
+            when 'true' then true
+            when 'false' then false
+            when '0' then 0
+            when is_an_integer?(value) then value.to_i
+            else value
+            end
+      end
+    end
+
+    def key_to_hash(key, include_keydata=false)
+      hash = {
+        fingerprint: key.fingerprint,
+        email: key.email,
+        expiry: key.expires,
+        generated_at: key.generated_at,
+        primary_uid: key.primary_uid.uid,
+        oneline: key.oneline,
+        trust_issues: key.usability_issue
+      }
+      if include_keydata
+        hash[:description] = key.to_s
+        hash[:ascii] = key.armored
+      end
+      hash
+    end
+
+    def set_x_messages(messages)
+      if messages.present?
+        headers 'X-Messages' => Array(messages).join(' // ').gsub(/\n/, ' // ')
+      end
+    end
+
+    def find_key_material
+      key_material = parsed_body['key_material'].presence
+      # By convention key_material is either ASCII or base64-encoded.
+      if key_material && ! key_material.match('BEGIN PGP')
+        key_material = Base64.decode64(key_material)
+      end
+      key_material
+    end
+
+    def find_attributes_from_body(attribs)
+      Array(attribs).inject({}) do |memo, attrib|
+        if parsed_body.has_key?(attrib)
+          memo[attrib] = parsed_body[attrib]
+        end
+        memo
+      end
+    end
+
+    def is_an_integer?(input)
+      input.to_s.match(/^[0-9]+$/).present?
+    end
+end

data/lib/schleuder-api-daemon/routes/key.rb

@@ -0,0 +1,40 @@
+class SchleuderApiDaemon < Sinatra::Base
+  register Sinatra::Namespace
+
+  namespace '/keys' do
+    get '.json' do
+      keys = list.keys.sort_by(&:email).map do |key|
+        key_to_hash(key)
+      end
+      json keys
+    end
+
+    post '.json' do
+      input = parsed_body['keymaterial']
+      if ! input.match('BEGIN PGP')
+        input = Base64.decode64(input)
+      end
+      json list(requested_list_id).import_key(input)
+    end
+
+    get '/check_keys.json' do
+      json result: list.check_keys
+    end
+
+    get '/:fingerprint.json' do |fingerprint|
+      if key = list.key(fingerprint)
+        json key_to_hash(key, true)
+      else
+        404
+      end
+    end
+
+    delete '/:fingerprint.json' do |fingerprint|
+      if list.delete_key(fingerprint)
+        200
+      else
+        404
+      end
+    end
+  end
+end

data/lib/schleuder-api-daemon/routes/list.rb

@@ -0,0 +1,69 @@
+class SchleuderApiDaemon < Sinatra::Base
+  register Sinatra::Namespace
+
+  namespace '/lists' do
+    get '.json' do
+      json List.all, include: :subscriptions
+    end
+
+    post '.json' do
+      listname = parsed_body['email']
+      fingerprint = parsed_body['fingerprint']
+      adminaddress = parsed_body['adminaddress']
+      adminfingerprint = parsed_body['adminfingerprint']
+      adminkey = parsed_body['adminkey']
+      list, messages = ListBuilder.new({email: listname, fingerprint: fingerprint}, adminaddress, adminfingerprint, adminkey).run
+      if list.nil?
+        client_error(messages, 422)
+      elsif ! list.valid?
+        client_error(list, 422)
+      else
+        set_x_messages(messages)
+        body json(list)
+      end
+    end
+
+    get '/configurable_attributes.json' do
+      json(List.configurable_attributes) + "\n"
+    end
+
+    post '/send_list_key_to_subscriptions.json' do
+      json(result: list.send_list_key_to_subscriptions)
+    end
+
+    get '/new.json' do
+      json List.new
+    end
+    
+    get '/:id.json' do |id|
+      json list(id)
+    end
+
+    put '/:id.json' do |id|
+      list = list(id)
+      if list.update(parsed_body)
+        204
+      else
+        client_error(list)
+      end
+    end
+
+    patch '/:id.json' do |id|
+      list = list(id)
+      if list.update(parsed_body)
+        204
+      else
+        client_error(list)
+      end
+    end
+
+    delete '/:id.json' do |id|
+      list = list(id)
+      if list.destroy
+        200
+      else
+        client_error(list)
+      end
+    end
+  end
+end

