memos/api/v1/auth.go

274 lines
9.9 KiB
Go
Raw Normal View History

package v1
2022-02-03 15:32:03 +08:00
import (
"encoding/json"
2022-02-03 15:32:03 +08:00
"fmt"
"net/http"
"regexp"
2022-02-03 15:32:03 +08:00
"github.com/labstack/echo/v4"
"github.com/pkg/errors"
"github.com/usememos/memos/api/v1/auth"
2023-07-06 22:53:38 +08:00
"github.com/usememos/memos/common/util"
"github.com/usememos/memos/plugin/idp"
"github.com/usememos/memos/plugin/idp/oauth2"
"github.com/usememos/memos/store"
2022-02-06 16:19:20 +08:00
"golang.org/x/crypto/bcrypt"
2022-02-03 15:32:03 +08:00
)
type SignIn struct {
Username string `json:"username"`
Password string `json:"password"`
}
type SSOSignIn struct {
IdentityProviderID int `json:"identityProviderId"`
Code string `json:"code"`
RedirectURI string `json:"redirectUri"`
}
type SignUp struct {
Username string `json:"username"`
Password string `json:"password"`
}
func (s *APIV1Service) registerAuthRoutes(g *echo.Group) {
2023-07-15 23:30:20 +08:00
// POST /auth/signin - Sign in.
g.POST("/auth/signin", func(c echo.Context) error {
2022-08-07 09:23:46 +08:00
ctx := c.Request().Context()
signin := &SignIn{}
if err := json.NewDecoder(c.Request().Body).Decode(signin); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signin request").SetInternal(err)
2022-02-03 15:32:03 +08:00
}
user, err := s.Store.GetUser(ctx, &store.FindUser{
Username: &signin.Username,
})
2023-07-06 22:53:38 +08:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Incorrect login credentials, please try again")
2022-02-03 15:32:03 +08:00
}
if user == nil {
return echo.NewHTTPError(http.StatusUnauthorized, "Incorrect login credentials, please try again")
} else if user.RowStatus == store.Archived {
return echo.NewHTTPError(http.StatusForbidden, fmt.Sprintf("User has been archived with username %s", signin.Username))
2022-02-03 15:32:03 +08:00
}
2022-02-06 16:19:20 +08:00
// Compare the stored hashed password, with the hashed version of the password that was received.
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(signin.Password)); err != nil {
2022-02-06 16:19:20 +08:00
// If the two passwords don't match, return a 401 status.
return echo.NewHTTPError(http.StatusUnauthorized, "Incorrect login credentials, please try again")
2022-02-03 15:32:03 +08:00
}
if err := auth.GenerateTokensAndSetCookies(c, user, s.Secret); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate tokens").SetInternal(err)
2022-02-04 00:56:44 +08:00
}
if err := s.createAuthSignInActivity(c, user); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create activity").SetInternal(err)
}
return c.JSON(http.StatusOK, user)
2022-02-03 15:32:03 +08:00
})
2022-02-18 22:21:10 +08:00
2023-07-15 23:30:20 +08:00
// POST /auth/signin/sso - Sign in with SSO
g.POST("/auth/signin/sso", func(c echo.Context) error {
ctx := c.Request().Context()
signin := &SSOSignIn{}
if err := json.NewDecoder(c.Request().Body).Decode(signin); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signin request").SetInternal(err)
}
2023-06-26 23:46:01 +08:00
identityProvider, err := s.Store.GetIdentityProvider(ctx, &store.FindIdentityProvider{
ID: &signin.IdentityProviderID,
})
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find identity provider").SetInternal(err)
}
2023-06-26 23:46:01 +08:00
if identityProvider == nil {
return echo.NewHTTPError(http.StatusNotFound, "Identity provider not found")
}
var userInfo *idp.IdentityProviderUserInfo
if identityProvider.Type == store.IdentityProviderOAuth2Type {
2023-06-26 23:46:01 +08:00
oauth2IdentityProvider, err := oauth2.NewIdentityProvider(identityProvider.Config.OAuth2Config)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create identity provider instance").SetInternal(err)
}
token, err := oauth2IdentityProvider.ExchangeToken(ctx, signin.RedirectURI, signin.Code)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to exchange token").SetInternal(err)
}
userInfo, err = oauth2IdentityProvider.UserInfo(token)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to get user info").SetInternal(err)
}
}
2023-06-26 23:46:01 +08:00
identifierFilter := identityProvider.IdentifierFilter
if identifierFilter != "" {
identifierFilterRegex, err := regexp.Compile(identifierFilter)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to compile identifier filter").SetInternal(err)
}
if !identifierFilterRegex.MatchString(userInfo.Identifier) {
return echo.NewHTTPError(http.StatusUnauthorized, "Access denied, identifier does not match the filter.").SetInternal(err)
}
}
user, err := s.Store.GetUser(ctx, &store.FindUser{
Username: &userInfo.Identifier,
})
2023-07-06 22:53:38 +08:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Incorrect login credentials, please try again")
}
if user == nil {
userCreate := &store.User{
Username: userInfo.Identifier,
// The new signup user should be normal user by default.
