ApiController.cs

Go to the documentation of this file.

using System;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using System.Net;
using System.Net.Mime;
using System.Threading;
using System.Threading.Tasks;
 
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Query;
using Microsoft.Extensions.Logging;
using Microsoft.Net.Http.Headers;
 
using Octokit;
 
using Serilog.Context;
 
using Tgstation.Server.Api;
using Tgstation.Server.Api.Models;
using Tgstation.Server.Api.Models.Response;
using Tgstation.Server.Host.Database;
using Tgstation.Server.Host.Extensions;
using Tgstation.Server.Host.Models;
using Tgstation.Server.Host.Security;
using Tgstation.Server.Host.Utils;
 
namespace Tgstation.Server.Host.Controllers
{
    [Produces(MediaTypeNames.Application.Json)]
    [ApiController]
    public abstract class ApiController : Controller
    {
        private const ushort DefaultPageSize = 10;
 
        private const ushort MaximumPageSize = 100;
 
        protected ApiHeaders ApiHeaders { get; private set; }
 
        protected IDatabaseContext DatabaseContext { get; }
 
        protected IAuthenticationContext AuthenticationContext { get; }
 
        protected ILogger<ApiController> Logger { get; }
 
        protected Models.Instance Instance { get; }
 
        readonly bool requireHeaders;
 
        protected ApiController(
            IDatabaseContext databaseContext,
            IAuthenticationContextFactory authenticationContextFactory,
            ILogger<ApiController> logger,
            bool requireHeaders)
        {
            DatabaseContext = databaseContext ?? throw new ArgumentNullException(nameof(databaseContext));
            ArgumentNullException.ThrowIfNull(authenticationContextFactory);
            Logger = logger ?? throw new ArgumentNullException(nameof(logger));
            AuthenticationContext = authenticationContextFactory.CurrentAuthenticationContext;
            Instance = AuthenticationContext?.InstancePermissionSet?.Instance;
            this.requireHeaders = requireHeaders;
        }
 
#pragma warning disable CA1506 // TODO: Decomplexify
        public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
        {
            ArgumentNullException.ThrowIfNull(context);
 
            // ALL valid token and login requests that match a route go through this function
            // 404 is returned before
            if (AuthenticationContext != null && AuthenticationContext.User == null)
            {
                // valid token, expired password
                await Unauthorized().ExecuteResultAsync(context);
                return;
            }
 
            // validate the headers
            try
            {
                ApiHeaders = new ApiHeaders(Request.GetTypedHeaders());
 
                if (!ApiHeaders.Compatible())
                {
                    await this.StatusCode(
                        HttpStatusCode.UpgradeRequired,
                        new ErrorMessageResponse(ErrorCode.ApiMismatch))
                        .ExecuteResultAsync(context);
                    return;
                }
 
                var errorCase = await ValidateRequest(context.HttpContext.RequestAborted);
                if (errorCase != null)
                {
                    await errorCase.ExecuteResultAsync(context);
                    return;
                }
            }
            catch (HeadersException)
            {
                if (requireHeaders)
                {
                    await HeadersIssue(false)
                        .ExecuteResultAsync(context);
                    return;
                }
            }
 
            if (ModelState?.IsValid == false)
            {
                var errorMessages = ModelState
                    .SelectMany(x => x.Value.Errors)
                    .Select(x => x.ErrorMessage)
 
                    // We use RequiredAttributes purely for preventing properties from becoming nullable in the databases
                    // We validate missing required fields in controllers
                    // Unfortunately, we can't remove the whole validator for that as it checks other things like StringLength
                    // This is the best way to deal with it unfortunately
                    .Where(x => !x.EndsWith(" field is required.", StringComparison.Ordinal));
 
                if (errorMessages.Any())
                {
                    await BadRequest(
                        new ErrorMessageResponse(ErrorCode.ModelValidationFailure)
                        {
                            AdditionalData = String.Join(Environment.NewLine, errorMessages),
                        })
                        .ExecuteResultAsync(context);
                    return;
                }
 
                ModelState.Clear();
            }
 
            using (ApiHeaders?.InstanceId != null
                ? LogContext.PushProperty(SerilogContextHelper.InstanceIdContextProperty, ApiHeaders.InstanceId)
                : null)
            using (AuthenticationContext != null
                ? LogContext.PushProperty(SerilogContextHelper.UserIdContextProperty, AuthenticationContext.User.Id)
                : null)
            using (LogContext.PushProperty(SerilogContextHelper.RequestPathContextProperty, $"{Request.Method} {Request.Path}"))
            {
                if (ApiHeaders != null)
                {
                    var isGet = HttpMethods.IsGet(Request.Method);
                    if (!(isGet && Request.Path.StartsWithSegments(Routes.Jobs, StringComparison.OrdinalIgnoreCase)))
                        Logger.Log(
                            isGet
                                ? LogLevel.Trace
                                : LogLevel.Debug,
                            "Starting API request: Version: {clientApiVersion}. {userAgentHeaderName}: {clientUserAgent}",
                            ApiHeaders.ApiVersion.Semver(),
                            HeaderNames.UserAgent,
                            ApiHeaders.RawUserAgent);
                }
                else if (Request.Headers.TryGetValue(HeaderNames.UserAgent, out var userAgents))
                    Logger.LogDebug(
                        "Starting unauthorized API request. {userAgentHeaderName}: {allUserAgents}",
                        HeaderNames.UserAgent,
                        userAgents);
                else
                    Logger.LogDebug(
                        "Starting unauthorized API request. No {userAgentHeaderName}!",
                        HeaderNames.UserAgent);
                await base.OnActionExecutionAsync(context, next);
            }
        }
#pragma warning restore CA1506
 
