Jared Wolff
6db4e07538
The protected auth routes (/me, /change-password, /logout) were merged with public routes in auth_handler.rs but never had auth middleware applied in main.rs — so the CurrentUserId extractor always failed with 401. Split auth_routes() into auth_public_routes() and auth_protected_routes(), applying auth + CSRF middleware to the latter. Also added credentials: 'same-origin' to all 13 fetch calls in admin.js so the browser sends HttpOnly auth cookies with requests.
434 lines
18 KiB
Rust
434 lines
18 KiB
Rust
#[global_allocator]
|
|
static GLOBAL: mimalloc::MiMalloc = mimalloc::MiMalloc;
|
|
|
|
use std::net::SocketAddr;
|
|
use std::sync::Arc;
|
|
use std::time::Duration;
|
|
|
|
use socket2::{Domain, Protocol, Socket, TcpKeepalive, Type};
|
|
|
|
use axum::Router;
|
|
use axum::extract::DefaultBodyLimit;
|
|
use tower_http::limit::RequestBodyLimitLayer;
|
|
use tower_http::set_header::SetResponseHeaderLayer;
|
|
use tower_http::trace::TraceLayer;
|
|
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
|
|
|
|
/// OxiCloud - Cloud Storage Platform
|
|
///
|
|
/// OxiCloud is a NextCloud-like file storage system built in Rust with a focus on
|
|
/// performance, security, and clean architecture. The system provides:
|
|
///
|
|
/// - File and folder management with rich metadata
|
|
/// - User authentication and authorization
|
|
/// - File trash system with automatic cleanup
|
|
/// - Efficient handling of large files through parallel processing
|
|
/// - Compression capabilities for bandwidth optimization
|
|
/// - RESTful API and web interface
|
|
///
|
|
/// The architecture follows the Clean/Hexagonal Architecture pattern with:
|
|
///
|
|
/// - Domain Layer: Core business entities and repository interfaces (domain/*)
|
|
/// - Application Layer: Use cases and service orchestration (application/*)
|
|
/// - Infrastructure Layer: Technical implementations of repositories (infrastructure/*)
|
|
/// - Interface Layer: API endpoints and web controllers (interfaces/*)
|
|
///
|
|
/// Dependencies are managed through dependency inversion, with high-level modules
|
|
/// defining interfaces (ports) that low-level modules implement (adapters).
|
|
///
|
|
/// @author OxiCloud Development Team
|
|
use oxicloud::common;
|
|
use oxicloud::infrastructure;
|
|
use oxicloud::interfaces;
|
|
|
|
use common::di::AppServiceFactory;
|
|
use infrastructure::db::create_database_pools;
|
|
use interfaces::{create_api_routes, create_public_api_routes, web::create_web_routes};
|
|
|
|
#[tokio::main]
|
|
async fn main() -> Result<(), Box<dyn std::error::Error>> {
|
|
// Load .env file if present (for local development)
|
|
dotenvy::dotenv().ok();
|
|
|
|
// Initialize tracing
|
|
tracing_subscriber::registry()
|
|
.with(tracing_subscriber::EnvFilter::new(
|
|
std::env::var("RUST_LOG").unwrap_or_else(|_| "info".into()),
|
|
))
|
|
.with(tracing_subscriber::fmt::layer())
|
|
.init();
|
|
|
|
// Load configuration from environment variables
|
|
let config = common::config::AppConfig::from_env();
|
|
|
|
// Ensure storage and locales directories exist
|
|
let storage_path = config.storage_path.clone();
|
|
if !storage_path.exists() {
|
|
std::fs::create_dir_all(&storage_path).expect("Failed to create storage directory");
|
|
}
|
|
// Locales are embedded in the binary via rust-embed — no filesystem path needed.
