diff --git a/.cargo/config.toml b/.cargo/config.toml index 7115f0015..085f3158f 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -2,5 +2,8 @@ [target.'cfg(windows)'] rustflags = ["-C", "link-args=/STACK:16777220", "--cfg", "tokio_unstable"] +[target.x86_64-pc-windows-msvc] +linker = "rust-lld" + [build] rustflags = ["--cfg", "tokio_unstable"] diff --git a/Cargo.lock b/Cargo.lock index d63122b80..61ac18bf3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8983,6 +8983,7 @@ dependencies = [ "data-url", "dirs", "discord-rich-presence", + "dotenvy", "dunce", "either", "encoding_rs", @@ -9037,6 +9038,8 @@ dependencies = [ "dashmap", "either", "enumset", + "hyper 1.6.0", + "hyper-util", "native-dialog", "paste", "serde", diff --git a/Cargo.toml b/Cargo.toml index d95e9b601..341c8838b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -67,6 +67,7 @@ heck = "0.5.0" hex = "0.4.3" hickory-resolver = "0.25.2" hmac = "0.12.1" +hyper = "1.6.0" hyper-rustls = { version = "0.27.7", default-features = false, features = [ "http1", "native-tokio", diff --git a/apps/app-frontend/src/App.vue b/apps/app-frontend/src/App.vue index c837744c9..e554210f4 100644 --- a/apps/app-frontend/src/App.vue +++ b/apps/app-frontend/src/App.vue @@ -61,9 +61,10 @@ import { renderString } from '@modrinth/utils' import { useFetch } from '@/helpers/fetch.js' // import { check } from '@tauri-apps/plugin-updater' import NavButton from '@/components/ui/NavButton.vue' -import { get as getCreds, login, logout } from '@/helpers/mr_auth.js' +import { cancelLogin, get as getCreds, login, logout } from '@/helpers/mr_auth.js' import { get_user } from '@/helpers/cache.js' import AppSettingsModal from '@/components/ui/modal/AppSettingsModal.vue' +import AuthGrantFlowWaitModal from '@/components/ui/modal/AuthGrantFlowWaitModal.vue' // import PromotionWrapper from '@/components/ui/PromotionWrapper.vue' // import { hide_ads_window, init_ads_window } from '@/helpers/ads.js' import FriendsList from '@/components/ui/friends/FriendsList.vue' @@ -283,6 +284,8 @@ const incompatibilityWarningModal = ref() const credentials = ref() +const modrinthLoginFlowWaitModal = ref() + async function fetchCredentials() { const creds = await getCreds().catch(handleError) if (creds && creds.user_id) { @@ -292,8 +295,24 @@ async function fetchCredentials() { } async function signIn() { - await login().catch(handleError) - await fetchCredentials() + modrinthLoginFlowWaitModal.value.show() + + try { + await login() + await fetchCredentials() + } catch (error) { + if ( + typeof error === 'object' && + typeof error['message'] === 'string' && + error.message.includes('Login canceled') + ) { + // Not really an error due to being a result of user interaction, show nothing + } else { + handleError(error) + } + } finally { + modrinthLoginFlowWaitModal.value.hide() + } } async function logOut() { @@ -422,6 +441,9 @@ function handleAuxClick(e) { + + + diff --git a/apps/app-frontend/src/components/ui/InstanceCreationModal.vue b/apps/app-frontend/src/components/ui/InstanceCreationModal.vue index c09255a7c..ee6328ff0 100644 --- a/apps/app-frontend/src/components/ui/InstanceCreationModal.vue +++ b/apps/app-frontend/src/components/ui/InstanceCreationModal.vue @@ -305,12 +305,16 @@ const [ get_game_versions().then(shallowRef).catch(handleError), get_loaders() .then((value) => - value - .filter((item) => item.supported_project_types.includes('modpack')) - .map((item) => item.name.toLowerCase()), + ref( + value + .filter((item) => item.supported_project_types.includes('modpack')) + .map((item) => item.name.toLowerCase()), + ), ) - .then(ref) - .catch(handleError), + .catch((err) => { + handleError(err) + return