qgsauthmanager.h

Go to the documentation of this file.

/***************************************************************************
    qgsauthmanager.h
    ---------------------
    begin                : October 5, 2014
    copyright            : (C) 2014 by Boundless Spatial, Inc. USA
    author               : Larry Shaffer
    email                : lshaffer at boundlessgeo dot com
 ***************************************************************************
 *                                                                         *
 *   This program is free software; you can redistribute it and/or modify  *
 *   it under the terms of the GNU General Public License as published by  *
 *   the Free Software Foundation; either version 2 of the License, or     *
 *   (at your option) any later version.                                   *
 *                                                                         *
 ***************************************************************************/
 
#ifndef QGSAUTHMANAGER_H
#define QGSAUTHMANAGER_H
 
#include "qgis_core.h"
#include "qgis_sip.h"
 
#include <QNetworkReply>
#include <QNetworkRequest>
#include <QObject>
#include <QRecursiveMutex>
#include <QSqlDatabase>
#include <QSqlError>
#include <QSqlQuery>
#include <QStringList>
 
#ifndef QT_NO_SSL
#include <QSslCertificate>
#include <QSslKey>
#include <QtCrypto>
#include "qgsauthcertutils.h"
#endif
 
#include "qgsauthconfig.h"
#include "qgsauthmethod.h"
 
#include <qt6keychain/keychain.h>
 
#ifndef SIP_RUN
#ifdef HAVE_AUTH
namespace QCA
{
  class Initializer;
}
#endif
#endif
class QgsAuthMethod;
class QgsAuthMethodEdit;
class QgsAuthProvider;
class QgsAuthMethodMetadata;
class QgsSettingsEntryBool;
class QTimer;
class QgsAuthConfigurationStorage;
class QgsAuthConfigurationStorageDb;
class QgsAuthConfigurationStorageRegistry;

class CORE_EXPORT QgsAuthManager : public QObject
{
    Q_OBJECT
 
  public:
    static const QgsSettingsEntryBool *settingsGenerateRandomPasswordForPasswordHelper SIP_SKIP;
    static const QgsSettingsEntryBool *settingsUsingGeneratedRandomPassword SIP_SKIP;
 
    static const QgsSettingsEntryBool *settingsPasswordHelperInsecureFallback SIP_SKIP;
 
    static const QgsSettingsEntryBool *settingsUsePasswordHelper SIP_SKIP;
 
    static const QgsSettingsEntryBool *settingsPasswordHelperLogging SIP_SKIP;

    enum MessageLevel
    {
      INFO = 0,
      WARNING = 1,
      CRITICAL = 2
    };
    Q_ENUM( MessageLevel )
 
    
    Q_DECL_DEPRECATED bool init( const QString &pluginPath = QString(), const QString &authDatabasePath = QString() ) SIP_DEPRECATED;

    void setup( const QString &pluginPath = QString(), const QString &authDatabasePath = QString() );

    bool ensureInitialized() const;
 
    ~QgsAuthManager() override;

    QgsAuthConfigurationStorageRegistry *authConfigurationStorageRegistry() const;

    Q_DECL_DEPRECATED QSqlDatabase authDatabaseConnection() const SIP_DEPRECATED;

    Q_DECL_DEPRECATED const QString authDatabaseConfigTable() const SIP_DEPRECATED { return AUTH_CONFIG_TABLE; }

    const QString methodConfigTableName() const;

    Q_DECL_DEPRECATED const QString authDatabaseServersTable() const SIP_DEPRECATED { return AUTH_SERVERS_TABLE; }
 

    bool isDisabled() const;

    const QString disabledMessage() const;

    Q_DECL_DEPRECATED const QString authenticationDatabasePath() const;

    static bool isFilesystemBasedDatabase( const QString &uri );

    QgsAuthConfigurationStorageDb *defaultDbStorage() const SIP_SKIP;

    const QString authenticationDatabaseUri() const;

    const QString authenticationDatabaseUriStripped() const;

    bool createAndStoreRandomMasterPasswordInKeyChain() SIP_SKIP;

    bool setMasterPassword( bool verify = false );

    bool setMasterPassword( const QString &password, bool verify = false );

    bool verifyMasterPassword( const QString &compare = QString() );

    bool masterPasswordIsSet() const;

    bool masterPasswordHashInDatabase() const;

    void clearMasterPassword() { mMasterPass = QString(); }

    bool masterPasswordSame( const QString &password ) const;

    bool resetMasterPassword( const QString &newpass, const QString &oldpass, bool keepbackup, QString *backuppath SIP_INOUT = nullptr );

    bool resetMasterPasswordUsingStoredPasswordHelper( const QString &newPassword, bool keepBackup, QString *backupPath = nullptr ) SIP_SKIP;

    bool scheduledAuthDatabaseErase() SIP_SKIP { return mScheduledDbErase; }

    void setScheduledAuthDatabaseErase( bool scheduleErase ) SIP_SKIP;

    void setScheduledAuthDatabaseEraseRequestEmitted( bool emitted ) { mScheduledDbEraseRequestEmitted = emitted; }

