1 files changed, 105 insertions, 76 deletions

diff --git a/src/login/static_provider.rs b/src/login/static_provider.rs
index b9be5a6..1e1ecbf 100644
--- a/src/login/static_provider.rs
+++ b/src/login/static_provider.rs
@@ -1,45 +1,89 @@
 use std::collections::HashMap;
+use std::path::PathBuf;
 use std::sync::Arc;
+use tokio::signal::unix::{signal, SignalKind};
+use tokio::sync::watch;
 
 use anyhow::{anyhow, bail, Result};
 use async_trait::async_trait;
 
 use crate::config::*;
-use crate::cryptoblob::{Key, SecretKey};
 use crate::login::*;
+use crate::storage;
 
-pub struct StaticLoginProvider {
-    default_bucket: Option<String>,
-    users: HashMap<String, Arc<LoginStaticUser>>,
-    users_by_email: HashMap<String, Arc<LoginStaticUser>>,
+pub struct ContextualUserEntry {
+    pub username: String,
+    pub config: UserEntry,
+}
 
-    k2v_region: Region,
-    s3_region: Region,
+#[derive(Default)]
+pub struct UserDatabase {
+    users: HashMap<String, Arc<ContextualUserEntry>>,
+    users_by_email: HashMap<String, Arc<ContextualUserEntry>>,
 }
 
-impl StaticLoginProvider {
-    pub fn new(config: LoginStaticConfig, k2v_region: Region, s3_region: Region) -> Result<Self> {
-        let users = config
-            .users
+pub struct StaticLoginProvider {
+    user_db: watch::Receiver<UserDatabase>,
+    in_memory_store: storage::in_memory::MemDb,
+}
+
+pub async fn update_user_list(config: PathBuf, up: watch::Sender<UserDatabase>) -> Result<()> {
+    let mut stream = signal(SignalKind::user_defined1())
+        .expect("failed to install SIGUSR1 signal hander for reload");
+
+    loop {
+        let ulist: UserList = match read_config(config.clone()) {
+            Ok(x) => x,
+            Err(e) => {
+                tracing::warn!(path=%config.as_path().to_string_lossy(), error=%e, "Unable to load config");
+                stream.recv().await;
+                continue;
+            }
+        };
+
+        let users = ulist
             .into_iter()
-            .map(|(k, v)| (k, Arc::new(v)))
+            .map(|(username, config)| {
+                (
+                    username.clone(),
+                    Arc::new(ContextualUserEntry { username, config }),
+                )
+            })
             .collect::<HashMap<_, _>>();
+
         let mut users_by_email = HashMap::new();
         for (_, u) in users.iter() {
-            for m in u.email_addresses.iter() {
+            for m in u.config.email_addresses.iter() {
                 if users_by_email.contains_key(m) {
-                    bail!("Several users have same email address: {}", m);
+                    tracing::warn!("Several users have the same email address: {}", m);
+                    stream.recv().await;
+                    continue;
                 }
                 users_by_email.insert(m.clone(), u.clone());
             }
         }
 
-        Ok(Self {
-            default_bucket: config.default_bucket,
+        tracing::info!("{} users loaded", users.len());
+        up.send(UserDatabase {
             users,
             users_by_email,
-            k2v_region,
-            s3_region,
+        })
+        .context("update user db config")?;
+        stream.recv().await;
+        tracing::info!("Received SIGUSR1, reloading");
+    }
+}
+
+impl StaticLoginProvider {
+    pub async fn new(config: LoginStaticConfig) -> Result<Self> {
+        let (tx, mut rx) = watch::channel(UserDatabase::default());
+
+        tokio::spawn(update_user_list(config.user_list, tx));
+        rx.changed().await?;
+
+        Ok(Self {
+            user_db: rx,
+            in_memory_store: storage::in_memory::MemDb::new(),
         })
     }
 }
@@ -48,82 +92,67 @@ impl StaticLoginProvider {
 impl LoginProvider for StaticLoginProvider {
     async fn login(&self, username: &str, password: &str) -> Result<Credentials> {
         tracing::debug!(user=%username, "login");
-        let user = match self.users.get(username) {
-            None => bail!("User {} does not exist", username),
-            Some(u) => u,
+        let user = {
+            let user_db = self.user_db.borrow();
+            match user_db.users.get(username) {
+                None => bail!("User {} does not exist", username),
+                Some(u) => u.clone(),
+            }
         };
 
         tracing::debug!(user=%username, "verify password");
-        if !verify_password(password, &user.password)? {
+        if !verify_password(password, &user.config.password)? {
             bail!("Wrong password");
         }
 