ref([]) + }), ]) loaders.value.unshift('vanilla') diff --git a/apps/app-frontend/src/components/ui/modal/AuthGrantFlowWaitModal.vue b/apps/app-frontend/src/components/ui/modal/AuthGrantFlowWaitModal.vue new file mode 100644 index 000000000..3f169faff --- /dev/null +++ b/apps/app-frontend/src/components/ui/modal/AuthGrantFlowWaitModal.vue @@ -0,0 +1,42 @@ + + diff --git a/apps/app-frontend/src/helpers/mr_auth.js b/apps/app-frontend/src/helpers/mr_auth.js index ecd9aee35..6be54bd21 100644 --- a/apps/app-frontend/src/helpers/mr_auth.js +++ b/apps/app-frontend/src/helpers/mr_auth.js @@ -16,3 +16,7 @@ export async function logout() { export async function get() { return await invoke('plugin:mr-auth|get') } + +export async function cancelLogin() { + return await invoke('plugin:mr-auth|cancel_modrinth_login') +} diff --git a/apps/app-playground/src/main.rs b/apps/app-playground/src/main.rs index a2c2b8922..13da97d39 100644 --- a/apps/app-playground/src/main.rs +++ b/apps/app-playground/src/main.rs @@ -15,7 +15,7 @@ pub async fn authenticate_run() -> theseus::Result { println!("A browser window will now open, follow the login flow there."); let login = minecraft_auth::begin_login().await?; - println!("Open URL {} in a browser", login.redirect_uri.as_str()); + println!("Open URL {} in a browser", login.auth_request_uri.as_str()); println!("Please enter URL code: "); let mut input = String::new(); diff --git a/apps/app/Cargo.toml b/apps/app/Cargo.toml index d1c67affc..e1a612e55 100644 --- a/apps/app/Cargo.toml +++ b/apps/app/Cargo.toml @@ -31,6 +31,8 @@ thiserror.workspace = true daedalus.workspace = true chrono.workspace = true either.workspace = true +hyper = { workspace = true, features = ["server"] } +hyper-util.workspace = true url.workspace = true urlencoding.workspace = true diff --git a/apps/app/build.rs b/apps/app/build.rs index f86176b6a..9d2b8789d 100644 --- a/apps/app/build.rs +++ b/apps/app/build.rs @@ -123,7 +123,12 @@ fn main() { .plugin( "mr-auth", InlinedPlugin::new() - .commands(&["modrinth_login", "logout", "get"]) + .commands(&[ + "modrinth_login", + "logout", + "get", + "cancel_modrinth_login", + ]) .default_permission( DefaultPermissionRule::AllowAllCommands, ), diff --git a/apps/app/src/api/auth.rs b/apps/app/src/api/auth.rs index 115d648e7..cafb59583 100644 --- a/apps/app/src/api/auth.rs +++ b/apps/app/src/api/auth.rs @@ -96,7 +96,7 @@ pub async fn login( let window = tauri::WebviewWindowBuilder::new( &app, "signin", - tauri::WebviewUrl::External(flow.redirect_uri.parse().map_err( + tauri::WebviewUrl::External(flow.auth_request_uri.parse().map_err( |_| { theseus::ErrorKind::OtherError( "Error parsing auth redirect URL".to_string(), @@ -140,6 +140,7 @@ pub async fn login( window.close()?; Ok(None) } + #[tauri::command] pub async fn remove_user(user: uuid::Uuid) -> Result<()> { Ok(minecraft_auth::remove_user(user).await?) diff --git a/apps/app/src/api/mod.rs b/apps/app/src/api/mod.rs index 3ce0dc921..e33117674 100644 --- a/apps/app/src/api/mod.rs +++ b/apps/app/src/api/mod.rs @@ -21,6 +21,8 @@ pub mod cache; pub mod friends; pub mod worlds; +mod oauth_utils; + pub type Result = std::result::Result; // // Main returnable Theseus GUI error diff --git a/apps/app/src/api/mr_auth.rs b/apps/app/src/api/mr_auth.rs index 43fee5436..2143d20c5 100644 --- a/apps/app/src/api/mr_auth.rs +++ b/apps/app/src/api/mr_auth.rs @@ -1,79 +1,70 @@ use crate::api::Result; -use chrono::{Duration, Utc}; +use crate::api::TheseusSerializableError; +use crate::api::oauth_utils; +use