Hydra local (#594)

* initial commit

* merge fixes

* added sanitizing

* linter

* Improve sign in UI

* simple simple!

* bump version

---------

Co-authored-by: CodexAdrian <83074853+CodexAdrian@users.noreply.github.com>
Co-authored-by: Jai A <jaiagr+gpg@pm.me>

theseus/src/api/auth.rs

@@ -1,7 +1,6 @@
 //! Authentication flow interface
-use crate::{launcher::auth as inner, State};
+use crate::{hydra::init::DeviceLoginSuccess, launcher::auth as inner, State};
 use chrono::Utc;
-use tokio::sync::oneshot;
 
 use crate::state::AuthTask;
 pub use inner::Credentials;
@@ -11,7 +10,7 @@ pub use inner::Credentials;
 /// This can be used in conjunction with 'authenticate_await_complete_flow'
 /// to call authenticate and call the flow from the frontend.
 /// Visit the URL in a browser, then call and await 'authenticate_await_complete_flow'.
-pub async fn authenticate_begin_flow() -> crate::Result<url::Url> {
+pub async fn authenticate_begin_flow() -> crate::Result<DeviceLoginSuccess> {
     let url = AuthTask::begin_auth().await?;
     Ok(url)
 }
@@ -20,8 +19,7 @@ pub async fn authenticate_begin_flow() -> crate::Result<url::Url> {
 /// This completes the authentication flow quasi-synchronously, returning the credentials
 /// This can be used in conjunction with 'authenticate_begin_flow'
 /// to call authenticate and call the flow from the frontend.
-pub async fn authenticate_await_complete_flow(
-) -> crate::Result<(Credentials, Option<String>)> {
+pub async fn authenticate_await_complete_flow() -> crate::Result<Credentials> {
     let credentials = AuthTask::await_auth_completion().await?;
     Ok(credentials)
 }
@@ -31,39 +29,6 @@ pub async fn cancel_flow() -> crate::Result<()> {
     AuthTask::cancel().await
 }
 
-/// Authenticate a user with Hydra
-/// To run this, you need to first spawn this function as a task, then
-/// open a browser to the given URL and finally wait on the spawned future
-/// with the ability to cancel in case the browser is closed before finishing
-#[tracing::instrument]
-#[theseus_macros::debug_pin]
-pub async fn authenticate(
-    browser_url: oneshot::Sender<url::Url>,
-) -> crate::Result<(Credentials, Option<String>)> {
-    let mut flow = inner::HydraAuthFlow::new().await?;
-    let state = State::get().await?;
-
-    let url = flow.prepare_login_url().await?;
-    browser_url.send(url).map_err(|url| {
-        crate::ErrorKind::OtherError(format!(
-            "Error sending browser url to parent: {url}"
-        ))
-    })?;
-
-    let credentials = flow.extract_credentials(&state.fetch_semaphore).await?;
-    {
-        let mut users = state.users.write().await;
-        users.insert(&credentials.0).await?;
-    }
-
-    if state.settings.read().await.default_user.is_none() {
-        let mut settings = state.settings.write().await;
-        settings.default_user = Some(credentials.0.id);
-    }
-
-    Ok(credentials)
-}
-
 /// Refresh some credentials using Hydra, if needed
 /// This is the primary desired way to get credentials, as it will also refresh them.
 #[tracing::instrument]

