481323104a
- Added a new function, createPublicEntryConfig, to create a deep copy of EntryConfig without sensitive data, ensuring that global configuration remains intact when returning public config. - Updated entry verification logic to utilize EntryVerificationStatus for clearer status handling during user verification. - Enhanced tests to verify that the global config is not modified after multiple requests for public entry configuration, addressing a critical bug related to captcha secret exposure.
536 lines
16 KiB
Go
536 lines
16 KiB
Go
package user
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/yaoapp/kun/log"
|
|
"github.com/yaoapp/yao/messenger"
|
|
messengertypes "github.com/yaoapp/yao/messenger/types"
|
|
"github.com/yaoapp/yao/openapi/oauth"
|
|
"github.com/yaoapp/yao/openapi/response"
|
|
"github.com/yaoapp/yao/openapi/utils"
|
|
utilscaptcha "github.com/yaoapp/yao/utils/captcha"
|
|
utilsotp "github.com/yaoapp/yao/utils/otp"
|
|
)
|
|
|
|
// getEntryConfig is the handler for get unified auth entry configuration
|
|
func getEntryConfig(c *gin.Context) {
|
|
// Get locale from query parameter (optional)
|
|
locale := c.Query("locale")
|
|
|
|
// Get entry configuration for the specified locale
|
|
config := GetEntryConfig(locale)
|
|
|
|
// Set session id if not exists
|
|
sid := utils.GetSessionID(c)
|
|
if sid == "" {
|
|
sid = generateSessionID()
|
|
response.SendSessionCookie(c, sid)
|
|
}
|
|
|
|
// If no configuration found, return error
|
|
if config == nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrInvalidRequest.Code,
|
|
ErrorDescription: "No entry configuration found for the requested locale",
|
|
}
|
|
response.RespondWithError(c, response.StatusNotFound, errorResp)
|
|
return
|
|
}
|
|
|
|
// Create public config without sensitive data (deep copy to avoid modifying global config)
|
|
publicConfig := createPublicEntryConfig(config)
|
|
|
|
// Return the entry configuration
|
|
response.RespondWithSuccess(c, response.StatusOK, publicConfig)
|
|
}
|
|
|
|
// entry is the handler for unified auth entry (login/register)
|
|
// The backend determines whether this is a login or registration based on email existence
|
|
func entry(c *gin.Context) {
|
|
// This is a placeholder - you may need to implement the actual login/register logic here
|
|
// The logic should:
|
|
// 1. Check if the email exists in the database
|
|
// 2. If exists: proceed with login flow
|
|
// 3. If not exists: proceed with registration flow
|
|
}
|
|
|
|
// GinEntryVerify is the handler for verifying entry (login/register)
|
|
// It checks if the username exists and sends verification code if needed
|
|
func GinEntryVerify(c *gin.Context) {
|
|
// Parse request body
|
|
var req EntryVerifyRequest
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrInvalidRequest.Code,
|
|
ErrorDescription: "Invalid request body: " + err.Error(),
|
|
}
|
|
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
|
return
|
|
}
|
|
|
|
// Get locale from request or query parameter
|
|
locale := req.Locale
|
|
if locale == "" {
|
|
locale = c.Query("locale")
|
|
}
|
|
if locale == "" {
|
|
locale = "en" // Default locale
|
|
}
|
|
|
|
// Determine username type (email or mobile) - check this first before expensive operations
|
|
usernameType := determineUsernameType(req.Username)
|
|
if usernameType == "" {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrInvalidRequest.Code,
|
|
ErrorDescription: "Invalid username format: must be email or mobile number",
