Two factor authentication support (#630)

* Initial commit for 2FA support

Signed-off-by: Andrew <write@imaginarycode.com>

* Add vendored files

* Add missing depends

* A few clean ups

* Added improvements, proper encryption

* Better encryption key

* Simplify "key" generation

* Make 2FA enrollment page more robust

* Fix typo

* Rename twofa/2FA to TwoFactor

* UNIQUE INDEX -> UNIQUE

5 files changed, 137 insertions, 0 deletions

diff --git a/templates/user/auth/twofa.tmpl b/templates/user/auth/twofa.tmpl
new file mode 100644
index 0000000000..d23458e99d
--- /dev/null
+++ b/templates/user/auth/twofa.tmpl
@@ -0,0 +1,27 @@
+{{template "base/head" .}}
+<div class="user signin">
+	<div class="ui middle very relaxed page grid">
+		<div class="column">
+			<form class="ui form" action="{{.Link}}" method="post">
+				{{.CsrfTokenHtml}}
+				<h3 class="ui top attached header">
+					{{.i18n.Tr "twofa"}}
+				</h3>
+				<div class="ui attached segment">
+					{{template "base/alert" .}}
+					<div class="required inline field">
+						<label for="passcode">{{.i18n.Tr "passcode"}}</label>
+						<input id="passcode" name="passcode" type="text" autocomplete="off" required>
+					</div>
+
+					<div class="inline field">
+						<label></label>
+						<button class="ui green button">{{.i18n.Tr "auth.verify"}}</button>
+                        <a href="{{AppSubUrl}}/user/two_factor/scratch">{{.i18n.Tr "auth.use_scratch_code" | Str2html}}</a>
+					</div>
+				</div>
+			</form>
+		</div>
+	</div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/user/auth/twofa_scratch.tmpl b/templates/user/auth/twofa_scratch.tmpl
new file mode 100644
index 0000000000..9b50285bf3
--- /dev/null
+++ b/templates/user/auth/twofa_scratch.tmpl
@@ -0,0 +1,26 @@
+{{template "base/head" .}}
+<div class="user signin">
+	<div class="ui middle very relaxed page grid">
+		<div class="column">
+			<form class="ui form" action="{{.Link}}" method="post">
+				{{.CsrfTokenHtml}}
+				<h3 class="ui top attached header">
+					{{.i18n.Tr "twofa_scratch"}}
+				</h3>
+				<div class="ui attached segment">
+					{{template "base/alert" .}}
+					<div class="required inline field">
+						<label for="token">{{.i18n.Tr "auth.scratch_code"}}</label>
+						<input id="token" name="token" type="text" autocomplete="off" required>
+					</div>
+
+					<div class="inline field">
+						<label></label>
+						<button class="ui green button">{{.i18n.Tr "auth.verify"}}</button>
+					</div>
+				</div>
+			</form>
+		</div>
+	</div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/user/settings/navbar.tmpl b/templates/user/settings/navbar.tmpl
index 5166bafaba..7449fdbf7e 100644
--- a/templates/user/settings/navbar.tmpl
+++ b/templates/user/settings/navbar.tmpl
@@ -19,6 +19,9 @@
 		<a class="{{if .PageIsSettingsApplications}}active{{end}} item" href="{{AppSubUrl}}/user/settings/applications">
 			{{.i18n.Tr "settings.applications"}}
 		</a>
+		<a class="{{if .PageIsSettingsTwofa}}active{{end}} item" href="{{AppSubUrl}}/user/settings/two_factor">
+			{{.i18n.Tr "settings.twofa"}}
+		</a>
 		<a class="{{if .PageIsSettingsDelete}}active{{end}} item" href="{{AppSubUrl}}/user/settings/delete">
 			{{.i18n.Tr "settings.delete"}}
 		</a>
diff --git a/templates/user/settings/twofa.tmpl b/templates/user/settings/twofa.tmpl
new file mode 100644
index 0000000000..fd214e4f7f
--- /dev/null
+++ b/templates/user/settings/twofa.tmpl
