memos/server/auth.go

129 lines
4.6 KiB
Go
Raw Normal View History

2022-02-03 10:32:03 +03:00
package server
import (
"encoding/json"
2022-02-03 10:32:03 +03:00
"fmt"
"net/http"
2022-06-27 17:09:06 +03:00
"github.com/usememos/memos/api"
"github.com/usememos/memos/common"
2022-10-29 06:15:39 +03:00
metric "github.com/usememos/memos/plugin/metrics"
2022-06-27 17:09:06 +03:00
2022-02-03 10:32:03 +03:00
"github.com/labstack/echo/v4"
2022-02-06 11:19:20 +03:00
"golang.org/x/crypto/bcrypt"
2022-02-03 10:32:03 +03:00
)
func (s *Server) registerAuthRoutes(g *echo.Group) {
g.POST("/auth/signin", func(c echo.Context) error {
2022-08-07 04:23:46 +03:00
ctx := c.Request().Context()
signin := &api.Signin{}
if err := json.NewDecoder(c.Request().Body).Decode(signin); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signin request").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
userFind := &api.UserFind{
Email: &signin.Email,
2022-02-03 10:32:03 +03:00
}
2022-08-07 04:23:46 +03:00
user, err := s.Store.FindUser(ctx, userFind)
2022-09-09 15:00:04 +03:00
if err != nil && common.ErrorCode(err) != common.NotFound {
return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to find user by email %s", signin.Email)).SetInternal(err)
2022-02-03 10:32:03 +03:00
}
if user == nil {
return echo.NewHTTPError(http.StatusUnauthorized, fmt.Sprintf("User not found with email %s", signin.Email))
2022-05-19 13:32:04 +03:00
} else if user.RowStatus == api.Archived {
return echo.NewHTTPError(http.StatusForbidden, fmt.Sprintf("User has been archived with email %s", signin.Email))
2022-02-03 10:32:03 +03:00
}
2022-02-06 11:19:20 +03:00
// Compare the stored hashed password, with the hashed version of the password that was received.
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(signin.Password)); err != nil {
2022-02-06 11:19:20 +03:00
// If the two passwords don't match, return a 401 status.
return echo.NewHTTPError(http.StatusUnauthorized, "Incorrect password").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
2022-03-28 19:01:34 +03:00
if err = setUserSession(c, user); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to set signin session").SetInternal(err)
2022-02-03 19:56:44 +03:00
}
2022-10-29 06:15:39 +03:00
s.Collector.Collect(ctx, &metric.Metric{
Name: "user signed in",
})
2022-02-03 19:56:44 +03:00
2022-02-03 10:32:03 +03:00
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
2022-02-04 12:06:04 +03:00
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
2022-02-05 06:43:25 +03:00
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
return nil
})
2022-02-18 17:21:10 +03:00
2022-02-03 10:32:03 +03:00
g.POST("/auth/logout", func(c echo.Context) error {
2022-10-29 06:15:39 +03:00
ctx := c.Request().Context()
2022-02-03 19:56:44 +03:00
err := removeUserSession(c)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to set logout session").SetInternal(err)
}
2022-10-29 06:15:39 +03:00
s.Collector.Collect(ctx, &metric.Metric{
Name: "user logout",
})
2022-02-03 10:32:03 +03:00
c.Response().WriteHeader(http.StatusOK)
return nil
})
2022-02-18 17:21:10 +03:00
2022-02-03 10:32:03 +03:00
g.POST("/auth/signup", func(c echo.Context) error {
2022-08-07 04:23:46 +03:00
ctx := c.Request().Context()
// Don't allow to signup by this api if site host existed.
hostUserType := api.Host
hostUserFind := api.UserFind{
Role: &hostUserType,
}
2022-08-07 04:23:46 +03:00
hostUser, err := s.Store.FindUser(ctx, &hostUserFind)
2022-09-09 15:00:04 +03:00
if err != nil && common.ErrorCode(err) != common.NotFound {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find host user").SetInternal(err)
}
if hostUser != nil {
return echo.NewHTTPError(http.StatusUnauthorized, "Site Host existed, please contact the site host to signin account firstly.").SetInternal(err)
}
2022-02-03 10:32:03 +03:00
signup := &api.Signup{}
if err := json.NewDecoder(c.Request().Body).Decode(signup); err != nil {
2022-02-03 19:56:44 +03:00
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signup request").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
2022-08-20 16:03:15 +03:00
userCreate := &api.UserCreate{
Email: signup.Email,
Role: api.Role(signup.Role),
Name: signup.Name,
Password: signup.Password,
OpenID: common.GenUUID(),
}
2022-08-20 16:03:15 +03:00
if err := userCreate.Validate(); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Invalid user create format.").SetInternal(err)
2022-02-06 11:19:20 +03:00
}
passwordHash, err := bcrypt.GenerateFromPassword([]byte(signup.Password), bcrypt.DefaultCost)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
}
2022-08-20 16:03:15 +03:00
userCreate.PasswordHash = string(passwordHash)
2022-08-07 04:23:46 +03:00
user, err := s.Store.CreateUser(ctx, userCreate)
2022-02-03 10:32:03 +03:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create user").SetInternal(err)
}
2022-10-29 06:15:39 +03:00
s.Collector.Collect(ctx, &metric.Metric{
Name: "user signed up",
})
2022-02-03 10:32:03 +03:00
2022-02-03 19:56:44 +03:00
err = setUserSession(c, user)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to set signup session").SetInternal(err)
}
2022-02-03 10:32:03 +03:00
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
2022-02-04 12:06:04 +03:00
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
2022-02-05 06:43:25 +03:00
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode created user response").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
return nil
})
}