theseus/src/api/hydra/complete.rs

@@ -0,0 +1,85 @@
+//! Main authentication flow for Hydra
+
+use serde::Deserialize;
+
+use crate::prelude::Credentials;
+
+use super::stages::{
+    bearer_token, player_info, poll_response, xbl_signin, xsts_token,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct OauthFailure {
+    pub error: String,
+}
+
+pub struct SuccessfulLogin {
+    pub name: String,
+    pub icon: String,
+    pub token: String,
+    pub refresh_token: String,
+    pub expires_after: i64,
+}
+
+pub async fn wait_finish(device_code: String) -> crate::Result<Credentials> {
+    // Loop, polling for response from Microsoft
+    let oauth = poll_response::poll_response(device_code).await?;
+
+    // Get xbl token from oauth token
+    let xbl_token = xbl_signin::login_xbl(&oauth.access_token).await?;
+
+    // Get xsts token from xbl token
+    let xsts_response = xsts_token::fetch_token(&xbl_token.token).await?;
+
+    match xsts_response {
+        xsts_token::XSTSResponse::Unauthorized(err) => {
+            Err(crate::ErrorKind::HydraError(format!(
+                "Error getting XBox Live token: {}",
+                err
+            ))
+            .as_error())
+        }
+        xsts_token::XSTSResponse::Success { token: xsts_token } => {
+            // Get xsts bearer token from xsts token
+            let bearer_token =
+                bearer_token::fetch_bearer(&xsts_token, &xbl_token.uhs)
+                    .await
+                    .map_err(|err| {
+                        crate::ErrorKind::HydraError(format!(
+                            "Error getting bearer token: {}",
+                            err
+                        ))
+                    })?;
+
+            // Get player info from bearer token
+            let player_info = player_info::fetch_info(&bearer_token).await.map_err(|_err| {
+                crate::ErrorKind::HydraError("No Minecraft account for profile. Make sure you own the game and have set a username through the official Minecraft launcher."
+            .to_string())
+            })?;
+
+            // Create credentials
+            let credentials = Credentials::new(
+                uuid::Uuid::parse_str(&player_info.id)?, // get uuid from player_info.id which is a String
+                player_info.name,
+                bearer_token,
+                oauth.refresh_token,
+                chrono::Utc::now()
+                    + chrono::Duration::seconds(oauth.expires_in),
+            );
+
+            // Put credentials into state
+            let state = crate::State::get().await?;
+            {
+                let mut users = state.users.write().await;
+                users.insert(&credentials).await?;
+            }
+
+            if state.settings.read().await.default_user.is_none() {
+                let mut settings = state.settings.write().await;
+                settings.default_user = Some(credentials.id);
+            }
+
+            Ok(credentials)
+        }
+    }
+}

theseus/src/api/hydra/init.rs

@@ -0,0 +1,45 @@
+//! Login route for Hydra, redirects to the Microsoft login page before going to the redirect route
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+
+use crate::{hydra::MicrosoftError, util::fetch::REQWEST_CLIENT};
+
+use super::MICROSOFT_CLIENT_ID;
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct DeviceLoginSuccess {
+    pub device_code: String,
+    pub user_code: String,
+    pub verification_uri: String,
+    pub expires_in: u64,
+    pub interval: u64,
+    pub message: String,
+}
+
+pub async fn init() -> crate::Result<DeviceLoginSuccess> {
+    // Get the initial URL
+    let client_id = MICROSOFT_CLIENT_ID;
+
+    // Get device code
+    // Define the parameters
+    let mut params = HashMap::new();
+    params.insert("client_id", client_id);
+    params.insert("scope", "XboxLive.signin offline_access");
+
+    // urlencoding::encode("XboxLive.signin offline_access"));
+    let req = REQWEST_CLIENT.post("https://login.microsoftonline.com/consumers/oauth2/v2.0/devicecode")
+    .header("Content-Type", "application/x-www-form-urlencoded").form(&params).send().await?;
+
+    match req.status() {
+        reqwest::StatusCode::OK => Ok(req.json().await?),
+        _ => {
+            let microsoft_error = req.json::<MicrosoftError>().await?;
+            Err(crate::ErrorKind::HydraError(format!(
+                "Error from Microsoft: {:?}",
+                microsoft_error.error_description
+            ))
+            .into())
+        }
+    }
+}

theseus/src/api/hydra/mod.rs

@@ -0,0 +1,15 @@
+pub mod complete;
+pub mod init;
+pub mod refresh;
+mod stages;
+
+use serde::Deserialize;
+
+const MICROSOFT_CLIENT_ID: &str = "c4502edb-87c6-40cb-b595-64a280cf8906";
+
+#[derive(Deserialize)]
+pub struct MicrosoftError {
+    pub error: String,
+    pub error_description: String,
+    pub error_codes: Vec<u64>,
+}

