check for tfa during cluster join, abort if yes

[pve-apiclient.git] / PVE / APIClient / LWP.pm

diff --git a/PVE/APIClient/LWP.pm b/PVE/APIClient/LWP.pm
index 4584bc08afc73770bd40bf3898a2b36fa543648f..492f64d84f5017886b5625f7a7e08abd7de47206 100755 (executable)
--- a/PVE/APIClient/LWP.pm
+++ b/PVE/APIClient/LWP.pm
@@ -11,6 +11,7 @@ use JSON;
 use Data::Dumper; # fixme: remove
 use HTTP::Request::Common;
 use Carp;
+use PVE::APIClient::Exception qw(raise);
 
 my $extract_data = sub {
     my ($res) = @_;
@@ -121,13 +122,18 @@ sub login {
     }
 
     if (!$response->is_success) {
-       die $response->status_line . "\n";
+       raise($response->status_line ."\n", code => $response->code)
     }
 
     my $res = from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
 
     my $data = $extract_data->($res);
 
+    # TODO: make it possible to use tfa
+    if ($data->{ticket} =~ m/^PVE:tfa!/) {
+       die "TFA in API is not yet implemented! Try disabling TFA for the user.\n";
+    }
+
     $self->update_ticket($data->{ticket});
     $self->update_csrftoken($data->{CSRFPreventionToken});
 
@@ -138,20 +144,21 @@ sub manual_verify_fingerprint {
     my ($self, $fingerprint) = @_;
 
     if (!$self->{manual_verification}) {
-       warn "fingerprint: $fingerprint\n";
-       return 0;
+       raise("fingerprint '$fingerprint' not verified, abort!\n");
     }
 
     print "The authenticity of host '$self->{host}' can't be established.\n" .
        "X509 SHA256 key fingerprint is $fingerprint.\n" .
        "Are you sure you want to continue connecting (yes/no)? ";
 
-    my $answer = <>;
+    my $answer = <STDIN>;
 
     my $valid = ($answer =~ m/^\s*yes\s*$/i) ? 1 : 0;
 
     $self->{cached_fingerprints}->{$fingerprint} = $valid;
 
+    raise("Fingerprint not verified, abort!\n") if !$valid;
+
     if (my $cb = $self->{register_fingerprint_cb}) {
        $cb->($fingerprint) if $valid;
     }
@@ -210,7 +217,7 @@ sub call {
        } elsif ($method eq 'DELETE') {
            $response = $ua->request(HTTP::Request::Common::DELETE($uri));
        } else {
-           die "method $method not implemented\n";
+           raise("method $method not implemented\n");
        }
        return $response;
     };
@@ -229,27 +236,21 @@ sub call {
 
     if ($response->is_success) {
 
-       die "got unexpected content type" if $ct !~ m|application/json|;
+       raise("got unexpected content type", code => $response->code)
+           if $ct !~ m|application/json|;
 
        return from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
 
     } else {
 
-       my $msg = $response->status_line . "\n";
-       eval {
+       my $msg = $response->message;
+       my $errors = eval {
            return if $ct !~ m|application/json|;
            my $res = from_json($response->decoded_content, {utf8 => 1, allow_nonref => 1});
-           if (my $errors = $res->{errors}) {
-               foreach my $key (keys %$errors) {
-                   my $m = $errors->{$key};
-                   chomp($m);
-                   $m =~s/\n/ -- /g;
-                   $msg .= " $key: $m\n";
-               }
-           }
+           return $res->{errors};
        };
-       die $msg;
 
+       raise("$msg\n", code => $response->code, errors => $errors);
     }
 }