added totp support

pkg/server/handler.go

@@ -5,6 +5,7 @@ package server
 import (
 	"git.giftfish.de/ston1th/gowiki/pkg/core"
 	"git.giftfish.de/ston1th/gowiki/pkg/log"
+	"git.giftfish.de/ston1th/gowiki/pkg/otp"
 	"git.giftfish.de/ston1th/gowiki/pkg/render"
 	"git.giftfish.de/ston1th/jwt/v3"
 	"net/http"
@@ -19,6 +20,16 @@ func (nf *notFoundHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	newContext(w, r, nf.s).NotFound()
 }
 
+func totpAuthHandler(h ctxHandler) ctxHandler {
+	return func(ctx *Context) {
+		if ctx.Totp() != "" {
+			h(ctx)
+			return
+		}
+		ctx.Redirect(core.IndexURI, 302)
+	}
+}
+
 func adminAuthHandler(h ctxHandler) ctxHandler {
 	return func(ctx *Context) {
 		if ctx.Admin() {
@@ -100,6 +111,46 @@ func loginHandler(ctx *Context) {
 			ctx.Error(err)
 			return
 		}
+		if u.Secret == "" {
+			ctx.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin})
+			ctx.Redirect(core.IndexURI, 302)
+			return
+		}
+		ctx.SetCookieToken(jwt.NewToken(map[string]interface{}{
+			totpClaim:    u.Username,
+			jwt.ExpClaim: jwt.NewExp(time.Minute),
+		}, nil))
+		ctx.Redirect(core.TotpURI, 302)
+	}
+}
+
+func loginTotpHandler(ctx *Context) {
+	if ctx.LoggedOn() {
+		ctx.Redirect(core.IndexURI, 302)
+		return
+	}
+	ctx.Template("loginTotpHandler")
+	ctx.Data = webData{
+		Title:     "TOTP Verification",
+		BodyTitle: "TOTP Veriftcation",
+	}
+	switch ctx.Method() {
+	case "GET":
+		ctx.Exec()
+	case "POST":
+		if !ctx.CheckXsrf() {
+			return
+		}
+		pin := ctx.Form("pin")
+		if pin == "" {
+			ctx.Error("wrong inputs")
+			return
+		}
+		u, err := ctx.Srv.DB.Totp(ctx.Totp(), pin)
+		if err != nil {
+			ctx.Error(err)
+			return
+		}
 		ctx.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin})
 		ctx.Redirect(core.IndexURI, 302)
 	}
@@ -483,6 +534,70 @@ func userEditHandler(ctx *Context) {
 	}
 }
 
+func userTotpHandler(ctx *Context) {
+	ctx.Template("userTotpHandler")
+	ctx.Data = webData{
+		Title:     "TOTP",
+		BodyTitle: "TOTP",
+	}
+	req := otp.Request{Username: ctx.Var("user")}
+	u, err := ctx.Srv.DB.GetUser(req.Username)
+	if err != nil {
+		ctx.Error(err)
+		return
+	}
+	if u.Secret == "" {
+		switch ctx.Method() {
+		case "GET":
+			req, err = otp.New(req.Username)
+			if err != nil {
+				ctx.Error(err)
+				return
+			}
+		case "POST":
+			req.URL = ctx.Form("url")
+			req.Image, req.Secret, err = otp.ImageSecretFromURL(req.URL)
+			if err != nil {
+				ctx.Error("wrong inputs")
+				return
+			}
+		}
+	}
+	switch ctx.Method() {
+	case "GET":
+		ctx.Data.Data = req
+		ctx.Exec()
+	case "POST":
+		if !ctx.CheckXsrf() {
+			return
+		}
+		pin := ctx.Form("pin")
+		if pin == "" {
+			ctx.Error("empty pin")
+			return
+		}
+		ctx.Data.Data = req
+		secret := req.Secret
+		if u.Secret != "" {
+			secret = u.Secret
+		}
+		valid := otp.Validate(pin, secret)
+		if ctx.User() != req.Username && ctx.Admin() {
+			valid = true
+		}
+
+		if !valid {
+			ctx.Error("validation failed")
+			return
+		}
+		if err := ctx.Srv.DB.UpdateUserSecret(req.Username, req.Secret); err != nil {
+			ctx.Error(err)
+			return
+		}
+		ctx.Redirect("/user/edit/"+req.Username, 302)
+	}
+}
+
 func userUnlockHandler(ctx *Context) {
 	user := ctx.Var("user")
 	if err := ctx.Srv.DB.UnlockUser(user); err != nil {