theseus/src/api/hydra/refresh.rs

@@ -0,0 +1,60 @@
+use std::collections::HashMap;
+
+use reqwest::StatusCode;
+use serde::Deserialize;
+
+use crate::{
+    hydra::{MicrosoftError, MICROSOFT_CLIENT_ID},
+    util::fetch::REQWEST_CLIENT,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct OauthSuccess {
+    pub token_type: String,
+    pub scope: String,
+    pub expires_in: i64,
+    pub access_token: String,
+    pub refresh_token: String,
+}
+
+pub async fn refresh(refresh_token: String) -> crate::Result<OauthSuccess> {
+    let mut params = HashMap::new();
+    params.insert("grant_type", "refresh_token");
+    params.insert("client_id", MICROSOFT_CLIENT_ID);
+    params.insert("refresh_token", &refresh_token);
+
+    // Poll the URL in a loop until we are successful.
+    // On an authorization_pending response, wait 5 seconds and try again.
+    let resp = REQWEST_CLIENT
+        .post("https://login.microsoftonline.com/consumers/oauth2/v2.0/token")
+        .header("Content-Type", "application/x-www-form-urlencoded")
+        .form(&params)
+        .send()
+        .await?;
+
+    match resp.status() {
+        StatusCode::OK => {
+            let oauth = resp.json::<OauthSuccess>().await.map_err(|err| {
+                crate::ErrorKind::HydraError(format!(
+                    "Could not decipher successful response: {}",
+                    err
+                ))
+            })?;
+            Ok(oauth)
+        }
+        _ => {
+            let failure =
+                resp.json::<MicrosoftError>().await.map_err(|err| {
+                    crate::ErrorKind::HydraError(format!(
+                        "Could not decipher failure response: {}",
+                        err
+                    ))
+                })?;
+            Err(crate::ErrorKind::HydraError(format!(
+                "Error refreshing token: {}",
+                failure.error
+            ))
+            .as_error())
+        }
+    }
+}

theseus/src/api/hydra/stages/bearer_token.rs

@@ -0,0 +1,29 @@
+use serde_json::json;
+
+const MCSERVICES_AUTH_URL: &str =
+    "https://api.minecraftservices.com/launcher/login";
+
+pub async fn fetch_bearer(token: &str, uhs: &str) -> crate::Result<String> {
+    let client = reqwest::Client::new();
+    let body = client
+        .post(MCSERVICES_AUTH_URL)
+        .json(&json!({
+            "xtoken": format!("XBL3.0 x={};{}", uhs, token),
+            "platform": "PC_LAUNCHER"
+        }))
+        .send()
+        .await?
+        .text()
+        .await?;
+
+    serde_json::from_str::<serde_json::Value>(&body)?
+        .get("access_token")
+        .and_then(serde_json::Value::as_str)
+        .map(String::from)
+        .ok_or(
+            crate::ErrorKind::HydraError(format!(
+                "Response didn't contain valid bearer token. body: {body}"
+            ))
+            .into(),
+        )
+}

theseus/src/api/hydra/stages/mod.rs

@@ -0,0 +1,7 @@
+//! MSA authentication stages
+
+pub mod bearer_token;
+pub mod player_info;
+pub mod poll_response;
+pub mod xbl_signin;
+pub mod xsts_token;

