Line data    Source code

       1              : /*
       2              :    This file is part of Challenger
       3              :    Copyright (C) 2023 Taler Systems SA
       4              : 
       5              :    Challenger is free software; you can redistribute it and/or modify it under the
       6              :    terms of the GNU General Public License as published by the Free Software
       7              :    Foundation; either version 3, or (at your option) any later version.
       8              : 
       9              :    Challenger is distributed in the hope that it will be useful, but WITHOUT ANY
      10              :    WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
      11              :    A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
      12              : 
      13              :    You should have received a copy of the GNU General Public License along with
      14              :    Challenger; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
      15              :  */
      16              : /**
      17              :  * @file src/challengerdb/update_validation.c
      18              :  * @brief Implementation of the update_validation function for Postgres
      19              :  * @author Christian Grothoff
      20              :  * @author Bohdan Potuzhnyi
      21              :  * @author Vlada Svirsh
      22              :  */
      23              : #include "platform.h"
      24              : #include <taler/taler_error_codes.h>
      25              : #include <taler/taler_dbevents.h>
      26              : #include <taler/taler_pq_lib.h>
      27              : #include "update_validation.h"
      28              : #include "pg_helper.h"
      29              : 
      30              : 
      31              : enum GNUNET_DB_QueryStatus
      32           15 : CHALLENGERDB_update_validation (
      33              :   struct CHALLENGERDB_PostgresContext *ctx,
      34              :   const struct CHALLENGER_ValidationNonceP *nonce,
      35              :   uint64_t client_id,
      36              :   const char *client_scope,
      37              :   const char *client_state,
      38              :   const char *client_redirect_uri,
      39              :   const char *code_challenge,
      40              :   uint32_t code_challenge_method,
      41              :   json_t **last_address,
      42              :   uint32_t *address_attempts_left,
      43              :   uint32_t *pin_transmissions_left,
      44              :   uint32_t *auth_attempts_left,
      45              :   bool *solved,
      46              :   struct GNUNET_TIME_Absolute *last_tx_time)
      47              : {
      48              :   struct GNUNET_TIME_Absolute now
      49           15 :     = GNUNET_TIME_absolute_get ();
      50           15 :   struct GNUNET_PQ_QueryParam params[] = {
      51           15 :     GNUNET_PQ_query_param_auto_from_type (nonce),
      52           15 :     GNUNET_PQ_query_param_uint64 (&client_id),
      53              :     NULL != client_scope
      54            9 :     ? GNUNET_PQ_query_param_string (client_scope)
      55           15 :     : GNUNET_PQ_query_param_null (),
      56              :     NULL != client_state
      57           12 :     ? GNUNET_PQ_query_param_string (client_state)
      58           15 :     : GNUNET_PQ_query_param_null (),
      59              :     NULL != client_redirect_uri
      60           15 :     ? GNUNET_PQ_query_param_string (client_redirect_uri)
      61           15 :     : GNUNET_PQ_query_param_null (),
      62              :     NULL != code_challenge
      63            2 :     ? GNUNET_PQ_query_param_string (code_challenge)
      64           15 :     : GNUNET_PQ_query_param_null (),
      65           15 :     GNUNET_PQ_query_param_uint32 (&code_challenge_method),
      66           15 :     GNUNET_PQ_query_param_absolute_time (&now),
      67              :     GNUNET_PQ_query_param_end
      68              :   };
      69           15 :   struct GNUNET_PQ_ResultSpec rs[] = {
      70           15 :     GNUNET_PQ_result_spec_allow_null (
      71              :       TALER_PQ_result_spec_json ("address",
      72              :                                  last_address),
      73              :       NULL),
      74           15 :     GNUNET_PQ_result_spec_uint32 ("address_attempts_left",
      75              :                                   address_attempts_left),
      76           15 :     GNUNET_PQ_result_spec_uint32 ("pin_transmissions_left",
      77              :                                   pin_transmissions_left),
      78           15 :     GNUNET_PQ_result_spec_uint32 ("auth_attempts_left",
      79              :                                   auth_attempts_left),
      80           15 :     GNUNET_PQ_result_spec_bool ("solved",
      81              :                                 solved),
      82           15 :     GNUNET_PQ_result_spec_absolute_time ("last_tx_time",
      83              :                                          last_tx_time),
      84              :     GNUNET_PQ_result_spec_end
      85              :   };
      86              : 
      87           15 :   *last_address = NULL;
      88              :   /* A repeated /authorize must never *weaken* an existing PKCE binding
      89              :      (RFC 7636): /authorize authenticates nobody (the client_id is a plain
      90              :      query argument) and the nonce is recoverable from an issued code, so
      91              :      replaying /authorize without a code_challenge would otherwise strip the
      92              :      binding from a validation that already had one.  Hence COALESCE, just
      93              :      like for client_redirect_uri above.  code_challenge_method must move
      94              :      with the challenge it describes: the column is NOT NULL DEFAULT 0, so
      95              :      writing it unconditionally would leave a retained challenge with the
      96              :      method of the request that tried to drop it. */
      97           15 :   PREPARE (ctx,
      98              :            "update_validation",
      99              :            "UPDATE validations SET"
     100              :            "  client_scope=$3"
     101              :            " ,client_state=$4"
     102              :            " ,client_redirect_uri=COALESCE($5::VARCHAR,client_redirect_uri)"
     103              :            " ,code_challenge=COALESCE($6::VARCHAR,code_challenge)"
     104              :            " ,code_challenge_method=CASE"
     105              :            "    WHEN $6::VARCHAR IS NULL"
     106              :            "    THEN code_challenge_method"
     107              :            "    ELSE $7"
     108              :            "  END"
     109              :            " WHERE nonce=$1"
     110              :            "   AND client_serial_id=$2"
     111              :            "   AND expiration_time > $8"
     112              :            "   AND ( ($5::VARCHAR=client_redirect_uri)"
     113              :            "      OR ( ($5::VARCHAR IS NULL)"
     114              :            "       AND (client_redirect_uri IS NOT NULL) ) )"
     115              :            " RETURNING"
     116              :            "   address"
     117              :            "  ,address_attempts_left"
     118              :            "  ,pin_transmissions_left"
     119              :            "  ,GREATEST(0, auth_attempts_left) AS auth_attempts_left"
     120              :            "  ,auth_attempts_left = -1 AS solved"
     121              :            "  ,last_tx_time;");
     122           15 :   return GNUNET_PQ_eval_prepared_singleton_select (ctx->conn,
     123              :                                                    "update_validation",
     124              :                                                    params,
     125              :                                                    rs);
     126              : }