diff --git a/Cargo.lock b/Cargo.lock index 3d55cb9b6..4dfc698b6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -8985,6 +8985,8 @@ dependencies = [ "dashmap", "either", "enumset", + "hyper 1.6.0", + "hyper-util", "native-dialog", "paste", "serde", diff --git a/Cargo.toml b/Cargo.toml index d95e9b601..341c8838b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -67,6 +67,7 @@ heck = "0.5.0" hex = "0.4.3" hickory-resolver = "0.25.2" hmac = "0.12.1" +hyper = "1.6.0" hyper-rustls = { version = "0.27.7", default-features = false, features = [ "http1", "native-tokio", diff --git a/apps/app-frontend/src/App.vue b/apps/app-frontend/src/App.vue index 1bc25942c..abfabdf52 100644 --- a/apps/app-frontend/src/App.vue +++ b/apps/app-frontend/src/App.vue @@ -61,9 +61,10 @@ import { renderString } from '@modrinth/utils' import { useFetch } from '@/helpers/fetch.js' import { check } from '@tauri-apps/plugin-updater' import NavButton from '@/components/ui/NavButton.vue' -import { get as getCreds, login, logout } from '@/helpers/mr_auth.js' +import { cancelLogin, get as getCreds, login, logout } from '@/helpers/mr_auth.js' import { get_user } from '@/helpers/cache.js' import AppSettingsModal from '@/components/ui/modal/AppSettingsModal.vue' +import AuthGrantFlowWaitModal from '@/components/ui/modal/AuthGrantFlowWaitModal.vue' import PromotionWrapper from '@/components/ui/PromotionWrapper.vue' import { hide_ads_window, init_ads_window } from '@/helpers/ads.js' import FriendsList from '@/components/ui/friends/FriendsList.vue' @@ -263,6 +264,8 @@ const incompatibilityWarningModal = ref() const credentials = ref() +const modrinthLoginFlowWaitModal = ref() + async function fetchCredentials() { const creds = await getCreds().catch(handleError) if (creds && creds.user_id) { @@ -272,8 +275,24 @@ async function fetchCredentials() { } async function signIn() { - await login().catch(handleError) - await fetchCredentials() + modrinthLoginFlowWaitModal.value.show() + + try { + await login() + await fetchCredentials() + } catch (error) { + if ( + typeof error === 'object' && + typeof error['message'] === 'string' && + error.message.includes('Login canceled') + ) { + // Not really an error due to being a result of user interaction, show nothing + } else { + handleError(error) + } + } finally { + modrinthLoginFlowWaitModal.value.hide() + } } async function logOut() { @@ -402,6 +421,9 @@ function handleAuxClick(e) { + + + diff --git a/apps/app-frontend/src/components/ui/InstanceCreationModal.vue b/apps/app-frontend/src/components/ui/InstanceCreationModal.vue index c09255a7c..ee6328ff0 100644 --- a/apps/app-frontend/src/components/ui/InstanceCreationModal.vue +++ b/apps/app-frontend/src/components/ui/InstanceCreationModal.vue @@ -305,12 +305,16 @@ const [ get_game_versions().then(shallowRef).catch(handleError), get_loaders() .then((value) => - value - .filter((item) => item.supported_project_types.includes('modpack')) - .map((item) => item.name.toLowerCase()), + ref( + value + .filter((item) => item.supported_project_types.includes('modpack')) + .map((item) => item.name.toLowerCase()), + ), ) - .then(ref) - .catch(handleError), + .catch((err) => { + handleError(err) + return ref([]) + }), ]) loaders.value.unshift('vanilla') diff --git a/apps/app-frontend/src/components/ui/modal/AuthGrantFlowWaitModal.vue b/apps/app-frontend/src/components/ui/modal/AuthGrantFlowWaitModal.vue new file mode 100644 index 000000000..3f169faff --- /dev/null +++ b/apps/app-frontend/src/components/ui/modal/AuthGrantFlowWaitModal.vue @@ -0,0 +1,42 @@ + + diff --git a/apps/app-frontend/src/helpers/mr_auth.js b/apps/app-frontend/src/helpers/mr_auth.js index ecd9aee35..6be54bd21 100644 --- a/apps/app-frontend/src/helpers/mr_auth.js +++ b/apps/app-frontend/src/helpers/mr_auth.js @@ -16,3 +16,7 @@ export async function logout() { export async function get() { return await invoke('plugin:mr-auth|get') } + +export async function cancelLogin() { + return await invoke('plugin:mr-auth|cancel_modrinth_login') +} diff --git a/apps/app-playground/src/main.rs b/apps/app-playground/src/main.rs index a2c2b8922..13da97d39 100644 --- a/apps/app-playground/src/main.rs +++ b/apps/app-playground/src/main.rs @@ -15,7 +15,7 @@ pub async fn authenticate_run() -> theseus::Result { println!