Implemented key rotation with the latest vault

4 files changed, 100 insertions, 27 deletions

diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index aad95d15..ce8572b7 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -1,15 +1,15 @@
 use rocket_contrib::json::Json;
 
-use db::DbConn;
 use db::models::*;
+use db::DbConn;
 
-use api::{PasswordData, JsonResult, EmptyResult, JsonUpcase, NumberOrString};
+use api::{EmptyResult, JsonResult, JsonUpcase, NumberOrString, PasswordData, UpdateType, WebSocketUsers};
 use auth::Headers;
 use mail;
 
 use CONFIG;
 
-use rocket::Route;
+use rocket::{Route, State};
 
 pub fn routes() -> Vec<Route> {
     routes![
@@ -21,6 +21,7 @@ pub fn routes() -> Vec<Route> {
         post_keys,
         post_password,
         post_kdf,
+        post_rotatekey,
         post_sstamp,
         post_email_token,
         post_email,
@@ -56,23 +57,22 @@ struct KeysData {
 fn register(data: JsonUpcase<RegisterData>, conn: DbConn) -> EmptyResult {
     let data: RegisterData = data.into_inner().data;
 
-
     let mut user = match User::find_by_mail(&data.Email, &conn) {
-        Some(mut user) => {
+        Some(user) => {
             if Invitation::take(&data.Email, &conn) {
                 for mut user_org in UserOrganization::find_invited_by_user(&user.uuid, &conn).iter_mut() {
                     user_org.status = UserOrgStatus::Accepted as i32;
                     if user_org.save(&conn).is_err() {
                         err!("Failed to accept user to organization")
                     }
-                };
+                }
                 user
             } else if CONFIG.signups_allowed {
-                 err!("Account with this email already exists")
+                err!("Account with this email already exists")
             } else {
-                 err!("Registration not allowed")
+                err!("Registration not allowed")
             }
-        },
+        }
         None => {
             if CONFIG.signups_allowed || Invitation::take(&data.Email, &conn) {
                 User::new(data.Email)
@@ -109,7 +109,7 @@ fn register(data: JsonUpcase<RegisterData>, conn: DbConn) -> EmptyResult {
 
     match user.save(&conn) {
         Ok(()) => Ok(()),
-        Err(_) => err!("Failed to save user")
+        Err(_) => err!("Failed to save user"),
     }
 }
 
@@ -122,7 +122,7 @@ fn profile(headers: Headers, conn: DbConn) -> JsonResult {
 #[allow(non_snake_case)]
 struct ProfileData {
     #[serde(rename = "Culture")]
-    _Culture: String,  // Ignored, always use en-US
+    _Culture: String, // Ignored, always use en-US
     MasterPasswordHint: Option<String>,
     Name: String,
 }
@@ -145,7 +145,7 @@ fn post_profile(data: JsonUpcase<ProfileData>, headers: Headers, conn: DbConn) -
     };
     match user.save(&conn) {
         Ok(()) => Ok(Json(user.to_json(&conn))),
-        Err(_) => err!("Failed to save user profile")
+        Err(_) => err!("Failed to save user profile"),
     }
 }
 
@@ -153,7 +153,7 @@ fn post_profile(data: JsonUpcase<ProfileData>, headers: Headers, conn: DbConn) -
 fn get_public_keys(uuid: String, _headers: Headers, conn: DbConn) -> JsonResult {
     let user = match User::find_by_uuid(&uuid, &conn) {
         Some(user) => user,
-        None => err!("User doesn't exist")
+        None => err!("User doesn't exist"),
     };
 
     Ok(Json(json!({
@@ -174,12 +174,10 @@ fn post_keys(data: JsonUpcase<KeysData>, headers: Headers, conn: DbConn) -> Json
 
     match user.save(&conn) {
         Ok(()) => Ok(Json(user.to_json(&conn))),
-        Err(_) => err!("Failed to save the user's keys")
+        Err(_) => err!("Failed to save the user's keys"),
     }
 }
 
-    
-
 #[derive(Deserialize)]
 #[allow(non_snake_case)]
 struct ChangePassData {
@@ -201,7 +199,7 @@ fn post_password(data: JsonUpcase<ChangePassData>, headers: Headers, conn: DbCon
     user.key = data.Key;
     match user.save(&conn) {
         Ok(()) => Ok(()),
-        Err(_) => err!("Failed to save password")
+        Err(_) => err!("Failed to save password"),
     }
 }
 
@@ -231,10 +229,86 @@ fn post_kdf(data: JsonUpcase<ChangeKdfData>, headers: Headers, conn: DbConn) ->
     user.key = data.Key;
     match user.save(&conn) {
         Ok(()) => Ok(()),
-        Err(_) => err!("Failed to save password settings")
+        Err(_) => err!("Failed to save password settings"),
     }
 }
 
