auth.go 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package auth
  5. import (
  6. "strings"
  7. "time"
  8. "github.com/go-macaron/session"
  9. gouuid "github.com/satori/go.uuid"
  10. "gopkg.in/macaron.v1"
  11. log "unknwon.dev/clog/v2"
  12. "gogs.io/gogs/internal/db"
  13. "gogs.io/gogs/internal/db/errors"
  14. "gogs.io/gogs/internal/setting"
  15. "gogs.io/gogs/internal/tool"
  16. )
  17. func IsAPIPath(url string) bool {
  18. return strings.HasPrefix(url, "/api/")
  19. }
  20. // SignedInID returns the id of signed in user, along with one bool value which indicates whether user uses token
  21. // authentication.
  22. func SignedInID(c *macaron.Context, sess session.Store) (_ int64, isTokenAuth bool) {
  23. if !db.HasEngine {
  24. return 0, false
  25. }
  26. // Check access token.
  27. if IsAPIPath(c.Req.URL.Path) {
  28. tokenSHA := c.Query("token")
  29. if len(tokenSHA) <= 0 {
  30. tokenSHA = c.Query("access_token")
  31. }
  32. if len(tokenSHA) == 0 {
  33. // Well, check with header again.
  34. auHead := c.Req.Header.Get("Authorization")
  35. if len(auHead) > 0 {
  36. auths := strings.Fields(auHead)
  37. if len(auths) == 2 && auths[0] == "token" {
  38. tokenSHA = auths[1]
  39. }
  40. }
  41. }
  42. // Let's see if token is valid.
  43. if len(tokenSHA) > 0 {
  44. t, err := db.GetAccessTokenBySHA(tokenSHA)
  45. if err != nil {
  46. if !db.IsErrAccessTokenNotExist(err) && !db.IsErrAccessTokenEmpty(err) {
  47. log.Error("GetAccessTokenBySHA: %v", err)
  48. }
  49. return 0, false
  50. }
  51. t.Updated = time.Now()
  52. if err = db.UpdateAccessToken(t); err != nil {
  53. log.Error("UpdateAccessToken: %v", err)
  54. }
  55. return t.UID, true
  56. }
  57. }
  58. uid := sess.Get("uid")
  59. if uid == nil {
  60. return 0, false
  61. }
  62. if id, ok := uid.(int64); ok {
  63. if _, err := db.GetUserByID(id); err != nil {
  64. if !errors.IsUserNotExist(err) {
  65. log.Error("GetUserByID: %v", err)
  66. }
  67. return 0, false
  68. }
  69. return id, false
  70. }
  71. return 0, false
  72. }
  73. // SignedInUser returns the user object of signed in user, along with two bool values,
  74. // which indicate whether user uses HTTP Basic Authentication or token authentication respectively.
  75. func SignedInUser(ctx *macaron.Context, sess session.Store) (_ *db.User, isBasicAuth bool, isTokenAuth bool) {
  76. if !db.HasEngine {
  77. return nil, false, false
  78. }
  79. uid, isTokenAuth := SignedInID(ctx, sess)
  80. if uid <= 0 {
  81. if setting.Service.EnableReverseProxyAuth {
  82. webAuthUser := ctx.Req.Header.Get(setting.ReverseProxyAuthUser)
  83. if len(webAuthUser) > 0 {
  84. u, err := db.GetUserByName(webAuthUser)
  85. if err != nil {
  86. if !errors.IsUserNotExist(err) {
  87. log.Error("GetUserByName: %v", err)
  88. return nil, false, false
  89. }
  90. // Check if enabled auto-registration.
  91. if setting.Service.EnableReverseProxyAutoRegister {
  92. u := &db.User{
  93. Name: webAuthUser,
  94. Email: gouuid.NewV4().String() + "@localhost",
  95. Passwd: webAuthUser,
  96. IsActive: true,
  97. }
  98. if err = db.CreateUser(u); err != nil {
  99. // FIXME: should I create a system notice?
  100. log.Error("CreateUser: %v", err)
  101. return nil, false, false
  102. } else {
  103. return u, false, false
  104. }
  105. }
  106. }
  107. return u, false, false
  108. }
  109. }
  110. // Check with basic auth.
  111. baHead := ctx.Req.Header.Get("Authorization")
  112. if len(baHead) > 0 {
  113. auths := strings.Fields(baHead)
  114. if len(auths) == 2 && auths[0] == "Basic" {
  115. uname, passwd, _ := tool.BasicAuthDecode(auths[1])
  116. u, err := db.UserLogin(uname, passwd, -1)
  117. if err != nil {
  118. if !errors.IsUserNotExist(err) {
  119. log.Error("UserLogin: %v", err)
  120. }
  121. return nil, false, false
  122. }
  123. return u, true, false
  124. }
  125. }
  126. return nil, false, false
  127. }
  128. u, err := db.GetUserByID(uid)
  129. if err != nil {
  130. log.Error("GetUserByID: %v", err)
  131. return nil, false, false
  132. }
  133. return u, false, isTokenAuth
  134. }