Merge branch 'websocket-auth'

5 files changed, 224 insertions, 112 deletions

diff --git a/app/app.js b/app/app.js
index 4886e42527..c0682343c3 100644
--- a/app/app.js
+++ b/app/app.js
@@ -24,7 +24,7 @@ const store = configureStore(initialState, memoryHistory);
 //////////////////////////////////////////////////////////////////////////
 const backend = new Backend(store);
 ipcRenderer.on('backend-info', (_event, args) => {
-  backend.setLocation(args.addr);
+  backend.setCredentials(args.credentials);
   backend.sync();
   backend.autologin()
     .catch( e => {
diff --git a/app/lib/backend.js b/app/lib/backend.js
index e159ca51df..b7f3f3e489 100644
--- a/app/lib/backend.js
+++ b/app/lib/backend.js
@@ -1,6 +1,7 @@
 // @flow
 
-import log from 'electron-log';
+//import log from 'electron-log';
+const log = console;
 import EventEmitter from 'events';
 import { servers } from '../config';
 import { IpcFacade, RealIpc } from './ipc-facade';
@@ -9,9 +10,8 @@ import connectionActions from '../redux/connection/actions';
 import type { ReduxStore } from '../redux/store';
 import { push } from 'react-router-redux';
 
-import type { BackendState } from './ipc-facade';
+import type { BackendState, RelayEndpoint } from './ipc-facade';
 import type { ConnectionState } from '../redux/connection/reducers';
-import type { RelayEndpoint } from './ipc-facade';
 
 export type EventType = 'connect' | 'connecting' | 'disconnect' | 'login' | 'logging' | 'logout' | 'updatedIp' | 'updatedLocation' | 'updatedReachability';
 export type ErrorType = 'NO_CREDIT' | 'NO_INTERNET' | 'INVALID_ACCOUNT' | 'NO_ACCOUNT';
@@ -66,31 +66,66 @@ export class BackendError extends Error {
 
 }
 
+
+export type IpcCredentials = {
+  connectionString: string,
+  sharedSecret: string,
+};
+export function parseIpcCredentials(data: string): ?IpcCredentials {
+  const [connectionString, sharedSecret] = data.split('\n', 2);
+  if(connectionString && sharedSecret) {
+    return {
+      connectionString,
+      sharedSecret,
+    };
+  } else {
+    return null;
+  }
+}
+
+
 /**
  * Backend implementation
  */
 export class Backend {
 
   _ipc: IpcFacade;
+  _credentials: ?IpcCredentials;
+  _authenticationPromise: ?Promise<void>;
   _store: ReduxStore;
   _eventEmitter = new EventEmitter();
 
-  constructor(store: ReduxStore, ipc: ?IpcFacade) {
+  constructor(store: ReduxStore, credentials?: IpcCredentials, ipc: ?IpcFacade) {
     this._store = store;
+    this._credentials = credentials;
+
+
     if(ipc) {
       this._ipc = ipc;
+
+      // force to re-authenticate when connection closed
+      this._ipc.setCloseConnectionHandler(() => {
+        this._authenticationPromise = null;
+      });
+
       this._registerIpcListeners();
       this._startReachability();
     }
   }
 
-  setLocation(loc: string) {
-    log.info('Got connection info to backend', loc);
+  setCredentials(credentials: IpcCredentials) {
+    log.info('Got connection info to backend', credentials.connectionString);
+    this._credentials = credentials;
 
     if (this._ipc) {
-      this._ipc.setConnectionString(loc);
+      this._credentials = credentials;
     } else {
-      this._ipc = new RealIpc(loc);
+      this._ipc = new RealIpc(credentials.connectionString);
+
+      // force to re-authenticate when connection closed
+      this._ipc.setCloseConnectionHandler(() => {
+        this._authenticationPromise = null;
+      });
     }
     this._registerIpcListeners();
   }
@@ -98,27 +133,33 @@ export class Backend {
   sync() {
     log.info('Syncing with the backend...');
 
-    this._ipc.getIp()
-      .then( ip => {
-        log.info('Got ip', ip);
-        this._store.dispatch(connectionActions.newPublicIp(ip));
-      })
-      .catch(e => {
-        log.info('Failed syncing with the backend,', e.message);
+    this._ensureAuthenticated()
+      .then( () => {
+        this._ipc.getIp()
+          .then( ip => {
+            log.info('Got ip', ip);
+            this._store.dispatch(connectionActions.newPublicIp(ip));
+          })
+          .catch(e => {
+            log.info('Failed syncing with the backend,', e.message);
+          });
       });
 