("A browser window will now open, follow the login flow there."); let login = minecraft_auth::begin_login().await?; - println!("Open URL {} in a browser", login.redirect_uri.as_str()); + println!("Open URL {} in a browser", login.auth_request_uri.as_str()); println!("Please enter URL code: "); let mut input = String::new(); diff --git a/apps/app/Cargo.toml b/apps/app/Cargo.toml index d1c67affc..e1a612e55 100644 --- a/apps/app/Cargo.toml +++ b/apps/app/Cargo.toml @@ -31,6 +31,8 @@ thiserror.workspace = true daedalus.workspace = true chrono.workspace = true either.workspace = true +hyper = { workspace = true, features = ["server"] } +hyper-util.workspace = true url.workspace = true urlencoding.workspace = true diff --git a/apps/app/build.rs b/apps/app/build.rs index 7a4da8872..4574acee9 100644 --- a/apps/app/build.rs +++ b/apps/app/build.rs @@ -120,7 +120,12 @@ fn main() { .plugin( "mr-auth", InlinedPlugin::new() - .commands(&["modrinth_login", "logout", "get"]) + .commands(&[ + "modrinth_login", + "logout", + "get", + "cancel_modrinth_login", + ]) .default_permission( DefaultPermissionRule::AllowAllCommands, ), diff --git a/apps/app/src/api/auth.rs b/apps/app/src/api/auth.rs index b084feb4d..c18bd770e 100644 --- a/apps/app/src/api/auth.rs +++ b/apps/app/src/api/auth.rs @@ -33,7 +33,7 @@ pub async fn login( let window = tauri::WebviewWindowBuilder::new( &app, "signin", - tauri::WebviewUrl::External(flow.redirect_uri.parse().map_err( + tauri::WebviewUrl::External(flow.auth_request_uri.parse().map_err( |_| { theseus::ErrorKind::OtherError( "Error parsing auth redirect URL".to_string(), @@ -77,6 +77,7 @@ pub async fn login( window.close()?; Ok(None) } + #[tauri::command] pub async fn remove_user(user: uuid::Uuid) -> Result<()> { Ok(minecraft_auth::remove_user(user).await?) diff --git a/apps/app/src/api/mod.rs b/apps/app/src/api/mod.rs index 294e784f6..a2ccb1178 100644 --- a/apps/app/src/api/mod.rs +++ b/apps/app/src/api/mod.rs @@ -22,6 +22,8 @@ pub mod cache; pub mod friends; pub mod worlds; +mod oauth_utils; + pub type Result = std::result::Result; // // Main returnable Theseus GUI error diff --git a/apps/app/src/api/mr_auth.rs b/apps/app/src/api/mr_auth.rs index 43fee5436..2143d20c5 100644 --- a/apps/app/src/api/mr_auth.rs +++ b/apps/app/src/api/mr_auth.rs @@ -1,79 +1,70 @@ use crate::api::Result; -use chrono::{Duration, Utc}; +use crate::api::TheseusSerializableError; +use crate::api::oauth_utils; +use tauri::Manager; +use tauri::Runtime; use tauri::plugin::TauriPlugin; -use tauri::{Manager, Runtime, UserAttentionType}; +use tauri_plugin_opener::OpenerExt; use theseus::prelude::*; +use tokio::sync::oneshot; pub fn init() -> TauriPlugin { tauri::plugin::Builder::new("mr-auth") - .invoke_handler(tauri::generate_handler![modrinth_login, logout, get,]) + .invoke_handler(tauri::generate_handler![ + modrinth_login, + logout, + get, + cancel_modrinth_login, + ]) .build() } #[tauri::command] pub async fn modrinth_login( app: tauri::AppHandle, -) -> Result> { - let redirect_uri = mr_auth::authenticate_begin_flow(); +) -> Result { + let (auth_code_recv_socket_tx, auth_code_recv_socket) = oneshot::channel(); + let auth_code = tokio::spawn(oauth_utils::auth_code_reply::listen( + auth_code_recv_socket_tx, + )); - let start = Utc::now(); + let auth_code_recv_socket = auth_code_recv_socket.await.unwrap()?; - if let Some(window) = app.get_webview_window("modrinth-signin") { - window.close()?; - } + let auth_request_uri = format!( + "{}?launcher=true&ipver={}&port={}", + mr_auth::authenticate_begin_flow(), + if auth_code_recv_socket.is_ipv4() { + "4" + } else { + "6" + }, + auth_code_recv_socket.port() + ); - let window = tauri::WebviewWindowBuilder::new( - &app, - "modrinth-signin", - tauri::WebviewUrl::External(redirect_uri.parse().map_err(|_| { - theseus::ErrorKind::OtherError( - "Error parsing auth redirect URL".to_string(), + app.opener() + .open_url(auth_request_uri, None::<&str>) + .map_err(|e| { + TheseusSerializableError::Theseus( + theseus::ErrorKind::OtherError(format!