mirror of
https://github.com/go-gitea/gitea.git
synced 2025-05-01 13:15:12 +00:00
0148d03f21
Fix #880 Design: 1. A global setting `security.TWO_FACTOR_AUTH`. * To support org-level config, we need to introduce a better "owner setting" system first (in the future) 2. A user without 2FA can login and may explore, but can NOT read or write to any repositories via API/web. 3. Keep things as simple as possible. * This option only aggressively suggest users to enable their 2FA at the moment, it does NOT guarantee that users must have 2FA before all other operations, it should be good enough for real world use cases. * Some details and tests could be improved in the future since this change only adds a check and seems won't affect too much. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
48 lines
1.5 KiB
Go
48 lines
1.5 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package oauth2
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/markbates/goth"
|
|
"github.com/markbates/goth/gothic"
|
|
)
|
|
|
|
// Callout redirects request/response pair to authenticate against the provider
|
|
func (source *Source) Callout(request *http.Request, response http.ResponseWriter) error {
|
|
// not sure if goth is thread safe (?) when using multiple providers
|
|
request.Header.Set(ProviderHeaderKey, source.AuthSource.Name)
|
|
|
|
// don't use the default gothic begin handler to prevent issues when some error occurs
|
|
// normally the gothic library will write some custom stuff to the response instead of our own nice error page
|
|
// gothic.BeginAuthHandler(response, request)
|
|
|
|
gothRWMutex.RLock()
|
|
defer gothRWMutex.RUnlock()
|
|
|
|
url, err := gothic.GetAuthURL(response, request)
|
|
if err == nil {
|
|
http.Redirect(response, request, url, http.StatusTemporaryRedirect)
|
|
}
|
|
return err
|
|
}
|
|
|
|
// Callback handles OAuth callback, resolve to a goth user and send back to original url
|
|
// this will trigger a new authentication request, but because we save it in the session we can use that
|
|
func (source *Source) Callback(request *http.Request, response http.ResponseWriter) (goth.User, error) {
|
|
// not sure if goth is thread safe (?) when using multiple providers
|
|
request.Header.Set(ProviderHeaderKey, source.AuthSource.Name)
|
|
|
|
gothRWMutex.RLock()
|
|
defer gothRWMutex.RUnlock()
|
|
|
|
user, err := gothic.CompleteUserAuth(response, request)
|
|
if err != nil {
|
|
return user, err
|
|
}
|
|
|
|
return user, nil
|
|
}
|