Basic JWT implementation (#1524)

* Basic JWT implementation

* Move JWT to UI_LOGIN mode and bring back SIMPLE_LOGIN as before

* Update server/src/main/kotlin/suwayomi/tachidesk/global/impl/util/Jwt.kt

Co-authored-by: Mitchell Syer <Syer10@users.noreply.github.com>

* Refresh: Update only access token

Co-authored-by: Mitchell Syer <Syer10@users.noreply.github.com>

* Implement JWT Audience

* Store JWT key

Generates the key on startup if not set

* Handle invalid Base64

* Make JWT expiry configurable

* Missing value parse

* Update server/src/main/kotlin/suwayomi/tachidesk/global/impl/util/Jwt.kt

Co-authored-by: Mitchell Syer <Syer10@users.noreply.github.com>

* Simplify Duration parsing

* JWT Protect Mutations

* JWT Protect Queries and Subscriptions

* JWT Protect v1 WebSockets

* WebSockets allow sending token via protocol header

* Also respect the `suwayomi-server-token` cookie

* JWT reduce default token expiry

* JWT Support cookie on WebSocket as well

* Lint

* Authenticate graphql subscription via connection_init payload

* WebView: Prefer explicit token over cookie

This hack was implemented because WebView sent `"null"` if no token was
supplied, just don't send a bad token, then we can do this properly

* WebView: Implement basic login dialog if no token supplied

---------

Co-authored-by: Mitchell Syer <Syer10@users.noreply.github.com>
Co-authored-by: schroda <50052685+schroda@users.noreply.github.com>

server/src/main/kotlin/suwayomi/tachidesk/graphql/subscriptions/DownloadSubscription.kt

@@ -9,18 +9,25 @@ package suwayomi.tachidesk.graphql.subscriptions
 
 import com.expediagroup.graphql.generator.annotations.GraphQLDeprecated
 import com.expediagroup.graphql.generator.annotations.GraphQLDescription
+import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.map
+import suwayomi.tachidesk.graphql.server.getAttribute
 import suwayomi.tachidesk.graphql.types.DownloadStatus
 import suwayomi.tachidesk.graphql.types.DownloadUpdates
 import suwayomi.tachidesk.manga.impl.download.DownloadManager
+import suwayomi.tachidesk.server.JavalinSetup.Attribute
+import suwayomi.tachidesk.server.JavalinSetup.getAttribute
+import suwayomi.tachidesk.server.user.requireUser
 
 class DownloadSubscription {
     @GraphQLDeprecated("Replaced with downloadStatusChanged", ReplaceWith("downloadStatusChanged(input)"))
-    fun downloadChanged(): Flow<DownloadStatus> =
-        DownloadManager.status.map { downloadStatus ->
+    fun downloadChanged(dataFetchingEnvironment: DataFetchingEnvironment): Flow<DownloadStatus> {
+        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+        return DownloadManager.status.map { downloadStatus ->
             DownloadStatus(downloadStatus)
         }
+    }
 
     data class DownloadChangedInput(
         @GraphQLDescription(
@@ -33,7 +40,11 @@ class DownloadSubscription {
         val maxUpdates: Int?,
     )
 
-    fun downloadStatusChanged(input: DownloadChangedInput): Flow<DownloadUpdates> {
+    fun downloadStatusChanged(
+        dataFetchingEnvironment: DataFetchingEnvironment,
+        input: DownloadChangedInput,
+    ): Flow<DownloadUpdates> {
+        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
         val omitUpdates = input.maxUpdates != null
         val maxUpdates = input.maxUpdates ?: 50
 

server/src/main/kotlin/suwayomi/tachidesk/graphql/subscriptions/InfoSubscription.kt

@@ -1,9 +1,17 @@
 package suwayomi.tachidesk.graphql.subscriptions
 
+import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.flow.Flow
+import suwayomi.tachidesk.graphql.server.getAttribute
 import suwayomi.tachidesk.graphql.types.WebUIUpdateStatus
+import suwayomi.tachidesk.server.JavalinSetup.Attribute
+import suwayomi.tachidesk.server.JavalinSetup.getAttribute
+import suwayomi.tachidesk.server.user.requireUser
 import suwayomi.tachidesk.server.util.WebInterfaceManager
 
 class InfoSubscription {
-    fun webUIUpdateStatusChange(): Flow<WebUIUpdateStatus> = WebInterfaceManager.status
+    fun webUIUpdateStatusChange(dataFetchingEnvironment: DataFetchingEnvironment): Flow<WebUIUpdateStatus> {
+        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+        return WebInterfaceManager.status
+    }
 }

server/src/main/kotlin/suwayomi/tachidesk/graphql/subscriptions/UpdateSubscription.kt

@@ -9,22 +9,29 @@ package suwayomi.tachidesk.graphql.subscriptions
 
 import com.expediagroup.graphql.generator.annotations.GraphQLDeprecated
 import com.expediagroup.graphql.generator.annotations.GraphQLDescription
+import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.flow.Flow
 import kotlinx.coroutines.flow.map
+import suwayomi.tachidesk.graphql.server.getAttribute
 import suwayomi.tachidesk.graphql.types.UpdateStatus
 import suwayomi.tachidesk.graphql.types.UpdaterUpdates
 import suwayomi.tachidesk.manga.impl.update.IUpdater
 import suwayomi.tachidesk.manga.impl.update.UpdateUpdates
+import suwayomi.tachidesk.server.JavalinSetup.Attribute
+import suwayomi.tachidesk.server.JavalinSetup.getAttribute
+import suwayomi.tachidesk.server.user.requireUser
 import uy.kohesive.injekt.injectLazy
 
 class UpdateSubscription {
     private val updater: IUpdater by injectLazy()
 
     @GraphQLDeprecated("Replaced with updates", ReplaceWith("updates(input)"))
-    fun updateStatusChanged(): Flow<UpdateStatus> =
-        updater.status.map { updateStatus ->
+    fun updateStatusChanged(dataFetchingEnvironment: DataFetchingEnvironment): Flow<UpdateStatus> {
+        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+        return updater.status.map { updateStatus ->
             UpdateStatus(updateStatus)
         }
+    }
 
     data class LibraryUpdateStatusChangedInput(
         @GraphQLDescription(
@@ -37,7 +44,11 @@ class UpdateSubscription {
         val maxUpdates: Int?,
     )
 
-    fun libraryUpdateStatusChanged(input: LibraryUpdateStatusChangedInput): Flow<UpdaterUpdates> {
+    fun libraryUpdateStatusChanged(
+        dataFetchingEnvironment: DataFetchingEnvironment,
+        input: LibraryUpdateStatusChangedInput,
+    ): Flow<UpdaterUpdates> {
+        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
         val omitUpdates = input.maxUpdates != null
         val maxUpdates = input.maxUpdates ?: 50