-
-
Notifications
You must be signed in to change notification settings - Fork 5k
/
auth.go
183 lines (170 loc) · 4.09 KB
/
auth.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
package handles
import (
"bytes"
"encoding/base64"
"image/png"
"time"
"github.com/Xhofe/go-cache"
"github.com/alist-org/alist/v3/internal/model"
"github.com/alist-org/alist/v3/internal/op"
"github.com/alist-org/alist/v3/server/common"
"github.com/gin-gonic/gin"
"github.com/pquerna/otp/totp"
)
var loginCache = cache.NewMemCache[int]()
var (
defaultDuration = time.Minute * 5
defaultTimes = 5
)
type LoginReq struct {
Username string `json:"username" binding:"required"`
Password string `json:"password"`
OtpCode string `json:"otp_code"`
}
// Login Deprecated
func Login(c *gin.Context) {
var req LoginReq
if err := c.ShouldBind(&req); err != nil {
common.ErrorResp(c, err, 400)
return
}
req.Password = model.StaticHash(req.Password)
loginHash(c, &req)
}
// LoginHash login with password hashed by sha256
func LoginHash(c *gin.Context) {
var req LoginReq
if err := c.ShouldBind(&req); err != nil {
common.ErrorResp(c, err, 400)
return
}
loginHash(c, &req)
}
func loginHash(c *gin.Context, req *LoginReq) {
// check count of login
ip := c.ClientIP()
count, ok := loginCache.Get(ip)
if ok && count >= defaultTimes {
common.ErrorStrResp(c, "Too many unsuccessful sign-in attempts have been made using an incorrect username or password, Try again later.", 429)
loginCache.Expire(ip, defaultDuration)
return
}
// check username
user, err := op.GetUserByName(req.Username)
if err != nil {
common.ErrorResp(c, err, 400)
loginCache.Set(ip, count+1)
return
}
// validate password hash
if err := user.ValidatePwdStaticHash(req.Password); err != nil {
common.ErrorResp(c, err, 400)
loginCache.Set(ip, count+1)
return
}
// check 2FA
if user.OtpSecret != "" {
if !totp.Validate(req.OtpCode, user.OtpSecret) {
common.ErrorStrResp(c, "Invalid 2FA code", 402)
loginCache.Set(ip, count+1)
return
}
}
// generate token
token, err := common.GenerateToken(user)
if err != nil {
common.ErrorResp(c, err, 400, true)
return
}
common.SuccessResp(c, gin.H{"token": token})
loginCache.Del(ip)
}
type UserResp struct {
model.User
Otp bool `json:"otp"`
}
// CurrentUser get current user by token
// if token is empty, return guest user
func CurrentUser(c *gin.Context) {
user := c.MustGet("user").(*model.User)
userResp := UserResp{
User: *user,
}
userResp.Password = ""
if userResp.OtpSecret != "" {
userResp.Otp = true
}
common.SuccessResp(c, userResp)
}
func UpdateCurrent(c *gin.Context) {
var req model.User
if err := c.ShouldBind(&req); err != nil {
common.ErrorResp(c, err, 400)
return
}
user := c.MustGet("user").(*model.User)
user.Username = req.Username
if req.Password != "" {
user.SetPassword(req.Password)
}
user.SsoID = req.SsoID
if err := op.UpdateUser(user); err != nil {
common.ErrorResp(c, err, 500)
} else {
common.SuccessResp(c)
}
}
func Generate2FA(c *gin.Context) {
user := c.MustGet("user").(*model.User)
if user.IsGuest() {
common.ErrorStrResp(c, "Guest user can not generate 2FA code", 403)
return
}
key, err := totp.Generate(totp.GenerateOpts{
Issuer: "Alist",
AccountName: user.Username,
})
if err != nil {
common.ErrorResp(c, err, 500)
return
}
img, err := key.Image(400, 400)
if err != nil {
common.ErrorResp(c, err, 500)
return
}
// to base64
var buf bytes.Buffer
png.Encode(&buf, img)
b64 := base64.StdEncoding.EncodeToString(buf.Bytes())
common.SuccessResp(c, gin.H{
"qr": "data:image/png;base64," + b64,
"secret": key.Secret(),
})
}
type Verify2FAReq struct {
Code string `json:"code" binding:"required"`
Secret string `json:"secret" binding:"required"`
}
func Verify2FA(c *gin.Context) {
var req Verify2FAReq
if err := c.ShouldBind(&req); err != nil {
common.ErrorResp(c, err, 400)
return
}
user := c.MustGet("user").(*model.User)
if user.IsGuest() {
common.ErrorStrResp(c, "Guest user can not generate 2FA code", 403)
return
}
if !totp.Validate(req.Code, req.Secret) {
common.ErrorStrResp(c, "Invalid 2FA code", 400)
return
}
user.OtpSecret = req.Secret
if err := op.UpdateUser(user); err != nil {
common.ErrorResp(c, err, 500)
} else {
common.SuccessResp(c)
}
}