chromeos/ash/components/osauth/impl/auth_hub_impl.cc

// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chromeos/ash/components/osauth/impl/auth_hub_impl.h"
#include <memory>
#include <utility>

#include "base/check.h"
#include "base/check_op.h"
#include "base/functional/bind.h"
#include "base/functional/callback.h"
#include "base/logging.h"
#include "base/notreached.h"
#include "chromeos/ash/components/osauth/impl/auth_factor_presence_cache.h"
#include "chromeos/ash/components/osauth/impl/auth_hub_common.h"
#include "chromeos/ash/components/osauth/impl/auth_hub_mode_lifecycle.h"
#include "chromeos/ash/components/osauth/impl/auth_hub_vector_lifecycle.h"
#include "chromeos/ash/components/osauth/public/auth_attempt_consumer.h"
#include "chromeos/ash/components/osauth/public/auth_factor_engine_factory.h"
#include "chromeos/ash/components/osauth/public/auth_factor_status_consumer.h"
#include "chromeos/ash/components/osauth/public/common_types.h"
#include "chromeos/ash/components/osauth/public/string_utils.h"
#include "components/account_id/account_id.h"

namespace ash {

AuthHubImpl::AuthHubImpl(AuthFactorPresenceCache* factor_cache)
    : cache_(factor_cache) {
  mode_lifecycle_ = std::make_unique<AuthHubModeLifecycle>(this);
}

AuthHubImpl::~AuthHubImpl() = default;

void AuthHubImpl::InitializeForMode(AuthHubMode target) {
  CHECK_NE(target, AuthHubMode::kNone);
  SwitchToModeImpl(target);
}

void AuthHubImpl::CancelCurrentAttempt(AuthHubConnector* connector) {
  if (attempt_handler_->HasOngoingAttempt()) {
    attempt_handler_->PrepareForShutdown(
        base::BindOnce(&AuthHubImpl::OnFactorAttemptFinishedForCancel,
                       weak_factory_.GetWeakPtr()));
    return;
  }
  vector_lifecycle_->CancelAttempt();
}

void AuthHubImpl::Shutdown() {
  SwitchToModeImpl(AuthHubMode::kNone);
}

void AuthHubImpl::SwitchToModeImpl(AuthHubMode target) {
  if (vector_lifecycle_ && !vector_lifecycle_->IsIdle()) {
    target_mode_ = target;
    // Eventually, after the current attempt gets canceled, `OnIdle()` will be
    // triggered, which then switches the mode to `target_mode_`.
    if (attempt_handler_->HasOngoingAttempt()) {
      attempt_handler_->PrepareForShutdown(
          base::BindOnce(&AuthHubImpl::OnFactorAttemptFinishedForCancel,
                         weak_factory_.GetWeakPtr()));
      return;
    }
    vector_lifecycle_->CancelAttempt();
    return;
  }
  mode_lifecycle_->SwitchToMode(target);
}

void AuthHubImpl::OnFactorAttemptFinishedForCancel() {
  vector_lifecycle_->CancelAttempt();
}

void AuthHubImpl::EnsureInitialized(base::OnceClosure on_initialized) {
  if (mode_lifecycle_->IsReady()) {
    std::move(on_initialized).Run();
    return;
  }
  on_initialized_listeners_.AddUnsafe(std::move(on_initialized));
}

void AuthHubImpl::StartAuthentication(AccountId account_id,
                                      AuthPurpose purpose,
                                      AuthAttemptConsumer* consumer) {
  if (!PurposeMatchesMode(purpose, mode_lifecycle_->GetCurrentMode())) {
    LOG(ERROR) << "Attempt for " << purpose
               << " rejected due to incorrect mode "
               << mode_lifecycle_->GetCurrentMode();
    consumer->OnUserAuthAttemptRejected();
    return;
  }

