nils/papercrate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tenant gate active

Browse Source
This commit is contained in:
nils
2025-11-11 02:45:05 +01:00
parent ac9e688e7a
commit 4f29ff73c6
12 changed files with 168 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/auth/mod.rs
+16 -3
View File
@@ -7,7 +7,10 @@ pub mod password;
use std::sync::{Arc, Mutex};
use axum::{extract::FromRequestParts, http::request::Parts};
use axum::{
extract::FromRequestParts,
http::{request::Parts, StatusCode},
};
use axum_extra::headers::{authorization::Bearer, Authorization};
use axum_extra::TypedHeader;
use serde::{Deserialize, Serialize};
@@ -15,8 +18,8 @@ use utoipa::ToSchema;
use crate::{
auth::capability_sets::{load_capabilities_for_set, load_capability_set},
error::AppError,
models::ApiCapability,
error::{AppError, AppResult},
models::{ApiCapability, TenantStatus},
state::{AppState, PgPooledConnection},
};
use uuid::Uuid;
@@ -133,6 +136,8 @@ impl FromRequestParts<AppState> for TenantScopedConn {
async move {
let user = AuthenticatedUser::from_request_parts(parts, &state).await?;
let tenant_id = user.tenant_id;
ensure_active_tenant(&state, tenant_id)?;
let conn = if let Some(holder) = parts.extensions.remove::<TenantConnectionHolder>() {
holder
.into_conn()
@@ -150,3 +155,11 @@ impl FromRequestParts<AppState> for TenantScopedConn {
}
}
}
pub(crate) fn ensure_active_tenant(state: &AppState, tenant_id: Uuid) -> AppResult<()> {
let tenant = state.tenants.get_by_id(tenant_id)?;
if tenant.status != TenantStatus::Active {
return Err(AppError::new(StatusCode::FORBIDDEN, "tenant is not active"));
}
Ok(())
}
backend/src/error.rs
+7 -1
View File
@@ -5,7 +5,7 @@ use axum::{
};
use serde::Serialize;
use serde_json::Value;
use std::fmt::Display;
use std::fmt::{self, Display};
use utoipa::ToSchema;
pub type AppResult<T> = Result<T, AppError>;
@@ -59,6 +59,12 @@ impl AppError {
}
}
impl fmt::Display for AppError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
write!(f, "{}: {}", self.status, self.message)
}
}
impl IntoResponse for AppError {
fn into_response(self) -> Response {
let status = self.status;
backend/src/jobs.rs
-1
View File
@@ -18,7 +18,6 @@ pub const STATUS_FAILED: &str = "failed";
pub const JOB_ANALYZE_DOCUMENT: &str = "analyze-document";
pub const JOB_GENERATE_THUMBNAILS: &str = "generate-thumbnails";
pub const JOB_GENERATE_OCR_TEXT: &str = "generate-ocr-text";
pub const JOB_INDEX_DOCUMENT_TEXT: &str = "index-document-text";
pub const JOB_PROVISION_TENANT: &str = "provision-tenant";
pub const JOB_PURGE_DOCUMENT: &str = "purge-document";
backend/src/routes/documents.rs
+3 -1
View File
@@ -14,7 +14,7 @@ use tracing::{error, info};
use utoipa::{IntoParams, ToSchema};
use uuid::Uuid;
use crate::auth::{jwt::DownloadSubject, TenantScopedConn};
use crate::auth::{ensure_active_tenant, jwt::DownloadSubject, TenantScopedConn};
use crate::documents::asset::{
asset_object_disposition, DocumentAssetDetailResponse, DocumentAssetResponse,
DocumentVersionDetailResponse, DocumentVersionResponse,
@@ -573,6 +573,8 @@ pub async fn download_with_token(
.verify_download_token(&token)
.map_err(|_| AppError::unauthorized())?;
ensure_active_tenant(&state, claims.tenant_id)?;
let mut conn = state.db_for_tenant(claims.tenant_id)?;
let now = Utc::now().naive_utc();
backend/src/routes/webdav/mod.rs
+9 -1
View File
@@ -16,7 +16,10 @@ use quick_xml::events::{BytesDecl, BytesEnd, BytesStart, BytesText, Event};
use quick_xml::Writer;
use uuid::Uuid;
