mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-12-11 04:30:13 +00:00
894d9b2836
Since `modules/context` has to depend on `models` and many other packages, it should be moved from `modules/context` to `services/context` according to design principles. There is no logic code change on this PR, only move packages. - Move `code.gitea.io/gitea/modules/context` to `code.gitea.io/gitea/services/context` - Move `code.gitea.io/gitea/modules/contexttest` to `code.gitea.io/gitea/services/contexttest` because of depending on context - Move `code.gitea.io/gitea/modules/upload` to `code.gitea.io/gitea/services/context/upload` because of depending on context (cherry picked from commit 29f149bd9f517225a3c9f1ca3fb0a7b5325af696) Conflicts: routers/api/packages/alpine/alpine.go routers/api/v1/repo/issue_reaction.go routers/install/install.go routers/web/admin/config.go routers/web/passkey.go routers/web/repo/search.go routers/web/repo/setting/default_branch.go routers/web/user/home.go routers/web/user/profile.go tests/integration/editor_test.go tests/integration/integration_test.go tests/integration/mirror_push_test.go trivial context conflicts also modified all other occurrences in Forgejo specific files
121 lines
3.4 KiB
Go
121 lines
3.4 KiB
Go
// Copyright 2018 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package security
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"strconv"
|
|
"time"
|
|
|
|
"code.gitea.io/gitea/models/auth"
|
|
wa "code.gitea.io/gitea/modules/auth/webauthn"
|
|
"code.gitea.io/gitea/modules/log"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
"code.gitea.io/gitea/modules/web"
|
|
"code.gitea.io/gitea/services/context"
|
|
"code.gitea.io/gitea/services/forms"
|
|
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
"github.com/go-webauthn/webauthn/webauthn"
|
|
)
|
|
|
|
// WebAuthnRegister initializes the webauthn registration procedure
|
|
func WebAuthnRegister(ctx *context.Context) {
|
|
form := web.GetForm(ctx).(*forms.WebauthnRegistrationForm)
|
|
if form.Name == "" {
|
|
// Set name to the hexadecimal of the current time
|
|
form.Name = strconv.FormatInt(time.Now().UnixNano(), 16)
|
|
}
|
|
|
|
cred, err := auth.GetWebAuthnCredentialByName(ctx, ctx.Doer.ID, form.Name)
|
|
if err != nil && !auth.IsErrWebAuthnCredentialNotExist(err) {
|
|
ctx.ServerError("GetWebAuthnCredentialsByUID", err)
|
|
return
|
|
}
|
|
if cred != nil {
|
|
ctx.Error(http.StatusConflict, "Name already taken")
|
|
return
|
|
}
|
|
|
|
_ = ctx.Session.Delete("webauthnRegistration")
|
|
if err := ctx.Session.Set("webauthnName", form.Name); err != nil {
|
|
ctx.ServerError("Unable to set session key for webauthnName", err)
|
|
return
|
|
}
|
|
|
|
credentialOptions, sessionData, err := wa.WebAuthn.BeginRegistration((*wa.User)(ctx.Doer))
|
|
if err != nil {
|
|
ctx.ServerError("Unable to BeginRegistration", err)
|
|
return
|
|
}
|
|
|
|
// Save the session data as marshaled JSON
|
|
if err = ctx.Session.Set("webauthnRegistration", sessionData); err != nil {
|
|
ctx.ServerError("Unable to set session", err)
|
|
return
|
|
}
|
|
|
|
ctx.JSON(http.StatusOK, credentialOptions)
|
|
}
|
|
|
|
// WebauthnRegisterPost receives the response of the security key
|
|
func WebauthnRegisterPost(ctx *context.Context) {
|
|
name, ok := ctx.Session.Get("webauthnName").(string)
|
|
if !ok || name == "" {
|
|
ctx.ServerError("Get webauthnName", errors.New("no webauthnName"))
|
|
return
|
|
}
|
|
|
|
// Load the session data
|
|
sessionData, ok := ctx.Session.Get("webauthnRegistration").(*webauthn.SessionData)
|
|
if !ok || sessionData == nil {
|
|
ctx.ServerError("Get registration", errors.New("no registration"))
|
|
return
|
|
}
|
|
defer func() {
|
|
_ = ctx.Session.Delete("webauthnRegistration")
|
|
}()
|
|
|
|
// Verify that the challenge succeeded
|
|
cred, err := wa.WebAuthn.FinishRegistration((*wa.User)(ctx.Doer), *sessionData, ctx.Req)
|
|
if err != nil {
|
|
if pErr, ok := err.(*protocol.Error); ok {
|
|
log.Error("Unable to finish registration due to error: %v\nDevInfo: %s", pErr, pErr.DevInfo)
|
|
}
|
|
ctx.ServerError("CreateCredential", err)
|
|
return
|
|
}
|
|
|
|
dbCred, err := auth.GetWebAuthnCredentialByName(ctx, ctx.Doer.ID, name)
|
|
if err != nil && !auth.IsErrWebAuthnCredentialNotExist(err) {
|
|
ctx.ServerError("GetWebAuthnCredentialsByUID", err)
|
|
return
|
|
}
|
|
if dbCred != nil {
|
|
ctx.Error(http.StatusConflict, "Name already taken")
|
|
return
|
|
}
|
|
|
|
// Create the credential
|
|
_, err = auth.CreateCredential(ctx, ctx.Doer.ID, name, cred)
|
|
if err != nil {
|
|
ctx.ServerError("CreateCredential", err)
|
|
return
|
|
}
|
|
_ = ctx.Session.Delete("webauthnName")
|
|
|
|
ctx.JSON(http.StatusCreated, cred)
|
|
}
|
|
|
|
// WebauthnDelete deletes an security key by id
|
|
func WebauthnDelete(ctx *context.Context) {
|
|
form := web.GetForm(ctx).(*forms.WebauthnDeleteForm)
|
|
if _, err := auth.DeleteCredential(ctx, form.ID, ctx.Doer.ID); err != nil {
|
|
ctx.ServerError("GetWebAuthnCredentialByID", err)
|
|
return
|
|
}
|
|
ctx.JSONRedirect(setting.AppSubURL + "/user/settings/security")
|
|
}
|