  CHECK(vector_lifecycle_);
  AuthAttemptVector attempt{account_id, purpose};

  if (current_attempt_.has_value()) {
    // If we have two login attempts, let new attempt take
    // over the existing one.
    if (AttemptShouldOverrideAnother(attempt, *current_attempt_)) {
      LOG(WARNING) << "Overriding ongoing attempt";
      pending_attempt_ = attempt;
      pending_consumer_ = consumer;
      if (attempt_handler_->HasOngoingAttempt()) {
        attempt_handler_->PrepareForShutdown(
            base::BindOnce(&AuthHubImpl::OnFactorAttemptFinishedForCancel,
                           weak_factory_.GetWeakPtr()));
        return;
      }
      vector_lifecycle_->CancelAttempt();
      return;
    }
    if (AttemptShouldOverrideAnother(*current_attempt_, attempt)) {
      LOG(WARNING) << "Attempt rejected: another higher-priority attempt";
      consumer->OnUserAuthAttemptRejected();
      return;
    }
    // Neither attempt is considered "Stronger" one,
    // so we should preserve ongoing one.
    LOG(WARNING) << "Attempt rejected: another same-priority attempt";
    consumer->OnUserAuthAttemptRejected();
    return;
  }
  if (pending_attempt_.has_value()) {
    // If we have two login attempts, let new attempt take
    // over the pending one.
    if (AttemptShouldOverrideAnother(attempt, *pending_attempt_)) {
      LOG(WARNING) << "Overriding pending attempt";
      pending_consumer_->OnUserAuthAttemptRejected();
      // Override pending attempt.
      pending_attempt_ = attempt;
      pending_consumer_ = consumer;
      return;
    }
    if (AttemptShouldOverrideAnother(*pending_attempt_, attempt)) {
      LOG(WARNING)
          << "Attempt rejected: another higher-priority pending attempt";
      consumer->OnUserAuthAttemptRejected();
      return;
    }
    // Neither attempt is considered "Stronger" one,
    // so we should preserve pending one.
    LOG(WARNING) << "Attempt rejected: pending same-priority attempt";
    consumer->OnUserAuthAttemptRejected();
    return;
  }

  CHECK(!attempt_consumer_);
  CHECK(!attempt_handler_);
  attempt_consumer_ = consumer;
  current_attempt_ = attempt;

  AuthFactorsSet cached_factors =
      cache_->GetExpectedFactorsPresence(*current_attempt_);

  attempt_handler_ = std::make_unique<AuthHubAttemptHandler>(
      this, *current_attempt_, engines_, cached_factors);
  raw_ptr<AuthFactorStatusConsumer> status_consumer;
  attempt_consumer_->OnUserAuthAttemptConfirmed(
      attempt_handler_->GetConnector(), status_consumer);
  attempt_handler_->SetConsumer(status_consumer);

  vector_lifecycle_->StartAttempt(*current_attempt_);
}

bool AuthHubImpl::PurposeMatchesMode(AuthPurpose purpose, AuthHubMode mode) {
  switch (mode) {
    case AuthHubMode::kLoginScreen:
      return purpose == AuthPurpose::kLogin;
    case AuthHubMode::kInSession:
      return purpose != AuthPurpose::kLogin;
    case AuthHubMode::kNone:
      NOTREACHED();
  }
}

bool AuthHubImpl::AttemptShouldOverrideAnother(
    const AuthAttemptVector& first,
    const AuthAttemptVector& second) {
  if (first.purpose == AuthPurpose::kLogin &&
      second.purpose == AuthPurpose::kLogin) {
    // New login attempt always overrides previous.
    return true;
  }
  // All login cases should be covered by check above + `PurposeMatchesMode`.
  CHECK_NE(first.purpose, AuthPurpose::kLogin);
  CHECK_NE(second.purpose, AuthPurpose::kLogin);
  if (first.purpose == AuthPurpose::kScreenUnlock) {
    // Lock screen always overrides any other attempt.
    return true;
  }
  if (second.purpose == AuthPurpose::kScreenUnlock) {
    // Nothing in-session can override lock screen.
    return false;
  }
  // Currently various in-session attempts should not override ongoing attempt.
  return false;
}