tauri::Manager; +use tauri::Runtime; use tauri::plugin::TauriPlugin; -use tauri::{Manager, Runtime, UserAttentionType}; +use tauri_plugin_opener::OpenerExt; use theseus::prelude::*; +use tokio::sync::oneshot; pub fn init() -> TauriPlugin { tauri::plugin::Builder::new("mr-auth") - .invoke_handler(tauri::generate_handler![modrinth_login, logout, get,]) + .invoke_handler(tauri::generate_handler![ + modrinth_login, + logout, + get, + cancel_modrinth_login, + ]) .build() } #[tauri::command] pub async fn modrinth_login( app: tauri::AppHandle, -) -> Result> { - let redirect_uri = mr_auth::authenticate_begin_flow(); +) -> Result { + let (auth_code_recv_socket_tx, auth_code_recv_socket) = oneshot::channel(); + let auth_code = tokio::spawn(oauth_utils::auth_code_reply::listen( + auth_code_recv_socket_tx, + )); - let start = Utc::now(); + let auth_code_recv_socket = auth_code_recv_socket.await.unwrap()?; - if let Some(window) = app.get_webview_window("modrinth-signin") { - window.close()?; - } + let auth_request_uri = format!( + "{}?launcher=true&ipver={}&port={}", + mr_auth::authenticate_begin_flow(), + if auth_code_recv_socket.is_ipv4() { + "4" + } else { + "6" + }, + auth_code_recv_socket.port() + ); - let window = tauri::WebviewWindowBuilder::new( - &app, - "modrinth-signin", - tauri::WebviewUrl::External(redirect_uri.parse().map_err(|_| { - theseus::ErrorKind::OtherError( - "Error parsing auth redirect URL".to_string(), + app.opener() + .open_url(auth_request_uri, None::<&str>) + .map_err(|e| { + TheseusSerializableError::Theseus( + theseus::ErrorKind::OtherError(format!( + "Failed to open auth request URI: {e}" + )) + .into(), ) - .as_error() - })?), - ) - .min_inner_size(420.0, 632.0) - .inner_size(420.0, 632.0) - .max_inner_size(420.0, 632.0) - .zoom_hotkeys_enabled(false) - .title("Sign into Modrinth") - .always_on_top(true) - .center() - .build()?; + })?; - window.request_user_attention(Some(UserAttentionType::Critical))?; + let Some(auth_code) = auth_code.await.unwrap()? else { + return Err(TheseusSerializableError::Theseus( + theseus::ErrorKind::OtherError("Login canceled".into()).into(), + )); + }; - while (Utc::now() - start) < Duration::minutes(10) { - if window.title().is_err() { - // user closed window, cancelling flow - return Ok(None); - } + let credentials = mr_auth::authenticate_finish_flow(&auth_code).await?; - if window - .url()? - .as_str() - .starts_with("https://launcher-files.modrinth.com") - { - let url = window.url()?; - - let code = url.query_pairs().find(|(key, _)| key == "code"); - - window.close()?; - - return if let Some((_, code)) = code { - let val = mr_auth::authenticate_finish_flow(&code).await?; - - Ok(Some(val)) - } else { - Ok(None) - }; - } - - tokio::time::sleep(std::time::Duration::from_millis(50)).await; + if let Some(main_window) = app.get_window("main") { + main_window.set_focus().ok(); } - window.close()?; - Ok(None) + Ok(credentials) } #[tauri::command] @@ -85,3 +76,8 @@ pub async fn logout() -> Result<()> { pub async fn get() -> Result> { Ok(theseus::mr_auth::get_credentials().await?) } + +#[tauri::command] +pub fn cancel_modrinth_login() { + oauth_utils::auth_code_reply::stop_listeners(); +} diff --git a/apps/app/src/api/oauth_utils/auth_code_reply.rs b/apps/app/src/api/oauth_utils/auth_code_reply.rs new file mode 100644 index 000000000..4e4a52928 --- /dev/null +++ b/apps/app/src/api/oauth_utils/auth_code_reply.rs @@ -0,0 +1,159 @@ +//! A minimal OAuth 2.0 authorization code grant flow redirection/reply loopback URI HTTP +//! server implementation, compliant with [RFC 6749]'s authorization code grant flow and +//! [RFC 