using MediaBrowser.Common.Extensions; using MediaBrowser.Common.Net; using MediaBrowser.Controller.Configuration; using MediaBrowser.Controller.Dto; using MediaBrowser.Controller.Library; using MediaBrowser.Controller.Net; using MediaBrowser.Controller.Session; using MediaBrowser.Model.Configuration; using MediaBrowser.Model.Connect; using MediaBrowser.Model.Dto; using MediaBrowser.Model.Users; using ServiceStack; using ServiceStack.Text.Controller; using System; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks; namespace MediaBrowser.Api { /// /// Class GetUsers /// [Route("/Users", "GET", Summary = "Gets a list of users")] [Authenticated] public class GetUsers : IReturn> { [ApiMember(Name = "IsHidden", Description = "Optional filter by IsHidden=true or false", IsRequired = false, DataType = "bool", ParameterType = "query", Verb = "GET")] public bool? IsHidden { get; set; } [ApiMember(Name = "IsDisabled", Description = "Optional filter by IsDisabled=true or false", IsRequired = false, DataType = "bool", ParameterType = "query", Verb = "GET")] public bool? IsDisabled { get; set; } [ApiMember(Name = "IsGuest", Description = "Optional filter by IsGuest=true or false", IsRequired = false, DataType = "bool", ParameterType = "query", Verb = "GET")] public bool? IsGuest { get; set; } } [Route("/Users/Public", "GET", Summary = "Gets a list of publicly visible users for display on a login screen.")] public class GetPublicUsers : IReturn> { } /// /// Class GetUser /// [Route("/Users/{Id}", "GET", Summary = "Gets a user by Id")] [Authenticated(EscapeParentalControl = true)] public class GetUser : IReturn { /// /// Gets or sets the id. /// /// The id. [ApiMember(Name = "User Id", IsRequired = true, DataType = "string", ParameterType = "path", Verb = "GET")] public string Id { get; set; } } /// /// Class DeleteUser /// [Route("/Users/{Id}", "DELETE", Summary = "Deletes a user")] [Authenticated(Roles = "Admin")] public class DeleteUser : IReturnVoid { /// /// Gets or sets the id. /// /// The id. [ApiMember(Name = "User Id", IsRequired = true, DataType = "string", ParameterType = "path", Verb = "DELETE")] public string Id { get; set; } } /// /// Class AuthenticateUser /// [Route("/Users/{Id}/Authenticate", "POST", Summary = "Authenticates a user")] public class AuthenticateUser : IReturn { /// /// Gets or sets the id. /// /// The id. [ApiMember(Name = "User Id", IsRequired = true, DataType = "string", ParameterType = "path", Verb = "POST")] public string Id { get; set; } /// /// Gets or sets the password. /// /// The password. [ApiMember(Name = "Password", IsRequired = true, DataType = "string", ParameterType = "body", Verb = "POST")] public string Password { get; set; } } /// /// Class AuthenticateUser /// [Route("/Users/AuthenticateByName", "POST", Summary = "Authenticates a user")] public class AuthenticateUserByName : IReturn { /// /// Gets or sets the id. /// /// The id. [ApiMember(Name = "Username", IsRequired = true, DataType = "string", ParameterType = "body", Verb = "POST")] public string Username { get; set; } /// /// Gets or sets the password. /// /// The password. [ApiMember(Name = "Password", IsRequired = true, DataType = "string", ParameterType = "body", Verb = "POST")] public string Password { get; set; } [ApiMember(Name = "PasswordMd5", IsRequired = true, DataType = "string", ParameterType = "body", Verb = "POST")] public string PasswordMd5 { get; set; } } /// /// Class UpdateUserPassword /// [Route("/Users/{Id}/Password", "POST", Summary = "Updates a user's password")] [Authenticated] public class UpdateUserPassword : IReturnVoid { /// /// Gets or sets the id. /// /// The id. public string Id { get; set; } /// /// Gets or sets the password. /// /// The password. public string CurrentPassword { get; set; } /// /// Gets or sets the new password. /// /// The new password. public string NewPassword { get; set; } /// /// Gets or sets a value indicating whether [reset password]. /// /// true if [reset password]; otherwise, false. public bool ResetPassword { get; set; } } /// /// Class UpdateUser /// [Route("/Users/{Id}", "POST", Summary = "Updates a user")] [Authenticated] public class UpdateUser : UserDto, IReturnVoid { } /// /// Class UpdateUser /// [Route("/Users/{Id}/Policy", "POST", Summary = "Updates a user policy")] [Authenticated(Roles = "admin")] public class UpdateUserPolicy : UserPolicy, IReturnVoid { [ApiMember(Name = "User Id", IsRequired = true, DataType = "string", ParameterType = "path", Verb = "POST")] public string Id { get; set; } } /// /// Class UpdateUser /// [Route("/Users/{Id}/Configuration", "POST", Summary = "Updates a user configuration")] [Authenticated] public class UpdateUserConfiguration : UserConfiguration, IReturnVoid { [ApiMember(Name = "User Id", IsRequired = true, DataType = "string", ParameterType = "path", Verb = "POST")] public string Id { get; set; } } /// /// Class CreateUser /// [Route("/Users/New", "POST", Summary = "Creates a user")] [Authenticated(Roles = "Admin")] public class CreateUserByName : IReturn { [ApiMember(Name = "Name", IsRequired = true, DataType = "string", ParameterType = "body", Verb = "POST")] public string Name { get; set; } } [Route("/Users/ForgotPassword", "POST", Summary = "Initiates the forgot password process for a local user")] public class ForgotPassword : IReturn { [ApiMember(Name = "EnteredUsername", IsRequired = false, DataType = "string", ParameterType = "body", Verb = "POST")] public string EnteredUsername { get; set; } } [Route("/Users/ForgotPassword/Pin", "POST", Summary = "Redeems a forgot password pin")] public class ForgotPasswordPin : IReturn { [ApiMember(Name = "Pin", IsRequired = false, DataType = "string", ParameterType = "body", Verb = "POST")] public string Pin { get; set; } } /// /// Class UsersService /// public class UserService : BaseApiService, IHasAuthorization { /// /// The _user manager /// private readonly IUserManager _userManager; private readonly IDtoService _dtoService; private readonly ISessionManager _sessionMananger; private readonly IServerConfigurationManager _config; private readonly INetworkManager _networkManager; public IAuthorizationContext AuthorizationContext { get; set; } public UserService(IUserManager userManager, IDtoService dtoService, ISessionManager sessionMananger, IServerConfigurationManager config, INetworkManager networkManager) { _userManager = userManager; _dtoService = dtoService; _sessionMananger = sessionMananger; _config = config; _networkManager = networkManager; } public object Get(GetPublicUsers request) { // If the startup wizard hasn't been completed then just return all users if (!_config.Configuration.IsStartupWizardCompleted) { return Get(new GetUsers { IsDisabled = false }); } // TODO: Uncomment once clients can handle an empty user list (and below) //if (Request.IsLocal || IsInLocalNetwork(Request.RemoteIp)) { return Get(new GetUsers { IsHidden = false, IsDisabled = false }); } //// Return empty when external //return ToOptimizedResult(new List()); } /// /// Gets the specified request. /// /// The request. /// System.Object. public object Get(GetUsers request) { var users = _userManager.Users; if (request.IsDisabled.HasValue) { users = users.Where(i => i.Policy.IsDisabled == request.IsDisabled.Value); } if (request.IsHidden.HasValue) { users = users.Where(i => i.Policy.IsHidden == request.IsHidden.Value); } if (request.IsGuest.HasValue) { users = users.Where(i => (i.ConnectLinkType.HasValue && i.ConnectLinkType.Value == UserLinkType.Guest) == request.IsGuest.Value); } var result = users .OrderBy(u => u.Name) .Select(i => _userManager.GetUserDto(i, Request.RemoteIp)) .ToList(); return ToOptimizedSerializedResultUsingCache(result); } /// /// Gets the specified request. /// /// The request. /// System.Object. public object Get(GetUser request) { var user = _userManager.GetUserById(request.Id); if (user == null) { throw new ResourceNotFoundException("User not found"); } var result = _userManager.GetUserDto(user, Request.RemoteIp); return ToOptimizedSerializedResultUsingCache(result); } /// /// Deletes the specified request. /// /// The request. public void Delete(DeleteUser request) { var task = DeleteAsync(request); Task.WaitAll(task); } public async Task DeleteAsync(DeleteUser request) { var user = _userManager.GetUserById(request.Id); if (user == null) { throw new ResourceNotFoundException("User not found"); } await _sessionMananger.RevokeUserTokens(user.Id.ToString("N")).ConfigureAwait(false); await _userManager.DeleteUser(user).ConfigureAwait(false); } /// /// Posts the specified request. /// /// The request. public object Post(AuthenticateUser request) { var user = _userManager.GetUserById(request.Id); if (user == null) { throw new ResourceNotFoundException("User not