        protected new NotFoundObjectResult NotFound() => NotFound(new ErrorMessageResponse(ErrorCode.ResourceNeverPresent));
 
        protected ObjectResult RequiresPosixSystemIdentity(NotImplementedException ex)
        {
            Logger.LogTrace(ex, "System identities not implemented!");
            return this.StatusCode(HttpStatusCode.NotImplemented, new ErrorMessageResponse(ErrorCode.RequiresPosixSystemIdentity));
        }
 
        protected StatusCodeResult StatusCode(HttpStatusCode statusCode) => StatusCode((int)statusCode);
 
        protected ObjectResult Created(object payload) => StatusCode((int)HttpStatusCode.Created, payload);
 
        protected ObjectResult RateLimit(RateLimitExceededException rateLimitException)
        {
            ArgumentNullException.ThrowIfNull(rateLimitException);
 
            Logger.LogWarning(rateLimitException, "Exceeded GitHub rate limit!");
 
            var secondsString = Math.Ceiling(rateLimitException.GetRetryAfterTimeSpan().TotalSeconds).ToString(CultureInfo.InvariantCulture);
            Response.Headers.Add(HeaderNames.RetryAfter, secondsString);
            return this.StatusCode(HttpStatusCode.TooManyRequests, new ErrorMessageResponse(ErrorCode.GitHubApiRateLimit));
        }
 
        protected virtual Task<IActionResult> ValidateRequest(CancellationToken cancellationToken)
            => Task.FromResult<IActionResult>(null);
 
        protected IActionResult HeadersIssue(bool ignoreMissingAuth)
        {
            HeadersException headersException;
            try
            {
                _ = new ApiHeaders(Request.GetTypedHeaders(), ignoreMissingAuth);
                throw new InvalidOperationException("Expected a header parse exception!");
            }
            catch (HeadersException ex)
            {
                headersException = ex;
            }
 
            var errorMessage = new ErrorMessageResponse(ErrorCode.BadHeaders)
            {
                AdditionalData = headersException.Message,
            };
 
            if (headersException.MissingOrMalformedHeaders.HasFlag(HeaderTypes.Accept))
                return this.StatusCode(HttpStatusCode.NotAcceptable, errorMessage);
 
            return BadRequest(errorMessage);
        }
 
        protected Task<IActionResult> Paginated<TModel>(
            Func<Task<PaginatableResult<TModel>>> queryGenerator,
            Func<TModel, Task> resultTransformer,
            int? pageQuery,
            int? pageSizeQuery,
            CancellationToken cancellationToken) => PaginatedImpl(
                queryGenerator,
                resultTransformer,
                pageQuery,
                pageSizeQuery,
                cancellationToken);
 
        protected Task<IActionResult> Paginated<TModel, TApiModel>(
            Func<Task<PaginatableResult<TModel>>> queryGenerator,
            Func<TApiModel, Task> resultTransformer,
            int? pageQuery,
            int? pageSizeQuery,
            CancellationToken cancellationToken)
            where TModel : IApiTransformable<TApiModel>
            => PaginatedImpl(
                queryGenerator,
                resultTransformer,
                pageQuery,
                pageSizeQuery,
                cancellationToken);
 
        async Task<IActionResult> PaginatedImpl<TModel, TResultModel>(
            Func<Task<PaginatableResult<TModel>>> queryGenerator,
            Func<TResultModel, Task> resultTransformer,
            int? pageQuery,
            int? pageSizeQuery,
            CancellationToken cancellationToken)
        {
            ArgumentNullException.ThrowIfNull(queryGenerator);
 
            if (pageQuery <= 0 || pageSizeQuery <= 0)
                return BadRequest(new ErrorMessageResponse(ErrorCode.ApiInvalidPageOrPageSize));
 
            var pageSize = pageSizeQuery ?? DefaultPageSize;
            if (pageSize > MaximumPageSize)
                return BadRequest(new ErrorMessageResponse(ErrorCode.ApiPageTooLarge)
                {
                    AdditionalData = $"Maximum page size: {MaximumPageSize}",
                });
 
            var page = pageQuery ?? 1;
 
            var paginationResult = await queryGenerator();
            if (paginationResult.EarlyOut != null)
                return paginationResult.EarlyOut;
 
            var queriedResults = paginationResult
                .Results
                .Skip((page - 1) * pageSize)
                .Take(pageSize);
 
            int totalResults;
            List<TModel> pagedResults;
            if (queriedResults.Provider is IAsyncQueryProvider)
            {
                totalResults = await paginationResult.Results.CountAsync(cancellationToken);
                pagedResults = await queriedResults
                    .ToListAsync(cancellationToken);
            }
            else
            {
                totalResults = paginationResult.Results.Count();
                pagedResults = queriedResults.ToList();
            }
 
            ICollection<TResultModel> finalResults;
            if (typeof(TModel) == typeof(TResultModel))
                finalResults = (List<TResultModel>)(object)pagedResults; // clearly a safe cast
            else
                finalResults = pagedResults
                    .OfType<IApiTransformable<TResultModel>>()
                    .Select(x => x.ToApi())
                    .ToList();
 
            if (resultTransformer != null)
                foreach (var finalResult in finalResults)
                    await resultTransformer(finalResult);
 
            var carryTheOne = totalResults % pageSize != 0
                ? 1
                : 0;
            return Json(
                new PaginatedResponse<TResultModel>
                {
                    Content = finalResults,
                    PageSize = pageSize,
                    TotalPages = (ushort)(totalResults / pageSize) + carryTheOne,
                    TotalItems = totalResults,
                });
        }
    }
}