auth.go 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package auth
  5. import (
  6. "strings"
  7. "time"
  8. "github.com/go-macaron/session"
  9. gouuid "github.com/satori/go.uuid"
  10. "gopkg.in/macaron.v1"
  11. log "unknwon.dev/clog/v2"
  12. "gogs.io/gogs/internal/conf"
  13. "gogs.io/gogs/internal/db"
  14. "gogs.io/gogs/internal/tool"
  15. )
  16. func IsAPIPath(url string) bool {
  17. return strings.HasPrefix(url, "/api/")
  18. }
  19. // SignedInID returns the id of signed in user, along with one bool value which indicates whether user uses token
  20. // authentication.
  21. func SignedInID(c *macaron.Context, sess session.Store) (_ int64, isTokenAuth bool) {
  22. if !db.HasEngine {
  23. return 0, false
  24. }
  25. // Check access token.
  26. if IsAPIPath(c.Req.URL.Path) {
  27. tokenSHA := c.Query("token")
  28. if len(tokenSHA) <= 0 {
  29. tokenSHA = c.Query("access_token")
  30. }
  31. if len(tokenSHA) == 0 {
  32. // Well, check with header again.
  33. auHead := c.Req.Header.Get("Authorization")
  34. if len(auHead) > 0 {
  35. auths := strings.Fields(auHead)
  36. if len(auths) == 2 && auths[0] == "token" {
  37. tokenSHA = auths[1]
  38. }
  39. }
  40. }
  41. // Let's see if token is valid.
  42. if len(tokenSHA) > 0 {
  43. t, err := db.GetAccessTokenBySHA(tokenSHA)
  44. if err != nil {
  45. if !db.IsErrAccessTokenNotExist(err) && !db.IsErrAccessTokenEmpty(err) {
  46. log.Error("GetAccessTokenBySHA: %v", err)
  47. }
  48. return 0, false
  49. }
  50. t.Updated = time.Now()
  51. if err = db.UpdateAccessToken(t); err != nil {
  52. log.Error("UpdateAccessToken: %v", err)
  53. }
  54. return t.UID, true
  55. }
  56. }
  57. uid := sess.Get("uid")
  58. if uid == nil {
  59. return 0, false
  60. }
  61. if id, ok := uid.(int64); ok {
  62. if _, err := db.GetUserByID(id); err != nil {
  63. if !db.IsErrUserNotExist(err) {
  64. log.Error("Failed to get user by ID: %v", err)
  65. }
  66. return 0, false
  67. }
  68. return id, false
  69. }
  70. return 0, false
  71. }
  72. // SignedInUser returns the user object of signed in user, along with two bool values,
  73. // which indicate whether user uses HTTP Basic Authentication or token authentication respectively.
  74. func SignedInUser(ctx *macaron.Context, sess session.Store) (_ *db.User, isBasicAuth bool, isTokenAuth bool) {
  75. if !db.HasEngine {
  76. return nil, false, false
  77. }
  78. uid, isTokenAuth := SignedInID(ctx, sess)
  79. if uid <= 0 {
  80. if conf.Auth.EnableReverseProxyAuthentication {
  81. webAuthUser := ctx.Req.Header.Get(conf.Security.ReverseProxyAuthenticationUser)
  82. if len(webAuthUser) > 0 {
  83. u, err := db.GetUserByName(webAuthUser)
  84. if err != nil {
  85. if !db.IsErrUserNotExist(err) {
  86. log.Error("Failed to get user by name: %v", err)
  87. return nil, false, false
  88. }
  89. // Check if enabled auto-registration.
  90. if conf.Auth.EnableReverseProxyAutoRegistration {
  91. u := &db.User{
  92. Name: webAuthUser,
  93. Email: gouuid.NewV4().String() + "@localhost",
  94. Passwd: webAuthUser,
  95. IsActive: true,
  96. }
  97. if err = db.CreateUser(u); err != nil {
  98. // FIXME: should I create a system notice?
  99. log.Error("Failed to create user: %v", err)
  100. return nil, false, false
  101. } else {
  102. return u, false, false
  103. }
  104. }
  105. }
  106. return u, false, false
  107. }
  108. }
  109. // Check with basic auth.
  110. baHead := ctx.Req.Header.Get("Authorization")
  111. if len(baHead) > 0 {
  112. auths := strings.Fields(baHead)
  113. if len(auths) == 2 && auths[0] == "Basic" {
  114. uname, passwd, _ := tool.BasicAuthDecode(auths[1])
  115. u, err := db.UserLogin(uname, passwd, -1)
  116. if err != nil {
  117. if !db.IsErrUserNotExist(err) {
  118. log.Error("Failed to authenticate user: %v", err)
  119. }
  120. return nil, false, false
  121. }
  122. return u, true, false
  123. }
  124. }
  125. return nil, false, false
  126. }
  127. u, err := db.GetUserByID(uid)
  128. if err != nil {
  129. log.Error("GetUserByID: %v", err)
  130. return nil, false, false
  131. }
  132. return u, false, isTokenAuth
  133. }