    QString authManTag() const { return AUTH_MAN_TAG; }

    bool registerCoreAuthMethods();

    QgsAuthMethodConfigsMap availableAuthMethodConfigs( const QString &dataprovider = QString() );

    void updateConfigAuthMethods();

    QgsAuthMethod *configAuthMethod( const QString &authcfg );

    QString configAuthMethodKey( const QString &authcfg ) const;

    QStringList authMethodsKeys( const QString &dataprovider = QString() );

    QgsAuthMethod *authMethod( const QString &authMethodKey );

    const QgsAuthMethodMetadata *authMethodMetadata( const QString &authMethodKey ) SIP_SKIP;

    QgsAuthMethodsMap authMethodsMap( const QString &dataprovider = QString() ) SIP_SKIP;
 
#ifdef HAVE_GUI
    SIP_IF_FEATURE( HAVE_GUI )
 
    
    QWidget *authMethodEditWidget( const QString &authMethodKey, QWidget *parent );
    SIP_END
#endif

    QgsAuthMethod::Expansions supportedAuthMethodExpansions( const QString &authcfg );

    const QString uniqueConfigId() const;

    bool configIdUnique( const QString &id ) const;

    static bool hasConfigId( const QString &txt );

    QString configIdRegex() const { return AUTH_CFG_REGEX; }

    QStringList configIds() const;

    bool storeAuthenticationConfig( QgsAuthMethodConfig &mconfig SIP_INOUT, bool overwrite = false );

    bool updateAuthenticationConfig( const QgsAuthMethodConfig &config );

    bool loadAuthenticationConfig( const QString &authcfg, QgsAuthMethodConfig &mconfig SIP_INOUT, bool full = false );

    bool removeAuthenticationConfig( const QString &authcfg );

    bool exportAuthenticationConfigsToXml( const QString &filename, const QStringList &authcfgs, const QString &password = QString() );

    bool importAuthenticationConfigsFromXml( const QString &filename, const QString &password = QString(), bool overwrite = false );

    bool removeAllAuthenticationConfigs();

    bool backupAuthenticationDatabase( QString *backuppath SIP_INOUT = nullptr );

    bool eraseAuthenticationDatabase( bool backup, QString *backuppath SIP_INOUT = nullptr );
 


    bool updateNetworkRequest( QNetworkRequest &request SIP_INOUT, const QString &authcfg, const QString &dataprovider = QString() );

    bool updateNetworkReply( QNetworkReply *reply, const QString &authcfg, const QString &dataprovider = QString() );

    bool updateDataSourceUriItems( QStringList &connectionItems SIP_INOUT, const QString &authcfg, const QString &dataprovider = QString() );

    bool updateNetworkProxy( QNetworkProxy &proxy SIP_INOUT, const QString &authcfg, const QString &dataprovider = QString() );


    bool storeAuthSetting( const QString &key, const QVariant &value, bool encrypt = false );

    QVariant authSetting( const QString &key, const QVariant &defaultValue = QVariant(), bool decrypt = false );

    bool existsAuthSetting( const QString &key );

    bool removeAuthSetting( const QString &key );
 
#ifndef QT_NO_SSL

    bool initSslCaches();

    bool storeCertIdentity( const QSslCertificate &cert, const QSslKey &key );

    const QSslCertificate certIdentity( const QString &id );

    const QPair<QSslCertificate, QSslKey> certIdentityBundle( const QString &id ) SIP_SKIP;

    const QStringList certIdentityBundleToPem( const QString &id );

    const QList<QSslCertificate> certIdentities();


    QStringList certIdentityIds() const;

    bool existsCertIdentity( const QString &id );

    bool removeCertIdentity( const QString &id );
 

    bool storeSslCertCustomConfig( const QgsAuthConfigSslServer &config );

    const QgsAuthConfigSslServer sslCertCustomConfig( const QString &id, const QString &hostport );

    const QgsAuthConfigSslServer sslCertCustomConfigByHost( const QString &hostport );

    const QList<QgsAuthConfigSslServer> sslCertCustomConfigs();

    bool existsSslCertCustomConfig( const QString &id, const QString &hostport );

    bool removeSslCertCustomConfig( const QString &id, const QString &hostport );