use crate::auth::api_tokens::{find_active_token_by_secret, touch_api_token};
use crate::auth::{
api_tokens::{find_active_token_by_secret, touch_api_token},
ensure_active_tenant,
};
use crate::error::{AppError, AppResult};
use crate::models::{ApiCapability, Document, DocumentVersion, Folder, User};
use crate::schema::{
@@ -483,6 +486,11 @@ fn authenticate(state: &AppState, headers: &HeaderMap) -> Result<Option<WebDavCo
}
};
if let Err(err) = ensure_active_tenant(state, tenant_id) {
tracing::warn!(tenant_id = %tenant_id, error = ?err, "webdav tenant not active");
return Ok(None);
}
apply_tenant_guc(&mut conn, tenant_id)?;
touch_api_token(&mut conn, token.id)?;
backend/src/services/auth.rs
+32 -19
View File
@@ -458,11 +458,14 @@ impl<'a> AuthService<'a> {
let mut tenants = Vec::with_capacity(tenant_ids.len());
for tenant_id in tenant_ids {
let name: String = tenant_dsl::tenants
let (name, status): (String, TenantStatus) = tenant_dsl::tenants
.find(tenant_id)
.select(tenant_dsl::name)
.select((tenant_dsl::name, tenant_dsl::status))
.first(&mut conn)
.map_err(AppError::from)?;
if status != TenantStatus::Active {
continue;
}
tenants.push(TenantSnippet {
id: tenant_id,
name,
@@ -575,14 +578,33 @@ impl<'a> AuthService<'a> {
return Err(AppError::unauthorized());
}
let mut active_tenants = Vec::new();
for tenant_id in tenant_ids {
let (name, status): (String, TenantStatus) = tenant_dsl::tenants
.find(tenant_id)
.select((tenant_dsl::name, tenant_dsl::status))
.first(conn)
.map_err(AppError::from)?;
if status == TenantStatus::Active {
active_tenants.push((tenant_id, name));
}
}
if active_tenants.is_empty() {
return Err(AppError::new(
StatusCode::FORBIDDEN,
"no active tenants available",
));
}
if let Some(preferred_id) = preferred_tenant_id {
if tenant_ids.iter().any(|id| *id == preferred_id) {
if active_tenants.iter().any(|(id, _)| *id == preferred_id) {
return self.issue_session(conn, user, preferred_id);
}
}
if tenant_ids.len() == 1 {
return self.issue_session(conn, user, tenant_ids[0]);
if active_tenants.len() == 1 {
return self.issue_session(conn, user, active_tenants[0].0);
}
let selection_token = self
@@ -591,20 +613,10 @@ impl<'a> AuthService<'a> {
.generate_tenant_selector_token(user.id)
.map_err(AppError::from)?;
let mut tenants = Vec::with_capacity(tenant_ids.len());
for tenant_id in tenant_ids {
apply_tenant_guc(conn, tenant_id)?;
clear_user_guc(conn)?;
let name: String = tenant_dsl::tenants
.find(tenant_id)
.select(tenant_dsl::name)
.first(conn)
.map_err(AppError::from)?;
tenants.push(TenantSnippet {
id: tenant_id,
name,
});
}
let tenants = active_tenants
.into_iter()
.map(|(id, name)| TenantSnippet { id, name })
.collect();
let response = ok_json(LoginResponseVariants::Selection(TenantSelectionResponse {
access_token: selection_token,
@@ -677,6 +689,7 @@ impl<'a> AuthService<'a> {
user: &User,
tenant_id: Uuid,
) -> AppResult<Response> {
crate::auth::ensure_active_tenant(&self.state, tenant_id)?;
apply_tenant_guc(conn, tenant_id)?;
clear_user_guc(conn)?;
clear_user_session_hash(conn)?;
backend/src/services/documents.rs
+4 -5
View File
@@ -37,9 +37,7 @@ use crate::documents::{
tags::assign_tags as assign_tags_to_document,
};
use crate::error::{AppError, AppResult};
use crate::jobs::{
enqueue_job, JobQueueError, JOB_ANALYZE_DOCUMENT, JOB_INDEX_DOCUMENT_TEXT, JOB_PURGE_DOCUMENT,
};
use crate::jobs::{enqueue_job, JobQueueError, JOB_ANALYZE_DOCUMENT, JOB_PURGE_DOCUMENT};
use crate::models::{
Document, DocumentAsset, DocumentAssetObject, DocumentVersion, NewDocument, NewDocumentVersion,
