aboutsummaryrefslogtreecommitdiffstats
path: root/routers/web/auth
Commit message (Collapse)AuthorAgeFilesLines
* remove util.OptionalBool and related functions (#29513)65432024-03-021-4/+4
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Allow to change primary email before account activation (#29412)wxiaoguang2024-02-271-3/+28
|
* Move context from modules to services (#29440)Lunny Xiao2024-02-277-7/+7
| | | | | | | | | | | | | | | Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context
* Refactor "user/active" related logic (#29390)wxiaoguang2024-02-251-59/+66
| | | | | And add more tests. Remove a lot of fragile "if" blocks. The old logic is kept as-is.
* Revert "Support SAML authentication (#25165)" (#29358)65432024-02-245-237/+39
| | | | | | | | | | This reverts #25165 (5bb8d1924d77c675467694de26697b876d709a17), as there was a chance some important reviews got missed. so after reverting this patch it will be resubmitted for reviewing again https://github.com/go-gitea/gitea/pull/25165#issuecomment-1960670242 temporary Open #5512 again
* Start to migrate from `util.OptionalBool` to `optional.Option[bool]` (#29329)65432024-02-231-1/+1
| | | just create transition helper and migrate two structs
* Support SAML authentication (#25165)techknowlogick2024-02-235-39/+237
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes https://github.com/go-gitea/gitea/issues/5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>
* Remove unnecessary "Str2html" modifier from templates (#29319)wxiaoguang2024-02-221-3/+4
| | | Follow #29165
* Do not use `ctx.Doer` when reset password (#29289)Jason Song2024-02-211-1/+1
| | | | | Fix #29278. Caused by a small typo in #28733
* Refactor more code in templates (#29236)wxiaoguang2024-02-181-9/+1
| | | | | | | | Follow #29165. * Introduce JSONTemplate to help to render JSON templates * Introduce JSEscapeSafe for templates. Now only use `{{ ... | JSEscape}}` instead of `{{ ... | JSEscape | Safe}}` * Simplify "UserLocationMapURL" useage
* Refactor locale&string&template related code (#29165)wxiaoguang2024-02-141-1/+1
| | | | | | Clarify when "string" should be used (and be escaped), and when "template.HTML" should be used (no need to escape) And help PRs like #29059 , to render the error messages correctly.
* Unify user update methods (#28733)KN4CK3R2024-02-043-113/+90
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Normalize oauth email username (#28561)Kyle D2024-01-033-6/+15
|
* Avoid cycle-redirecting user/login page (#28636)wxiaoguang2023-12-301-5/+5
| | | | Fix #28231, and remove some unused code. The `db.HasEngine` doesn't seem useful because the db engine is always initialized before web route.
* Always enable caches (#28527)Lunny Xiao2023-12-192-15/+9
| | | | | | | | | Nowadays, cache will be used on almost everywhere of Gitea and it cannot be disabled, otherwise some features will become unaviable. Then I think we can just remove the option for cache enable. That means cache cannot be disabled. But of course, we can still use cache configuration to set how should Gitea use the cache.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-031-8/+4
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-143-11/+11
| | | Last part of #27065
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-144-48/+44
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Don't show Link to TOTP if not set up (#27585)JakobDev2023-10-111-0/+8
|
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-113-6/+6
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Even more `db.DefaultContext` refactor (#27352)JakobDev2023-10-031-2/+2
| | | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: delvh <dev.lh@web.de>
* make writing main test easier (#27270)Lunny Xiao2023-09-281-4/+1
| | | | | | | | | This PR removed `unittest.MainTest` the second parameter `TestOptions.GiteaRoot`. Now it detects the root directory by current working directory. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-254-4/+4
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Next round of `db.DefaultContext` refactor (#27089)JakobDev2023-09-164-10/+10
| | | Part of #27065
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-155-10/+10
| | | Next step of #27065
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-145-18/+18
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Show OpenID Connect and OAuth on signup page (#20242)Dmitry Sharshakov2023-09-131-0/+18
| | | | | | | | Fix #19809 --------- Signed-off-by: Dmitry Sharshakov <d3dx12.xx@gmail.com> Co-authored-by: jackHay22 <jack@allspice.io>
* Add more descriptive error on forgot password page (#26848)Jack Hay2023-09-011-3/+4
| | | | | | | | ## Changes - Forces flashed error to render immediately when forgot password code is incorrect or has expired. - Adds a link back to the `forgot_password` page so that the user can restart the process (in the event that their link has expired)
* Update team invitation email link (#26550)Jack Hay2023-08-311-0/+11
| | | | | Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: Jonathan Tran <jonnytran@gmail.com>
* Start using template context function (#26254)wxiaoguang2023-08-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | Before: * `{{.locale.Tr ...}}` * `{{$.locale.Tr ...}}` * `{{$.root.locale.Tr ...}}` * `{{template "sub" .}}` * `{{template "sub" (dict "locale" $.locale)}}` * `{{template "sub" (dict "root" $)}}` * ..... With context function: only need to `{{ctx.Locale.Tr ...}}` The "ctx" could be considered as a super-global variable for all templates including sub-templates. To avoid potential risks (any bug in the template context function package), this PR only starts using "ctx" in "head.tmpl" and "footer.tmpl" and it has a "DataRaceCheck". If there is anything wrong, the code can be fixed or reverted easily.