    QHash<QString, QSet<QSslError::SslError> > ignoredSslErrorCache() SIP_SKIP { return mIgnoredSslErrorsCache; }

    void dumpIgnoredSslErrorsCache_();

    bool updateIgnoredSslErrorsCacheFromConfig( const QgsAuthConfigSslServer &config );

    bool updateIgnoredSslErrorsCache( const QString &shahostport, const QList<QSslError> &errors );

    bool rebuildIgnoredSslErrorCache();
 

    bool storeCertAuthorities( const QList<QSslCertificate> &certs );

    bool storeCertAuthority( const QSslCertificate &cert );


    const QSslCertificate certAuthority( const QString &id );

    bool existsCertAuthority( const QSslCertificate &cert );

    bool removeCertAuthority( const QSslCertificate &cert );

    static const QList<QSslCertificate> systemRootCAs();

    const QList<QSslCertificate> extraFileCAs();

    const QList<QSslCertificate> databaseCAs();

    const QMap<QString, QSslCertificate> mappedDatabaseCAs();

    const QMap<QString, QPair<QgsAuthCertUtils::CaCertSource, QSslCertificate> > caCertsCache() SIP_SKIP { return mCaCertsCache; }

    bool rebuildCaCertsCache();

    bool storeCertTrustPolicy( const QSslCertificate &cert, QgsAuthCertUtils::CertTrustPolicy policy );

    QgsAuthCertUtils::CertTrustPolicy certTrustPolicy( const QSslCertificate &cert );

    bool removeCertTrustPolicies( const QList<QSslCertificate> &certs );

    bool removeCertTrustPolicy( const QSslCertificate &cert );

    QgsAuthCertUtils::CertTrustPolicy certificateTrustPolicy( const QSslCertificate &cert );

    bool setDefaultCertTrustPolicy( QgsAuthCertUtils::CertTrustPolicy policy );

    QgsAuthCertUtils::CertTrustPolicy defaultCertTrustPolicy();

    const QMap<QgsAuthCertUtils::CertTrustPolicy, QStringList > certTrustCache() { return mCertTrustCache; }

    bool rebuildCertTrustCache();

    const QList<QSslCertificate> trustedCaCerts( bool includeinvalid = false );

    const QList<QSslCertificate> untrustedCaCerts( QList<QSslCertificate> trustedCAs = QList<QSslCertificate>() );

    bool rebuildTrustedCaCertsCache();

    const QList<QSslCertificate> trustedCaCertsCache() { return mTrustedCaCertsCache; }

    const QByteArray trustedCaCertsPemText();
 
#endif

    const QString passwordHelperErrorMessage() SIP_SKIP { return mPasswordHelperErrorMessage; }

    bool passwordHelperDelete() SIP_SKIP;

    static bool passwordHelperEnabled();

    void setPasswordHelperEnabled( bool enabled );

    static bool passwordHelperLoggingEnabled() SIP_SKIP;

    static void setPasswordHelperLoggingEnabled( bool enabled ) SIP_SKIP;

    bool passwordHelperSync();

    bool verifyStoredPasswordHelperPassword() SIP_SKIP;
 
    // TODO QGIS 5.0 -- remove

    static const QString AUTH_PASSWORD_HELPER_DISPLAY_NAME;

    static QString passwordHelperDisplayName( bool titleCase = false );

    static const QString AUTH_MAN_TAG;

    QString sqliteDatabasePath() const SIP_SKIP;
 
  signals:

    void passwordHelperFailure();

    void passwordHelperSuccess();

    Q_DECL_DEPRECATED void messageOut( const QString &message, const QString &tag = QgsAuthManager::AUTH_MAN_TAG, QgsAuthManager::MessageLevel level = QgsAuthManager::INFO ) const SIP_DEPRECATED;

    void messageLog( const QString &message, const QString &tag = QgsAuthManager::AUTH_MAN_TAG, Qgis::MessageLevel level = Qgis::MessageLevel::Info ) const;

    Q_DECL_DEPRECATED void passwordHelperMessageOut( const QString &message, const QString &tag = QgsAuthManager::AUTH_MAN_TAG, QgsAuthManager::MessageLevel level = QgsAuthManager::INFO )
      SIP_DEPRECATED;

    void passwordHelperMessageLog( const QString &message, const QString &tag = QgsAuthManager::AUTH_MAN_TAG, Qgis::MessageLevel level = Qgis::MessageLevel::Info );

    void masterPasswordVerified( bool verified );

    void authDatabaseEraseRequested();

    void authDatabaseChanged();
 
  public slots:
    void clearAllCachedConfigs();

    void clearCachedConfig( const QString &authcfg );
 
  private slots:
    void writeToConsole( const QString &message, const QString &tag = QString(), Qgis::MessageLevel level = Qgis::MessageLevel::Info );

    void tryToStartDbErase();
 
  protected:
    static QgsAuthManager *instance() SIP_SKIP;
 
 
#ifdef Q_OS_WIN
  public:
    explicit QgsAuthManager() SIP_SKIP;
#else
  protected:
    explicit QgsAuthManager() SIP_SKIP;
#endif
 
  private:
    static QString generatePassword();
 
    bool initPrivate( const QString &pluginPath );