theseus/src/api/hydra/stages/player_info.rs

@@ -0,0 +1,33 @@
+//! Fetch player info for display
+use serde::Deserialize;
+
+const PROFILE_URL: &str = "https://api.minecraftservices.com/minecraft/profile";
+
+#[derive(Deserialize)]
+pub struct PlayerInfo {
+    pub id: String,
+    pub name: String,
+}
+
+impl Default for PlayerInfo {
+    fn default() -> Self {
+        Self {
+            id: "606e2ff0ed7748429d6ce1d3321c7838".to_string(),
+            name: String::from("???"),
+        }
+    }
+}
+
+pub async fn fetch_info(token: &str) -> crate::Result<PlayerInfo> {
+    let client = reqwest::Client::new();
+    let resp = client
+        .get(PROFILE_URL)
+        .header(reqwest::header::AUTHORIZATION, format!("Bearer {token}"))
+        .send()
+        .await?
+        .error_for_status()?
+        .json()
+        .await?;
+
+    Ok(resp)
+}

theseus/src/api/hydra/stages/poll_response.rs

@@ -0,0 +1,91 @@
+use std::collections::HashMap;
+
+use reqwest::StatusCode;
+use serde::Deserialize;
+
+use crate::{
+    hydra::{MicrosoftError, MICROSOFT_CLIENT_ID},
+    util::fetch::REQWEST_CLIENT,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct OauthSuccess {
+    pub token_type: String,
+    pub scope: String,
+    pub expires_in: i64,
+    pub access_token: String,
+    pub refresh_token: String,
+}
+
+pub async fn poll_response(device_code: String) -> crate::Result<OauthSuccess> {
+    let mut params = HashMap::new();
+    params.insert("grant_type", "urn:ietf:params:oauth:grant-type:device_code");
+    params.insert("client_id", MICROSOFT_CLIENT_ID);
+    params.insert("device_code", &device_code);
+
+    // Poll the URL in a loop until we are successful.
+    // On an authorization_pending response, wait 5 seconds and try again.
+    loop {
+        let resp = REQWEST_CLIENT
+            .post(
+                "https://login.microsoftonline.com/consumers/oauth2/v2.0/token",
+            )
+            .header("Content-Type", "application/x-www-form-urlencoded")
+            .form(&params)
+            .send()
+            .await?;
+
+        match resp.status() {
+            StatusCode::OK => {
+                let oauth =
+                    resp.json::<OauthSuccess>().await.map_err(|err| {
+                        crate::ErrorKind::HydraError(format!(
+                            "Could not decipher successful response: {}",
+                            err
+                        ))
+                    })?;
+                return Ok(oauth);
+            }
+            _ => {
+                let failure =
+                    resp.json::<MicrosoftError>().await.map_err(|err| {
+                        crate::ErrorKind::HydraError(format!(
+                            "Could not decipher failure response: {}",
+                            err
+                        ))
+                    })?;
+                match failure.error.as_str() {
+                    "authorization_pending" => {
+                        tokio::time::sleep(std::time::Duration::from_secs(2))
+                            .await;
+                    }
+                    "authorization_declined" => {
+                        return Err(crate::ErrorKind::HydraError(
+                            "Authorization declined".to_string(),
+                        )
+                        .as_error());
+                    }
+                    "expired_token" => {
+                        return Err(crate::ErrorKind::HydraError(
+                            "Device code expired".to_string(),
+                        )
+                        .as_error());
+                    }
+                    "bad_verification_code" => {
+                        return Err(crate::ErrorKind::HydraError(
+                            "Invalid device code".to_string(),
+                        )
+                        .as_error());
+                    }
+                    _ => {
+                        return Err(crate::ErrorKind::HydraError(format!(
+                            "Unknown error: {}",
+                            failure.error
+                        ))
+                        .as_error());
+                    }
+                }
+            }
+        }
+    }
+}