8252]'s best current practices for OAuth 2.0 in native apps. +//! +//! This server is needed for the step 4 of the OAuth authentication dance represented in +//! figure 1 of [RFC 8252]. +//! +//! Further reading: https://www.oauth.com/oauth2-servers/oauth-native-apps/redirect-urls-for-native-apps/ +//! +//! [RFC 6749]: https://datatracker.ietf.org/doc/html/rfc6749 +//! [RFC 8252]: https://datatracker.ietf.org/doc/html/rfc8252 + +use std::{ + net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr}, + sync::{LazyLock, Mutex}, + time::Duration, +}; + +use hyper::body::Incoming; +use hyper_util::rt::{TokioIo, TokioTimer}; +use theseus::ErrorKind; +use tokio::{ + net::TcpListener, + sync::{broadcast, oneshot}, +}; + +static SERVER_SHUTDOWN: LazyLock> = + LazyLock::new(|| broadcast::channel(1024).0); + +/// Starts a temporary HTTP server to receive OAuth 2.0 authorization code grant flow redirects +/// on a loopback interface with an ephemeral port. The caller can know the bound socket address +/// by listening on the counterpart channel for `listen_socket_tx`. +/// +/// If the server is stopped before receiving an authorization code, `Ok(None)` is returned. +pub async fn listen( + listen_socket_tx: oneshot::Sender>, +) -> Result, theseus::Error> { + // IPv4 is tried first for the best compatibility and performance with most systems. + // IPv6 is also tried in case IPv4 is not available. Resolving "localhost" is avoided + // to prevent failures deriving from improper name resolution setup. Any available + // ephemeral port is used to prevent conflicts with other services. This is all as per + // RFC 8252's recommendations + const ANY_LOOPBACK_SOCKET: &[SocketAddr] = &[ + SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0), + SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0), + ]; + + let listener = match TcpListener::bind(ANY_LOOPBACK_SOCKET).await { + Ok(listener) => { + listen_socket_tx + .send(listener.local_addr().map_err(|e| { + ErrorKind::OtherError(format!( + "Failed to get auth code reply socket address: {e}" + )) + .into() + })) + .ok(); + + listener + } + Err(e) => { + let error_msg = + format!("Failed to bind auth code reply socket: {e}"); + + listen_socket_tx + .send(Err(ErrorKind::OtherError(error_msg.clone()).into())) + .ok(); + + return Err(ErrorKind::OtherError(error_msg).into()); + } + }; + + let mut auth_code = Mutex::new(None); + let mut shutdown_notification = SERVER_SHUTDOWN.subscribe(); + + while auth_code.get_mut().unwrap().is_none() { + let client_socket = tokio::select! { + biased; + _ = shutdown_notification.recv() => { + break; + } + conn_accept_result = listener.accept() => { + match conn_accept_result { + Ok((socket, _)) => socket, + Err(e) => { + tracing::warn!("Failed to accept auth code reply: {e}"); + continue; + } + } + } + }; + + if let Err(e) = hyper::server::conn::http1::Builder::new() + .keep_alive(false) + .header_read_timeout(Duration::from_secs(5)) + .timer(TokioTimer::new()) + .auto_date_header(false) + .serve_connection( + TokioIo::new(client_socket), + hyper::service::service_fn(|req| handle_reply(req, &auth_code)), + ) + .await + { + tracing::warn!