-        tracing::debug!(user=%username, "fetch bucket");
-        let bucket = user
-            .bucket
-            .clone()
-            .or_else(|| self.default_bucket.clone())
-            .ok_or(anyhow!(
-                "No bucket configured and no default bucket specieid"
-            ))?;
-
         tracing::debug!(user=%username, "fetch keys");
-        let storage = StorageCredentials {
-            k2v_region: self.k2v_region.clone(),
-            s3_region: self.s3_region.clone(),
-            aws_access_key_id: user.aws_access_key_id.clone(),
-            aws_secret_access_key: user.aws_secret_access_key.clone(),
-            bucket,
-        };
-
-        let keys = match (&user.master_key, &user.secret_key) {
-            (Some(m), Some(s)) => {
-                let master_key =
-                    Key::from_slice(&base64::decode(m)?).ok_or(anyhow!("Invalid master key"))?;
-                let secret_key = SecretKey::from_slice(&base64::decode(s)?)
-                    .ok_or(anyhow!("Invalid secret key"))?;
-                CryptoKeys::open_without_password(&storage, &master_key, &secret_key).await?
+        let storage: storage::Builder = match &user.config.storage {
+            StaticStorage::InMemory => self.in_memory_store.builder(username).await,
+            StaticStorage::Garage(grgconf) => {
+                storage::garage::GarageBuilder::new(storage::garage::GarageConf {
+                    region: grgconf.aws_region.clone(),
+                    k2v_endpoint: grgconf.k2v_endpoint.clone(),
+                    s3_endpoint: grgconf.s3_endpoint.clone(),
+                    aws_access_key_id: grgconf.aws_access_key_id.clone(),
+                    aws_secret_access_key: grgconf.aws_secret_access_key.clone(),
+                    bucket: grgconf.bucket.clone(),
+                })?
             }
-            (None, None) => {
-                let user_secrets = UserSecrets {
-                    user_secret: user.user_secret.clone(),
-                    alternate_user_secrets: user.alternate_user_secrets.clone(),
-                };
-                CryptoKeys::open(&storage, &user_secrets, password).await?
-            }
-            _ => bail!(
-                "Either both master and secret key or none of them must be specified for user"
-            ),
         };
 
+        let cr = CryptoRoot(user.config.crypto_root.clone());
+        let keys = cr.crypto_keys(password)?;
+
         tracing::debug!(user=%username, "logged");
         Ok(Credentials { storage, keys })
     }
 
     async fn public_login(&self, email: &str) -> Result<PublicCredentials> {
-        let user = match self.users_by_email.get(email) {
-            None => bail!("No user for email address {}", email),
-            Some(u) => u,
+        let user = {
+            let user_db = self.user_db.borrow();
+            match user_db.users_by_email.get(email) {
+                None => bail!("Email {} does not exist", email),
+                Some(u) => u.clone(),
+            }
         };
-
-        let bucket = user
-            .bucket
-            .clone()
-            .or_else(|| self.default_bucket.clone())
-            .ok_or(anyhow!(
-                "No bucket configured and no default bucket specieid"
-            ))?;
-
-        let storage = StorageCredentials {
-            k2v_region: self.k2v_region.clone(),
-            s3_region: self.s3_region.clone(),
-            aws_access_key_id: user.aws_access_key_id.clone(),
-            aws_secret_access_key: user.aws_secret_access_key.clone(),
-            bucket,
+        tracing::debug!(user=%user.username, "public_login");
+
+        let storage: storage::Builder = match &user.config.storage {
+            StaticStorage::InMemory => self.in_memory_store.builder(&user.username).await,
+            StaticStorage::Garage(grgconf) => {
+                storage::garage::GarageBuilder::new(storage::garage::GarageConf {
+                    region: grgconf.aws_region.clone(),
+                    k2v_endpoint: grgconf.k2v_endpoint.clone(),
+                    s3_endpoint: grgconf.s3_endpoint.clone(),
+                    aws_access_key_id: grgconf.aws_access_key_id.clone(),
+                    aws_secret_access_key: grgconf.aws_secret_access_key.clone(),
+                    bucket: grgconf.bucket.clone(),
+                })?
+            }
         };
 
-        let k2v_client = storage.k2v_client()?;
-        let (_, public_key) = CryptoKeys::load_salt_and_public(&k2v_client).await?;
+        let cr = CryptoRoot(user.config.crypto_root.clone());
+        let public_key = cr.public_key()?;
 
         Ok(PublicCredentials {
             storage,