|
|
}
|
|
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
|
return
|
|
}
|
|
|
|
// Get entry configuration
|
|
config := GetEntryConfig(locale)
|
|
if config == nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrInvalidRequest.Code,
|
|
ErrorDescription: "Entry configuration not found for locale: " + locale,
|
|
}
|
|
response.RespondWithError(c, response.StatusNotFound, errorResp)
|
|
return
|
|
}
|
|
|
|
// Verify captcha
|
|
if config.Form != nil && config.Form.Captcha != nil {
|
|
err := verifyCaptcha(config.Form.Captcha, req.CaptchaID, req.Captcha)
|
|
if err != nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrInvalidRequest.Code,
|
|
ErrorDescription: "Captcha verification failed: " + err.Error(),
|
|
}
|
|
response.RespondWithError(c, response.StatusBadRequest, errorResp)
|
|
return
|
|
}
|
|
}
|
|
|
|
// Check if user exists
|
|
userExists, userID, err := checkUserExists(c.Request.Context(), usernameType, req.Username)
|
|
if err != nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrServerError.Code,
|
|
ErrorDescription: "Failed to check user existence: " + err.Error(),
|
|
}
|
|
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
|
return
|
|
}
|
|
|
|
// Get Yao client config for token generation
|
|
yaoClientConfig := GetYaoClientConfig()
|
|
if yaoClientConfig == nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrServerError.Code,
|
|
ErrorDescription: "Client configuration not found",
|
|
}
|
|
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
|
return
|
|
}
|
|
|
|
// Generate temporary access token for entry verification (valid for 10 minutes)
|
|
var tokenExpire int = 10 * 60 // 10 minutes
|
|
|
|
// Create subject based on username (temporary subject for verification)
|
|
tempSubject := fmt.Sprintf("entry:%s:%s", usernameType, req.Username)
|
|
|
|
// Extra claims for the token
|
|
extraClaims := map[string]interface{}{
|
|
"username": req.Username,
|
|
"username_type": usernameType,
|
|
}
|
|
|
|
// If user exists, add user_id to claims
|
|
if userExists && userID != "" {
|
|
extraClaims["user_id"] = userID
|
|
}
|
|
|
|
accessToken, err := oauth.OAuth.MakeAccessToken(yaoClientConfig.ClientID, ScopeEntryVerification, tempSubject, tokenExpire, extraClaims)
|
|
if err != nil {
|
|
errorResp := &response.ErrorResponse{
|
|
Code: response.ErrServerError.Code,
|
|
ErrorDescription: "Failed to generate access token: " + err.Error(),
|
|
}
|
|
response.RespondWithError(c, response.StatusInternalServerError, errorResp)
|
|
return
|
|
}
|
|
|
|
// Prepare response
|
|
verifyResp := EntryVerifyResponse{
|
|
AccessToken: accessToken,
|
|
ExpiresIn: tokenExpire,
|
|
TokenType: "Bearer",
|
|
Scope: ScopeEntryVerification,
|
|
UserExists: userExists,
|
|
}
|
|
|
|
// If user exists: return login status
|
|
if userExists {
|
|
verifyResp.Status = EntryVerificationStatusLogin
|
|
response.RespondWithSuccess(c, response.StatusOK, verifyResp)
|
|
return
|
|
}
|
|
|
|
// User doesn't exist: send verification code and return register status
|
|
verifyResp.Status = EntryVerificationStatusRegister
|
|
|
|
// Send verification code asynchronously
|
|
go func() {
|
|
ctx := context.Background()
|
|
err := sendEntryVerificationCode(ctx, config, usernameType, req.Username, locale)
|
|
if err != nil {
|
|
log.Error("Failed to send verification code to %s: %v", req.Username, err)
|
|
} else {
|
|
log.Info("Verification code sent to %s for registration", req.Username)
|
|
}
|
|
}()
|
|
|
|