theseus/src/api/hydra/stages/xbl_signin.rs

@@ -0,0 +1,55 @@
+use serde_json::json;
+
+const XBL_AUTH_URL: &str = "https://user.auth.xboxlive.com/user/authenticate";
+
+// Deserialization
+pub struct XBLLogin {
+    pub token: String,
+    pub uhs: String,
+}
+
+// Impl
+pub async fn login_xbl(token: &str) -> crate::Result<XBLLogin> {
+    let client = reqwest::Client::new();
+    let body = client
+        .post(XBL_AUTH_URL)
+        .header(reqwest::header::ACCEPT, "application/json")
+        .header("x-xbl-contract-version", "1")
+        .json(&json!({
+            "Properties": {
+                "AuthMethod": "RPS",
+                "SiteName": "user.auth.xboxlive.com",
+                "RpsTicket": format!("d={token}")
+            },
+            "RelyingParty": "http://auth.xboxlive.com",
+            "TokenType": "JWT"
+        }))
+        .send()
+        .await?
+        .text()
+        .await?;
+
+    let json = serde_json::from_str::<serde_json::Value>(&body)?;
+    let token = Some(&json)
+        .and_then(|it| it.get("Token")?.as_str().map(String::from))
+        .ok_or(crate::ErrorKind::HydraError(
+            "XBL response didn't contain valid token".to_string(),
+        ))?;
+    let uhs = Some(&json)
+        .and_then(|it| {
+            it.get("DisplayClaims")?
+                .get("xui")?
+                .get(0)?
+                .get("uhs")?
+                .as_str()
+                .map(String::from)
+        })
+        .ok_or(
+            crate::ErrorKind::HydraError(
+                "XBL response didn't contain valid user hash".to_string(),
+            )
+            .as_error(),
+        )?;
+
+    Ok(XBLLogin { token, uhs })
+}

theseus/src/api/hydra/stages/xsts_token.rs

@@ -0,0 +1,56 @@
+use serde_json::json;
+
+const XSTS_AUTH_URL: &str = "https://xsts.auth.xboxlive.com/xsts/authorize";
+
+pub enum XSTSResponse {
+    Unauthorized(String),
+    Success { token: String },
+}
+
+pub async fn fetch_token(token: &str) -> crate::Result<XSTSResponse> {
+    let client = reqwest::Client::new();
+    let resp = client
+        .post(XSTS_AUTH_URL)
+        .header(reqwest::header::ACCEPT, "application/json")
+        .json(&json!({
+            "Properties": {
+                "SandboxId": "RETAIL",
+                "UserTokens": [
+                    token
+                ]
+            },
+            "RelyingParty": "rp://api.minecraftservices.com/",
+            "TokenType": "JWT"
+        }))
+        .send()
+        .await?;
+    let status = resp.status();
+
+    let body = resp.text().await?;
+    let json = serde_json::from_str::<serde_json::Value>(&body)?;
+
+    if status.is_success() {
+        Ok(json
+            .get("Token")
+            .and_then(|x| x.as_str().map(String::from))
+            .map(|it| XSTSResponse::Success { token: it })
+            .unwrap_or(XSTSResponse::Unauthorized(
+                "XSTS response didn't contain valid token!".to_string(),
+            )))
+    } else {
+        Ok(XSTSResponse::Unauthorized(
+            #[allow(clippy::unreadable_literal)]
+            match json.get("XErr").and_then(|x| x.as_i64()) {
+                Some(2148916238) => {
+                    String::from("This Microsoft account is underage and is not linked to a family.")
+                },
+                Some(2148916235) => {
+                    String::from("XBOX Live/Minecraft is not available in your country.")
+                },
+                Some(2148916233) => String::from("This account does not have a valid XBOX Live profile. Please buy Minecraft and try again!"),
+                Some(2148916236) | Some(2148916237) => String::from("This account needs adult verification on Xbox page."),
+                _ => String::from("Unknown error code"),
+            },
+        ))
+    }
+}

theseus/src/api/mod.rs

@@ -1,6 +1,7 @@
 //! API for interacting with Theseus
 pub mod auth;
 pub mod handler;
+pub mod hydra;
 pub mod jre;
 pub mod logs;
 pub mod metadata;

theseus/src/api/profile/mod.rs

@@ -1089,5 +1089,5 @@ pub async fn build_folder(
 }
 
 pub fn sanitize_profile_name(input: &str) -> String {
-    input.replace(['/', '\\', ':'], "_")
+    input.replace(['/', '\\', '?', '*', ':', '\'', '\"', '|', '<', '>'], "_")
 }