found"); } return Post(new AuthenticateUserByName { Username = user.Name, Password = request.Password }); } public async Task Post(AuthenticateUserByName request) { var auth = AuthorizationContext.GetAuthorizationInfo(Request); if (string.IsNullOrWhiteSpace(auth.Client)) { auth.Client = "Unknown app"; } if (string.IsNullOrWhiteSpace(auth.Device)) { auth.Device = "Unknown device"; } if (string.IsNullOrWhiteSpace(auth.Version)) { auth.Version = "Unknown version"; } if (string.IsNullOrWhiteSpace(auth.DeviceId)) { auth.DeviceId = "Unknown device id"; } var result = await _sessionMananger.AuthenticateNewSession(new AuthenticationRequest { App = auth.Client, AppVersion = auth.Version, DeviceId = auth.DeviceId, DeviceName = auth.Device, PasswordSha1 = request.Password, PasswordMd5 = request.PasswordMd5, RemoteEndPoint = Request.RemoteIp, Username = request.Username }).ConfigureAwait(false); return ToOptimizedResult(result); } /// /// Posts the specified request. /// /// The request. public void Post(UpdateUserPassword request) { var task = PostAsync(request); Task.WaitAll(task); } public async Task PostAsync(UpdateUserPassword request) { var user = _userManager.GetUserById(request.Id); if (user == null) { throw new ResourceNotFoundException("User not found"); } if (request.ResetPassword) { await _userManager.ResetPassword(user).ConfigureAwait(false); } else { var success = await _userManager.AuthenticateUser(user.Name, request.CurrentPassword, Request.RemoteIp).ConfigureAwait(false); if (!success) { throw new ArgumentException("Invalid user or password entered."); } await _userManager.ChangePassword(user, request.NewPassword).ConfigureAwait(false); } } /// /// Posts the specified request. /// /// The request. public void Post(UpdateUser request) { var task = PostAsync(request); Task.WaitAll(task); } public async Task PostAsync(UpdateUser request) { // We need to parse this manually because we told service stack not to with IRequiresRequestStream // https://code.google.com/p/servicestack/source/browse/trunk/Common/ServiceStack.Text/ServiceStack.Text/Controller/PathInfo.cs var pathInfo = PathInfo.Parse(Request.PathInfo); var id = new Guid(pathInfo.GetArgumentValue(1)); var dtoUser = request; var user = _userManager.GetUserById(id); var task = user.Name.Equals(dtoUser.Name, StringComparison.Ordinal) ? _userManager.UpdateUser(user) : _userManager.RenameUser(user, dtoUser.Name); await task.ConfigureAwait(false); await _userManager.UpdateConfiguration(dtoUser.Id, dtoUser.Configuration); } /// /// Posts the specified request. /// /// The request. /// System.Object. public object Post(CreateUserByName request) { var dtoUser = request; var newUser = _userManager.CreateUser(dtoUser.Name).Result; var result = _userManager.GetUserDto(newUser, Request.RemoteIp); return ToOptimizedResult(result); } /// /// Posts the specified request. /// /// The request. /// System.Object. public object Post(ForgotPassword request) { var isLocal = Request.IsLocal || _networkManager.IsInLocalNetwork(Request.RemoteIp); return _userManager.StartForgotPasswordProcess(request.EnteredUsername, isLocal); } public object Post(ForgotPasswordPin request) { return _userManager.RedeemPasswordResetPin(request.Pin); } public void Post(UpdateUserConfiguration request) { var task = _userManager.UpdateConfiguration(request.Id, request); Task.WaitAll(task); } public void Post(UpdateUserPolicy request) { var task = UpdateUserPolicy(request); Task.WaitAll(task); } private async Task UpdateUserPolicy(UpdateUserPolicy request) { var user = _userManager.GetUserById(request.Id); // If removing admin access if (!request.IsAdministrator && user.Policy.IsAdministrator) { if (_userManager.Users.Count(i => i.Policy.IsAdministrator) == 1) { throw new ArgumentException("There must be at least one user in the system with administrative access."); } } // If disabling if (request.IsDisabled && user.Policy.IsAdministrator) { throw new ArgumentException("Administrators cannot be disabled."); } // If disabling if (request.IsDisabled && !user.Policy.IsDisabled) { if (_userManager.Users.Count(i => !i.Policy.IsDisabled) == 1) { throw new ArgumentException("There must be at least one enabled user in the system."); } await _sessionMananger.RevokeUserTokens(user.Id.ToString("N")).ConfigureAwait(false); } await _userManager.UpdateUserPolicy(request.Id, request).ConfigureAwait(false); } } }