verifyResp.VerificationSent = true
|
|
response.RespondWithSuccess(c, response.StatusOK, verifyResp)
|
|
}
|
|
|
|
// Helper Functions
|
|
|
|
// verifyCaptcha verifies the captcha based on type (image or turnstile)
|
|
func verifyCaptcha(captchaConfig *CaptchaConfig, captchaID, captcha string) error {
|
|
if captchaConfig == nil {
|
|
return nil // No captcha required
|
|
}
|
|
|
|
switch captchaConfig.Type {
|
|
case "image":
|
|
// Verify image captcha
|
|
if captchaID == "" || captcha == "" {
|
|
return fmt.Errorf("captcha_id and captcha are required for image captcha")
|
|
}
|
|
|
|
valid := utilscaptcha.Validate(captchaID, captcha)
|
|
if !valid {
|
|
return fmt.Errorf("invalid captcha")
|
|
}
|
|
return nil
|
|
|
|
case "turnstile":
|
|
// Verify Cloudflare Turnstile
|
|
if captcha == "" {
|
|
return fmt.Errorf("captcha token is required for Turnstile")
|
|
}
|
|
|
|
// Get secret from options
|
|
secret := ""
|
|
if captchaConfig.Options != nil {
|
|
if s, ok := captchaConfig.Options["secret"].(string); ok {
|
|
secret = s
|
|
}
|
|
}
|
|
|
|
if secret == "" {
|
|
return fmt.Errorf("Turnstile secret not configured")
|
|
}
|
|
|
|
// Verify Turnstile token using captcha function
|
|
valid := utilscaptcha.ValidateCloudflare(captcha, secret)
|
|
if !valid {
|
|
return fmt.Errorf("invalid Turnstile token")
|
|
}
|
|
return nil
|
|
|
|
default:
|
|
return fmt.Errorf("unsupported captcha type: %s", captchaConfig.Type)
|
|
}
|
|
}
|
|
|
|
// determineUsernameType determines if the username is email or mobile
|
|
func determineUsernameType(username string) string {
|
|
// Check if it's an email
|
|
emailRegex := regexp.MustCompile(`^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`)
|
|
if emailRegex.MatchString(username) {
|
|
return "email"
|
|
}
|
|
|
|
// Check if it's a mobile number (international format)
|
|
// Support formats like: +86123456789, 86123456789, 123456789
|
|
mobileRegex := regexp.MustCompile(`^\+?[0-9]{10,15}$`)
|
|
if mobileRegex.MatchString(username) {
|
|
return "mobile"
|
|
}
|
|
|
|
return ""
|
|
}
|
|
|
|
// checkUserExists checks if a user exists with the given email or mobile
|
|
// Returns: (userExists bool, userID string, error)
|
|
func checkUserExists(ctx context.Context, usernameType, username string) (bool, string, error) {
|
|
// Get user provider
|
|
userProvider, err := oauth.OAuth.GetUserProvider()
|
|
if err != nil {
|
|
return false, "", fmt.Errorf("failed to get user provider: %w", err)
|
|
}
|
|
|
|
// Query user by email or mobile
|
|
var user map[string]interface{}
|
|
switch usernameType {
|
|
case "email":
|
|
user, err = userProvider.GetUserByEmail(ctx, username)
|
|
case "mobile":
|
|
// For mobile, use GetUserForAuth with phone_number identifier type
|
|
user, err = userProvider.GetUserForAuth(ctx, username, "phone_number")
|
|
default:
|
|
return false, "", fmt.Errorf("invalid username type: %s", usernameType)
|
|
}
|
|
|
|
if err != nil {
|
|
// If user not found, return false without error
|
|
if strings.Contains(err.Error(), "not found") || strings.Contains(err.Error(), "User not found") {
|
|
return false, "", nil
|
|
}
|
|
return false, "", fmt.Errorf("failed to query user: %w", err)
|
|
}
|
|
|
|
// Extract user_id from the returned map
|
|
userID := ""
|
|
if user != nil {
|
|
if id, ok := user["user_id"].(string); ok {
|
|
userID = id
|
|
} else if id, ok := user["id"].(string); ok {
|
|
userID = id
|
|
}
|
|
}
|
|
|
|
if userID == "" {
|
|
return false, "", nil
|