|
|
|
|
// Initialize database pools if auth is enabled
|
|
let db_pools = if config.features.enable_auth {
|
|
match create_database_pools(&config).await {
|
|
Ok(pools) => {
|
|
tracing::info!("PostgreSQL database pools initialized successfully");
|
|
Some(pools)
|
|
}
|
|
Err(e) => {
|
|
// SECURITY: fail-closed. If auth is required but the database
|
|
// is unreachable, the server MUST NOT start in public mode.
|
|
panic!(
|
|
"FATAL: enable_auth=true but database connection failed: {}. \
|
|
Refusing to start without authentication.",
|
|
e
|
|
);
|
|
}
|
|
}
|
|
} else {
|
|
None
|
|
};
|
|
|
|
// Build all services via the factory
|
|
let factory = AppServiceFactory::with_config(storage_path, None, config.clone());
|
|
|
|
let app_state = factory.build_app_state(db_pools).await
|
|
.expect("Failed to build application state. If running in Docker, ensure the storage volume is writable by the oxicloud user (UID 1001)");
|
|
|
|
// Wrap in Arc so that Axum clones a single refcount per request
|
|
// instead of deep-copying ~42 Arc fields + 16 String/PathBuf allocations.
|
|
let app_state = Arc::new(app_state);
|
|
|
|
// Build application router
|
|
let api_routes = create_api_routes(&app_state);
|
|
let public_api_routes = create_public_api_routes(&app_state);
|
|
let web_routes = create_web_routes();
|
|
|
|
let mut app;
|
|
|
|
// Build CalDAV / CardDAV / WebDAV protocol routers (merged at top-level, not under /api)
|
|
use oxicloud::interfaces::api::handlers::caldav_handler;
|
|
use oxicloud::interfaces::api::handlers::carddav_handler;
|
|
use oxicloud::interfaces::api::handlers::webdav_handler;
|
|
let caldav_router = caldav_handler::caldav_routes();
|
|
let well_known_router = caldav_handler::well_known_routes();
|
|
let carddav_router = carddav_handler::carddav_routes();
|
|
let webdav_router = webdav_handler::webdav_routes();
|
|
|
|
// CalDAV/CardDAV only carry XML payloads — cap at 1 MB at the transport
|
|
// level so `body::to_bytes()` cannot be abused to OOM the server.
|
|
// WebDAV is excluded: its streaming PUT handler enforces its own per-upload
|
|
// limit from StorageConfig::max_upload_size.
|
|
let caldav_router = caldav_router.layer(RequestBodyLimitLayer::new(1_048_576));
|
|
let carddav_router = carddav_router.layer(RequestBodyLimitLayer::new(1_048_576));
|
|
|
|
// Build WOPI routes if enabled
|
|
use oxicloud::interfaces::api::handlers::wopi_handler;
|
|
let wopi_routes = if config.wopi.enabled {
|
|
if let (Some(token_svc), Some(lock_svc), Some(discovery_svc)) = (
|
|
&app_state.wopi_token_service,
|
|
&app_state.wopi_lock_service,
|
|
&app_state.wopi_discovery_service,
|
|
) {
|
|
let wopi_base_url = std::env::var("OXICLOUD_WOPI_BASE_URL")
|
|
.map(|v| v.trim_end_matches('/').to_string())
|
|
.ok()
|
|
.filter(|v| !v.is_empty())
|
|
.unwrap_or_else(|| config.base_url());
|
|
|
|
let wopi_state = wopi_handler::WopiState {
|
|
token_service: token_svc.clone(),
|
|
lock_service: lock_svc.clone(),
|
|
discovery_service: discovery_svc.clone(),
|
|
app_state: app_state.clone(),
|
|
public_base_url: config.base_url(),
|
|
wopi_base_url,
|
|
};
|
|
|
|
let (protocol, api) = wopi_handler::wopi_routes(wopi_state);
|
|
Some((protocol, api))
|
|
} else {
|
|
None
|
|
}
|
|
} else {
|
|
None
|
|
};
|
|
|
|
// Apply auth middleware to protected API routes when auth is enabled
|
|
if config.features.enable_auth {
|
|
// SECURITY: if auth is required, auth_service MUST be present at this
|
|
// point. The earlier guards in di.rs and main.rs guarantee this, but
|
|
// add a defensive check so a future refactor cannot silently degrade.
