From 6d29c4c76b5affa64ae1b2e697984cafe5664246 Mon Sep 17 00:00:00 2001
From: John Estabrook <jestabro@vyos.io>
Date: Sun, 26 Feb 2023 15:21:13 -0600
Subject: graphql: T4979: add user info to token request

---
 .../api/graphql/graphql/auth_token_mutation.py     | 14 +++++++-
 src/services/api/graphql/libs/token_auth.py        |  7 ++--
 src/services/api/graphql/session/session.py        | 38 +++++++++++++---------
 3 files changed, 39 insertions(+), 20 deletions(-)

diff --git a/src/services/api/graphql/graphql/auth_token_mutation.py b/src/services/api/graphql/graphql/auth_token_mutation.py
index 21ac40094..603a13758 100644
--- a/src/services/api/graphql/graphql/auth_token_mutation.py
+++ b/src/services/api/graphql/graphql/auth_token_mutation.py
@@ -20,6 +20,7 @@ from ariadne import ObjectType, UnionType
 from graphql import GraphQLResolveInfo
 
 from .. libs.token_auth import generate_token
+from .. session.session import get_user_info
 from .. import state
 
 auth_token_mutation = ObjectType("Mutation")
@@ -36,13 +37,24 @@ def auth_token_resolver(obj: Any, info: GraphQLResolveInfo, data: Dict):
                   datetime.timedelta(seconds=exp_interval))
 
     res = generate_token(user, passwd, secret, expiration)
-    if res:
+    try:
+        res |= get_user_info(user)
+    except ValueError:
+        # non-existent user already caught
+        pass
+    if 'token' in res:
         data['result'] = res
         return {
             "success": True,
             "data": data
         }
 
+    if 'errors' in res:
+        return {
+            "success": False,
+            "errors": res['errors']
+        }
+
     return {
         "success": False,
         "errors": ['token generation failed']
diff --git a/src/services/api/graphql/libs/token_auth.py b/src/services/api/graphql/libs/token_auth.py
index 2100eba7f..8585485c9 100644
--- a/src/services/api/graphql/libs/token_auth.py
+++ b/src/services/api/graphql/libs/token_auth.py
@@ -29,14 +29,13 @@ def generate_token(user: str, passwd: str, secret: str, exp: int) -> dict:
         payload_data = {'iss': user, 'sub': user_id, 'exp': exp}
         secret = state.settings.get('secret')
         if secret is None:
-            return {
-                    "success": False,
-                    "errors": ['failed secret generation']
-                   }
+            return {"errors": ['missing secret']}
         token = jwt.encode(payload=payload_data, key=secret, algorithm="HS256")
 
         users |= {user_id: user}
         return {'token': token}
+    else:
+        return {"errors": ['failed pam authentication']}
 
 def get_user_context(request):
     context = {}
diff --git a/src/services/api/graphql/session/session.py b/src/services/api/graphql/session/session.py
index b2aef9bd9..3c5a062b6 100644
--- a/src/services/api/graphql/session/session.py
+++ b/src/services/api/graphql/session/session.py
@@ -29,6 +29,28 @@ from api.graphql.libs.op_mode import normalize_output
 
 op_mode_include_file = os.path.join(directories['data'], 'op-mode-standardized.json')
 
+def get_config_dict(path=[], effective=False, key_mangling=None,
+                     get_first_key=False, no_multi_convert=False,
+                     no_tag_node_value_mangle=False):
+    config = Config()
+    return config.get_config_dict(path=path, effective=effective,
+                                  key_mangling=key_mangling,
+                                  get_first_key=get_first_key,
+                                  no_multi_convert=no_multi_convert,
+                                  no_tag_node_value_mangle=no_tag_node_value_mangle)
+
+def get_user_info(user):
+    user_info = {}
+    info = get_config_dict(['system', 'login', 'user', user],
+                           get_first_key=True)
+    if not info:
+        raise ValueError("No such user")
+
+    user_info['user'] = user
+    user_info['full_name'] = info.get('full-name', '')
+
+    return user_info
+
 class Session:
     """
     Wrapper for calling configsession functions based on GraphQL requests.
@@ -46,17 +68,6 @@ class Session:
         except Exception:
             self._op_mode_list = None
 
-    @staticmethod
-    def _get_config_dict(path=[], effective=False, key_mangling=None,
-                         get_first_key=False, no_multi_convert=False,
-                         no_tag_node_value_mangle=False):
-        config = Config()
-        return config.get_config_dict(path=path, effective=effective,
-                                      key_mangling=key_mangling,
-                                      get_first_key=get_first_key,
-                                      no_multi_convert=no_multi_convert,
-                                      no_tag_node_value_mangle=no_tag_node_value_mangle)
-
     def show_config(self):
         session = self._session
         data = self._data
@@ -134,10 +145,7 @@ class Session:
         user_info = {}
         user = data['user']
         try:
-            info = self._get_config_dict(['system', 'login', 'user', user,
-                                          'full-name'])
-            user_info['user'] = user
-            user_info['full_name'] = info.get('full-name', '')
+            user_info = get_user_info(user)
         except Exception as error:
             raise error
 
-- 
cgit v1.2.3