    // Password Helper methods

    QString passwordHelperName() const;

    void passwordHelperLog( const QString &msg ) const;

    QString passwordHelperRead( bool &ok );

    bool passwordHelperWrite( const QString &password );

    void passwordHelperSetErrorMessage( const QString &errorMessage ) { mPasswordHelperErrorMessage = errorMessage; }

    void passwordHelperClearErrors();

    void passwordHelperProcessError();
 
    bool masterPasswordInput();

    bool masterPasswordRowsInDb( int &rows ) const;
 
    bool masterPasswordCheckAgainstDb( const QString &compare = QString() ) const;
 
    bool masterPasswordStoreInDb() const;
 
    bool masterPasswordClearDb();
 
    const QString masterPasswordCiv() const;
 
    bool verifyPasswordCanDecryptConfigs() const;
 
    bool reencryptAllAuthenticationConfigs( const QString &prevpass, const QString &prevciv );
 
    bool reencryptAuthenticationConfig( const QString &authcfg, const QString &prevpass, const QString &prevciv );
 
    bool reencryptAllAuthenticationSettings( const QString &prevpass, const QString &prevciv );
 
    bool reencryptAllAuthenticationIdentities( const QString &prevpass, const QString &prevciv );
 
    bool reencryptAuthenticationIdentity( const QString &identid, const QString &prevpass, const QString &prevciv );
 
#ifndef QT_NO_SSL
    void insertCaCertInCache( QgsAuthCertUtils::CaCertSource source, const QList<QSslCertificate> &certs );
#endif
 
    QString authPasswordHelperKeyName() const;

    QgsAuthConfigurationStorage *firstStorageWithCapability( Qgis::AuthConfigurationStorageCapability capability ) const;
 
    static QgsAuthManager *sInstance;
    static const QString AUTH_CONFIG_TABLE;
    static const QString AUTH_SERVERS_TABLE;
    static const QString AUTH_CFG_REGEX;
 
    QString mPluginPath;
    QString mAuthDatabaseConnectionUri;
 
    mutable bool mLazyInitResult = false;
    bool mAuthInit = false;
 
    mutable std::unique_ptr<QgsAuthConfigurationStorageRegistry> mAuthConfigurationStorageRegistry;
#ifdef HAVE_AUTH
    std::unique_ptr<QCA::Initializer> mQcaInitializer;
#endif
 
    QHash<QString, QString> mConfigAuthMethods;
    QHash<QString, QgsAuthMethod *> mAuthMethods;
 
    QString mMasterPass;
    int mPassTries = 0;
    bool mAuthDisabled = false;
    QString mAuthDisabledMessage;
    std::unique_ptr<QTimer> mScheduledDbEraseTimer;
    bool mScheduledDbErase = false;
    int mScheduledDbEraseRequestWait = 3; // in seconds
    bool mScheduledDbEraseRequestEmitted = false;
    int mScheduledDbEraseRequestCount = 0;
 
    std::unique_ptr<QRecursiveMutex> mMutex;
    std::unique_ptr<QRecursiveMutex> mMasterPasswordMutex;
#ifndef QT_NO_SSL
    // mapping of sha1 digest and cert source and cert
    // appending removes duplicates
    QMap<QString, QPair<QgsAuthCertUtils::CaCertSource, QSslCertificate> > mCaCertsCache;
    // list of sha1 digests per policy
    QMap<QgsAuthCertUtils::CertTrustPolicy, QStringList > mCertTrustCache;
    // cache of certs ready to be utilized in network connections
    QList<QSslCertificate> mTrustedCaCertsCache;
    // cache of SSL errors to be ignored in network connections, per sha-hostport
    QHash<QString, QSet<QSslError::SslError> > mIgnoredSslErrorsCache;
 
    bool mHasCustomConfigByHost = false;
    bool mHasCheckedIfCustomConfigByHostExists = false;
    QMap< QString, QgsAuthConfigSslServer > mCustomConfigByHostCache;
#endif

    // Password Helper Variables

    bool mPasswordHelperVerificationError = false;

    QString mPasswordHelperErrorMessage;

    QKeychain::Error mPasswordHelperErrorCode = QKeychain::NoError;

    bool mPasswordHelperLoggingEnabled = false;

    bool mPasswordHelperFailedInit = false;

    static const QLatin1String AUTH_PASSWORD_HELPER_KEY_NAME_BASE;

    static const QLatin1String AUTH_PASSWORD_HELPER_FOLDER_NAME;
 
    mutable QMap<QThread *, QMetaObject::Connection> mConnectedThreads;
 
    friend class QgsApplication;
};
 
#endif // QGSAUTHMANAGER_H