|
|
assert!(
|
|
app_state.auth_service.is_some(),
|
|
"FATAL: enable_auth=true but auth_service is None. \
|
|
This should have been caught during initialization."
|
|
);
|
|
}
|
|
if config.features.enable_auth {
|
|
use interfaces::api::handlers::auth_handler::{
|
|
auth_protected_routes, auth_public_routes, login_route, refresh_route, register_route,
|
|
setup_route,
|
|
};
|
|
use oxicloud::interfaces::api::handlers::app_password_handler;
|
|
use oxicloud::interfaces::api::handlers::device_auth_handler;
|
|
use oxicloud::interfaces::middleware::auth::auth_middleware;
|
|
use oxicloud::interfaces::middleware::csrf::csrf_middleware;
|
|
use oxicloud::interfaces::middleware::rate_limit::{
|
|
RateLimiter, rate_limit_login, rate_limit_refresh, rate_limit_register,
|
|
};
|
|
|
|
// ── Rate limiters (IP-based, in-memory via moka) ────────────────
|
|
let rl = &config.auth.rate_limit;
|
|
let login_limiter = Arc::new(RateLimiter::new(
|
|
rl.login_max_requests,
|
|
rl.login_window_secs,
|
|
100_000,
|
|
));
|
|
let register_limiter = Arc::new(RateLimiter::new(
|
|
rl.register_max_requests,
|
|
rl.register_window_secs,
|
|
100_000,
|
|
));
|
|
let refresh_limiter = Arc::new(RateLimiter::new(
|
|
rl.refresh_max_requests,
|
|
rl.refresh_window_secs,
|
|
100_000,
|
|
));
|
|
tracing::info!(
|
|
"Rate limiting enabled — login: {}/{} s, register: {}/{} s, refresh: {}/{} s",
|
|
rl.login_max_requests,
|
|
rl.login_window_secs,
|
|
rl.register_max_requests,
|
|
rl.register_window_secs,
|
|
rl.refresh_max_requests,
|
|
rl.refresh_window_secs,
|
|
);
|
|
|
|
// Auth routes split by rate-limit policy
|
|
let auth_login = login_route()
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
login_limiter.clone(),
|
|
rate_limit_login,
|
|
))
|
|
.with_state(app_state.clone());
|
|
let auth_register = register_route()
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
register_limiter.clone(),
|
|
rate_limit_register,
|
|
))
|
|
.with_state(app_state.clone());
|
|
let auth_refresh = refresh_route()
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
refresh_limiter.clone(),
|
|
rate_limit_refresh,
|
|
))
|
|
.with_state(app_state.clone());
|
|
// Public auth routes (status, OIDC)
|
|
let auth_public = auth_public_routes().with_state(app_state.clone());
|
|
// Protected auth routes (/me, /change-password, /logout) — require auth + CSRF
|
|
let auth_protected = auth_protected_routes()
|
|
.layer(axum::middleware::from_fn(csrf_middleware))
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
))
|
|
.with_state(app_state.clone());
|
|
// One-time setup route — public, rate-limited like register
|
|
let setup_router = setup_route()
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
register_limiter.clone(),
|
|
rate_limit_register,
|
|
))
|
|
.with_state(app_state.clone());
|
|
|
|
// Device Authorization Grant (RFC 8628)
|
|
// Public endpoints: /api/auth/device/authorize + /api/auth/device/token
|
|
let device_public =
|
|
device_auth_handler::device_auth_public_routes().with_state(app_state.clone());
|
|
// Protected endpoints: /api/auth/device/verify, /api/auth/device/devices
|
|
let device_protected = device_auth_handler::device_auth_protected_routes()
|
|
.layer(axum::middleware::from_fn(csrf_middleware))
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
))
|
|
.with_state(app_state.clone());
|
|
|
|
// App Password management endpoints (protected — require JWT)
|
|
