magic token login

backend/src/routes/auth.rs

@@ -25,10 +25,13 @@ use crate::{
         AuthenticatedUser,
     },
     error::{AppError, AppResult},
-    models::{NewRefreshToken, NewUser, RefreshToken, Tenant, TenantStatus, User, UserMembership},
+    models::{
+        MagicToken, MagicTokenKind, NewRefreshToken, NewUser, RefreshToken, Tenant, TenantStatus,
+        User, UserMembership,
+    },
     schema::{
-        refresh_tokens, tenants::dsl as tenant_dsl, user_memberships::dsl as memberships_dsl,
-        user_passkeys::dsl as passkey_dsl, users::dsl,
+        magic_tokens::dsl as magic_dsl, refresh_tokens, tenants::dsl as tenant_dsl,
+        user_memberships::dsl as memberships_dsl, user_passkeys::dsl as passkey_dsl, users::dsl,
     },
     state::AppState,
 };
@@ -40,8 +43,14 @@ const REFRESH_COOKIE_NAME: &str = "refresh_token";
 
 #[derive(Deserialize, ToSchema)]
 pub struct LoginRequest {
+    #[serde(default)]
     pub username: String,
-    pub password: String,
+    #[serde(default)]
+    #[schema(nullable)]
+    pub password: Option<String>,
+    #[serde(default)]
+    #[schema(nullable)]
+    pub magic_token: Option<String>,
     #[serde(default)]
     #[schema(nullable)]
     pub preferred_tenant_id: Option<Uuid>,
@@ -152,10 +161,41 @@ pub struct AuthApiDoc;
     ),
     tag = "Auth"
 )]
-pub async fn login(_state: State<AppState>, _payload: Json<LoginRequest>) -> AppResult<Response> {
-    Err(AppError::bad_request(
-        "password authentication is no longer supported",
-    ))
+pub async fn login(
+    State(state): State<AppState>,
+    Json(payload): Json<LoginRequest>,
+) -> AppResult<Response> {
+    let magic_token = payload
+        .magic_token
+        .as_ref()
+        .map(|value| value.trim())
+        .filter(|value| !value.is_empty());
+
+    if magic_token.is_none() {
+        if payload.password.is_some() {
+            return Err(AppError::bad_request(
+                "password authentication is no longer supported",
+            ));
+        }
+
+        return Err(AppError::bad_request(
+            "magic_token is required for passwordless login",
+        ));
+    }
+
+    let token_value = magic_token.unwrap();
+
+    let mut conn = state.db_unscoped()?;
+    let username_hint = payload.username.trim();
+    let preferred_tenant_id = payload.preferred_tenant_id;
+
+    magic_token_login(
+        &state,
+        &mut conn,
+        token_value,
+        (!username_hint.is_empty()).then_some(username_hint),
+        preferred_tenant_id,
+    )
 }
 
 #[utoipa::path(
@@ -644,6 +684,63 @@ fn complete_login(
     .into_response())
 }
 
+fn magic_token_login(
+    state: &AppState,
+    conn: &mut PgConnection,
+    token_value: &str,
+    username_hint: Option<&str>,
+    preferred_tenant_id: Option<Uuid>,
+) -> AppResult<Response> {
+    if token_value.is_empty() {
+        return Err(AppError::bad_request("magic_token must not be empty"));
+    }
+
+    let token_hash = hash_magic_token(token_value);
+    let now = Utc::now();
+    let now_naive = now.naive_utc();
+
+    conn.transaction::<Response, AppError, _>(|conn| {
+        let magic = magic_dsl::magic_tokens
+            .filter(magic_dsl::token_hash.eq(&token_hash))
+            .filter(magic_dsl::expires_at.gt(now_naive))
+            .first::<MagicToken>(conn)
+            .map_err(|err| match err {
+                diesel::result::Error::NotFound => AppError::unauthorized(),
+                _ => AppError::from(err),
+            })?;
+
+        if let Some(limit) = magic.max_uses {
+            if magic.used_count >= limit {
+                return Err(AppError::unauthorized());
+            }
+        }
+
+        match magic.kind {
+            MagicTokenKind::EmailLogin | MagicTokenKind::DemoLogin => {}
+        }
+
+        let user: User = dsl::users
+            .find(magic.user_id)
+            .first(conn)
+            .map_err(AppError::from)?;
+
+        if let Some(expected) = username_hint {
+            if expected != user.username {
+                return Err(AppError::unauthorized());
+            }
+        }
+
+        diesel::update(magic_dsl::magic_tokens.filter(magic_dsl::id.eq(magic.id)))
+            .set((
+                magic_dsl::used_count.eq(magic.used_count + 1),
+                magic_dsl::last_used_at.eq(Some(now_naive)),
+            ))
+            .execute(conn)?;
+
+        complete_login(state, conn, &user, preferred_tenant_id)
+    })
+}
+
 fn issue_session(
     state: &AppState,
     conn: &mut PgConnection,
@@ -704,6 +801,10 @@ fn hash_refresh_token(token: &str) -> String {
     hex::encode(hasher.finalize())
 }
 
+fn hash_magic_token(token: &str) -> String {
+    hash_refresh_token(token)
+}
+
 fn generate_refresh_token() -> String {
     let mut bytes = [0u8; 32];
     OsRng.fill_bytes(&mut bytes);