authentik.enterprise.providers.ssf.views.stream

  1from uuid import uuid4
  2
  3from django.http import HttpRequest
  4from django.urls import reverse
  5from rest_framework.exceptions import PermissionDenied, ValidationError
  6from rest_framework.fields import CharField, ChoiceField, ListField, SerializerMethodField
  7from rest_framework.request import Request
  8from rest_framework.response import Response
  9from structlog.stdlib import get_logger
 10
 11from authentik.api.validation import validate
 12from authentik.core.api.utils import ModelSerializer, PassiveSerializer
 13from authentik.enterprise.providers.ssf.models import (
 14    DeliveryMethods,
 15    EventTypes,
 16    SSFProvider,
 17    Stream,
 18    StreamStatus,
 19)
 20from authentik.enterprise.providers.ssf.tasks import send_ssf_events
 21from authentik.enterprise.providers.ssf.views.base import SSFStreamView
 22
 23LOGGER = get_logger()
 24
 25
 26class StreamDeliverySerializer(PassiveSerializer):
 27    method = ChoiceField(choices=[(x.value, x.value) for x in DeliveryMethods])
 28    endpoint_url = CharField(required=False)
 29    authorization_header = CharField(required=False)
 30
 31    def validate_method(self, method: DeliveryMethods):
 32        """Currently only push is supported"""
 33        if method == DeliveryMethods.RISC_POLL:
 34            raise ValidationError("Polling for SSF events is not currently supported.")
 35        return method
 36
 37    def validate(self, attrs: dict) -> dict:
 38        if attrs.get("method") in [DeliveryMethods.RISC_PUSH, DeliveryMethods.RFC_PUSH]:
 39            if not attrs.get("endpoint_url"):
 40                raise ValidationError("Endpoint URL is required when using push.")
 41        return attrs
 42
 43
 44class StreamSerializer(ModelSerializer):
 45    delivery = StreamDeliverySerializer()
 46    events_requested = ListField(
 47        child=ChoiceField(choices=[(x.value, x.value) for x in EventTypes])
 48    )
 49    format = CharField(default="iss_sub")
 50    aud = ListField(child=CharField(), allow_empty=True, default=list)
 51
 52    def create(self, validated_data):
 53        provider: SSFProvider = validated_data["provider"]
 54        request: HttpRequest = self.context["request"]
 55        iss = request.build_absolute_uri(
 56            reverse(
 57                "authentik_providers_ssf:configuration",
 58                kwargs={
 59                    "application_slug": provider.backchannel_application.slug,
 60                },
 61            )
 62        )
 63        # Ensure that streams always get SET verification events sent to them
 64        validated_data["events_requested"].append(EventTypes.SET_VERIFICATION)
 65        stream_id = uuid4()
 66        default_aud = f"goauthentik.io/providers/ssf/{str(stream_id)}"
 67        return super().create(
 68            {
 69                "delivery_method": validated_data["delivery"]["method"],
 70                "endpoint_url": validated_data["delivery"].get("endpoint_url"),
 71                "authorization_header": validated_data["delivery"].get("authorization_header"),
 72                "format": validated_data["format"],
 73                "provider": validated_data["provider"],
 74                "events_requested": validated_data["events_requested"],
 75                "aud": validated_data["aud"] or [default_aud],
 76                "iss": iss,
 77                "pk": stream_id,
 78            }
 79        )
 80
 81    class Meta:
 82        model = Stream
 83        fields = [
 84            "delivery",
 85            "events_requested",
 86            "format",
 87            "aud",
 88        ]
 89
 90
 91class StreamResponseSerializer(PassiveSerializer):
 92    stream_id = CharField(source="pk")
 93    iss = CharField()
 94    aud = ListField(child=CharField())
 95    delivery = SerializerMethodField()
 96    format = CharField()
 97
 98    events_requested = ListField(child=CharField())
 99    events_supported = SerializerMethodField()
100    events_delivered = ListField(child=CharField(), source="events_requested")
101
102    def get_delivery(self, instance: Stream) -> StreamDeliverySerializer:
103        return {
104            "method": instance.delivery_method,
105            "endpoint_url": instance.endpoint_url,
106        }
107
108    def get_events_supported(self, instance: Stream) -> list[str]:
109        return [x.value for x in EventTypes]
110
111
112class StreamView(SSFStreamView):
113
114    def get(self, request: Request, *args, **kwargs):
115        stream = self.get_object()
116        return Response(
117            StreamResponseSerializer(instance=stream, context={"request": request}).data
118        )
119
120    @validate(StreamSerializer)
121    def post(self, request: Request, *args, body: StreamSerializer, **kwargs) -> Response:
122        if not request.user.has_perm("authentik_providers_ssf.add_stream", self.provider):
123            raise PermissionDenied(
124                "User does not have permission to create stream for this provider."
125            )
126        instance: Stream = body.save(provider=self.provider)
127
128        LOGGER.info("Sending verification event", stream=instance)
129        send_ssf_events(
130            EventTypes.SET_VERIFICATION,
131            {
132                "state": None,
133            },
134            stream_filter={"pk": instance.uuid},
135            sub_id={"format": "opaque", "id": str(instance.uuid)},
136        )
137        response = StreamResponseSerializer(instance=instance, context={"request": request}).data
138        return Response(response, status=201)
139
140    def patch(self, request: Request, *args, **kwargs) -> Response:
141        stream = self.get_object()
142        serializer = StreamSerializer(stream, data=request.data, partial=True)
143        serializer.is_valid(raise_exception=True)
144        serializer.save()
145        response = StreamResponseSerializer(
146            instance=serializer.instance, context={"request": request}
147        ).data
148        return Response(response, status=200)
149
150    def put(self, request: Request, *args, **kwargs) -> Response:
151        stream = self.get_object()
152        serializer = StreamSerializer(stream, data=request.data)
153        serializer.is_valid(raise_exception=True)
154        serializer.save()
155        response = StreamResponseSerializer(
156            instance=serializer.instance, context={"request": request}
157        ).data
158        return Response(response, status=200)
159
160    def delete(self, request: Request, *args, **kwargs) -> Response:
161        stream = self.get_object()
162        stream.status = StreamStatus.DISABLED
163        stream.save()
164        return Response(status=204)
165
166
167class StreamVerifyView(SSFStreamView):
168
169    def post(self, request: Request, *args, **kwargs):
170        stream = self.get_object()
171        state = request.data.get("state", None)
172        send_ssf_events(
173            EventTypes.SET_VERIFICATION,
174            {
175                "state": state,
176            },
177            stream_filter={"pk": stream.uuid},
178            sub_id={"format": "opaque", "id": str(stream.uuid)},
179        )
180        return Response(status=204)
181
182
183class StreamStatusView(SSFStreamView):
184
185    def get(self, request: Request, *args, **kwargs):
186        stream = self.get_object(any_status=True)
187        return Response(
188            {
189                "stream_id": str(stream.pk),
190                "status": str(stream.status),
191            }
192        )