ApiController.cs

Go to the documentation of this file.

using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.Extensions.Logging;
using System;
using System.Globalization;
using System.Linq;
using System.Net;
using System.Threading.Tasks;
using Tgstation.Server.Api;
using Tgstation.Server.Api.Models;
using Tgstation.Server.Host.Models;
using Tgstation.Server.Host.Security;

namespace Tgstation.Server.Host.Controllers
{
    [Produces(ApiHeaders.ApplicationJson)]
    [Consumes(ApiHeaders.ApplicationJson)]
    public abstract class ApiController : Controller
    {
        protected ApiHeaders ApiHeaders { get; private set; }

        protected IDatabaseContext DatabaseContext { get; }

        protected IAuthenticationContext AuthenticationContext { get; }

        protected ILogger Logger { get; }

        protected Models.Instance Instance { get; }

        readonly bool requireInstance;

        readonly bool requireHeaders;

        public ApiController(IDatabaseContext databaseContext, IAuthenticationContextFactory authenticationContextFactory, ILogger logger, bool requireInstance, bool requireHeaders)
        {
            DatabaseContext = databaseContext ?? throw new ArgumentNullException(nameof(databaseContext));
            if (authenticationContextFactory == null)
                throw new ArgumentNullException(nameof(authenticationContextFactory));
            Logger = logger ?? throw new ArgumentNullException(nameof(logger));
            AuthenticationContext = authenticationContextFactory.CurrentAuthenticationContext;
            Instance = AuthenticationContext?.InstanceUser?.Instance;
            this.requireInstance = requireInstance;
            this.requireHeaders = requireHeaders;
        }

        public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
        {
            //ALL valid token and login requests that match a route go through this function
            //404 is returned before

            if (AuthenticationContext != null && AuthenticationContext.User == null)
            {
                //valid token, expired password
                await Unauthorized().ExecuteResultAsync(context).ConfigureAwait(false);
                return;
            }

            //validate the headers
            try
            {
                ApiHeaders = new ApiHeaders(Request.GetTypedHeaders());

                if (!ApiHeaders.Compatible())
                {
                    await StatusCode((int)HttpStatusCode.UpgradeRequired, new ErrorMessage
                    {
                        Message = "Provided API version is incompatible with server version!"
                    }).ExecuteResultAsync(context).ConfigureAwait(false);
                    return;
                }

                if (requireInstance)
                {
                    if (!ApiHeaders.InstanceId.HasValue)
                    {
                        await BadRequest(new ErrorMessage { Message = "Missing Instance header!" }).ExecuteResultAsync(context).ConfigureAwait(false);
                        return;
                    }
                    if (AuthenticationContext.InstanceUser == null)
                    {
                        //accessing an instance they don't have access to or one that's disabled
                        await Forbid().ExecuteResultAsync(context).ConfigureAwait(false);
                        return;
                    }
                }
            }
            catch (InvalidOperationException e)
            {
                if (requireHeaders)
                {
                    await BadRequest(new ErrorMessage { Message = e.Message }).ExecuteResultAsync(context).ConfigureAwait(false);
                    return;
                }
            }

            if (ModelState?.IsValid == false)
            {
                var errorMessages = ModelState.SelectMany(x => x.Value.Errors).Select(x => x.ErrorMessage).ToList();
                //HACK
                //do some fuckery to remove RequiredAttribute errors
                for (var I = 0; I < errorMessages.Count; ++I)
                {
                    var message = errorMessages[I];
                    if (message.StartsWith("The ", StringComparison.Ordinal) && message.EndsWith(" field is required.", StringComparison.Ordinal))
                    {
                        errorMessages.RemoveAt(I);
                        --I;
                    }
                }
                if (errorMessages.Count > 0)
                {
                    await BadRequest(new ErrorMessage { Message = String.Join(Environment.NewLine, errorMessages) }).ExecuteResultAsync(context).ConfigureAwait(false);
                    return;
                }
            }

            if (ApiHeaders != null)
                Logger.LogDebug("Request made by User ID {0}. Api version: {1}. User-Agent: {2}. Type: {3}. Route {4}{5} to Instance {6}", AuthenticationContext?.User.Id.ToString(CultureInfo.InvariantCulture), ApiHeaders.ApiVersion, ApiHeaders.UserAgent, Request.Method, Request.Path, Request.QueryString, ApiHeaders.InstanceId);

            try
            {
                await base.OnActionExecutionAsync(context, next).ConfigureAwait(false);
            }
            catch (OperationCanceledException e)
            {
                Logger.LogDebug("Request cancelled! Exception: {0}", e);
                throw;
            }
        }
    }
}