let app_password_protected = app_password_handler::app_password_routes()
|
|
.layer(axum::middleware::from_fn(csrf_middleware))
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
))
|
|
.with_state(app_state.clone());
|
|
|
|
// Protected API routes — require valid JWT token
|
|
let protected_api = api_routes
|
|
.layer(axum::middleware::from_fn(csrf_middleware))
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
));
|
|
|
|
// CalDAV/CardDAV/WebDAV with auth middleware (merged, not nested)
|
|
let caldav_protected = caldav_router.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
));
|
|
let carddav_protected = carddav_router.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
));
|
|
let webdav_protected = webdav_router.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
));
|
|
|
|
app = Router::new()
|
|
// Rate-limited auth endpoints (login, register, refresh)
|
|
.nest("/api/auth", auth_login)
|
|
.nest("/api/auth", auth_register)
|
|
.nest("/api/auth", auth_refresh)
|
|
// Public auth endpoints (status, OIDC)
|
|
.nest("/api/auth", auth_public)
|
|
// Protected auth endpoints (/me, /change-password, /logout)
|
|
.nest("/api/auth", auth_protected)
|
|
// One-time setup endpoint — public, rate-limited
|
|
.nest("/api", setup_router)
|
|
// Device Auth Grant public endpoints (authorize + token polling)
|
|
.nest("/api/auth/device", device_public)
|
|
// Device Auth Grant protected endpoints (verify + device management)
|
|
.nest("/api/auth/device", device_protected)
|
|
// App Password management endpoints (create, list, revoke)
|
|
.nest("/api/auth", app_password_protected)
|
|
// Public API routes (share access, i18n) — no auth required
|
|
.nest("/api", public_api_routes)
|
|
// All other API routes are protected by auth middleware
|
|
.nest("/api", protected_api)
|
|
// RFC 6764 well-known discovery (public, no auth — just redirects)
|
|
.merge(well_known_router.clone())
|
|
// CalDAV/CardDAV/WebDAV protocols merged at top-level for client compatibility
|
|
.merge(caldav_protected)
|
|
.merge(carddav_protected)
|
|
.merge(webdav_protected)
|
|
.merge(web_routes)
|
|
.layer(TraceLayer::new_for_http());
|
|
|
|
// Mount WOPI routes (protocol routes use own token auth, API routes behind auth middleware)
|
|
if let Some((wopi_protocol, wopi_api)) = wopi_routes {
|
|
let wopi_api_protected = wopi_api
|
|
.layer(axum::middleware::from_fn(csrf_middleware))
|
|
.layer(axum::middleware::from_fn_with_state(
|
|
app_state.clone(),
|
|
auth_middleware,
|
|
));
|
|
app = app
|
|
.nest("/wopi", wopi_protocol)
|
|
.nest("/api/wopi", wopi_api_protected);
|
|
}
|
|
} else {
|
|
// Auth disabled — no middleware applied
|
|
tracing::warn!("Authentication is DISABLED — all API routes are publicly accessible");
|
|
app = Router::new()
|
|
.nest("/api", public_api_routes)
|
|
.nest("/api", api_routes)
|
|
// RFC 6764 well-known discovery (just redirects)
|
|
.merge(well_known_router)
|
|
// CalDAV/CardDAV/WebDAV protocols merged at top-level
|
|
.merge(caldav_router)
|
|
.merge(carddav_router)
|
|
.merge(webdav_router)
|
|
.merge(web_routes)
|
|
.layer(TraceLayer::new_for_http());
|
|
|
|
// Mount WOPI routes (no auth middleware when auth is disabled)
|
|
if let Some((wopi_protocol, wopi_api)) = wopi_routes {
|
|
app = app.nest("/wopi", wopi_protocol).nest("/api/wopi", wopi_api);
|
|
}
|
|
}
|
|
|
|
// Increase the default body limit to 10 GB to allow large file uploads.