( + "Failed to open auth request URI: {e}" + )) + .into(), ) - .as_error() - })?), - ) - .min_inner_size(420.0, 632.0) - .inner_size(420.0, 632.0) - .max_inner_size(420.0, 632.0) - .zoom_hotkeys_enabled(false) - .title("Sign into Modrinth") - .always_on_top(true) - .center() - .build()?; + })?; - window.request_user_attention(Some(UserAttentionType::Critical))?; + let Some(auth_code) = auth_code.await.unwrap()? else { + return Err(TheseusSerializableError::Theseus( + theseus::ErrorKind::OtherError("Login canceled".into()).into(), + )); + }; - while (Utc::now() - start) < Duration::minutes(10) { - if window.title().is_err() { - // user closed window, cancelling flow - return Ok(None); - } + let credentials = mr_auth::authenticate_finish_flow(&auth_code).await?; - if window - .url()? - .as_str() - .starts_with("https://launcher-files.modrinth.com") - { - let url = window.url()?; - - let code = url.query_pairs().find(|(key, _)| key == "code"); - - window.close()?; - - return if let Some((_, code)) = code { - let val = mr_auth::authenticate_finish_flow(&code).await?; - - Ok(Some(val)) - } else { - Ok(None) - }; - } - - tokio::time::sleep(std::time::Duration::from_millis(50)).await; + if let Some(main_window) = app.get_window("main") { + main_window.set_focus().ok(); } - window.close()?; - Ok(None) + Ok(credentials) } #[tauri::command] @@ -85,3 +76,8 @@ pub async fn logout() -> Result<()> { pub async fn get() -> Result> { Ok(theseus::mr_auth::get_credentials().await?) } + +#[tauri::command] +pub fn cancel_modrinth_login() { + oauth_utils::auth_code_reply::stop_listeners(); +} diff --git a/apps/app/src/api/oauth_utils/auth_code_reply.rs b/apps/app/src/api/oauth_utils/auth_code_reply.rs new file mode 100644 index 000000000..4e4a52928 --- /dev/null +++ b/apps/app/src/api/oauth_utils/auth_code_reply.rs @@ -0,0 +1,159 @@ +//! A minimal OAuth 2.0 authorization code grant flow redirection/reply loopback URI HTTP +//! server implementation, compliant with [RFC 6749]'s authorization code grant flow and +//! [RFC 8252]'s best current practices for OAuth 2.0 in native apps. +//! +//! This server is needed for the step 4 of the OAuth authentication dance represented in +//! figure 1 of [RFC 8252]. +//! +//! Further reading: https://www.oauth.com/oauth2-servers/oauth-native-apps/redirect-urls-for-native-apps/ +//! +//! [RFC 6749]: https://datatracker.ietf.org/doc/html/rfc6749 +//! [RFC 8252]: https://datatracker.ietf.org/doc/html/rfc8252 + +use std::{ + net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr}, + sync::{LazyLock, Mutex}, + time::Duration, +}; + +use hyper::body::Incoming; +use hyper_util::rt::{TokioIo, TokioTimer}; +use theseus::ErrorKind; +use tokio::{ + net::TcpListener, + sync::{broadcast, oneshot}, +}; + +static SERVER_SHUTDOWN: LazyLock> = + LazyLock::new(|| broadcast::channel(1024).0); + +/// Starts a temporary HTTP server to receive OAuth 2.0 authorization code grant flow redirects +/// on a loopback interface with an ephemeral port. The caller can know the bound socket address +/// by listening on the counterpart channel for `listen_socket_tx`. +/// +/// If the server is stopped before receiving an authorization code, `Ok(None)` is returned. +pub async fn listen( + listen_socket_tx: oneshot::Sender>, +) -> Result, theseus::Error> { + // IPv4 is tried first for the best compatibility and performance with most systems. + // IPv6 is also tried in case IPv4 is not available. Resolving "localhost" is avoided + // to prevent failures deriving from improper name resolution setup. Any available + // ephemeral port is used to prevent conflicts with other services. This is all as per + // RFC 8252's recommendations + const ANY_LOOPBACK_SOCKET: &[SocketAddr] = &[ + SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0), + SocketAddr::new(IpAddr::V6(Ipv6Addr::LOCALHOST), 0), + ]; + + let listener = match TcpListener::bind(ANY_LOOPBACK_SOCKET).await { + Ok(listener) => { + listen_socket_tx + .send(listener.local_addr().map_err(|e| { + ErrorKind::OtherError(format!