3 files changed, 416 insertions, 0 deletions

diff --git a/app/models/account.go b/app/models/account.go
new file mode 100644
index 0000000..0ae1821
--- /dev/null
+++ b/app/models/account.go
@@ -0,0 +1,115 @@
+package models
+
+import (
+        "context"
+        "fmt"
+        "time"
+
+        "code.crute.us/mcrute/golib/db/mongodb"
+)
+
+const accountCol = "accounts"
+
+type AccountStore interface {
+        List(context.Context) ([]*Account, error)
+        ListForUser(context.Context, *User) ([]*Account, error)
+        Get(context.Context, string) (*Account, error)               // Error on not found
+        GetForUser(context.Context, string, *User) (*Account, error) // Error on not found
+        Put(context.Context, *Account) error
+        Delete(context.Context, *Account) error
+}
+
+type Account struct {
+        ShortName              string `bson:"_id"`
+        AccountType            string
+        AccountNumber          int
+        Name                   string
+        ConsoleSessionDuration time.Duration
+        VaultMaterial          string
+        DefaultRegion          string
+        Users                  []string
+}
+
+func (a *Account) ConsoleSessionDurationSecs() int64 {
+        return int64(a.ConsoleSessionDuration.Seconds())
+}
+
+func (a *Account) CanAccess(u *User) bool {
+        if u.IsAdmin {
+                return true
+        }
+        // Linear search should be fine for now, these lists are pretty small
+        for _, n := range a.Users {
+                if n == u.Username {
+                        return true
+                }
+        }
+        return false
+}
+
+type MongoDbAccountStore struct {
+        Db *mongodb.Mongo
+}
+
+// List returns all accounts in the system.
+func (s *MongoDbAccountStore) List(ctx context.Context) ([]*Account, error) {
+        var out []*Account
+        if err := s.Db.FindAll(ctx, accountCol, &out); err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+// ListForUser returns all accounts for which the user has access. This is the
+// authorized version of List.
+//
+// Note this does not handle the case where a user is an admin but not
+// explicitly listed in the allowed users list for an account. For that case
+// just use List directly.
+func (s *MongoDbAccountStore) ListForUser(ctx context.Context, u *User) ([]*Account, error) {
+        var out []*Account
+        filter := mongodb.AnyInTopLevelArray("Users", u.Username)
+        if err := s.Db.FindAllByFilter(ctx, accountCol, filter, &out); err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (s *MongoDbAccountStore) Get(ctx context.Context, id string) (*Account, error) {
+        var a Account
+        if err := s.Db.FindOneById(ctx, accountCol, id, &a); err != nil {
+                return nil, err
+        }
+        return &a, nil
+}
+
+// GetForUser returns an account if the user has access to this account,
+// otherwise it returns an error. This is the authorized version of Get.
+func (s *MongoDbAccountStore) GetForUser(ctx context.Context, id string, u *User) (*Account, error) {
+        a, err := s.Get(ctx, id)
+        if err != nil {
+                return nil, err
+        }
+
+        if !a.CanAccess(u) {
+                return nil, fmt.Errorf("User does not have access to account")
+        }
+
+        return a, nil
+}
+
+func (s *MongoDbAccountStore) Put(ctx context.Context, a *Account) error {
+        if err := s.Db.ReplaceOneById(ctx, accountCol, a.ShortName, a); err != nil {
+                return err
+        }
+        return nil
+}
+
+func (s *MongoDbAccountStore) Delete(ctx context.Context, a *Account) error {
+        if err := s.Db.DeleteOneById(ctx, accountCol, a.ShortName); err != nil {
+                return err
+        }
+        return nil
+}
+
+var _ AccountStore = (*MongoDbAccountStore)(nil)
diff --git a/app/models/session_key.go b/app/models/session_key.go
new file mode 100644
index 0000000..64ac7e0
--- /dev/null
+++ b/app/models/session_key.go
@@ -0,0 +1,202 @@
+package models
+
+import (
+        "crypto"
+        "crypto/ecdsa"
+        "crypto/elliptic"
+        "crypto/rand"
+        "crypto/x509"
+        "encoding/base64"
+        "encoding/hex"
+        "fmt"
+        "time"
+
+        "go.mongodb.org/mongo-driver/bson"
+)
+
+// SessionKey represents a public and sometimes private key-pair for a user
+// that will be stored on the user's record in the user store. These keys are
+// used for signing authentication JWTs.
