From 9d923ae3e76ab8afb774d6b5458846a67223055b Mon Sep 17 00:00:00 2001
From: Spitfireap <dev@asdrip.fr>
Date: Thu, 18 Jul 2024 21:30:56 +0200
Subject: [PATCH] Updated RSA key gen for OIDC

---
 modoboa/core/checks.py          | 10 ++++++++++
 modoboa/core/commands/deploy.py | 21 ++------------------
 modoboa/core/utils.py           | 35 +++++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 19 deletions(-)
 create mode 100644 modoboa/core/checks.py

diff --git a/modoboa/core/checks.py b/modoboa/core/checks.py
new file mode 100644
index 000000000..a4f0f5bf6
--- /dev/null
+++ b/modoboa/core/checks.py
@@ -0,0 +1,10 @@
+from django.core.checks import register, Info
+from django.conf import settings
+
+from modoboa.core.utils import generate_rsa_private_key
+
+
+@register(deploy=True)
+def generate_rsa_private_key_check(app_configs, **kwargs):
+    if generate_rsa_private_key(settings.BASE_DIR):
+        return Info("Generated the RSA key for OIDC.")
diff --git a/modoboa/core/commands/deploy.py b/modoboa/core/commands/deploy.py
index 76a2fd7b7..16954c381 100644
--- a/modoboa/core/commands/deploy.py
+++ b/modoboa/core/commands/deploy.py
@@ -9,8 +9,6 @@ import string
 import subprocess
 import sys
 
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric import rsa
 import dj_database_url
 
 import django
@@ -19,6 +17,7 @@ from django.template import Context, Template
 from django.utils.encoding import smart_str
 
 from modoboa.core.commands import Command
+from modoboa.core.utils import generate_rsa_private_key
 from modoboa.lib.api_client import ModoAPIClient
 from modoboa.lib.sysutils import exec_cmd
 
@@ -199,22 +198,6 @@ class DeployCommand(Command):
             extra_settings.append(extension[1])
         return extra_settings
 
-    def generate_rsa_private_key(self, storage_path: str):
-        """Generate RSA private key for OIDC support."""
-        private_key = rsa.generate_private_key(
-            public_exponent=65537,
-            key_size=4096,
-        )
-        pem = private_key.private_bytes(
-            encoding=serialization.Encoding.PEM,
-            format=serialization.PrivateFormat.TraditionalOpenSSL,
-            encryption_algorithm=serialization.NoEncryption(),
-        )
-        content = bytes(pem)
-        content = content.replace(b"\n", b"\\n")
-        with open(f"{storage_path}/.env", "wb") as fp:
-            fp.write(b'OIDC_RSA_PRIVATE_KEY="' + content + b'"\n')
-
     def handle(self, parsed_args):
         django.setup()
         management.call_command("startproject", parsed_args.name, verbosity=False)
@@ -285,7 +268,7 @@ class DeployCommand(Command):
         )
         with open("%s/settings.py" % path, "w") as fp:
             fp.write(tpl)
-        self.generate_rsa_private_key(parsed_args.name)
+        generate_rsa_private_key(parsed_args.name)
 
         shutil.copyfile("%s/urls.py.tpl" % self._templates_dir, "%s/urls.py" % path)
         os.mkdir("%s/media" % parsed_args.name)
diff --git a/modoboa/core/utils.py b/modoboa/core/utils.py
index 1ef002d64..22e0371a3 100644
--- a/modoboa/core/utils.py
+++ b/modoboa/core/utils.py
@@ -1,6 +1,11 @@
 """Utility functions."""
 
 from pkg_resources import parse_version
+import os
+import environ
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 
 from django.utils.translation import gettext as _
 
@@ -49,3 +54,33 @@ def check_for_updates():
                 update_avail = True
                 break
     return update_avail, extensions
+
+
+def generate_rsa_private_key(storage_path: str) -> bool:
+    """Generate RSA private key for OIDC support.
+
+    :return: False if the key was not generated
+    and True if it was."""
+
+    env_path = os.path.join(storage_path, ".env")
+
+    env = environ.Env(OIDC_RSA_PRIVATE_KEY=(str, "NONE"))
+    environ.Env.read_env(env_path)
+
+    if env("OIDC_RSA_PRIVATE_KEY") != "NONE":
+        return False
+
+    private_key = rsa.generate_private_key(
+        public_exponent=65537,
+        key_size=4096,
+    )
+    pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    content = bytes(pem)
+    content = content.replace(b"\n", b"\\n")
+    with open(env_path, "wb") as fp:
+        fp.write(b'OIDC_RSA_PRIVATE_KEY="' + content + b'"\n')
+    return True