aboutsummaryrefslogtreecommitdiffstats
path: root/services/auth
Commit message (Collapse)AuthorAgeFilesLines
* Fix tautological conditions (#30735)silverwind2024-04-301-1/+1
| | | | | | | As discovered by https://github.com/go-gitea/gitea/pull/30729. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Enable more `revive` linter rules (#30608)silverwind2024-04-221-1/+0
| | | | | | | | | | | Noteable additions: - `redefines-builtin-id` forbid variable names that shadow go builtins - `empty-lines` remove unnecessary empty lines that `gofumpt` does not remove for some reason - `superfluous-else` eliminate more superfluous `else` branches Rules are also sorted alphabetically and I cleaned up various parts of `.golangci.yml`.
* fix: Fix to delete cookie when AppSubURL is non-empty (#30375)Jonathan Tran2024-04-141-1/+2
| | | | | | | | Cookies may exist on "/subpath" and "/subpath/" for some legacy reasons (eg: changed CookiePath behavior in code). The legacy cookie should be removed correctly. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Kyle D <kdumontnu@gmail.com>
* Migrate margin and padding helpers to tailwind (#30043)silverwind2024-03-243-4/+4
| | | | | | | | | | | | | This will conclude the refactor of 1:1 class replacements to tailwind, except `gt-hidden`. Commands ran: ```bash perl -p -i -e 's#gt-(p|m)([lrtbxy])?-0#tw-$1$2-0#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-1#tw-$1$2-0.5#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-2#tw-$1$2-1#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-3#tw-$1$2-2#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-4#tw-$1$2-4#g' {web_src/js,templates,routers,services}/**/* perl -p -i -e 's#gt-(p|m)([lrtbxy])?-5#tw-$1$2-8#g' {web_src/js,templates,routers,services}/**/* ```
* Fix the bug that user may logout if he switch pages too fast (#29962)Lunny Xiao2024-03-211-17/+9
| | | | | | | | | | | | This PR fixed a bug when the user switching pages too fast, he will logout automatically. The reason is that when the error is context cancelled, the previous code think user hasn't login then the session will be deleted. Now it will return the errors but not think it's not login. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Replace more gt- with tw- (#29678)silverwind2024-03-081-1/+1
| | | This will conclude the trivial class replacements.
* Move some asymkey functions to service layer (#28894)Lunny Xiao2024-03-042-4/+6
| | | | After the moving, all models will not depend on `util.Rename` so that I can do next step refactoring.
* Add user blocking (#29028)KN4CK3R2024-03-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | Fixes #17453 This PR adds the abbility to block a user from a personal account or organization to restrict how the blocked user can interact with the blocker. The docs explain what's the consequence of blocking a user. Screenshots: ![grafik](https://github.com/go-gitea/gitea/assets/1666336/4ed884f3-e06a-4862-afd3-3b8aa2488dc6) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ae6d4981-f252-4f50-a429-04f0f9f1cdf1) ![grafik](https://github.com/go-gitea/gitea/assets/1666336/ca153599-5b0f-4b4a-90fe-18bdfd6f0b6b) --------- Co-authored-by: Lauris BH <lauris@nix.lv>
* remove util.OptionalBool and related functions (#29513)65432024-03-024-8/+7
| | | | | | and migrate affected code _last refactoring bits to replace **util.OptionalBool** with **optional.Option[bool]**_
* Move context from modules to services (#29440)Lunny Xiao2024-02-272-2/+2
| | | | | | | | | | | | | | | Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context
* Revert "Support SAML authentication (#25165)" (#29358)65432024-02-249-560/+0
| | | | | | | | | | This reverts #25165 (5bb8d1924d77c675467694de26697b876d709a17), as there was a chance some important reviews got missed. so after reverting this patch it will be resubmitted for reviewing again https://github.com/go-gitea/gitea/pull/25165#issuecomment-1960670242 temporary Open #5512 again
* Fix tarball/zipball download bug (#29342)Zettat1232024-02-232-1/+6
| | | | | | | Fix #29249 ~~Use the `/repos/{owner}/{repo}/archive/{archive}` API to download.~~ Apply #26430 to archive download URLs.