|
|
// Without this Axum caps Multipart bodies at 2 MB.
|
|
app = app.layer(DefaultBodyLimit::max(10 * 1024 * 1024 * 1024));
|
|
|
|
// ── Security headers ─────────────────────────────────────────────────
|
|
// Applied globally so every response (API, static, DAV) carries them.
|
|
use axum::http::HeaderValue;
|
|
use axum::http::header::HeaderName;
|
|
|
|
app = app
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
HeaderName::from_static("content-security-policy"),
|
|
// All inline scripts and styles have been migrated to external
|
|
// files, so 'unsafe-inline' is no longer needed.
|
|
// frame-src is permissive (*) to allow WOPI editor iframes whose
|
|
// origin is configured at runtime (Collabora, OnlyOffice, etc.).
|
|
HeaderValue::from_static(
|
|
"default-src 'self'; \
|
|
script-src 'self'; \
|
|
style-src 'self'; \
|
|
img-src 'self' data: blob:; \
|
|
connect-src 'self'; \
|
|
font-src 'self' data:; \
|
|
frame-src *; \
|
|
frame-ancestors 'none'; \
|
|
base-uri 'self'; \
|
|
form-action 'self'",
|
|
),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
HeaderName::from_static("x-content-type-options"),
|
|
HeaderValue::from_static("nosniff"),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
HeaderName::from_static("x-frame-options"),
|
|
HeaderValue::from_static("DENY"),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
HeaderName::from_static("referrer-policy"),
|
|
HeaderValue::from_static("strict-origin-when-cross-origin"),
|
|
))
|
|
.layer(SetResponseHeaderLayer::overriding(
|
|
HeaderName::from_static("permissions-policy"),
|
|
HeaderValue::from_static("camera=(), microphone=(), geolocation=()"),
|
|
));
|
|
|
|
// Start server — tuned socket for low-latency responses
|
|
let addr = SocketAddr::from(([0, 0, 0, 0], 8086));
|
|
tracing::info!("Starting OxiCloud server on http://{}", addr);
|
|
|
|
let socket = Socket::new(Domain::IPV4, Type::STREAM, Some(Protocol::TCP))?;
|
|
socket.set_reuse_address(true)?;
|
|
// Allow multiple workers on the same port (future-ready)
|
|
#[cfg(not(windows))]
|
|
socket.set_reuse_port(true)?;
|
|
// Disable Nagle's algorithm — send small responses (JSON, PROPFIND)
|
|
// immediately instead of waiting up to 40ms for coalescing.
|
|
socket.set_tcp_nodelay(true)?;
|
|
// Detect dead connections within 60s instead of hours
|
|
socket.set_keepalive(true)?;
|
|
socket.set_tcp_keepalive(
|
|
&TcpKeepalive::new()
|
|
.with_time(Duration::from_secs(60))
|
|
.with_interval(Duration::from_secs(10)),
|
|
)?;
|
|
socket.set_nonblocking(true)?;
|
|
socket.bind(&addr.into())?;
|
|
// High backlog for connection bursts (WebDAV clients open many parallel connections)
|
|
socket.listen(2048)?;
|
|
|
|
let listener = tokio::net::TcpListener::from_std(socket.into())?;
|
|
|
|
// Provide the fully-built state to the router
|
|
let app = app.with_state(app_state);
|
|
|
|
// TCP_NODELAY is inherited from the listening socket on Linux,
|
|
// so every accepted connection already has Nagle disabled.
|
|
axum::serve(listener, app).await?;
|
|
tracing::info!("Server shutdown completed");
|
|
|
|
Ok(())
|
|
}
|