|
}
|
|
|
|
return true, userID, nil
|
|
}
|
|
|
|
// sendEntryVerificationCode sends a verification code to the user's email or mobile
|
|
func sendEntryVerificationCode(ctx context.Context, config *EntryConfig, usernameType, username, locale string) error {
|
|
// Check if messenger is available
|
|
if messenger.Instance == nil {
|
|
return fmt.Errorf("messenger service not available")
|
|
}
|
|
|
|
// Check messenger configuration
|
|
if config.Messenger == nil {
|
|
return fmt.Errorf("messenger configuration not found in entry config")
|
|
}
|
|
|
|
// Generate verification code using OTP (6-digit number, 10 minutes expiry)
|
|
otpOption := utilsotp.NewOption()
|
|
otpOption.Length = 6
|
|
otpOption.Type = "numeric"
|
|
otpOption.Expiration = 600 // 10 minutes
|
|
|
|
otpID, verificationCode := utilsotp.Generate(otpOption)
|
|
|
|
// Store OTP ID in context for later verification
|
|
// The OTP code is automatically stored in memory with expiration
|
|
log.Debug("Generated OTP for %s: ID=%s", username, otpID)
|
|
|
|
var channel string
|
|
var template string
|
|
var messageType messengertypes.MessageType
|
|
|
|
// Determine channel and template based on username type
|
|
switch usernameType {
|
|
case "email":
|
|
if config.Messenger.Mail == nil {
|
|
return fmt.Errorf("email messenger configuration not found")
|
|
}
|
|
channel = config.Messenger.Mail.Channel
|
|
template = config.Messenger.Mail.Template
|
|
messageType = messengertypes.MessageTypeEmail
|
|
|
|
// Default channel if not specified
|
|
if channel == "" {
|
|
channel = "default"
|
|
}
|
|
|
|
case "mobile":
|
|
if config.Messenger.SMS == nil {
|
|
return fmt.Errorf("SMS messenger configuration not found")
|
|
}
|
|
channel = config.Messenger.SMS.Channel
|
|
template = config.Messenger.SMS.Template
|
|
messageType = messengertypes.MessageTypeSMS
|
|
|
|
// Default channel if not specified
|
|
if channel == "" {
|
|
channel = "default"
|
|
}
|
|
|
|
default:
|
|
return fmt.Errorf("unsupported username type: %s", usernameType)
|
|
}
|
|
|
|
if template == "" {
|
|
return fmt.Errorf("template not configured for %s verification", usernameType)
|
|
}
|
|
|
|
// Prepare template data
|
|
templateData := messengertypes.TemplateData{
|
|
"to": username,
|
|
"code": verificationCode, // Variable name matches template: {{ code }}
|
|
"expires_in": "10", // 10 minutes
|
|
"locale": locale,
|
|
}
|
|
|
|
// Send verification code
|
|
err := messenger.Instance.SendT(ctx, channel, template, templateData, messageType)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to send verification code: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// createPublicEntryConfig creates a deep copy of EntryConfig without sensitive data
|
|
// This prevents modifying the global config when removing secrets
|
|
func createPublicEntryConfig(config *EntryConfig) *EntryConfig {
|
|
if config == nil {
|
|
return nil
|
|
}
|
|
|
|
// Create a new config instance
|
|
publicConfig := &EntryConfig{
|
|
Title: config.Title,
|
|
Description: config.Description,
|
|
Default: config.Default,
|
|
SuccessURL: config.SuccessURL,
|
|
FailureURL: config.FailureURL,
|
|
LogoutRedirect: config.LogoutRedirect,
|
|
ClientID: config.ClientID,
|
|
ClientSecret: "", // Remove sensitive data
|
|
AutoLogin: config.AutoLogin,
|
|
Role: config.Role,
|
|
Type: config.Type,
|
|
InviteRequired: config.InviteRequired,
|
|
}
|
|
|
|
// Deep copy Form config
|
|
if config.Form != nil {
|
|
publicConfig.Form = &FormConfig{
