Expose the user agent string to the policy execution context

Author: sandhose

crates/handlers/src/graphql/mod.rs

@@ -238,6 +238,7 @@ async fn get_requester(
     activity_tracker: &BoundActivityTracker,
     mut repo: BoxRepository,
     session_info: SessionInfo,
+    user_agent: Option<String>,
     token: Option<&str>,
 ) -> Result<Requester, RouteError> {
     let entity = if let Some(token) = token {
@@ -301,6 +302,7 @@ async fn get_requester(
     let requester = Requester {
         entity,
         ip_address: activity_tracker.ip(),
+        user_agent,
     };
 
     repo.cancel().await?;
@@ -318,19 +320,22 @@ pub async fn post(
     cookie_jar: CookieJar,
     content_type: Option<TypedHeader<ContentType>>,
     authorization: Option<TypedHeader<Authorization<Bearer>>>,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     body: Body,
 ) -> Result<impl IntoResponse, RouteError> {
     let body = body.into_data_stream();
     let token = authorization
         .as_ref()
         .map(|TypedHeader(Authorization(bearer))| bearer.token());
+    let user_agent = user_agent.map(|TypedHeader(h)| h.to_string());
     let (session_info, _cookie_jar) = cookie_jar.session_info();
     let requester = get_requester(
         undocumented_oauth2_access,
         &clock,
         &activity_tracker,
         repo,
         session_info,
+        user_agent,
         token,
     )
     .await?;
@@ -370,18 +375,21 @@ pub async fn get(
     activity_tracker: BoundActivityTracker,
     cookie_jar: CookieJar,
     authorization: Option<TypedHeader<Authorization<Bearer>>>,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     RawQuery(query): RawQuery,
 ) -> Result<impl IntoResponse, FancyError> {
     let token = authorization
         .as_ref()
         .map(|TypedHeader(Authorization(bearer))| bearer.token());
+    let user_agent = user_agent.map(|TypedHeader(h)| h.to_string());
     let (session_info, _cookie_jar) = cookie_jar.session_info();
     let requester = get_requester(
         undocumented_oauth2_access,
         &clock,
         &activity_tracker,
         repo,
         session_info,
+        user_agent,
         token,
     )
     .await?;
@@ -422,6 +430,7 @@ pub fn schema_builder() -> SchemaBuilder {
 pub struct Requester {
     entity: RequestingEntity,
     ip_address: Option<IpAddr>,
+    user_agent: Option<String>,
 }
 
 impl Requester {
@@ -432,6 +441,13 @@ impl Requester {
             RequesterFingerprint::EMPTY
         }
     }
+
+    pub fn for_policy(&self) -> mas_policy::Requester {
+        mas_policy::Requester {
+            ip_address: self.ip_address,
+            user_agent: self.user_agent.clone(),
+        }
+    }
 }
 
 impl Deref for Requester {

crates/handlers/src/graphql/mutations/user_email.rs

@@ -427,7 +427,7 @@ impl UserEmailMutations {
             let res = policy
                 .evaluate_email(mas_policy::EmailInput {
                     email: &input.email,
-                    requester: requester.fingerprint().into(),
+                    requester: requester.for_policy(),
                 })
                 .await?;
             if !res.valid() {
@@ -618,7 +618,7 @@ impl UserEmailMutations {
         let res = policy
             .evaluate_email(mas_policy::EmailInput {
                 email: &input.email,
-                requester: requester.fingerprint().into(),
+                requester: requester.for_policy(),
             })
             .await?;
         if !res.valid() {

crates/handlers/src/oauth2/authorization/complete.rs

@@ -8,6 +8,7 @@ use axum::{
     extract::{Path, State},
     response::{Html, IntoResponse, Response},
 };
+use axum_extra::TypedHeader;
 use hyper::StatusCode;
 use mas_axum_utils::{cookies::CookieJar, csrf::CsrfExt, sentry::SentryEventID, SessionInfoExt};
 use mas_data_model::{AuthorizationGrant, BrowserSession, Client, Device};
@@ -89,6 +90,7 @@ pub(crate) async fn get(
     State(key_store): State<Keystore>,
     policy: Policy,
     activity_tracker: BoundActivityTracker,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     mut repo: BoxRepository,
     cookie_jar: CookieJar,
     Path(grant_id): Path<Ulid>,
@@ -97,6 +99,8 @@ pub(crate) async fn get(
 
     let maybe_session = session_info.load_session(&mut repo).await?;
 
