feature: every user manages their own account through /account.

debian-package/src/usr/lib/vpn-router/web

@@ -15,12 +15,15 @@ Pages:
            profile, and TOTP enrolment (see users())
   /groups  the groups of the router's directory: list, add, rename or describe, remove, and
            add and take out members (see groups())
+  /account the account of the signed-in user: its details, its password and its TOTP
+           enrolment (see account())
   /auth    sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
 
-/config, /users and /groups need an HS256 JWT in an Authorization: Bearer header signed with
-vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names a user in sub, who
-must be a member of vpnrouter_users.ADMIN_GROUP; a token of vpn-router-token has the admin
-claim, and only such a token may change ADMIN_GROUP: create, rename to it, change, remove it,
+/config, /users, /groups and /account need an HS256 JWT in an Authorization: Bearer header signed
+with vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names a user in sub;
+/account serves that user, and the other paths need a member of vpnrouter_users.ADMIN_GROUP. A
+token of vpn-router-token has the admin claim and names no user; it may call every path but
+/account, and only such a token may change ADMIN_GROUP: create, rename to it, change, remove it,
 add or take out its members, and remove one of its members. These paths and /auth are not
 served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls per client
 address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by
@@ -507,6 +510,54 @@ def groups(state, method, path, body):
     return (201 if route == ('POST', 1, None) else 200), document
 
 
+def account(name, method, path, body):
+    """Answer an /account request of the user named by the token with vpnrouter_users: the HTTP status and the JSON document.
+
+      GET  /account            the user, with admin, whether the user is a member of ADMIN_GROUP
+      PUT  /account/password   set the password: {"current_password", "current_code"?, "password"}
+      POST /account/otp        a new TOTP secret and its otpauth URI; nothing is stored
+      PUT  /account/otp        store a TOTP secret: {"current_password", "current_code"?, "secret", "code"},
+                               code a code of the secret
+
+    A change needs the current password and, for an enrolled user, a current code; a wrong one is 403 and counts as
+    a failed login. A password change revokes the user's refresh tokens.
+    """
+    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
+        return 400, {'error': 'the body must be a JSON object'}
+    body = body or {}
+    route = (method, path.rstrip('/'))
+    if route not in (('GET', '/account'), ('PUT', '/account/password'), ('POST', '/account/otp'), ('PUT', '/account/otp')):
+        return 404, {'error': f'no route {method} {path}'}
+    try:
+        if route == ('PUT', '/account/password'):
+            vpnrouter_users.check_password(body.get('password'))
+        if method == 'PUT':
+            vpnrouter_users.login(name, body.get('current_password'), body.get('current_code'))
+        with vpnrouter_users.session() as connection:
+            if route == ('GET', '/account'):
+                document = {**vpnrouter_users.summary(vpnrouter_users.entry(connection, name)),
+                            'admin': vpnrouter_users.is_admin(connection, name)}
+            elif route == ('PUT', '/account/password'):
+                document = vpnrouter_users.passwd(connection, name, body['password'])
+            elif route == ('POST', '/account/otp'):
+                document = vpnrouter_users.otp_new(connection, name)
+            else:
+                document = vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code'))
+        if route == ('PUT', '/account/password'):
+            vpnrouter_auth.revoke(vpnrouter.load_config(), name)
+    except vpnrouter_users.Failure as failure:
+        if failure.status == 5:
+            return 403, {'error': 'the current password or code is wrong'}
+        return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
+    except (ldap.LDAPError, OSError) as exc:
+        return 500, {'error': f'the user directory failed: {exc}'}
+    except vpnrouter_auth.DatabaseError as exc:
+        return 500, {'error': str(exc)}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+    return 200, document
+
+
 def changes_admins(connection, method, parts, body):
     """Whether a /users or /groups request creates, renames to, changes or removes ADMIN_GROUP, or removes a member of it."""
     admins = vpnrouter_users.ADMIN_GROUP
@@ -523,9 +574,11 @@ def changes_admins(connection, method, parts, body):
 
 def refusal(claims, method, path, body):
     """Why the holder of the claims may not make the request to a protected path, or '' when it may."""
+    name = claims.get('sub')
+    if path == '/account' or path.startswith('/account/'):
+        return '' if isinstance(name, str) else 'the token names no user'
     if claims.get('admin') is True:
         return ''
-    name = claims.get('sub')
     if not isinstance(name, str):
         return 'the token names no user'
     admins = vpnrouter_users.ADMIN_GROUP
@@ -625,7 +678,7 @@ class Handler(BaseHTTPRequestHandler):
         # A body that is not read must not be taken for the next request.
         if self.command not in ('GET', 'HEAD'):
             self.close_connection = True
-        directory = next((name for name in ('users', 'groups') if path == f'/{name}' or path.startswith(f'/{name}/')), None)
+        directory = next((name for name in ('users', 'groups', 'account') if path == f'/{name}' or path.startswith(f'/{name}/')), None)
         protected = path == '/config' or directory is not None
         signing = path in ('/auth', '/auth/refresh', '/auth/logout')
         state = current() if protected or signing else {}
@@ -653,6 +706,9 @@ class Handler(BaseHTTPRequestHandler):
             body = json.dumps({'error': refused[1]}, indent=2).encode() + b'\n'
         elif path == '/config' and self.command in ('GET', 'HEAD'):
             body, kind, code = json.dumps(details(state), indent=2).encode() + b'\n', 'application/json', 200
+        elif directory == 'account':
+            code, document = account(claims['sub'], self.command, path, payload)
+            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif protected and path != '/config':
             code, document = (users if directory == 'users' else groups)(state, self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'