* Start to migrate from `util.OptionalBool` to `optional.Option[bool]` (#29329)65432024-02-236-13/+13
| | | just create transition helper and migrate two structs
* Support SAML authentication (#25165)techknowlogick2024-02-239-0/+560
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes https://github.com/go-gitea/gitea/issues/5512 This PR adds basic SAML support - Adds SAML 2.0 as an auth source - Adds SAML configuration documentation - Adds integration test: - Use bare-bones SAML IdP to test protocol flow and test account is linked successfully (only runs on Postgres by default) - Adds documentation for configuring and running SAML integration test locally Future PRs: - Support group mapping - Support auto-registration (account linking) Co-Authored-By: @jackHay22 --------- Co-authored-by: jackHay22 <jack@allspice.io> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: morphelinho <morphelinho@users.noreply.github.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Yarden Shoham <git@yardenshoham.com> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: silverwind <me@silverwind.io>
* Fix c/p error in inline documentation (#29148)Johan Van de Wauw2024-02-191-1/+1
| | | | | | | Fix small copy/paste error in inline documentation --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use general token signing secret (#29205)wxiaoguang2024-02-181-8/+1
| | | Use a clearly defined "signing secret" for token signing.
* Refactor JWT secret generating & decoding code (#29172)wxiaoguang2024-02-161-1/+2
| | | | | | | | Old code is not consistent for generating & decoding the JWT secrets. Now, the callers only need to use 2 consistent functions: NewJwtSecretWithBase64 and DecodeJwtSecretBase64 And remove a non-common function Base64FixedDecode from util.go
* Unify user update methods (#28733)KN4CK3R2024-02-043-25/+31
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Fix SSPI user creation (#28948)KN4CK3R2024-01-271-7/+3
| | | | | | Fixes #28945 Setting the avatar is wrong and creating a random password is equal to leave it empty.
* Refactor timeutil package (#28623)wxiaoguang2023-12-281-5/+5
| | | | | 1. make names more readable 2. remove unused FormatLong/FormatShort 3. use `FormatDate` instead of `Format "2006-01-02"`
* Deprecate query string auth tokens (#28390)Jack Hay2023-12-121-7/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ## Changes - Add deprecation warning to `Token` and `AccessToken` authentication methods in swagger. - Add deprecation warning header to API response. Example: ``` HTTP/1.1 200 OK ... Warning: token and access_token API authentication is deprecated ... ``` - Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth tokens entirely. Default is `false` ## Next steps - `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and the methods should be removed in swagger - `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of the auth methods in question should be removed ## Open questions - Should there be further changes to the swagger documentation? Deprecation is not yet supported for security definitions (coming in [OpenAPI Spec version 3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506)) - Should the API router logger sanitize urls that use `token` or `access_token`? (This is obviously an insufficient solution on its own) --------- Co-authored-by: delvh <dev.lh@web.de>
* Use db.Find instead of writing methods for every object (#28084)Lunny Xiao2023-11-246-6/+12
| | | | For those simple objects, it's unnecessary to write the find and count methods again and again.
* Unify two factor check (#27915)KN4CK3R2023-11-061-2/+22
| | | | | | | | Fixes #27819 We have support for two factor logins with the normal web login and with basic auth. For basic auth the two factor check was implemented at three different places and you need to know that this check is necessary. This PR moves the check into the basic auth itself.
* Refactor Find Sources and fix bug when view a user who belongs to an ↵Lunny Xiao2023-11-035-24/+44
| | | | | | | | | | | | unactive auth source (#27798) The steps to reproduce it. First, create a new oauth2 source. Then, a user login with this oauth2 source. Disable the oauth2 source. Visit users -> settings -> security, 500 will be displayed. This is because this page only load active Oauth2 sources but not all Oauth2 sources.
* Replace more db.DefaultContext (#27628)Lunny Xiao2023-10-151-4/+4
| | | Target #27065
* Final round of `db.DefaultContext` refactor (#27587)JakobDev2023-10-143-12/+16
| | | Last part of #27065
* Enhanced auth token / remember me (#27606)KN4CK3R2023-10-143-0/+244
| | | | | | | | | | | | | | | | | Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-116-14/+14
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix attachment download bug (#27486)Lunny Xiao2023-10-105-12/+20
|
* Fix ldap admin privileges update bug (#27051)CaiCandong2023-10-011-10/+7
| | | | | | | | | | | | When the user does not set a username lookup condition, LDAP will get an empty string `""` for the user, hence the following code ``` if isExist, err := user_model.IsUserExist(db.DefaultContext, 0, sr.Username) ``` The user presence determination will always be nonexistent, so updates to user information will never be performed. Fix #27049
* Allow get release download files and lfs files with oauth2 token format (#26430)Lunny Xiao2023-10-011-1/+3
| | | | Fix #26165 Fix #25257
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-253-6/+5
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Increase auth provider icon size on login page (#27122)silverwind2023-09-193-9/+11
| | | | | | | | | | | | | | | | | | Before, 20px: <img width="474" alt="Screenshot 2023-09-19 at 00 10 05" src="https://github.com/go-gitea/gitea/assets/115237/4bed4edb-219d-4844-9d3c-0d747033b09f"> After, 28px: <img width="576" alt="Screenshot 2023-09-19 at 00 20 40" src="https://github.com/go-gitea/gitea/assets/115237/f482ac09-38ae-4c84-80d9-0bd39b7f9772"> Dropdown in account settings is unchanged at 20px: <img width="157" alt="Screenshot 2023-09-19 at 00 09 11" src="https://github.com/go-gitea/gitea/assets/115237/9c998cdf-eeed-4118-9262-664faaa56092"> --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Make SSPI auth mockable (#27036)wxiaoguang2023-09-173-16/+63
| | | | | | Before, the SSPI auth is only complied for Windows, it's difficult to test and it breaks a lot. Now, make the SSPI auth mockable and testable.