+    let user_agent = user_agent.map(|TypedHeader(ua)| ua.to_string());
+
     let grant = repo
         .oauth2_authorization_grant()
         .lookup(grant_id)
@@ -130,6 +134,7 @@ pub(crate) async fn get(
         &mut rng,
         &clock,
         &activity_tracker,
+        user_agent,
         repo,
         key_store,
         policy,
@@ -199,6 +204,7 @@ pub(crate) async fn complete(
     rng: &mut (impl rand::RngCore + rand::CryptoRng + Send),
     clock: &impl Clock,
     activity_tracker: &BoundActivityTracker,
+    user_agent: Option<String>,
     mut repo: BoxRepository,
     key_store: Keystore,
     mut policy: Policy,
@@ -233,6 +239,7 @@ pub(crate) async fn complete(
             grant_type: mas_policy::GrantType::AuthorizationCode,
             requester: mas_policy::Requester {
                 ip_address: activity_tracker.ip(),
+                user_agent,
             },
         })
         .await?;

crates/handlers/src/oauth2/authorization/mod.rs

@@ -8,6 +8,7 @@ use axum::{
     extract::{Form, State},
     response::{Html, IntoResponse, Response},
 };
+use axum_extra::TypedHeader;
 use hyper::StatusCode;
 use mas_axum_utils::{cookies::CookieJar, csrf::CsrfExt, sentry::SentryEventID, SessionInfoExt};
 use mas_data_model::{AuthorizationCode, Pkce};
@@ -136,6 +137,7 @@ pub(crate) async fn get(
     State(key_store): State<Keystore>,
     State(url_builder): State<UrlBuilder>,
     policy: Policy,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     activity_tracker: BoundActivityTracker,
     mut repo: BoxRepository,
     cookie_jar: CookieJar,
@@ -166,6 +168,8 @@ pub(crate) async fn get(
     let (session_info, cookie_jar) = cookie_jar.session_info();
     let (csrf_token, cookie_jar) = cookie_jar.csrf_token(&clock, &mut rng);
 
+    let user_agent = user_agent.map(|TypedHeader(ua)| ua.to_string());
+
     // One day, we will have try blocks
     let res: Result<Response, RouteError> = ({
         let templates = templates.clone();
@@ -349,6 +353,7 @@ pub(crate) async fn get(
                         &mut rng,
                         &clock,
                         &activity_tracker,
+                        user_agent,
                         repo,
                         key_store,
                         policy,
@@ -401,6 +406,7 @@ pub(crate) async fn get(
                         &mut rng,
                         &clock,
                         &activity_tracker,
+                        user_agent,
                         repo,
                         key_store,
                         policy,

crates/handlers/src/oauth2/consent.rs

@@ -8,6 +8,7 @@ use axum::{
     extract::{Form, Path, State},
     response::{Html, IntoResponse, Response},
 };
+use axum_extra::TypedHeader;
 use hyper::StatusCode;
 use mas_axum_utils::{
     cookies::CookieJar,
@@ -80,13 +81,16 @@ pub(crate) async fn get(
     mut policy: Policy,
     mut repo: BoxRepository,
     activity_tracker: BoundActivityTracker,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     cookie_jar: CookieJar,
     Path(grant_id): Path<Ulid>,
 ) -> Result<Response, RouteError> {
     let (session_info, cookie_jar) = cookie_jar.session_info();
 
     let maybe_session = session_info.load_session(&mut repo).await?;
 
+    let user_agent = user_agent.map(|ua| ua.to_string());
+
     let grant = repo
         .oauth2_authorization_grant()
         .lookup(grant_id)
@@ -118,6 +122,7 @@ pub(crate) async fn get(
                 grant_type: mas_policy::GrantType::AuthorizationCode,
                 requester: mas_policy::Requester {
                     ip_address: activity_tracker.ip(),
+                    user_agent,
                 },
             })
             .await?;
@@ -159,6 +164,7 @@ pub(crate) async fn post(
     mut policy: Policy,
     mut repo: BoxRepository,
     activity_tracker: BoundActivityTracker,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     cookie_jar: CookieJar,
     State(url_builder): State<UrlBuilder>,
     Path(grant_id): Path<Ulid>,
@@ -170,6 +176,8 @@ pub(crate) async fn post(
 
     let maybe_session = session_info.load_session(&mut repo).await?;
 
+    let user_agent = user_agent.map(|ua| ua.to_string());
+
     let grant = repo
         .oauth2_authorization_grant()
         .lookup(grant_id)
@@ -200,6 +208,7 @@ pub(crate) async fn post(
             grant_type: mas_policy::GrantType::AuthorizationCode,
             requester: mas_policy::Requester {
                 ip_address: activity_tracker.ip(),
+                user_agent,
             },
         })
         .await?;

crates/handlers/src/oauth2/device/consent.rs

@@ -10,6 +10,7 @@ use axum::{
     response::{Html, IntoResponse, Response},
     Form,
 };
+use axum_extra::TypedHeader;
 use mas_axum_utils::{
     cookies::CookieJar,
     csrf::{CsrfExt, ProtectedForm},
@@ -46,6 +47,7 @@ pub(crate) async fn get(
     mut repo: BoxRepository,
     mut policy: Policy,
     activity_tracker: BoundActivityTracker,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     cookie_jar: CookieJar,
     Path(grant_id): Path<Ulid>,
 ) -> Result<Response, FancyError> {
@@ -54,6 +56,8 @@ pub(crate) async fn get(
 
     let maybe_session = session_info.load_session(&mut repo).await?;
 