data/lib/schleuder-api-daemon/routes/status.rb

@@ -0,0 +1,5 @@
+class SchleuderApiDaemon < Sinatra::Base
+  get '/status.json' do
+    json status: :ok
+  end
+end

data/lib/schleuder-api-daemon/routes/subscription.rb

@@ -0,0 +1,99 @@
+class SchleuderApiDaemon < Sinatra::Base
+  register Sinatra::Namespace
+
+  namespace '/subscriptions' do
+    get '.json' do
+      filterkeys = Subscription.configurable_attributes + [:list_id, :email]
+      filter = params.select do |param|
+        filterkeys.include?(param.to_sym)
+      end
+
+      logger.debug "Subscription filter: #{filter.inspect}"
+      if filter['list_id'] && ! is_an_integer?(filter['list_id'])
+        # Value is an email-address
+        if list = List.where(email: filter['list_id']).first
+          filter['list_id'] = list.id
+        else
+          status 404
+          return json(errors: 'No such list')
+        end
+      end
+
+      json Subscription.where(filter)
+    end
+
+    post '.json' do
+      begin
+        list = list(requested_list_id)
+        # We don't have to care about nil-values, subscribe() does that for us.
+        sub, msgs = list.subscribe(
+          parsed_body['email'],
+          parsed_body['fingerprint'],
+          parsed_body['admin'],
+          parsed_body['delivery_enabled'],
+          find_key_material
+        )
+        set_x_messages(msgs)
+        logger.debug "subcription: #{sub.inspect}"
+        if sub.valid?
+          logger.debug "Subscribed: #{sub.inspect}"
+          # TODO: why redirect instead of respond with result?
+          redirect to("/subscriptions/#{sub.id}.json"), 201
+        else
+          client_error(sub, 422)
+        end
+      rescue ActiveRecord::RecordNotUnique
+        logger.error "Already subscribed"
+        status 422
+        json errors: {email: ['is already subscribed']}
+      end
+    end
+
+    get '/configurable_attributes.json' do
+      json(Subscription.configurable_attributes) + "\n"
+    end
+
+    get '/new.json' do
+      json Subscription.new
+    end
+
+    get '/:id.json' do |id|
+      json subscription(id)
+    end
+
+    put '/:id.json' do |id|
+      sub = subscription(id)
+      list = sub.list
+      args = find_attributes_from_body(%w[email fingerprint admin delivery_enabled])
+      fingerprint, messages = list.import_key_and_find_fingerprint(find_key_material)
+      set_x_messages(messages)
+      # For an already existing subscription, only update fingerprint if a
+      # new one has been selected from the upload.
+      if fingerprint.present?
+        args["fingerprint"] = fingerprint
+      end
+      if sub.update(args)
+        200
+      else
+        client_error(sub, 422)
+      end
+    end
+
+    patch '/:id.json' do |id|
+      sub = subscription(id)
+      if sub.update(parsed_body)
+        200
+      else
+        client_error(sub)
+      end
+    end
+
+    delete '/:id.json' do |id|
+      if sub = subscription(id).destroy
+        200
+      else
+        client_error(sub)
+      end
+    end
+  end
+end

data/lib/schleuder-api-daemon/routes/version.rb

@@ -0,0 +1,5 @@
+class SchleuderApiDaemon < Sinatra::Base
+  get '/version.json' do
+    json version: Schleuder::VERSION
+  end
+end