( + "Failed to get auth code reply socket address: {e}" + )) + .into() + })) + .ok(); + + listener + } + Err(e) => { + let error_msg = + format!("Failed to bind auth code reply socket: {e}"); + + listen_socket_tx + .send(Err(ErrorKind::OtherError(error_msg.clone()).into())) + .ok(); + + return Err(ErrorKind::OtherError(error_msg).into()); + } + }; + + let mut auth_code = Mutex::new(None); + let mut shutdown_notification = SERVER_SHUTDOWN.subscribe(); + + while auth_code.get_mut().unwrap().is_none() { + let client_socket = tokio::select! { + biased; + _ = shutdown_notification.recv() => { + break; + } + conn_accept_result = listener.accept() => { + match conn_accept_result { + Ok((socket, _)) => socket, + Err(e) => { + tracing::warn!("Failed to accept auth code reply: {e}"); + continue; + } + } + } + }; + + if let Err(e) = hyper::server::conn::http1::Builder::new() + .keep_alive(false) + .header_read_timeout(Duration::from_secs(5)) + .timer(TokioTimer::new()) + .auto_date_header(false) + .serve_connection( + TokioIo::new(client_socket), + hyper::service::service_fn(|req| handle_reply(req, &auth_code)), + ) + .await + { + tracing::warn!("Failed to handle auth code reply: {e}"); + } + } + + Ok(auth_code.into_inner().unwrap()) +} + +/// Stops any active OAuth 2.0 authorization code grant flow reply listening HTTP servers. +pub fn stop_listeners() { + SERVER_SHUTDOWN.send(()).ok(); +} + +async fn handle_reply( + req: hyper::Request, + auth_code_out: &Mutex>, +) -> Result, hyper::http::Error> { + if req.method() != hyper::Method::GET { + return hyper::Response::builder() + .status(hyper::StatusCode::METHOD_NOT_ALLOWED) + .header("Allow", "GET") + .body("".into()); + } + + // The authorization code is guaranteed to be sent as a "code" query parameter + // in the request URI query string as per RFC 6749 § 4.1.2 + let auth_code = req.uri().query().and_then(|query_string| { + query_string + .split('&') + .filter_map(|query_pair| query_pair.split_once('=')) + .find_map(|(key, value)| (key == "code").then_some(value)) + }); + + let response = if let Some(auth_code) = auth_code { + *auth_code_out.lock().unwrap() = Some(auth_code.to_string()); + + hyper::Response::builder() + .status(hyper::StatusCode::OK) + .header("Content-Type", "text/html;charset=utf-8") + .body( + include_str!("auth_code_reply/page.html") + .replace("{{title}}", "Success") + .replace("{{message}}", "You have successfully signed in! You can close this page now."), + ) + } else { + hyper::Response::builder() + .status(hyper::StatusCode::BAD_REQUEST) + .header("Content-Type", "text/html;charset=utf-8") + .body( + include_str!("auth_code_reply/page.html") + .replace("{{title}}", "Error") + .replace("{{message}}", "Authorization code not found. Please try signing in again."), + ) + }?; + + Ok(response) +} diff --git a/apps/app/src/api/oauth_utils/auth_code_reply/page.html b/apps/app/src/api/oauth_utils/auth_code_reply/page.html new file mode 100644 index 000000000..f0ccff4ad --- /dev/null +++ b/apps/app/src/api/oauth_utils/auth_code_reply/page.html @@ -0,0 +1 @@ +Sign In - Modrinth App
diff --git a/apps/app/src/api/oauth_utils/mod.rs b/apps/app/src/api/oauth_utils/mod.rs new file mode 100644 index 000000000..4182cfb6c --- /dev/null +++ b/apps/app/src/api/oauth_utils/mod.rs @@ -0,0 +1,3 @@ +//! Assorted utilities for OAuth 2.0 authorization flows. + +pub mod auth_code_reply; diff --git a/apps/app/tauri.conf.json b/apps/app/tauri.conf.json index 724e536d8..8667de5c6 100644 --- a/apps/app/tauri.conf.json +++ b/apps/app/tauri.conf.json @@ -63,6 +63,7 @@ "height": 800, "resizable": true, "title": "Modrinth App", + "label": "main", "width": 1280, "minHeight": 700, "minWidth": 1100, diff --git a/apps/frontend/src/pages/auth/sign-in.vue b/apps/frontend/src/pages/auth/sign-in.vue index b9a62301b..23d6b8de5 100644 --- a/apps/frontend/src/pages/auth/sign-in.vue +++ b/apps/frontend/src/pages/auth/sign-in.vue @@ -1,6 +1,12 @@