("Failed to handle auth code reply: {e}"); + } + } + + Ok(auth_code.into_inner().unwrap()) +} + +/// Stops any active OAuth 2.0 authorization code grant flow reply listening HTTP servers. +pub fn stop_listeners() { + SERVER_SHUTDOWN.send(()).ok(); +} + +async fn handle_reply( + req: hyper::Request, + auth_code_out: &Mutex>, +) -> Result, hyper::http::Error> { + if req.method() != hyper::Method::GET { + return hyper::Response::builder() + .status(hyper::StatusCode::METHOD_NOT_ALLOWED) + .header("Allow", "GET") + .body("".into()); + } + + // The authorization code is guaranteed to be sent as a "code" query parameter + // in the request URI query string as per RFC 6749 § 4.1.2 + let auth_code = req.uri().query().and_then(|query_string| { + query_string + .split('&') + .filter_map(|query_pair| query_pair.split_once('=')) + .find_map(|(key, value)| (key == "code").then_some(value)) + }); + + let response = if let Some(auth_code) = auth_code { + *auth_code_out.lock().unwrap() = Some(auth_code.to_string()); + + hyper::Response::builder() + .status(hyper::StatusCode::OK) + .header("Content-Type", "text/html;charset=utf-8") + .body( + include_str!("auth_code_reply/page.html") + .replace("{{title}}", "Success") + .replace("{{message}}", "You have successfully signed in! You can close this page now."), + ) + } else { + hyper::Response::builder() + .status(hyper::StatusCode::BAD_REQUEST) + .header("Content-Type", "text/html;charset=utf-8") + .body( + include_str!("auth_code_reply/page.html") + .replace("{{title}}", "Error") + .replace("{{message}}", "Authorization code not found. Please try signing in again."), + ) + }?; + + Ok(response) +} diff --git a/apps/app/src/api/oauth_utils/auth_code_reply/page.html b/apps/app/src/api/oauth_utils/auth_code_reply/page.html new file mode 100644 index 000000000..f0ccff4ad --- /dev/null +++ b/apps/app/src/api/oauth_utils/auth_code_reply/page.html @@ -0,0 +1 @@ +Sign In - Modrinth App
diff --git a/apps/app/src/api/oauth_utils/mod.rs b/apps/app/src/api/oauth_utils/mod.rs new file mode 100644 index 000000000..4182cfb6c --- /dev/null +++ b/apps/app/src/api/oauth_utils/mod.rs @@ -0,0 +1,3 @@ +//! Assorted utilities for OAuth 2.0 authorization flows. + +pub mod auth_code_reply; diff --git a/apps/app/tauri.conf.json b/apps/app/tauri.conf.json index 06c10baad..780869358 100644 --- a/apps/app/tauri.conf.json +++ b/apps/app/tauri.conf.json @@ -63,6 +63,7 @@ "height": 800, "resizable": true, "title": "AstralRinth", + "label": "main", "width": 1280, "minHeight": 700, "minWidth": 1100, diff --git a/apps/daedalus_client/Dockerfile b/apps/daedalus_client/Dockerfile index 9ea70f9ca..271c829aa 100644 --- a/apps/daedalus_client/Dockerfile +++ b/apps/daedalus_client/Dockerfile @@ -1,9 +1,19 @@ +# syntax=docker/dockerfile:1 + FROM rust:1.88.0 AS build WORKDIR /usr/src/daedalus COPY . . -RUN cargo build --release --package daedalus_client +RUN --mount=type=cache,target=/usr/src/daedalus/target \ + --mount=type=cache,target=/usr/local/cargo/git/db \ + --mount=type=cache,target=/usr/local/cargo/registry \ + cargo build --release --package daedalus_client +FROM build AS artifacts + +RUN --mount=type=cache,target=/usr/src/daedalus/target \ + mkdir /daedalus \ + && cp /usr/src/daedalus/target/release/daedalus_client /daedalus/daedalus_client FROM debian:bookworm-slim @@ -11,7 +21,7 @@ RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates openssl \ && rm -rf /var/lib/apt/lists/* -COPY --from=build /usr/src/daedalus/target/release/daedalus_client /daedalus/daedalus_client -WORKDIR /daedalus_client +COPY --from=artifacts /daedalus /daedalus -CMD /daedalus/daedalus_client +WORKDIR /daedalus_client +CMD ["/daedalus/daedalus_client"] diff --git a/apps/frontend/src/components/ui/moderation/ModpackPermissionsFlow.vue b/apps/frontend/src/components/ui/moderation/ModpackPermissionsFlow.vue index 124a49336..cdb97d7c0 100644 --- a/apps/frontend/src/components/ui/moderation/ModpackPermissionsFlow.vue +++ b/apps/frontend/src/components/ui/moderation/ModpackPermissionsFlow.vue @@ -8,7 +8,7 @@
Loading data...