-    this._ipc.getLocation()
-      .then( location => {
-        log.info('Got location', location);
-        const newLocation = {
-          location: location.latlong,
-          country: location.country,
-          city: location.city
-        };
-        this._store.dispatch(connectionActions.newLocation(newLocation));
-      })
-      .catch(e => {
-        log.info('Failed getting new location,', e.message);
+    this._ensureAuthenticated()
+      .then( () => {
+        this._ipc.getLocation()
+          .then( location => {
+            log.info('Got location', location);
+            const newLocation = {
+              location: location.latlong,
+              country: location.country,
+              city: location.city
+            };
+            this._store.dispatch(connectionActions.newLocation(newLocation));
+          })
+          .catch(e => {
+            log.info('Failed getting new location,', e.message);
+          });
       });
   }
 
@@ -131,30 +172,33 @@ export class Backend {
 
     this._store.dispatch(accountActions.startLogin(accountToken));
 
-    return this._ipc.getAccountData(accountToken)
-      .then( response => {
-        log.info('Account exists', response);
+    return this._ensureAuthenticated()
+      .then( () => {
+        return this._ipc.getAccountData(accountToken)
+          .then( response => {
+            log.info('Account exists', response);
 
-        return this._ipc.setAccount(accountToken)
-          .then( () => response );
+            return this._ipc.setAccount(accountToken)
+              .then( () => response );
 
-      }).then( accountData => {
-        log.info('Log in complete');
+          }).then( accountData => {
+            log.info('Log in complete');
 
-        this._store.dispatch(accountActions.loginSuccessful(accountData.expiry));
+            this._store.dispatch(accountActions.loginSuccessful(accountData.expiry));
 
-        // Redirect the user after some time to allow for
-        // the 'Login Successful' screen to be visible
-        setTimeout(() => {
-          this._store.dispatch(push('/connect'));
-          this.connect();
-        }, 1000);
-      }).catch(e => {
-        log.error('Failed to log in,', e.message);
+            // Redirect the user after some time to allow for
+            // the 'Login Successful' screen to be visible
+            setTimeout(() => {
+              this._store.dispatch(push('/connect'));
+              this.connect();
+            }, 1000);
+          }).catch(e => {
+            log.error('Failed to log in,', e.message);
 
-        // TODO: This is not true. If there is a communication link failure the promise will be rejected too
-        const err = new BackendError('INVALID_ACCOUNT');
-        this._store.dispatch(accountActions.loginFailed(err));
+            // TODO: This is not true. If there is a communication link failure the promise will be rejected too
+            const err = new BackendError('INVALID_ACCOUNT');
+            this._store.dispatch(accountActions.loginFailed(err));
+          });
       });
   }
 
@@ -163,49 +207,55 @@ export class Backend {
 
     this._store.dispatch(accountActions.startLogin());
 
-    return this._ipc.getAccount()
-      .then( accountToken => {
-        if (!accountToken) {
-          throw new BackendError('NO_ACCOUNT');
-        }
-        log.debug('The backend had an account number stored:', accountToken);
-        this._store.dispatch(accountActions.startLogin(accountToken));
+    return this._ensureAuthenticated()
+      .then( () => {
+        return this._ipc.getAccount()
+          .then( accountToken => {
+            if (!accountToken) {
+              throw new BackendError('NO_ACCOUNT');
+            }
+            log.debug('The backend had an account number stored:', accountToken);
+            this._store.dispatch(accountActions.startLogin(accountToken));
 
-        return this._ipc.getAccountData(accountToken);
-      })
-      .then( accountData => {
-        log.info('The stored account number still exists', accountData);
+            return this._ipc.getAccountData(accountToken);
+          })
+          .then( accountData => {
+            log.info('The stored account number still exists', accountData);
 
-        this._store.dispatch(accountActions.loginSuccessful(accountData.expiry));
+            this._store.dispatch(accountActions.loginSuccessful(accountData.expiry));
 
-        this._store.dispatch(push('/connect'));
-        this.connect();
-      })
-      .catch( e => {
-        log.warn('Unable to autologin,', e.message);
+            this._store.dispatch(push('/connect'));
+            this.connect();
+          })
+          .catch( e => {
+            log.warn('Unable to autologin,', e.message);
 
-        this._store.dispatch(accountActions.autoLoginFailed());
-        this._store.dispatch(push('/'));
+            this._store.dispatch(accountActions.autoLoginFailed());
+            this._store.dispatch(push('/'));
 
-        throw e;
+            throw e;
+          });
       });
   }
 
   logout() {
     // @TODO: What does it mean for a logout to be successful or failed?
-    this._ipc.setAccount(null)
-      .then(() => {
+    return this._ensureAuthenticated()
+      .then( () => {
+        return this._ipc.setAccount(null)
+          .then(() => {
 