+//
+// This object is designed to be serialized to BSON. Other serializations can
+// be added in the future as needed.
+//
+// There are two flavors of this record. A record with a private key (which
+// implies a public key) is a key that the service generated and is used by the
+// service to sign JWTs for the user. The private key is never given to the
+// user. The private key is only used in the CreateToken flow, never the Verify
+// flow. Currently (as of Nov 2021) the application sets a near-future NotAfter
+// date and these get garbage collected. It might be nice to re-use them in the
+// future for a while but it's not all that important.
+//
+// The other flavor of this key will have a public key but no private key.
+// These are service keys. Service keys are given to programmatic actors that
+// need to be able to mint their own JWTs for authentication to the service.
+// For these keys the client will construct their own JWT and sign it with the
+// private key and the service will validate the signature with the public key.
+// These keys (as of Nov 2021) do not expire, though they can be revoked.
+type SessionKey struct {
+        KeyId       string
+        Description string
+        Revoked     *time.Time
+        NotAfter    *time.Time
+        NotBefore   *time.Time
+        PublicKey   crypto.PublicKey
+        PrivateKey  *ecdsa.PrivateKey
+}
+
+func GenerateSessionKey(ttl time.Duration) (*SessionKey, error) {
+        pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+        if err != nil {
+                return nil, err
+        }
+
+        key := make([]byte, 8)
+        if _, err := rand.Read(key); err != nil {
+                return nil, err
+        }
+
+        now := time.Now()
+        notAfter := now.Add(ttl)
+
+        return &SessionKey{
+                KeyId:      hex.EncodeToString(key),
+                Revoked:    nil,
+                NotAfter:   &notAfter,
+                NotBefore:  &now,
+                PublicKey:  pk.Public(),
+                PrivateKey: pk,
+        }, nil
+}
+
+// IsGarbage checks to determine if a key is garbage that should be collected.
+// The definition of garbage is similar to the inversion of the definition of
+// vaild but revoked keys are not considered to be garbage since they may be
+// useful for auditing later. Also keys that are not yet valid are not garbage.
+func (s *SessionKey) IsGarbage() bool {
+        if s.Revoked != nil {
+                return false
+        }
+
+        if s.NotBefore != nil && s.NotBefore.Before(time.Now()) {
+                return false
+        }
+
+        if s.NotAfter != nil && s.NotAfter.After(time.Now()) {
+                return true
+        }
+
+        return false
+}
+
+// IsValid checks the various dates in the SessionKey to verify that they are
+// valid and in-range for use. This should be called before trusting this key
+// for any use.
+func (s *SessionKey) IsValid() bool {
+        if s.Revoked != nil {
+                return false
+        }
+
+        if s.NotBefore != nil && s.NotBefore.Before(time.Now()) {
+                return false
+        }
+
+        if s.NotAfter != nil && s.NotAfter.After(time.Now()) {
+                return false
+        }
+
+        return true
+}
+
+func (s *SessionKey) MarshalBSON() ([]byte, error) {
+        var err error
+        var pub, priv []byte
+
+        if s.PrivateKey != nil {
+                priv, err = x509.MarshalECPrivateKey(s.PrivateKey)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        // If there's a private key and a public key set then just save the private
+        // key. The private key already contains a copy of the public key.
+        if s.PublicKey != nil && s.PrivateKey == nil {
+                pub, err = x509.MarshalPKIXPublicKey(s.PublicKey)
+                if err != nil {
+                        return nil, err
+                }
+        }
+
+        return bson.Marshal(struct {
+                KeyId      string
+                Revoked    *time.Time
+                NotAfter   *time.Time
+                NotBefore  *time.Time
+                PublicKey  string
+                PrivateKey string
+        }{
+                s.KeyId,
+                s.Revoked, s.NotAfter, s.NotBefore,
+                base64.StdEncoding.EncodeToString(pub),
+                base64.StdEncoding.EncodeToString(priv),
+        })
+}
+
+func (s *SessionKey) UnmarshalBSON(d []byte) error {
+        v := struct {
+                KeyId      string
+                Revoked    *time.Time
+                NotAfter   *time.Time
+                NotBefore  *time.Time
+                PublicKey  string
+                PrivateKey string
+        }{}
+        if err := bson.Unmarshal(d, &v); err != nil {
+                return err
+        }
+
+        s.KeyId = v.KeyId
+        s.Revoked = v.Revoked
+        s.NotAfter = v.NotAfter
+        s.NotBefore = v.NotBefore
+
+        if v.PrivateKey != "" {
+                privb, err := base64.StdEncoding.DecodeString(v.PrivateKey)
+                if err != nil {
+                        return err
+                }
+
+                priv, err := x509.ParseECPrivateKey(privb)
+                if err != nil {
+                        return err
+                }
+
+                s.PrivateKey = priv
+                s.PublicKey = priv.Public()
+        }
+
+        // If there was a private key then the public key was already set by
+        // decoding that private key. No need to do this a second time (also it's
+        // rather unlikely that both would be set).