Tag,
@@ -1163,10 +1161,11 @@ impl<'a> DocumentsService<'a> {
if let Err(err) = enqueue_job(
conn,
tenant_id,
JOB_INDEX_DOCUMENT_TEXT,
JOB_ANALYZE_DOCUMENT,
json!({
"document_id": document.id,
"document_version_id": current_version.id,
"force": false,
}),
None,
) {
@@ -1174,7 +1173,7 @@ impl<'a> DocumentsService<'a> {
document_id = %document.id,
version_id = %current_version.id,
error = %err,
"failed to enqueue reindex job after title change"
"failed to enqueue analyze job after title change"
);
}
}
backend/src/workers/analyze.rs
+8 -1
View File
@@ -6,7 +6,8 @@ use serde::Deserialize;
use uuid::Uuid;
use crate::{
jobs::JOB_ANALYZE_DOCUMENT, models::Document, state::AppState, storage::TenantStorage,
auth::ensure_active_tenant, jobs::JOB_ANALYZE_DOCUMENT, models::Document, state::AppState,
storage::TenantStorage,
};
use super::{
@@ -49,6 +50,12 @@ impl JobHandler for AnalyzeDocumentJob {
job: crate::models::Job,
storage: TenantStorage,
) -> JobExecution {
if let Err(err) = ensure_active_tenant(&state, job.tenant_id) {
return JobExecution::Failed {
error: err.to_string(),
};
}
let payload: AnalyzePayload = match serde_json::from_value(job.payload.clone()) {
Ok(payload) => payload,
Err(err) => {
backend/src/workers/index.rs
+2 -88
View File
@@ -1,101 +1,15 @@
use std::sync::Arc;
use std::time::Duration;
use async_trait::async_trait;
use reqwest::Client;
use serde::Deserialize;
use uuid::Uuid;
use crate::{
documents::search::{build_quickwit_ingest_record, quickwit_ingest},
jobs::JOB_INDEX_DOCUMENT_TEXT,
state::AppState,
storage::TenantStorage,
};
use crate::documents::search::{build_quickwit_ingest_record, quickwit_ingest};
use super::{
job_execution_from_task_error,
ocr::OCR_TEXT_ASSET_TYPE,
taskflow::{
document::DocumentVersionTaskContext, BoxedTask, Task, TaskError, TaskExecutor,
TaskPlanner, TaskResult,
},
JobExecution, JobHandler,
taskflow::{document::DocumentVersionTaskContext, Task, TaskError, TaskResult},
};
#[derive(Debug, Deserialize)]
struct IndexPayload {
document_id: Uuid,
document_version_id: Uuid,
}
pub struct IndexDocumentTextJob;
impl IndexDocumentTextJob {
pub fn new() -> Self {
Self
}
}
#[async_trait]
impl JobHandler for IndexDocumentTextJob {
fn job_type(&self) -> &'static str {
JOB_INDEX_DOCUMENT_TEXT
}
async fn handle(
&self,
state: Arc<AppState>,
job: crate::models::Job,
storage: TenantStorage,
) -> JobExecution {
let payload: IndexPayload = match serde_json::from_value(job.payload.clone()) {
Ok(payload) => payload,
Err(err) => {
return JobExecution::Failed {
error: format!("invalid index payload: {err}"),
};
}
};
let mut context = DocumentVersionTaskContext::new(
job.id,
JOB_INDEX_DOCUMENT_TEXT,
job.tenant_id,
payload.document_id,
payload.document_version_id,
false,
state.config.worker_max_document_bytes,
state.clone(),
storage,
);
let planner = IndexPlanner::new();
match TaskExecutor::run(&planner, &mut context).await {
Ok(()) => JobExecution::Success,
Err(err) => job_execution_from_task_error(err),
}
}
}
struct IndexPlanner;
impl IndexPlanner {
fn new() -> Self {
Self
}
}
#[async_trait]
impl TaskPlanner<DocumentVersionTaskContext> for IndexPlanner {
async fn plan(
&self,
_ctx: &mut DocumentVersionTaskContext,
) -> TaskResult<Vec<BoxedTask<DocumentVersionTaskContext>>> {
Ok(vec![Box::new(IndexDocumentTask::new())])
}
}
pub struct IndexDocumentTask;
impl IndexDocumentTask {
backend/src/workers/mod.rs
-1
View File
@@ -152,7 +152,6 @@ pub fn default_handlers() -> Vec<Arc<dyn JobHandler>> {
vec![
Arc::new(analyze::AnalyzeDocumentJob::new()),