-        this._store.dispatch(accountActions.loggedOut());
+            this._store.dispatch(accountActions.loggedOut());
 
-        // disconnect user during logout
-        return this.disconnect()
-          .then( () => {
-            this._store.dispatch(push('/'));
+            // disconnect user during logout
+            return this.disconnect()
+              .then( () => {
+                this._store.dispatch(push('/'));
+              });
+          })
+          .catch(e => {
+            log.info('Failed to logout,', e.message);
           });
-      })
-      .catch(e => {
-        log.info('Failed to logout,', e.message);
       });
   }
 
@@ -215,28 +265,37 @@ export class Backend {
     if (relayEndpoint) {
       this._store.dispatch(connectionActions.connectingTo(relayEndpoint));
 
-      return this._ipc.setCustomRelay(relayEndpoint)
+      return this._ensureAuthenticated()
         .then( () => {
-          return this._ipc.connect();
-        })
-        .catch(e => {
-          log.info('Failed connecting to', relayEndpoint.host, '-', e.message);
-          this._store.dispatch(connectionActions.disconnected());
+          return this._ipc.setCustomRelay(relayEndpoint)
+            .then( () => {
+              return this._ipc.connect();
+            })
+            .catch(e => {
+              log.info('Failed connecting to', relayEndpoint.host, '-', e.message);
+              this._store.dispatch(connectionActions.disconnected());
+            });
         });
     } else {
-      return this._ipc.connect()
-        .catch(e => {
-          log.info('Failed connecting to the relay set in the backend, ', e.message);
-          this._store.dispatch(connectionActions.disconnected());
+      return this._ensureAuthenticated()
+        .then( () => {
+          return this._ipc.connect()
+            .catch(e => {
+              log.info('Failed connecting to the relay set in the backend, ', e.message);
+              this._store.dispatch(connectionActions.disconnected());
+            });
         });
     }
   }
 
   disconnect(): Promise<void> {
     // @TODO: Failure modes
-    return this._ipc.disconnect()
-      .catch(e => {
-        log.info('Failed to disconnect,', e.message);
+    return this._ensureAuthenticated()
+      .then( () => {
+        return this._ipc.disconnect()
+          .catch(e => {
+            log.info('Failed to disconnect,', e.message);
+          });
       });
   }
 
@@ -266,24 +325,27 @@ export class Backend {
   }
 
   _registerIpcListeners() {
-    this._ipc.registerStateListener(newState => {
-      log.info('Got new state from backend', newState);
+    return this._ensureAuthenticated()
+      .then( () => {
+        return this._ipc.registerStateListener(newState => {
+          log.info('Got new state from backend', newState);
 
-      const newStatus = this._securityStateToConnectionState(newState);
-      switch(newStatus) {
-      case 'connecting':
-        this._store.dispatch(connectionActions.connecting());
-        break;
-      case 'connected':
-        this._store.dispatch(connectionActions.connected());
-        break;
-      case 'disconnected':
-        this._store.dispatch(connectionActions.disconnected());
-        break;
-      }
+          const newStatus = this._securityStateToConnectionState(newState);
+          switch(newStatus) {
+          case 'connecting':
+            this._store.dispatch(connectionActions.connecting());
+            break;
+          case 'connected':
+            this._store.dispatch(connectionActions.connected());
+            break;
+          case 'disconnected':
+            this._store.dispatch(connectionActions.disconnected());
+            break;
+          }
 
-      this.sync();
-    });
+          this.sync();
+        });
+      });
   }
 
   _securityStateToConnectionState(backendState: BackendState): ConnectionState {
@@ -296,4 +358,27 @@ export class Backend {
     }
     throw new Error('Unsupported state/target state combination: ' + JSON.stringify(backendState));
   }
+
+  _ensureAuthenticated(): Promise<void> {
+    const credentials = this._credentials;
+    if(credentials) {
+      if(!this._authenticationPromise) {
+        this._authenticationPromise = this._authenticate(credentials.sharedSecret);
+      }
+      return this._authenticationPromise;
+    } else {
+      return Promise.reject(new Error('Missing authentication credentials.'));
+    }
+  }
+
+  _authenticate(sharedSecret: string): Promise<void> {
+    return this._ipc.authenticate(sharedSecret)
+      .then(() => {
+        log.info('Authenticated with backend');
+      })
+      .catch((e) => {
+        log.error('Failed to authenticate with backend: ', e.message);
+        throw e;
+      });
+  }
 }
diff --git a/app/lib/ipc-facade.js b/app/lib/ipc-facade.js
index 29c369dd9b..4039d44ee9 100644
--- a/app/lib/ipc-facade.js
+++ b/app/lib/ipc-facade.js
@@ -44,6 +44,8 @@ export interface IpcFacade {
   getLocation(): Promise<Location>,
   getState(): Promise<BackendState>,
   registerStateListener((BackendState) => void): void,
+  setCloseConnectionHandler(() => void): void,
+  authenticate(sharedSecret: string): Promise<void>,
 }
 