+        if v.PublicKey != "" && s.PublicKey == nil {
+                pubb, err := base64.StdEncoding.DecodeString(v.PublicKey)
+                if err != nil {
+                        return err
+                }
+
+                pubp, err := x509.ParsePKIXPublicKey(pubb)
+                if err != nil {
+                        return err
+                }
+
+                pub, ok := pubp.(*ecdsa.PublicKey)
+                if !ok {
+                        return fmt.Errorf("Failed to convert public key to *ecdsa.PublicKey")
+                }
+
+                s.PublicKey = pub
+        }
+
+        return nil
+}
diff --git a/app/models/user.go b/app/models/user.go
new file mode 100644
index 0000000..0cbd92d
--- /dev/null
+++ b/app/models/user.go
@@ -0,0 +1,99 @@
+package models
+
+import (
+        "context"
+
+        "code.crute.us/mcrute/golib/db/mongodb"
+)
+
+const userCol = "users"
+
+type UserStore interface {
+        List(context.Context) ([]*User, error)
+        Get(context.Context, string) (*User, error) // Error on not found
+        Put(context.Context, *User) error
+        Delete(context.Context, *User) error
+}
+
+type AuthToken struct {
+        Kind         string
+        Token        string
+        RefreshToken string
+}
+
+type User struct {
+        Username   string `bson:"_id"`
+        IsAdmin    bool
+        IsService  bool
+        Keys       map[string]*SessionKey // kid  -> key
+        AuthTokens map[string]*AuthToken  // kind -> token
+}
+
+// GCKeys garbage collects keys that are no longer valid
+func (u *User) GCKeys() {
+        for k, v := range u.Keys {
+                if v.IsGarbage() {
+                        delete(u.Keys, k)
+                }
+        }
+}
+
+// GetKey returns a key for a key ID. It will only return valid keys.
+func (u *User) GetKey(kid string) *SessionKey {
+        if u.Keys != nil {
+                if k := u.Keys[kid]; k != nil && k.IsValid() {
+                        return k
+                }
+        }
+        return nil
+}
+
+func (u *User) AddKey(k *SessionKey) {
+        if u.Keys == nil {
+                u.Keys = map[string]*SessionKey{}
+        }
+        u.Keys[k.KeyId] = k
+}
+
+func (u *User) AddToken(t *AuthToken) {
+        if u.AuthTokens == nil {
+                u.AuthTokens = map[string]*AuthToken{}
+        }
+        u.AuthTokens[t.Kind] = t
+}
+
+type MongoDbUserStore struct {
+        Db *mongodb.Mongo
+}
+
+func (s *MongoDbUserStore) List(ctx context.Context) ([]*User, error) {
+        var out []*User
+        if err := s.Db.FindAll(ctx, userCol, &out); err != nil {
+                return nil, err
+        }
+        return out, nil
+}
+
+func (s *MongoDbUserStore) Get(ctx context.Context, username string) (*User, error) {
+        var u User
+        if err := s.Db.FindOneById(ctx, userCol, username, &u); err != nil {
+                return nil, err
+        }
+        return &u, nil
+}
+
+func (s *MongoDbUserStore) Put(ctx context.Context, u *User) error {
+        if err := s.Db.ReplaceOneById(ctx, userCol, u.Username, u); err != nil {
+                return err
+        }
+        return nil
+}
+
+func (s *MongoDbUserStore) Delete(ctx context.Context, u *User) error {
+        if err := s.Db.DeleteOneById(ctx, userCol, u.Username); err != nil {
+                return err
+        }
+        return nil
+}
+
+var _ UserStore = (*MongoDbUserStore)(nil)