|
|
ForgotPasswordLink: config.Form.ForgotPasswordLink,
|
|
RememberMe: config.Form.RememberMe,
|
|
RegisterLink: config.Form.RegisterLink,
|
|
LoginLink: config.Form.LoginLink,
|
|
TermsOfServiceLink: config.Form.TermsOfServiceLink,
|
|
PrivacyPolicyLink: config.Form.PrivacyPolicyLink,
|
|
}
|
|
|
|
// Deep copy Username config
|
|
if config.Form.Username != nil {
|
|
publicConfig.Form.Username = &UsernameConfig{
|
|
Placeholder: config.Form.Username.Placeholder,
|
|
}
|
|
if config.Form.Username.Fields != nil {
|
|
publicConfig.Form.Username.Fields = make([]string, len(config.Form.Username.Fields))
|
|
copy(publicConfig.Form.Username.Fields, config.Form.Username.Fields)
|
|
}
|
|
}
|
|
|
|
// Deep copy Password config
|
|
if config.Form.Password != nil {
|
|
publicConfig.Form.Password = &PasswordConfig{
|
|
Placeholder: config.Form.Password.Placeholder,
|
|
}
|
|
}
|
|
|
|
// Deep copy ConfirmPassword config
|
|
if config.Form.ConfirmPassword != nil {
|
|
publicConfig.Form.ConfirmPassword = &PasswordConfig{
|
|
Placeholder: config.Form.ConfirmPassword.Placeholder,
|
|
}
|
|
}
|
|
|
|
// Deep copy Captcha config (WITHOUT secret)
|
|
if config.Form.Captcha != nil {
|
|
publicConfig.Form.Captcha = &CaptchaConfig{
|
|
Type: config.Form.Captcha.Type,
|
|
}
|
|
|
|
// Deep copy Options, excluding "secret"
|
|
if config.Form.Captcha.Options != nil {
|
|
publicConfig.Form.Captcha.Options = make(map[string]interface{})
|
|
for k, v := range config.Form.Captcha.Options {
|
|
if k != "secret" {
|
|
publicConfig.Form.Captcha.Options[k] = v
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Deep copy Token config
|
|
if config.Token != nil {
|
|
publicConfig.Token = &TokenConfig{
|
|
ExpiresIn: config.Token.ExpiresIn,
|
|
RememberMeExpiresIn: config.Token.RememberMeExpiresIn,
|
|
}
|
|
}
|
|
|
|
// Deep copy Messenger config (without sensitive data)
|
|
if config.Messenger != nil {
|
|
publicConfig.Messenger = &MessengerConfig{}
|
|
|
|
if config.Messenger.Mail != nil {
|
|
publicConfig.Messenger.Mail = &MessengerChannelConfig{
|
|
Channel: config.Messenger.Mail.Channel,
|
|
Template: config.Messenger.Mail.Template,
|
|
}
|
|
}
|
|
|
|
if config.Messenger.SMS != nil {
|
|
publicConfig.Messenger.SMS = &MessengerChannelConfig{
|
|
Channel: config.Messenger.SMS.Channel,
|
|
Template: config.Messenger.SMS.Template,
|
|
}
|
|
}
|
|
}
|
|
|
|
// Deep copy ThirdParty config
|
|
if config.ThirdParty != nil {
|
|
publicConfig.ThirdParty = &ThirdParty{}
|
|
|
|
if config.ThirdParty.Providers != nil {
|
|
publicConfig.ThirdParty.Providers = make([]*Provider, len(config.ThirdParty.Providers))
|
|
for i, provider := range config.ThirdParty.Providers {
|
|
if provider != nil {
|
|
// Create a copy of provider without sensitive data
|
|
publicConfig.ThirdParty.Providers[i] = &Provider{
|
|
ID: provider.ID,
|
|
Label: provider.Label,
|
|
Title: provider.Title,
|
|
Logo: provider.Logo,
|
|
Color: provider.Color,
|
|
TextColor: provider.TextColor,
|
|
ClientID: provider.ClientID,
|
|
ResponseMode: provider.ResponseMode,
|
|
// ClientSecret is intentionally omitted for security
|
|
// ClientSecretGenerator is intentionally omitted for security
|
|
}
|
|
|
|
// Copy scopes if present
|
|
if provider.Scopes != nil {
|
|
publicConfig.ThirdParty.Providers[i].Scopes = make([]string, len(provider.Scopes))
|
|
copy(publicConfig.ThirdParty.Providers[i].Scopes, provider.Scopes)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return publicConfig
|
|
}
|