2019-11-22 18:33:31 -05:00
|
|
|
// Copyright 2019 The Gitea Authors. All rights reserved.
|
2022-11-27 13:20:29 -05:00
|
|
|
// SPDX-License-Identifier: MIT
|
2019-11-22 18:33:31 -05:00
|
|
|
|
2021-06-09 12:53:16 -05:00
|
|
|
package auth
|
2019-11-22 18:33:31 -05:00
|
|
|
|
|
|
|
import (
|
2021-07-24 05:16:34 -05:00
|
|
|
"context"
|
2021-01-05 08:05:40 -05:00
|
|
|
"net/http"
|
2019-11-22 18:33:31 -05:00
|
|
|
|
2021-11-24 04:49:20 -05:00
|
|
|
user_model "code.gitea.io/gitea/models/user"
|
2021-01-26 10:36:53 -05:00
|
|
|
"code.gitea.io/gitea/modules/session"
|
2021-01-30 03:55:53 -05:00
|
|
|
"code.gitea.io/gitea/modules/web/middleware"
|
2019-11-22 18:33:31 -05:00
|
|
|
)
|
|
|
|
|
2021-01-05 08:05:40 -05:00
|
|
|
// DataStore represents a data store
|
2023-05-04 01:36:34 -05:00
|
|
|
type DataStore middleware.ContextDataStore
|
2021-01-05 08:05:40 -05:00
|
|
|
|
|
|
|
// SessionStore represents a session store
|
2021-01-26 10:36:53 -05:00
|
|
|
type SessionStore session.Store
|
2021-01-05 08:05:40 -05:00
|
|
|
|
2021-07-24 05:16:34 -05:00
|
|
|
// Method represents an authentication method (plugin) for HTTP requests.
|
|
|
|
type Method interface {
|
|
|
|
// Verify tries to verify the authentication data contained in the request.
|
|
|
|
// If verification is successful returns either an existing user object (with id > 0)
|
|
|
|
// or a new user object (with id = 0) populated with the information that was found
|
|
|
|
// in the authentication data (username or email).
|
refactor auth interface to return error when verify failure (#22119)
This PR changed the Auth interface signature from
`Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess
SessionStore) *user_model.User`
to
`Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess
SessionStore) (*user_model.User, error)`.
There is a new return argument `error` which means the verification
condition matched but verify process failed, we should stop the auth
process.
Before this PR, when return a `nil` user, we don't know the reason why
it returned `nil`. If the match condition is not satisfied or it
verified failure? For these two different results, we should have
different handler. If the match condition is not satisfied, we should
try next auth method and if there is no more auth method, it's an
anonymous user. If the condition matched but verify failed, the auth
process should be stop and return immediately.
This will fix #20563
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
Co-authored-by: Jason Song <i@wolfogre.com>
2022-12-28 00:53:28 -05:00
|
|
|
// Second argument returns err if verification fails, otherwise
|
|
|
|
// First return argument returns nil if no matched verification condition
|
|
|
|
Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)
|
2021-06-09 12:53:16 -05:00
|
|
|
|
2021-07-24 05:16:34 -05:00
|
|
|
Name() string
|
|
|
|
}
|
|
|
|
|
|
|
|
// PasswordAuthenticator represents a source of authentication
|
|
|
|
type PasswordAuthenticator interface {
|
2023-09-14 12:09:32 -05:00
|
|
|
Authenticate(ctx context.Context, user *user_model.User, login, password string) (*user_model.User, error)
|
2021-07-24 05:16:34 -05:00
|
|
|
}
|
|
|
|
|
2021-09-17 06:43:47 -05:00
|
|
|
// LocalTwoFASkipper represents a source of authentication that can skip local 2fa
|
|
|
|
type LocalTwoFASkipper interface {
|
|
|
|
IsSkipLocalTwoFA() bool
|
|
|
|
}
|
|
|
|
|
2021-07-24 05:16:34 -05:00
|
|
|
// SynchronizableSource represents a source that can synchronize users
|
|
|
|
type SynchronizableSource interface {
|
|
|
|
Sync(ctx context.Context, updateExisting bool) error
|
2019-11-22 18:33:31 -05:00
|
|
|
}
|