 export class RealIpc implements IpcFacade {
@@ -163,4 +165,13 @@ export class RealIpc implements IpcFacade {
       listener(parsedEvent);
     });
   }
+
+  authenticate(sharedSecret: string): Promise<void> {
+    return this._ipc.send('auth', sharedSecret)
+      .then(this._ignoreResponse);
+  }
+
+  setCloseConnectionHandler(handler: () => void) {
+    console.log('appa', handler);
+  }
 }
diff --git a/app/lib/jsonrpc-ws-ipc.js b/app/lib/jsonrpc-ws-ipc.js
index 2609d1514c..deefce3d66 100644
--- a/app/lib/jsonrpc-ws-ipc.js
+++ b/app/lib/jsonrpc-ws-ipc.js
@@ -75,6 +75,7 @@ export default class Ipc {
   _websocket: WebSocket;
   _backoff: ReconnectionBackoff;
   _websocketFactory: (string) => WebSocket;
+  _closeConnectionHandler: ?() => void;
 
   constructor(connectionString: string, websocketFactory: ?(string)=>WebSocket) {
     this._connectionString = connectionString;
@@ -91,6 +92,10 @@ export default class Ipc {
     this._connectionString = str;
   }
 
+  setCloseConnectionHandler(handler: ?() => void) {
+    this._closeConnectionHandler = handler;
+  }
+
   on(event: string, listener: (mixed) => void): Promise<*> {
 
     log.info('Adding a listener to', event);
@@ -246,6 +251,10 @@ export default class Ipc {
     };
 
     this._websocket.onclose = () => {
+      if(this._closeConnectionHandler) {
+        this._closeConnectionHandler();
+      }
+
       const delay = this._backoff.getIncreasedBackoff();
       log.warn('The websocket connetion closed, attempting to reconnect it in', delay, 'milliseconds');
       setTimeout(() => this._reconnect(), delay);
diff --git a/app/main.js b/app/main.js
index 5d24239791..7dcb83f9c6 100644
--- a/app/main.js
+++ b/app/main.js
@@ -7,6 +7,7 @@ import { app, BrowserWindow, ipcMain, Tray, Menu, nativeImage } from 'electron';
 import TrayIconManager from './lib/tray-icon-manager';
 import ElectronSudo from 'electron-sudo';
 import { version } from '../package.json';
+import { parseIpcCredentials } from './lib/backend';
 
 import type { TrayIconType } from './lib/tray-icon-manager';
 
@@ -88,6 +89,7 @@ const appDelegate = {
       browserWindowReady = true;
       appDelegate._pollForConnectionInfoFile();
     });
+
     ipcMain.on('show-window', () => {
       appDelegate._showWindow(window, appDelegate._tray);
     });
@@ -101,6 +103,8 @@ const appDelegate = {
     // create tray icon on macOS
     if(isMacOS) {
       appDelegate._tray = appDelegate._createTray(window);
+    } else {
+      appDelegate._showWindow(window, null);
     }
 
     appDelegate._setAppMenu();
@@ -227,10 +231,13 @@ const appDelegate = {
         return log.error('Could not find backend connection info', err);
       }
 
-      log.info('Read IPC connection info', data);
-      window.webContents.send('backend-info', {
-        addr: data,
-      });
+      const credentials = parseIpcCredentials(data);
+      if(credentials) {
+        log.info('Read IPC connection info', credentials.connectionString);
+        window.webContents.send('backend-info', { credentials });
+      } else {
+        log.error('Could not parse IPC credentials.');
+      }
     });
   },
 
@@ -255,6 +262,7 @@ const appDelegate = {
       resizable: false,
       maximizable: false,
       fullscreenable: false,
+      show: false,
       webPreferences: {
         // prevents renderer process code from not running when window is hidden
         backgroundThrottling: false,
@@ -268,8 +276,7 @@ const appDelegate = {
       options = Object.assign({}, options, {
         height: contentHeight + 12, // 12 is the size of transparent area around arrow
         frame: false,
-        transparent: true,
-        show: false
+        transparent: true
       });
     }