Arc::new(purge::PurgeDocumentJob::new()),
Arc::new(index::IndexDocumentTextJob::new()),
Arc::new(ProvisionTenantJob::new()),
]
}
backend/src/workers/purge.rs
+7
View File
@@ -8,6 +8,7 @@ use diesel::result::Error as DieselError;
use serde::Deserialize;
use uuid::Uuid;
use crate::auth::ensure_active_tenant;
use crate::jobs::JOB_PURGE_DOCUMENT;
use crate::models::{Document, DocumentVersion};
use crate::schema::{document_asset_objects, document_assets, document_versions};
@@ -52,6 +53,12 @@ impl JobHandler for PurgeDocumentJob {
job: crate::models::Job,
storage: TenantStorage,
) -> JobExecution {
if let Err(err) = ensure_active_tenant(&state, job.tenant_id) {
return JobExecution::Failed {
error: err.to_string(),
};
}
let payload: PurgeDocumentPayload = match serde_json::from_value(job.payload.clone()) {
Ok(payload) => payload,
Err(err) => {
backend/tests/auth_flow.rs
+80 -2
View File
@@ -8,9 +8,19 @@ use papercrate::auth::passkeys::{
PasskeyLoginFinishPayload, PasskeyLoginStartPayload, PasskeyRegistrationFinishPayload,
RegistrationChallengeResponse,
};
use papercrate::models::{NewUserMembership, NewUserSession, TenantStatus, UserPasskey};
use papercrate::models::{
MagicToken, MagicTokenKind, NewUserMembership, NewUserSession, TenantStatus, UserPasskey,
};
use papercrate::openapi::schemas::PasskeySummary;
use papercrate::schema::{capability_sets, tenants, user_memberships, user_sessions, users};
use papercrate::schema::{
capability_sets,
magic_tokens::dsl as magic_dsl,
tenants,
tenants::dsl as tenant_dsl,
user_memberships,
user_sessions,
users,
};
use papercrate::test_support::{acquire_db_lock, body_to_vec, TestApp, TestUserRole};
use rand::{rngs::OsRng, TryRngCore};
use serde::Deserialize;
@@ -678,3 +688,71 @@ fn hash_session_token(value: &str) -> String {
hasher.update(value.as_bytes());
hex::encode(hasher.finalize())
}
#[tokio::test]
async fn tenant_selection_excludes_inactive_tenants() -> Result<()> {
let _lock = acquire_db_lock().await;
let app = TestApp::new().await?;
let user_id = app.insert_user("tenant-user", TestUserRole::Owner).await?;
let tenant_id = app
.with_conn(|conn| {
let tenant: papercrate::models::Tenant = tenant_dsl::tenants
.filter(tenant_dsl::name.eq("test_tenant"))
.first(conn)?;
Ok::<_, anyhow::Error>(tenant.id)
})
.await?;
app.with_conn(move |conn| {
diesel::update(tenant_dsl::tenants.find(tenant_id))
.set(tenant_dsl::status.eq(TenantStatus::Suspended))
.execute(conn)?;
Ok(())
})
.await?;
let magic_value = "tenant-status-token";
let token_hash = {
let mut hasher = Sha256::new();
hasher.update(magic_value.as_bytes());
hex::encode(hasher.finalize())
};
let user_id_for_token = user_id;
app.with_conn(move |conn| {
let token = MagicToken {
id: Uuid::new_v4(),
user_id: user_id_for_token,
kind: MagicTokenKind::EmailLogin,
token_hash,
metadata: json!({}),
expires_at: (Utc::now() + ChronoDuration::hours(1)).naive_utc(),
max_uses: None,
used_count: 0,
created_at: Utc::now().naive_utc(),
created_by: None,
last_used_at: None,
};
diesel::insert_into(magic_dsl::magic_tokens)
.values(&token)
.execute(conn)?;
Ok(())
})
.await?;
let payload = json!({
"username": "tenant-user",
"magic_token": magic_value,
});
let response = app.post_json("/api/auth/login", &payload, None).await?;
assert_eq!(response.status(), StatusCode::FORBIDDEN);
let body = body_to_vec(response.into_body()).await?;
let err: ApiErrorResponse = serde_json::from_slice(&body)?;
assert_eq!(err.error, "no active tenants available");
app.cleanup().await?;
Ok(())
}