feat(auth): Implement stateless auth ticket system to speed up API requests

Signed-off-by: Marcel Klehr <mklehr@gmx.net>

Author: marcelklehr

lib/AppInfo/Application.php

@@ -25,6 +25,7 @@
 use OCA\Bookmarks\Hooks\BeforeTemplateRenderedListener;
 use OCA\Bookmarks\Hooks\UsersGroupsCirclesListener;
 use OCA\Bookmarks\Middleware\ExceptionMiddleware;
+use OCA\Bookmarks\Middleware\TicketMiddleware;
 use OCA\Bookmarks\Reference\BookmarkReferenceProvider;
 use OCA\Bookmarks\Search\Provider;
 use OCA\Bookmarks\Service\TreeCacheManager;
@@ -104,6 +105,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(BeforeTemplateRenderedEvent::class, BeforeTemplateRenderedListener::class);
 
 		$context->registerMiddleware(ExceptionMiddleware::class);
+		$context->registerMiddleware(TicketMiddleware::class);
 
 		$context->registerEventListener(ContentProviderRegisterEvent::class, ContextChatProvider::class);
 	}

lib/Middleware/TicketMiddleware.php

@@ -0,0 +1,44 @@
+<?php
+
+/*
+ * Copyright (c) 2021. The Nextcloud Bookmarks contributors.
+ *
+ * This file is licensed under the Affero General Public License version 3 or later. See the COPYING file.
+ */
+
+namespace OCA\Bookmarks\Middleware;
+
+use OCA\Bookmarks\Controller\BookmarkController;
+use OCA\Bookmarks\Controller\FoldersController;
+use OCA\Bookmarks\Controller\InternalBookmarkController;
+use OCA\Bookmarks\Controller\InternalFoldersController;
+use OCA\Bookmarks\Controller\TagsController;
+use OCA\Bookmarks\Db\Folder;
+use OCA\Bookmarks\Exception\UnauthenticatedError;
+use OCA\Bookmarks\Service\Authorizer;
+use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\DataResponse;
+use OCP\AppFramework\Http\Response;
+use OCP\AppFramework\Middleware;
+
+class TicketMiddleware extends Middleware {
+
+	public function __construct(private Authorizer $authorizer, private \OCP\IRequest $request) {
+	}
+
+	public function afterController(Controller $controller, string $methodName, Response $response): Response {
+		if ($controller instanceof FoldersController ||  $controller instanceof BookmarkController) {
+			if ($this->authorizer->getUserId() !== null && !str_starts_with($this->request->getHeader('Authorization'), 'Bearer')) {
+				if ($response instanceof DataResponse || $response instanceof Http\JSONResponse) {
+					$data = $response->getData();
+					if (is_array($data)) {
+						$data['ticket'] = $this->authorizer->generateTicket($this->authorizer->getUserId());
+						$response->setData($data);
+					}
+				}
+			}
+		}
+		return $response;
+	}
+}

lib/Service/Authorizer.php

@@ -20,7 +20,9 @@
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Db\MultipleObjectsReturnedException;
 use OCP\IRequest;
+use OCP\IUserManager;
 use OCP\IUserSession;
+use OCP\Security\ICrypto;
 
 class Authorizer {
 	public const PERM_NONE = 0;
@@ -44,6 +46,8 @@ public function __construct(
 		private TreeMapper $treeMapper,
 		private IUserSession $userSession,
 		private SharedFolderMapper $sharedFolderMapper,
+		private ICrypto $crypto,
+		private IUserManager $userManager,
 	) {
 	}
 
@@ -68,6 +72,12 @@ public function setCredentials(IRequest $request): void {
 		if ($auth !== null && $auth !== '') {
 			[$type, $credentials] = explode(' ', $auth);
 			if (strtolower($type) === 'bearer') {
+				$userFromTicket = $this->checkTicket($credentials);
+				if ($userFromTicket !== null) {
+					$this->userSession->setUser($this->userManager->get($userFromTicket));
+					$this->setUserId($userFromTicket);
+					return;
+				}
 				$this->setToken($credentials);
 			}
 		}
@@ -313,4 +323,24 @@ public function getTokenPermissionsForFolder(string $token, int $folderId): int
 		}
 		return self::PERM_NONE;
 	}
+
+	public function generateTicket(string $userId): string {
+		return $this->crypto->encrypt(json_encode(['userId' => $userId, 'timestamp' => time()]));
+	}
+
+	public function checkTicket(string $ticket): ?string {
+		try {
+			$data = json_decode($this->crypto->decrypt($ticket), true);
+		} catch (\Exception $e) {
+			return null;
+		}
+		if (!isset($data['userId'], $data['timestamp'])) {
+			return null;
+		}
+		if (time() > $data['timestamp'] + 3600) {
+			return null;
+		}
+
+		return $data['userId'];
+	}
 }