@@ -0,0 +1,48 @@
+{{template "base/head" .}}
+<div class="user settings delete">
+	<div class="ui container">
+		<div class="ui grid">
+			{{template "user/settings/navbar" .}}
+			<div class="twelve wide column content">
+				{{template "base/alert" .}}
+				<h4 class="ui top attached header">
+					{{.i18n.Tr "settings.twofa"}}
+				</h4>
+				<div class="ui attached segment">
+					<p>{{.i18n.Tr "settings.twofa_desc"}}</p>
+					{{if .TwofaEnrolled}}
+                    <p>{{$.i18n.Tr "settings.twofa_is_enrolled" | Str2html }}</p>
+                    <form class="ui form" action="{{.Link}}/regenerate_scratch" method="post" enctype="multipart/form-data">
+						{{.CsrfTokenHtml}}
+                        <p>{{.i18n.Tr "settings.regenerate_scratch_token_desc"}}</p>
+                        <button class="ui blue button">{{$.i18n.Tr "settings.twofa_scratch_token_regenerate"}}</button>
+                    </form>
+                    <form class="ui form" action="{{.Link}}/disable" method="post" enctype="multipart/form-data" id="disable-form">
+						{{.CsrfTokenHtml}}
+						<p>{{.i18n.Tr "settings.twofa_disable_note"}}</p>
+						<div class="ui red button delete-button" data-type="form" data-form="#disable-form">{{$.i18n.Tr "settings.twofa_disable"}}</div>
+                    </form>
+                    {{else}}
+                    <p>{{.i18n.Tr "settings.twofa_not_enrolled"}}</p>
+                    <div class="inline field">
+						<a class="ui green button" href="{{.Link}}/enroll">{{$.i18n.Tr "settings.twofa_enroll"}}</a>
+					</div>
+                    {{end}}
+				</div>
+			</div>
+		</div>
+	</div>
+</div>
+
+<div class="ui small basic delete modal">
+	<div class="ui icon header">
+		<i class="trash icon"></i>
+		{{.i18n.Tr "settings.twofa_disable"}}
+	</div>
+	<div class="content">
+		<p>{{.i18n.Tr "settings.twofa_disable_desc"}}</p>
+	</div>
+	{{template "base/delete_modal_actions" .}}
+</div>
+
+{{template "base/footer" .}}
diff --git a/templates/user/settings/twofa_enroll.tmpl b/templates/user/settings/twofa_enroll.tmpl
new file mode 100644
index 0000000000..bc2dc271eb
--- /dev/null
+++ b/templates/user/settings/twofa_enroll.tmpl
@@ -0,0 +1,33 @@
+{{template "base/head" .}}
+<div class="user settings delete">
+	<div class="ui container">
+		<div class="ui grid">
+			{{template "user/settings/navbar" .}}
+			<div class="twelve wide column content">
+				{{template "base/alert" .}}
+				<h4 class="ui top attached header">
+					{{.i18n.Tr "settings.twofa_enroll"}}
+				</h4>
+				<div class="ui attached segment">
+					<p>{{.i18n.Tr "settings.scan_this_image"}}</p>
+                    <img src="{{.QrUri}}" alt="{{.TwofaSecret}}">
+                    <p>{{.i18n.Tr "settings.or_enter_secret" .TwofaSecret}}
+                    <p>{{.i18n.Tr "settings.then_enter_passcode"}}
+                    <form class="ui form" action="{{.Link}}" method="post">
+						{{.CsrfTokenHtml}}
+						<div class="inline required field {{if .Err_Passcode}}error{{end}}">
+							<label for="passcode">{{.i18n.Tr "passcode"}}</label>
+							<input id="passcode" name="passcode" autofocus required>
+						</div>
+						<div class="inline field">
+							<label></label>
+							<button class="ui green button">{{.i18n.Tr "auth.verify"}}</button>
+						</div>
+					</form>
+				</div>
+			</div>
+		</div>
+	</div>
+</div>
+
+{{template "base/footer" .}}