ston1th/goacc
0
0
Fork 0
Code Issues 1 Releases Activity

some improvements

Browse source
This commit is contained in:
ston1th 2022-07-10 17:33:03 +02:00
commit 804842e7c5
4 changed files with 47 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

1
pkg/core/types.go
View file

@ -8,6 +8,7 @@ type User struct {
Password string
Created string
Secret string
Claims map[string]string
Admin bool
Disabled bool
Locked int

5
pkg/db/user.go
View file

@ -39,9 +39,12 @@ func (db *DB) GetUsers() (users core.Users, err error) {
return
}
func (db *DB) GetUserWithoutPassword(username string) (u *core.User, err error) {
func (db *DB) GetUserWithoutSecrets(username string) (u *core.User, err error) {
u, err = db.GetUser(username)
u.Password = ""
if u.Secret != "" {
u.Secret = "redacted"
}
return
}

35
pkg/server/context.go
View file

@ -301,9 +301,16 @@ func (c *Context) Admin() bool {
return c.Token.Claims.GetBool(adminClaim)
}
func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) {
func (c *Context) ApproveLogin(u *core.User, challenge string) (rdr string, err error) {
accept := client.NewAcceptLoginRequest(u.Username)
accept.Acr = new(string)
if u.Secret == "" {
*accept.Acr = "pwd"
} else {
*accept.Acr = "mfa"
}
cr, resp, err := c.Srv.API.AdminApi.AcceptLoginRequest(context.Background()).
AcceptLoginRequest(*client.NewAcceptLoginRequest(user)).
AcceptLoginRequest(*accept).
LoginChallenge(challenge).
Execute()
if err != nil {
@ -314,7 +321,7 @@ func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) {
return
}
func (c *Context) ApproveConsent(challenge string) (rdr string, err error) {
func (c *Context) ApproveConsent(u *core.User, challenge string) (rdr string, err error) {
ci, err := c.Consent(challenge)
if err != nil {
return
@ -324,6 +331,15 @@ func (c *Context) ApproveConsent(challenge string) (rdr string, err error) {
accept.GrantAccessTokenAudience = ci.RequestedAccessTokenAudience
accept.Remember = new(bool)
*accept.Remember = true
accept.Session = &client.ConsentRequestSession{
IdToken: u.Claims,
}
/*
map[string]string{
"apps": "git",
"git_group": "admin",
},
*/
cr, resp, err := c.Srv.API.AdminApi.AcceptConsentRequest(context.Background()).
AcceptConsentRequest(*accept).
ConsentChallenge(challenge).
@ -399,14 +415,11 @@ func (c *Context) RevokeSession(user, client string, all bool) (err error) {
if client == "" && !all {
return
}
req := c.Srv.API.AdminApi.RevokeConsentSessions(context.Background()).
Subject(user)
if all {
req = req.All(all)
} else {
req = req.Client(client)
}
resp, err := req.Execute()
resp, err := c.Srv.API.AdminApi.RevokeConsentSessions(context.Background()).
Subject(user).
Client(client).
All(all).
Execute()
if err != nil {
return
}

29
pkg/server/handler.go
View file

@ -112,10 +112,7 @@ func sessionsHandler(ctx *Context) {
func loginHandler(ctx *Context) {
log := ctx.log.WithName("login")
var (
data loginData
err error
)
var data loginData
data.LoginChallenge = ctx.Query("login_challenge")
ctx.Template("loginHandler")
ctx.Data = webData{
@ -125,7 +122,12 @@ func loginHandler(ctx *Context) {
if ctx.LoggedOn() {
rdr := sessions
if data.LoginChallenge != "" {
rdr, err = ctx.ApproveLogin(ctx.User(), data.LoginChallenge)
u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.User())
if err != nil {
ctx.Error(err)
return
}
rdr, err = ctx.ApproveLogin(u, data.LoginChallenge)
if err != nil {
ctx.Error(err)
return
@ -174,7 +176,7 @@ func loginHandler(ctx *Context) {
ctx.Login(u, remember)
rdr := sessions
if data.LoginChallenge != "" {
rdr, err = ctx.ApproveLogin(data.User, data.LoginChallenge)
rdr, err = ctx.ApproveLogin(u, data.LoginChallenge)
if err != nil {
ctx.Error(err)
return
@ -224,7 +226,7 @@ func loginTotpHandler(ctx *Context) {
ctx.Login(u, ctx.Remember())
rdr := sessions
if data.LoginChallenge != "" {
rdr, err = ctx.ApproveLogin(user, data.LoginChallenge)
rdr, err = ctx.ApproveLogin(u, data.LoginChallenge)
if err != nil {
ctx.Error(err)
ctx.log.Error(err, "error approving login")
@ -243,6 +245,11 @@ func consentHandler(ctx *Context) {
BodyTitle: "Authorize",
}
var data consentData
u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.User())
if err != nil {
ctx.Error(err)
return
}
switch ctx.Method() {
case "GET":
data.ConsentChallenge = ctx.Query("consent_challenge")
@ -254,7 +261,7 @@ func consentHandler(ctx *Context) {
return
}
if cr.GetSkip() {
rdr, err := ctx.ApproveConsent(data.ConsentChallenge)
rdr, err := ctx.ApproveConsent(u, data.ConsentChallenge)
if err != nil {
ctx.log.Error(err, "error approving consent")
ctx.Error("error approving consent")
@ -276,7 +283,7 @@ func consentHandler(ctx *Context) {
var err error
rdr := root
if consent == "approve" {
rdr, err = ctx.ApproveConsent(data.ConsentChallenge)
rdr, err = ctx.ApproveConsent(u, data.ConsentChallenge)
if err != nil {
ctx.log.Error(err, "error approving consent")
ctx.Error("error approving consent")
@ -356,7 +363,7 @@ func userEditHandler(ctx *Context) {
Title: "Edit User",
BodyTitle: "Edit User",
}
u, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user"))
u, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.Var("user"))
if err != nil {
ctx.Error(err)
return
@ -523,7 +530,7 @@ func userDelHandler(ctx *Context) {
}
switch ctx.Method() {
case "GET":
user, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user"))
user, err := ctx.Srv.DB.GetUserWithoutSecrets(ctx.Var("user"))
if err != nil {
ctx.Error(err)
return