mirror of
https://github.com/go-gitea/gitea.git
synced 2025-05-01 13:15:12 +00:00
0148d03f21
Fix #880 Design: 1. A global setting `security.TWO_FACTOR_AUTH`. * To support org-level config, we need to introduce a better "owner setting" system first (in the future) 2. A user without 2FA can login and may explore, but can NOT read or write to any repositories via API/web. 3. Keep things as simple as possible. * This option only aggressively suggest users to enable their 2FA at the moment, it does NOT guarantee that users must have 2FA before all other operations, it should be good enough for real world use cases. * Some details and tests could be improved in the future since this change only adds a check and seems won't affect too much. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
51 lines
1.8 KiB
Go
51 lines
1.8 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package oauth2
|
|
|
|
import (
|
|
"fmt"
|
|
)
|
|
|
|
// RegisterSource causes an OAuth2 configuration to be registered
|
|
func (source *Source) RegisterSource() error {
|
|
err := RegisterProviderWithGothic(source.AuthSource.Name, source)
|
|
return wrapOpenIDConnectInitializeError(err, source.AuthSource.Name, source)
|
|
}
|
|
|
|
// UnregisterSource causes an OAuth2 configuration to be unregistered
|
|
func (source *Source) UnregisterSource() error {
|
|
RemoveProviderFromGothic(source.AuthSource.Name)
|
|
return nil
|
|
}
|
|
|
|
// ErrOpenIDConnectInitialize represents a "OpenIDConnectInitialize" kind of error.
|
|
type ErrOpenIDConnectInitialize struct {
|
|
OpenIDConnectAutoDiscoveryURL string
|
|
ProviderName string
|
|
Cause error
|
|
}
|
|
|
|
// IsErrOpenIDConnectInitialize checks if an error is a ExternalLoginUserAlreadyExist.
|
|
func IsErrOpenIDConnectInitialize(err error) bool {
|
|
_, ok := err.(ErrOpenIDConnectInitialize)
|
|
return ok
|
|
}
|
|
|
|
func (err ErrOpenIDConnectInitialize) Error() string {
|
|
return fmt.Sprintf("Failed to initialize OpenID Connect Provider with name '%s' with url '%s': %v", err.ProviderName, err.OpenIDConnectAutoDiscoveryURL, err.Cause)
|
|
}
|
|
|
|
func (err ErrOpenIDConnectInitialize) Unwrap() error {
|
|
return err.Cause
|
|
}
|
|
|
|
// wrapOpenIDConnectInitializeError is used to wrap the error but this cannot be done in modules/auth/oauth2
|
|
// inside oauth2: import cycle not allowed models -> modules/auth/oauth2 -> models
|
|
func wrapOpenIDConnectInitializeError(err error, providerName string, source *Source) error {
|
|
if err != nil && source.Provider == "openidConnect" {
|
|
err = ErrOpenIDConnectInitialize{ProviderName: providerName, OpenIDConnectAutoDiscoveryURL: source.OpenIDConnectAutoDiscoveryURL, Cause: err}
|
|
}
|
|
return err
|
|
}
|