* More refactoring of `db.DefaultContext` (#27083)JakobDev2023-09-152-12/+12
| | | Next step of #27065
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-1413-33/+41
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Extract auth middleware from service (#27028)KN4CK3R2023-09-121-255/+0
| | | | | | Related #27027 Extract the router logic from `services/auth/middleware.go` into `routers/web` <-> `routers/common` <-> `routers/api`.
* Improve LDAP group config documentation, fixes #21159 (#21227)Sven Seeberg2023-09-051-4/+5
| | | | Improve the wording of the LDAP group attributes documentation and expand the examples.
* Remove `Named` interface (#26913)KN4CK3R2023-09-058-21/+4
| | | | `Named` is implemented by every `Method` and future implementations should implement the method too.
* Update team invitation email link (#26550)Jack Hay2023-08-311-2/+2
| | | | | Co-authored-by: Kyle D <kdumontnu@gmail.com> Co-authored-by: Jonathan Tran <jonnytran@gmail.com>
* Use `Set[Type]` instead of `map[Type]bool/struct{}`. (#26804)KN4CK3R2023-08-301-3/+4
|
* Use `object-fit: contain` for oauth2 custom icons (#26493)wxiaoguang2023-08-141-1/+1
|
* Handle base64 decoding correctly to avoid panic (#26483)wxiaoguang2023-08-141-10/+1
| | | Fix the panic if the "base64 secret" is too long.
* Bump github.com/golang-jwt/jwt to v5 (#25975)harryzcy2023-07-192-2/+5
| | | | | | | | | | | | | | | | Bumping `github.com/golang-jwt/jwt` from v4 to v5. `github.com/golang-jwt/jwt` v5 is bringing some breaking changes: - standard `Valid()` method on claims is removed. It's replaced by `ClaimsValidator` interface implementing `Validator()` method instead, which is called after standard validation. Gitea doesn't seem to be using this logic. - `jwt.Token` has a field `Valid`, so it's checked in `ParseToken` function in `services/auth/source/oauth2/token.go` --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Fix SSPI auth panic (#25955)wxiaoguang2023-07-181-2/+2
| | | | | Try to fix #25952 Co-authored-by: Giteabot <teabot@gitea.io>
* Fix the error message when the token is incorrect (#25701)caicandong2023-07-112-24/+41
| | | | | | | | | | | | | | | we refactored `userIDFromToken` for the token parsing part into a new function `parseToken`. `parseToken` returns the string `token` from request, and a boolean `ok` representing whether the token exists or not. So we can distinguish between token non-existence and token inconsistency in the `verfity` function, thus solving the problem of no proper error message when the token is inconsistent. close #24439 related #22119 --------- Co-authored-by: Jason Song <i@wolfogre.com> Co-authored-by: Giteabot <teabot@gitea.io>
* Replace `interface{}` with `any` (#25686)silverwind2023-07-042-16/+16
| | | | | Result of running `perl -p -i -e 's#interface\{\}#any#g' **/*` and `make fmt`. Basically the same [as golang did](https://github.com/golang/go/commit/2580d0e08d5e9f979b943758d3c49877fb2324cb).
* Log the real reason when authentication fails (but don't show the user) (#25414)Lunny Xiao2023-07-031-2/+37
|
* Change default email domain for LDAP users (#25425)Zettat1232023-06-222-2/+2
| | | | | Fixes #21169 Change `localhost` to `localhost.local`
* Fix LDAP sync when Username Attribute is empty (#25278)Zettat1232023-06-201-30/+32
| | | | | | | | | | | | | Fix #21072 ![image](https://github.com/go-gitea/gitea/assets/15528715/96b30beb-7f88-4a60-baae-2e5ad8049555) Username Attribute is not a required item when creating an authentication source. If Username Attribute is empty, the username value of LDAP user cannot be read, so all users from LDAP will be marked as inactive by mistake when synchronizing external users. This PR improves the sync logic, if username is empty, the email address will be used to find user.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-24 02:20:08 +0000