// AuthHubModeLifecycle::Owner:

void AuthHubImpl::OnReadyForMode(AuthHubMode mode,
                                 AuthEnginesMap available_engines) {
  CHECK(engines_.empty());
  CHECK(!vector_lifecycle_);

  engines_ = std::move(available_engines);
  vector_lifecycle_ =
      std::make_unique<AuthHubVectorLifecycle>(this, mode, engines_);

  on_initialized_listeners_.Notify();
}

void AuthHubImpl::OnExitedMode(AuthHubMode mode) {
  engines_.clear();
  vector_lifecycle_.reset();
}

void AuthHubImpl::OnModeShutdown() {}

// AuthHubVectorLifecycle::Owner:

AuthFactorEngine::FactorEngineObserver* AuthHubImpl::AsEngineObserver() {
  CHECK(attempt_handler_);
  return attempt_handler_.get();
}

void AuthHubImpl::OnAttemptStarted(const AuthAttemptVector& attempt,
                                   AuthFactorsSet available_factors,
                                   AuthFactorsSet failed_factors) {
  CHECK(attempt == *current_attempt_);
  CHECK(attempt_handler_);
  attempt_handler_->OnFactorsChecked(available_factors, failed_factors);
}

void AuthHubImpl::OnAttemptCleanedUp(const AuthAttemptVector& attempt) {
  CHECK(attempt == *current_attempt_);
  if (authenticated_factor_.has_value()) {
    AuthProofToken token =
        engines_[*authenticated_factor_]->StoreAuthenticationContext();
    attempt_consumer_->OnUserAuthSuccess(*authenticated_factor_, token);
    authenticated_factor_.reset();
  }
}

void AuthHubImpl::OnAttemptFinished(const AuthAttemptVector& attempt) {
  CHECK(attempt == *current_attempt_);
  attempt_consumer_ = nullptr;
  current_attempt_.reset();
  attempt_handler_.reset();
}

void AuthHubImpl::OnAttemptCancelled(const AuthAttemptVector& attempt) {
  CHECK(attempt == *current_attempt_);
  attempt_consumer_->OnUserAuthAttemptCancelled();
  attempt_consumer_ = nullptr;
  current_attempt_.reset();
  attempt_handler_.reset();
}

void AuthHubImpl::OnIdle() {
  if (target_mode_.has_value()) {
    if (pending_attempt_.has_value()) {
      // Cancel pending attempt.
      pending_consumer_->OnUserAuthAttemptRejected();
      target_mode_.reset();
      pending_consumer_ = nullptr;
    }
    // We can get into this branch if attempt was never
    // started/finished, e.g. if Mode change was requested before
    // one of the engines started.
    if (attempt_consumer_) {
      CHECK(current_attempt_);
      CHECK(attempt_handler_);
      attempt_consumer_->OnUserAuthAttemptCancelled();
      attempt_consumer_ = nullptr;
      current_attempt_.reset();
      attempt_handler_.reset();
    }
    AuthHubMode mode = *target_mode_;
    target_mode_.reset();
    SwitchToModeImpl(mode);
    return;
  }

  if (pending_attempt_.has_value()) {
    AuthAttemptVector attempt = *pending_attempt_;
    AuthAttemptConsumer* consumer = pending_consumer_.get();

    pending_consumer_ = nullptr;
    pending_attempt_.reset();

    StartAuthentication(attempt.account, attempt.purpose, consumer);
    return;
  }
}

void AuthHubImpl::UpdateFactorUiCache(const AuthAttemptVector& attempt,
                                      AuthFactorsSet available_factors) {
  CHECK(attempt == *current_attempt_);
  cache_->StoreFactorPresenceCache(attempt, available_factors);
}

void AuthHubImpl::OnFactorAttemptFailed(const AuthAttemptVector& attempt,
                                        AshAuthFactor factor) {
  CHECK(attempt == *current_attempt_);
  attempt_consumer_->OnFactorAttemptFailed(factor);
}

void AuthHubImpl::OnAuthenticationSuccess(const AuthAttemptVector& attempt,
                                          AshAuthFactor factor) {
  CHECK(attempt == *current_attempt_);
  CHECK(engines_.contains(factor));

  // Record the authenticated factor and start terminating all engines.
  // AuthProofToken will be retrieved after all auth engines clean up their
  // internal states during the termination process, to avoid race conditions
  // on authenticated UserContext.
  authenticated_factor_ = factor;
  vector_lifecycle_->CancelAttempt();
}

}  // namespace ash