Role: store.RoleUser,
Nickname: userInfo.DisplayName,
Email: userInfo.Email,
2023-07-06 22:53:38 +08:00
OpenID: util.GenUUID(),
}
2023-07-06 22:53:38 +08:00
password, err := util.RandomString(20)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate random password").SetInternal(err)
}
passwordHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
}
userCreate.PasswordHash = string(passwordHash)
user, err = s.Store.CreateUser(ctx, userCreate)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create user").SetInternal(err)
}
}
if user.RowStatus == store.Archived {
return echo.NewHTTPError(http.StatusForbidden, fmt.Sprintf("User has been archived with username %s", userInfo.Identifier))
}
if err := auth.GenerateTokensAndSetCookies(c, user, s.Secret); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate tokens").SetInternal(err)
}
if err := s.createAuthSignInActivity(c, user); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create activity").SetInternal(err)
}
return c.JSON(http.StatusOK, user)
})
2023-07-15 23:30:20 +08:00
// POST /auth/signup - Sign up a new user.
2022-02-03 15:32:03 +08:00
g.POST("/auth/signup", func(c echo.Context) error {
2022-08-07 09:23:46 +08:00
ctx := c.Request().Context()
signup := &SignUp{}
if err := json.NewDecoder(c.Request().Body).Decode(signup); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signup request").SetInternal(err)
}
hostUserType := store.RoleHost
existedHostUsers, err := s.Store.ListUsers(ctx, &store.FindUser{
Role: &hostUserType,
})
2023-02-11 15:15:56 +08:00
if err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Failed to find users").SetInternal(err)
}
userCreate := &store.User{
Username: signup.Username,
// The new signup user should be normal user by default.
Role: store.RoleUser,
Nickname: signup.Username,
2023-07-06 22:53:38 +08:00
OpenID: util.GenUUID(),
}
2023-02-11 15:15:56 +08:00
if len(existedHostUsers) == 0 {
// Change the default role to host if there is no host user.
userCreate.Role = store.RoleHost
2023-02-11 15:15:56 +08:00
} else {
2023-06-29 22:55:03 +08:00
allowSignUpSetting, err := s.Store.GetSystemSetting(ctx, &store.FindSystemSetting{
Name: SystemSettingAllowSignUpName.String(),
2023-02-11 15:15:56 +08:00
})
2023-07-06 22:53:38 +08:00
if err != nil {
2023-02-11 15:15:56 +08:00
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find system setting").SetInternal(err)
}
2023-02-11 15:15:56 +08:00
allowSignUpSettingValue := false
if allowSignUpSetting != nil {
err = json.Unmarshal([]byte(allowSignUpSetting.Value), &allowSignUpSettingValue)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to unmarshal system setting allow signup").SetInternal(err)
}
}
if !allowSignUpSettingValue {
return echo.NewHTTPError(http.StatusUnauthorized, "signup is disabled").SetInternal(err)
}
2022-02-03 15:32:03 +08:00
}
2022-02-06 16:19:20 +08:00
passwordHash, err := bcrypt.GenerateFromPassword([]byte(signup.Password), bcrypt.DefaultCost)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
}
2022-08-20 21:03:15 +08:00
userCreate.PasswordHash = string(passwordHash)
user, err := s.Store.CreateUser(ctx, userCreate)
2022-02-03 15:32:03 +08:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create user").SetInternal(err)
}
if err := auth.GenerateTokensAndSetCookies(c, user, s.Secret); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate tokens").SetInternal(err)
}
if err := s.createAuthSignUpActivity(c, user); err != nil {
2023-01-02 23:18:12 +08:00
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create activity").SetInternal(err)
}
2022-02-03 15:32:03 +08:00
return c.JSON(http.StatusOK, user)
2022-02-03 15:32:03 +08:00
})
2022-12-28 20:58:59 +08:00
2023-07-15 23:30:20 +08:00
// POST /auth/signout - Sign out.
g.POST("/auth/signout", func(c echo.Context) error {
auth.RemoveTokensAndCookies(c)
2022-12-28 20:58:59 +08:00
return c.JSON(http.StatusOK, true)
})
2022-02-03 15:32:03 +08:00
}
func (s *APIV1Service) createAuthSignInActivity(c echo.Context, user *store.User) error {
ctx := c.Request().Context()
payload := ActivityUserAuthSignInPayload{
UserID: user.ID,
IP: echo.ExtractIPFromRealIPHeader()(c.Request()),
}
payloadBytes, err := json.Marshal(payload)
if err != nil {
2023-01-02 23:18:12 +08:00
return errors.Wrap(err, "failed to marshal activity payload")
}
activity, err := s.Store.CreateActivity(ctx, &store.Activity{
CreatorID: user.ID,
Type: string(ActivityUserAuthSignIn),
Level: string(ActivityInfo),
Payload: string(payloadBytes),
})
2023-01-07 11:49:58 +08:00
if err != nil || activity == nil {
return errors.Wrap(err, "failed to create activity")
}
return err
}
2023-01-02 23:18:12 +08:00
func (s *APIV1Service) createAuthSignUpActivity(c echo.Context, user *store.User) error {
2023-01-02 23:18:12 +08:00
ctx := c.Request().Context()
payload := ActivityUserAuthSignUpPayload{
2023-01-02 23:18:12 +08:00
Username: user.Username,
IP: echo.ExtractIPFromRealIPHeader()(c.Request()),
}
payloadBytes, err := json.Marshal(payload)
2023-01-02 23:18:12 +08:00
if err != nil {
return errors.Wrap(err, "failed to marshal activity payload")
}
activity, err := s.Store.CreateActivity(ctx, &store.Activity{
2023-01-02 23:18:12 +08:00
CreatorID: user.ID,
Type: string(ActivityUserAuthSignUp),
Level: string(ActivityInfo),
Payload: string(payloadBytes),
2023-01-02 23:18:12 +08:00
})
2023-01-07 11:49:58 +08:00
if err != nil || activity == nil {
return errors.Wrap(err, "failed to create activity")
}
2023-01-02 23:18:12 +08:00
return err
}