+    let user_agent = user_agent.map(|ua| ua.to_string());
+
     let Some(session) = maybe_session else {
         let login = mas_router::Login::and_continue_device_code_grant(grant_id);
         return Ok((cookie_jar, url_builder.redirect(&login)).into_response());
@@ -89,6 +93,7 @@ pub(crate) async fn get(
             user: Some(&session.user),
             requester: mas_policy::Requester {
                 ip_address: activity_tracker.ip(),
+                user_agent,
             },
         })
         .await?;
@@ -127,6 +132,7 @@ pub(crate) async fn post(
     mut repo: BoxRepository,
     mut policy: Policy,
     activity_tracker: BoundActivityTracker,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     cookie_jar: CookieJar,
     Path(grant_id): Path<Ulid>,
     Form(form): Form<ProtectedForm<ConsentForm>>,
@@ -137,6 +143,8 @@ pub(crate) async fn post(
 
     let maybe_session = session_info.load_session(&mut repo).await?;
 
+    let user_agent = user_agent.map(|TypedHeader(ua)| ua.to_string());
+
     let Some(session) = maybe_session else {
         let login = mas_router::Login::and_continue_device_code_grant(grant_id);
         return Ok((cookie_jar, url_builder.redirect(&login)).into_response());
@@ -172,6 +180,7 @@ pub(crate) async fn post(
             user: Some(&session.user),
             requester: mas_policy::Requester {
                 ip_address: activity_tracker.ip(),
+                user_agent,
             },
         })
         .await?;

crates/handlers/src/oauth2/registration.rs

@@ -5,6 +5,7 @@
 // Please see LICENSE in the repository root for full details.
 
 use axum::{extract::State, response::IntoResponse, Json};
+use axum_extra::TypedHeader;
 use hyper::StatusCode;
 use mas_axum_utils::sentry::SentryEventID;
 use mas_iana::oauth::OAuthClientAuthenticationMethod;
@@ -196,6 +197,7 @@ pub(crate) async fn post(
     mut repo: BoxRepository,
     mut policy: Policy,
     activity_tracker: BoundActivityTracker,
+    user_agent: Option<TypedHeader<headers::UserAgent>>,
     State(encrypter): State<Encrypter>,
     body: Result<Json<ClientMetadata>, axum::extract::rejection::JsonRejection>,
 ) -> Result<impl IntoResponse, RouteError> {
@@ -204,6 +206,8 @@ pub(crate) async fn post(
 
     info!(?body, "Client registration");
 
+    let user_agent = user_agent.map(|ua| ua.to_string());
+
     // Validate the body
     let metadata = body.validate()?;
 
@@ -250,6 +254,7 @@ pub(crate) async fn post(
             client_metadata: &metadata,
             requester: mas_policy::Requester {
                 ip_address: activity_tracker.ip(),
+                user_agent,
             },
         })
         .await?;

crates/handlers/src/oauth2/token.rs

@@ -683,6 +683,7 @@ async fn client_credentials_grant(
             grant_type: mas_policy::GrantType::ClientCredentials,
             requester: mas_policy::Requester {
                 ip_address: activity_tracker.ip(),
+                user_agent: user_agent.clone().map(|ua| ua.raw),
             },
         })
         .await?;

crates/handlers/src/rate_limit.rs

@@ -53,12 +53,6 @@ pub struct RequesterFingerprint {
     ip: Option<IpAddr>,
 }
 
-impl From<RequesterFingerprint> for mas_policy::Requester {
-    fn from(val: RequesterFingerprint) -> Self {
-        mas_policy::Requester { ip_address: val.ip }
-    }
-}
-
 impl std::fmt::Display for RequesterFingerprint {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if let Some(ip) = self.ip {

crates/handlers/src/upstream_oauth2/link.rs

@@ -449,6 +449,7 @@ pub(crate) async fn get(
                                 email: None,
                                 requester: mas_policy::Requester {
                                     ip_address: activity_tracker.ip(),
+                                    user_agent: user_agent.clone().map(|ua| ua.raw),
                                 },
                             })
                             .await?;
@@ -768,6 +769,7 @@ pub(crate) async fn post(
                     email: email.as_deref(),
                     requester: mas_policy::Requester {
                         ip_address: activity_tracker.ip(),
+                        user_agent: user_agent.clone().map(|ua| ua.raw),
                     },
                 })
                 .await?;