libeufin

tan.rs (7490B)

---

 /*
 * This file is part of LibEuFin.
 * Copyright (C) 2026 Taler Systems S.A.
 
 * LibEuFin is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation; either version 3, or
 * (at your option) any later version.
 
 * LibEuFin is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General
 * Public License for more details.
 
 * You should have received a copy of the GNU Affero General Public
 * License along with LibEuFin; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>
 */
 
 //! Data access logic for tan challenged
 
 use std::time::Duration;
 
 use compact_str::CompactString;
 use jiff::Timestamp;
 use sqlx::{PgPool, Row, postgres::PgRow};
 use taler_api::{
     db::{BindHelper, TypeHelper},
     serialized,
 };
 use taler_common::types::base32::Base32;
 use uuid::Uuid;
 
 use crate::{TanChannel, mfa::Operation};
 
 /** Create a new challenge */
 pub async fn new(
     db: &PgPool,
     username: &str,
     op: Operation,
     hash: &Base32<64>,
     salt: &Base32<16>,
     code: &str,
     now: &Timestamp,
     retry_counter: u16,
     validity: Duration,
     channel: TanChannel,
     info: &str,
 ) -> sqlx::Result<Uuid> {
     serialized!(
         sqlx::query_scalar(
             "
         INSERT INTO tan_challenges (
             hbody,
             salt,
             op,
             code,
             creation_date,
             expiration_date,
             retry_counter,
             customer,
             tan_channel,
             tan_info,
             uuid
         ) VALUES (
             $1,
             $2,
             $3,
             $4,
             $5,
             $6,
             $7,
             (SELECT customer_id FROM customers WHERE username = $8 AND deleted_at IS NULL),
             $9,
             $10,
             gen_random_uuid()
         ) RETURNING uuid
         ",
         )
         .bind(hash)
         .bind(salt)
         .bind(op)
         .bind(code)
         .bind_timestamp(now)
         .bind_timestamp(&(*now + validity))
         .bind(retry_counter as i16)
         .bind(username)
         .bind(channel)
         .bind(info)
         .fetch_one(db)
     )
 }
 
 /** Result of TAN challenge transmission */
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum SendResult {
     Send {
         info: CompactString,
         channel: TanChannel,
         code: CompactString,
         expiration: Timestamp,
     },
     Success {
         expiration: Timestamp,
         retransmission: Timestamp,
     },
     Expired,
     Solved,
     NotFound,
     TooMany,
 }
 
 /** Request TAN challenge transmission */
 pub async fn send(
     db: &PgPool,
     uuid: &Uuid,
     now: &Timestamp,
     max_active: u16,
 ) -> sqlx::Result<SendResult> {
     Ok(serialized!(
         sqlx::query("
     SELECT
        (confirmation_date IS NOT NULL) as solved
       ,retransmission_date
       ,expiration_date
       ,code
       ,tan_channel
       ,tan_info
       ,retry_counter
       -- If this is the first time we submit this challenge check there is not too many active challenges
       ,(retransmission_date = 0 AND (
         SELECT count(*) >= $1
         FROM tan_challenges as o
         WHERE c.customer = o.customer
           AND retransmission_date != 0
           AND confirmation_date IS NULL
           AND expiration_date >= $2
       )) AS too_many
     FROM tan_challenges as c
     WHERE uuid = $3
     ")
     .bind(max_active as i16)
     .bind_timestamp(now)
     .bind(uuid)
     .try_map(|r: PgRow| Ok(
             if r.try_get("solved")? {
                 SendResult::Solved
             } else if r.try_get::<i32, _>("retry_counter")? <= 0 {
                 SendResult::Expired
             } else if r.try_get("too_many")? {
                 SendResult::TooMany
             } else {
                 let retransmission = r.try_get_timestamp("retransmission_date")?;
                 let expiration = r.try_get_timestamp("expiration_date")?;
                 if expiration <= *now {
                     SendResult::Expired
                 } else if retransmission <= *now {
                     SendResult::Send {
                         info: r.try_get("tan_info")?,
                         channel: r.try_get("tan_channel")?,
                         code: r.try_get("code")?,
                         expiration
                     }
                 } else {
                     SendResult::Success {
                         expiration,
                         retransmission
                     }
                 }
             }
         ))
     .fetch_optional(db)
     )?.unwrap_or(SendResult::NotFound))
 }
 
 /** Mark TAN challenge transmission */
 pub async fn mark_sent(db: &PgPool, uuid: &Uuid, retransmission: &Timestamp) -> sqlx::Result<()> {
     serialized!(
         sqlx::query("UPDATE tan_challenges SET retransmission_date = $1 WHERE uuid = $2")
             .bind_timestamp(retransmission)
             .bind(uuid)
             .execute(db)
     )?;
     Ok(())
 }
 
 /** Result of TAN challenge solution */
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum SolveResult {
     Success {
         op: Operation,
         channel: Option<TanChannel>,
         info: Option<CompactString>,
     },
     NotFound,
     NoRetry,
     Expired,
     BadCode,
 }
 
 /** Solve TAN challenge */
 pub async fn solve(
     db: &PgPool,
     uuid: &Uuid,
     code: &str,
     timestamp: &Timestamp,
 ) -> sqlx::Result<SolveResult> {
     serialized!(
         sqlx::query(
             "
         SELECT
             out_ok, out_no_op, out_no_retry, out_expired,
             out_op, out_channel, out_info
         FROM tan_challenge_try($1,$2,$3)
         ",
         )
         .bind(uuid)
         .bind(code)
         .bind_timestamp(timestamp)
         .try_map(|r: PgRow| {
             Ok(if r.try_get_flag("out_ok")? {
                 SolveResult::Success {
                     op: r.try_get("out_op")?,
                     channel: r.try_get("out_channel")?,
                     info: r.try_get("out_info")?,
                 }
             } else if r.try_get_flag("out_no_op")? {
                 SolveResult::NotFound
             } else if r.try_get_flag("out_no_retry")? {
                 SolveResult::NoRetry
             } else if r.try_get_flag("out_expired")? {
                 SolveResult::Expired
             } else {
                 SolveResult::BadCode
             })
         })
         .fetch_one(db)
     )
 }
 
 #[derive(Debug)]
 pub struct Challenge {
     pub id: Uuid,
     pub salt: Base32<16>,
     pub hash: Base32<64>,
     pub channel: TanChannel,
     pub info: CompactString,
     pub confirmed: bool,
     pub op: Operation,
 }
 
 pub async fn challenge(db: &PgPool, uuids: &[Uuid]) -> sqlx::Result<Vec<Challenge>> {
     serialized!(
         sqlx::query(
             "
         SELECT uuid, salt, hbody, tan_channel, tan_info, op, (confirmation_date IS NOT NULL) as confirmed
         FROM tan_challenges
         WHERE uuid = ANY($1)
         ",
         )
         .bind(uuids)
         .try_map(|r: PgRow| {
             Ok(Challenge {
                 id: r.try_get("uuid")?,
                 salt: r.try_get("salt")?,
                 hash: r.try_get("hbody")?,
                 channel: r.try_get("tan_channel")?,
                 info: r.try_get("tan_info")?,
                 confirmed: r.try_get("confirmed")?,
                 op: r.try_get("op")?,
             })
         })
         .fetch_all(db)
     )
 }