* Move web JSON functions to web context and simplify code (#26132)wxiaoguang2023-07-261-1/+1
| | | | | | | | | The JSONRedirect/JSONOK/JSONError functions were put into "Base" context incorrectly, it would cause abuse. Actually, they are for "web context" only, so, move them to the correct place. And by the way, use them to simplify old code: +75 -196
* Bump github.com/golang-jwt/jwt to v5 (#25975)harryzcy2023-07-192-13/+11
| | | | | | | | | | | | | | | | Bumping `github.com/golang-jwt/jwt` from v4 to v5. `github.com/golang-jwt/jwt` v5 is bringing some breaking changes: - standard `Valid()` method on claims is removed. It's replaced by `ClaimsValidator` interface implementing `Validator()` method instead, which is called after standard validation. Gitea doesn't seem to be using this logic. - `jwt.Token` has a field `Valid`, so it's checked in `ParseToken` function in `services/auth/source/oauth2/token.go` --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Less naked returns (#25713)65432023-07-071-8/+8
| | | | | just a step towards #25655 and some related refactoring
* Replace `interface{}` with `any` (#25686)silverwind2023-07-045-15/+15
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Log the real reason when authentication fails (but don't show the user) (#25414)Lunny Xiao2023-07-033-12/+31
|
* Use JSON response for "user/logout" (#25522)wxiaoguang2023-06-261-1/+1
| | | | The request sent to "user/logout" is from "link-action", it expects to get JSON response.
* Show OAuth2 errors to end users (#25261)wxiaoguang2023-06-151-3/+19
| | | | | | | | | | | | Partially fix #23936 ![image](https://github.com/go-gitea/gitea/assets/2114189/8aa7f3ad-a5f0-42ce-a478-289a03bd08a3) ![image](https://github.com/go-gitea/gitea/assets/2114189/bb901e7d-485a-47a5-b68d-9ebe7013a6b2) ![image](https://github.com/go-gitea/gitea/assets/2114189/9a1ce0f3-f011-4baf-8e2f-cc6304bc9703)
* Allow for PKCE flow without client secret + add docs (#25033)Denys Konovalov2023-06-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The PKCE flow according to [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) allows for secure authorization without the requirement to provide a client secret for the OAuth app. It is implemented in Gitea since #5378 (v1.8.0), however without being able to omit client secret. Since #21316 Gitea supports setting client type at OAuth app registration. As public clients are already forced to use PKCE since #21316, in this PR the client secret check is being skipped if a public client is detected. As Gitea seems to implement PKCE authorization correctly according to the spec, this would allow for PKCE flow without providing a client secret. Also add some docs for it, please check language as I'm not a native English speaker. Closes #17107 Closes #25047
* Split "modules/context.go" to separate files (#24569)wxiaoguang2023-05-082-3/+3
| | | | | | | | | | | | | | The "modules/context.go" is too large to maintain. This PR splits it to separate files, eg: context_request.go, context_response.go, context_serve.go This PR will help: 1. The future refactoring for Gitea's web context (eg: simplify the context) 2. Introduce proper "range request" support 3. Introduce context function This PR only moves code, doesn't change any logic.
* Respect the REGISTER_MANUAL_CONFIRM setting when registering via OIDC (#24035)Gary Moon2023-04-251-1/+1
| | | | | | | | This change prevents Gitea from bypassing the manual approval process for newly registered users when OIDC is used. - Resolves https://github.com/go-gitea/gitea/issues/23392 Signed-off-by: Gary Moon <gary@garymoon.net>
* Refactor cookie (#24107)wxiaoguang2023-04-134-16/+15
| | | | | | | | | | | | Close #24062 At the beginning, I just wanted to fix the warning mentioned by #24062 But, the cookie code really doesn't look good to me, so clean up them. Complete the TODO on `SetCookie`: > TODO: Copied from gitea.com/macaron/macaron and should be improved after macaron removed.