data/lib/schleuder.rb

@@ -1,3 +1,10 @@
+# default to UTF-8 encoding as early as possible for external
+# data.
+#
+# this should ensure we are able to parse most incoming
+# plain text mails in different charsets.
+Encoding.default_external = Encoding::UTF_8
+
 # Stdlib
 require 'fileutils'
 require 'singleton'
@@ -22,6 +29,8 @@ $:.unshift libdir
 # Monkeypatches
 require 'schleuder/mail/parts_list.rb'
 require 'schleuder/mail/message.rb'
+require 'schleuder/mail/gpg.rb'
+require 'schleuder/mail/encrypted_part.rb'
 require 'schleuder/gpgme/import_status.rb'
 require 'schleuder/gpgme/key.rb'
 require 'schleuder/gpgme/sub_key.rb'
@@ -46,9 +55,6 @@ Dir["#{libdir}/schleuder/plugins/*.rb"].each do |file|
   require file
 end
 require 'schleuder/filters_runner'
-Dir["#{libdir}/schleuder/filters/*.rb"].each do |file|
-  require file
-end
 Dir["#{libdir}/schleuder/validators/*.rb"].each do |file|
   require file
 end
@@ -62,6 +68,9 @@ ENV["SCHLEUDER_CONFIG"] ||= '/etc/schleuder/schleuder.yml'
 ENV["SCHLEUDER_LIST_DEFAULTS"] ||= '/etc/schleuder/list-defaults.yml'
 ENV["SCHLEUDER_ENV"] ||= 'production'
 ENV["SCHLEUDER_ROOT"] = rootdir.to_s
+# Ensure that gnupg never-ever tries to ask for a passphrase.
+ENV["GPG_TTY"] = "/nonexistant-#{rand}"
+ENV["DISPLAY"] = nil
 
 GPGME::Ctx.set_gpg_path_from_env
 GPGME::Ctx.check_gpg_version

data/lib/schleuder/cli.rb

@@ -1,6 +1,7 @@
 require 'thor'
 require 'yaml'
 require 'gpgme'
+require 'charlock_holmes'
 
 require_relative '../schleuder'
 require 'schleuder/cli/subcommand_fix'
@@ -62,11 +63,14 @@ module Schleuder
           list.logger.notify_admin(msg, nil, I18n.t('check_keys'))
         end
       end
+      permission_notice
     end
 
     desc 'refresh_keys [list1@example.com]', "Refresh all keys of all list from the keyservers sequentially (one by one or on the passed list). (This is supposed to be run from cron weekly.)"
     def refresh_keys(list=nil)
+      GPGME::Ctx.send_notice_if_gpg_does_not_know_import_filter
       work_on_lists(:refresh_keys,list)
+      permission_notice
     end
 
     desc 'pin_keys [list1@example.com]', "Find keys for subscriptions without a pinned key and try to pin a certain key (one by one or based on the passed list)."
@@ -122,6 +126,7 @@ module Schleuder
       end
 
       say "Schleuder has been set up. You can now create a new list using `schleuder-cli`.\nWe hope you enjoy!"
+      permission_notice
     rescue => exc
       fatal exc.message
     end
@@ -257,6 +262,7 @@ Please notify the users and admins of this list of these changes.
       if messages.present?
         say messages.gsub(' // ', "\n")
       end
+      permission_notice
     rescue => exc
       fatal "#{exc}\n#{exc.backtrace.first}"
     end
@@ -315,11 +321,15 @@ Please notify the users and admins of this list of these changes.
     private
 
     def work_on_lists(subj, list=nil)
-      selected_lists = if list.nil?
-        List.all
+      if list.nil?
+        selected_lists = List.all
       else
-        List.where(email: list)
+        selected_lists = List.where(email: list)
+        if selected_lists.blank?
+          error("No list with this address exists: #{list.inspect}")
+        end
       end
+
       selected_lists.each do |list|
         I18n.locale = list.language
         output = list.send(subj)
@@ -330,5 +340,25 @@ Please notify the users and admins of this list of these changes.
       end
     end
 
+    # Make this class exit with code 1 in case of an error. See <https://github.com/erikhuda/thor/issues/244>.
+    def self.exit_on_failure?
+      true
+    end
+
+    def permission_notice
+      if Process.euid == 0
+        dirs = [Conf.lists_dir, Conf.listlogs_dir]
+        if Conf.database['adapter'] == 'sqlite3'
+          dirs << Conf.database['database']
+        end
+        dirs_sentence = dirs.uniq.map { |dir| enquote(dir) }.to_sentence
+        say "Warning: this process was run as root -- please make sure that all files in #{dirs_sentence} have correct file system permissions for the user that is running both, schleuder from the MTA and `schleuder-api-daemon`."
+      end
+    end
+
+    def enquote(string)
+      "\`#{string}\`"
+    end
+
   end
 end