+#[derive(Deserialize)]
+#[allow(non_snake_case)]
+struct UpdateFolderData {
+    Id: String,
+    Name: String,
+}
+
+use super::ciphers::CipherData;
+
+#[derive(Deserialize)]
+#[allow(non_snake_case)]
+struct KeyData {
+    Ciphers: Vec<CipherData>,
+    Folders: Vec<UpdateFolderData>,
+    Key: String,
+    PrivateKey: String,
+    MasterPasswordHash: String,
+}
+
+#[post("/accounts/key", data = "<data>")]
+fn post_rotatekey(data: JsonUpcase<KeyData>, headers: Headers, conn: DbConn, ws: State<WebSocketUsers>) -> EmptyResult {
+    let data: KeyData = data.into_inner().data;
+
+    if !headers.user.check_valid_password(&data.MasterPasswordHash) {
+        err!("Invalid password")
+    }
+
+    let user_uuid = &headers.user.uuid;
+
+    // Update folder data
+    for folder_data in data.Folders {
+        let mut saved_folder = match Folder::find_by_uuid(&folder_data.Id, &conn) {
+            Some(folder) => folder,
+            None => err!("Folder doesn't exist"),
+        };
+
+        if &saved_folder.user_uuid != user_uuid {
+            err!("The folder is not owned by the user")
+        }
+
+        saved_folder.name = folder_data.Name;
+        if saved_folder.save(&conn).is_err() {
+            err!("Failed to save folder")
+        }
+    }
+
+    // Update cipher data
+    use super::ciphers::update_cipher_from_data;
+
+    for cipher_data in data.Ciphers {
+        let mut saved_cipher = match Cipher::find_by_uuid(cipher_data.Id.as_ref().unwrap(), &conn) {
+            Some(cipher) => cipher,
+            None => err!("Cipher doesn't exist"),
+        };
+
+        if saved_cipher.user_uuid.as_ref().unwrap() != user_uuid {
+            err!("The cipher is not owned by the user")
+        }
+
+        update_cipher_from_data(&mut saved_cipher, cipher_data, &headers, false, &conn, &ws, UpdateType::SyncCipherUpdate)?
+    }
+
+    // Update user data
+    let mut user = headers.user;
+
+    user.key = data.Key;
+    user.private_key = Some(data.PrivateKey);
+    user.reset_security_stamp();
+
+    if user.save(&conn).is_err() {
+        err!("Failed modify user key");
+    }
+
+    Ok(())
+}
+
 #[post("/accounts/security-stamp", data = "<data>")]
 fn post_sstamp(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> EmptyResult {
     let data: PasswordData = data.into_inner().data;
@@ -247,7 +321,7 @@ fn post_sstamp(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -
     user.reset_security_stamp();
     match user.save(&conn) {
         Ok(()) => Ok(()),
-        Err(_) => err!("Failed to reset security stamp")
+        Err(_) => err!("Failed to reset security stamp"),
     }
 }
 
@@ -278,7 +352,7 @@ fn post_email_token(data: JsonUpcase<EmailTokenData>, headers: Headers, conn: Db
 struct ChangeEmailData {
     MasterPasswordHash: String,
     NewEmail: String,
-    
+
     Key: String,
     NewMasterPasswordHash: String,
     #[serde(rename = "Token")]
@@ -299,13 +373,13 @@ fn post_email(data: JsonUpcase<ChangeEmailData>, headers: Headers, conn: DbConn)
     }
 
     user.email = data.NewEmail;
-    
+
     user.set_password(&data.NewMasterPasswordHash);
     user.key = data.Key;
 
     match user.save(&conn) {
         Ok(()) => Ok(()),
-        Err(_) => err!("Failed to save email address")
+        Err(_) => err!("Failed to save email address"),
     }
 }
 
@@ -322,10 +396,10 @@ fn delete_account(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn
     if !user.check_valid_password(&data.MasterPasswordHash) {
         err!("Invalid password")
     }
-    
+
     match user.delete(&conn) {
         Ok(()) => Ok(()),
-        Err(_) => err!("Failed deleting user account, are you the only owner of some organization?")
+        Err(_) => err!("Failed deleting user account, are you the only owner of some organization?"),
     }
 }
 
diff --git a/src/api/core/ciphers.rs b/src/api/core/ciphers.rs
index ef5414d9..f812babc 100644
--- a/src/api/core/ciphers.rs
+++ b/src/api/core/ciphers.rs
@@ -136,7 +136,7 @@ fn get_cipher_details(uuid: String, headers: Headers, conn: DbConn) -> JsonResul
 #[allow(non_snake_case)]
 pub struct CipherData {
     // Id is optional as it is included only in bulk share
-    Id: Option<String>,
+    pub Id: Option<String>,
     // Folder id is not included in import
     FolderId: Option<String>,
     // TODO: Some of these might appear all the time, no need for Option
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 1e6f88b7..c958a516 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -97,7 +97,6 @@ impl User {
         self.password_hash = crypto::hash_password(password.as_bytes(),
                                                    &self.salt,
                                                    self.password_iterations as u32);
-        self.reset_security_stamp();
     }
 
     pub fn reset_security_stamp(&mut self) {
diff --git a/src/main.rs b/src/main.rs
index b7eca415..560d77c3 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,4 +1,4 @@
-#![feature(proc_macro_hygiene, decl_macro, custom_derive, vec_remove_item, try_trait)]
+#![feature(proc_macro_hygiene, decl_macro, custom_derive, vec_remove_item, try_trait, nll)]
 #![recursion_limit="128"]
 #![allow(proc_macro_derive_resolution_fallback)] // TODO: Remove this when diesel update fixes warnings