* Group template helper functions, remove `Printf`, improve template error ↵wxiaoguang2023-04-081-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | messages (#23982) Follow #23328 Major changes: * Group the function in `templates/help.go` by their purposes. It could make future work easier. * Remove the `Printf` helper function, there is already a builtin `printf`. * Remove `DiffStatsWidth`, replace with `Eval` in template * Rename the `NewTextFuncMap` to `mailSubjectTextFuncMap`, it's for subject text template only, no need to make it support HTML functions. ---- And fine tune template error messages, to make it more friendly to developers and users. ![image](https://user-images.githubusercontent.com/2114189/230714245-4fd202d1-2b25-41b2-8be5-03c5fee45091.png) ![image](https://user-images.githubusercontent.com/2114189/230714277-66783577-2a03-49d5-8e8c-ceba5e07a2d4.png) --------- Co-authored-by: silverwind <me@silverwind.io>
* Provide the ability to set password hash algorithm parameters (#22942)zeripath2023-02-192-2/+2
| | | | | | | | | | | | | | | | | | | | | | | This PR refactors and improves the password hashing code within gitea and makes it possible for server administrators to set the password hashing parameters In addition it takes the opportunity to adjust the settings for `pbkdf2` in order to make the hashing a little stronger. The majority of this work was inspired by PR #14751 and I would like to thank @boppy for their work on this. Thanks to @gusted for the suggestion to adjust the `pbkdf2` hashing parameters. Close #14751 --------- Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: John Olheiser <john.olheiser@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Add context cache as a request level cache (#22294)Lunny Xiao2023-02-155-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid duplicated load of the same data in an HTTP request, we can set a context cache to do that. i.e. Some pages may load a user from a database with the same id in different areas on the same page. But the code is hidden in two different deep logic. How should we share the user? As a result of this PR, now if both entry functions accept `context.Context` as the first parameter and we just need to refactor `GetUserByID` to reuse the user from the context cache. Then it will not be loaded twice on an HTTP request. But of course, sometimes we would like to reload an object from the database, that's why `RemoveContextData` is also exposed. The core context cache is here. It defines a new context ```go type cacheContext struct { ctx context.Context data map[any]map[any]any lock sync.RWMutex } var cacheContextKey = struct{}{} func WithCacheContext(ctx context.Context) context.Context { return context.WithValue(ctx, cacheContextKey, &cacheContext{ ctx: ctx, data: make(map[any]map[any]any), }) } ``` Then you can use the below 4 methods to read/write/del the data within the same context. ```go func GetContextData(ctx context.Context, tp, key any) any func SetContextData(ctx context.Context, tp, key, value any) func RemoveContextData(ctx context.Context, tp, key any) func GetWithContextCache[T any](ctx context.Context, cacheGroupKey string, cacheTargetID any, f func() (T, error)) (T, error) ``` Then let's take a look at how `system.GetString` implement it. ```go func GetSetting(ctx context.Context, key string) (string, error) { return cache.GetWithContextCache(ctx, contextCacheKey, key, func() (string, error) { return cache.GetString(genSettingCacheKey(key), func() (string, error) { res, err := GetSettingNoCache(ctx, key) if err != nil { return "", err } return res.SettingValue, nil }) }) } ``` First, it will check if context data include the setting object with the key. If not, it will query from the global cache which may be memory or a Redis cache. If not, it will get the object from the database. In the end, if the object gets from the global cache or database, it will be set into the context cache. An object stored in the context cache will only be destroyed after the context disappeared.
* Map OIDC groups to Orgs/Teams (#21441)KN4CK3R2023-02-082-30/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #19555 Test-Instructions: https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 This PR implements the mapping of user groups provided by OIDC providers to orgs teams in Gitea. The main part is a refactoring of the existing LDAP code to make it usable from different providers. Refactorings: - Moved the router auth code from module to service because of import cycles - Changed some model methods to take a `Context` parameter - Moved the mapping code from LDAP to a common location I've tested it with Keycloak but other providers should work too. The JSON mapping format is the same as for LDAP. ![grafik](https://user-images.githubusercontent.com/1666336/195634392-3fc540fc-b229-4649-99ac-91ae8e19df2d.png) --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix error on account activation with wrong passwd (#22609)Otto Richter (fnetX)2023-01-281-3/+3
| | | | | | | | | | | | | | On activating local accounts, the error message didn't differentiate between using a wrong or expired token, or a wrong password. The result could already be obtained from the behaviour (different screens were presented), but the error message was misleading and lead to confusion for new users on Codeberg with Forgejo. Now, entering a wrong password for a valid token prints a different error message. The problem was introduced in 0f14f69e6070c9aca09f57c419e7d6007d0e520b. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Allow setting `redirect_to` cookie on OAuth login (#22594)Sybren2023-01-241-0/+5
| | | | | | | | | | | | | | The regular login flow can use a `redirect_to` cookie to ensure the user ends their authentication flow on the same page as where they started it. This commit adds the same functionality to the OAuth login URLs, so that you can use URLs like these to directly use a specific OAuth provider: `/user/oauth2/{provider}?redirect_to={post-login path}` Only the `auth.SignInOAuth()` function needed a change for this, as the rest of the login flow is aware of this cookie and uses it properly already.
* Replace deprecated Webauthn library (#22400)techknowlogick2023-01-111-2/+2
| | | | | Fix #22052 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* refactor some functions to support ctx as first parameter (#21878)Lunny Xiao2022-12-034-8/+8
| | | | Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lauris BH <lauris@nix.lv>
* Implement FSFE REUSE for golang files (#21840)flynnnnnnnnnn2022-11-279-18/+9
| | | | | | | | | Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-15 06:32:56 +0000