-

All permissions obtained. You may skip this step!

+

All permissions already obtained.

@@ -157,7 +157,7 @@ import type { } from "@modrinth/utils"; import { ButtonStyled } from "@modrinth/ui"; import { ref, computed, watch, onMounted } from "vue"; -import { useLocalStorage } from "@vueuse/core"; +import { useLocalStorage, useSessionStorage } from "@vueuse/core"; const props = defineProps<{ projectId: string; @@ -182,7 +182,26 @@ const persistedModPackData = useLocalStorage( const persistedIndex = useLocalStorage(`modpack-permissions-index-${props.projectId}`, 0); -const modPackData = ref(null); +const modPackData = useSessionStorage( + `modpack-permissions-data-${props.projectId}`, + null, + { + serializer: { + read: (v: any) => (v ? JSON.parse(v) : null), + write: (v: any) => JSON.stringify(v), + }, + }, +); +const permanentNoFiles = useSessionStorage( + `modpack-permissions-permanent-no-${props.projectId}`, + [], + { + serializer: { + read: (v: any) => (v ? JSON.parse(v) : []), + write: (v: any) => JSON.stringify(v), + }, + }, +); const currentIndex = ref(0); const fileApprovalTypes: ModerationModpackPermissionApprovalType[] = [ @@ -251,7 +270,45 @@ async function fetchModPackData(): Promise { const data = (await useBaseFetch(`moderation/project/${props.projectId}`, { internal: true, })) as ModerationModpackResponse; + + const permanentNoItems: ModerationModpackItem[] = Object.entries(data.identified || {}) + .filter(([_, file]) => file.status === "permanent-no") + .map( + ([sha1, file]): ModerationModpackItem => ({ + sha1, + file_name: file.file_name, + type: "identified", + status: file.status, + approved: null, + }), + ) + .sort((a, b) => a.file_name.localeCompare(b.file_name)); + + permanentNoFiles.value = permanentNoItems; + const sortedData: ModerationModpackItem[] = [ + ...Object.entries(data.identified || {}) + .filter( + ([_, file]) => + file.status !== "yes" && + file.status !== "with-attribution-and-source" && + file.status !== "permanent-no", + ) + .map( + ([sha1, file]): ModerationModpackItem => ({ + sha1, + file_name: file.file_name, + type: "identified", + status: file.status, + approved: null, + ...(file.status === "unidentified" && { + proof: "", + url: "", + title: "", + }), + }), + ) + .sort((a, b) => a.file_name.localeCompare(b.file_name)), ...Object.entries(data.unknown_files || {}) .map( ([sha1, fileName]): ModerationUnknownModpackItem => ({ @@ -310,6 +367,7 @@ async function fetchModPackData(): Promise { } catch (error) { console.error("Failed to fetch modpack data:", error); modPackData.value = []; + permanentNoFiles.value = []; persistAll(); } } @@ -321,6 +379,14 @@ function goToPrevious(): void { } } +watch( + modPackData, + (newValue) => { + persistedModPackData.value = newValue; + }, + { deep: true }, +); + function goToNext(): void { if (modPackData.value && currentIndex.value < modPackData.value.length) { currentIndex.value++; @@ -396,6 +462,17 @@ onMounted(() => { } }); +watch( + modPackData, + (newValue) => { + if (newValue && newValue.length === 0) { + emit("complete"); + clearPersistedData(); + } + }, + { immediate: true }, +); + watch( () => props.projectId, () => { @@ -406,6 +483,20 @@ watch( } }, ); + +function getModpackFiles(): { + interactive: ModerationModpackItem[]; + permanentNo: ModerationModpackItem[]; +} { + return { + interactive: modPackData.value || [], + permanentNo: permanentNoFiles.value, + }; +} + +defineExpose({ + getModpackFiles, +});