1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60

// Copyright 2022 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package auth

import (
	"net/http"

	"code.gitea.io/gitea/modules/context"
	"code.gitea.io/gitea/modules/log"
	"code.gitea.io/gitea/modules/web/middleware"
)

// Auth is a middleware to authenticate a web user
func Auth(authMethod Method) func(*context.Context) {
	return func(ctx *context.Context) {
		if err := authShared(ctx, authMethod); err != nil {
			log.Error("Failed to verify user: %v", err)
			ctx.Error(http.StatusUnauthorized, "Verify")
			return
		}
		if ctx.Doer == nil {
			// ensure the session uid is deleted
			_ = ctx.Session.Delete("uid")
		}
	}
}

// APIAuth is a middleware to authenticate an api user
func APIAuth(authMethod Method) func(*context.APIContext) {
	return func(ctx *context.APIContext) {
		if err := authShared(ctx.Context, authMethod); err != nil {
			ctx.Error(http.StatusUnauthorized, "APIAuth", err)
		}
	}
}

func authShared(ctx *context.Context, authMethod Method) error {
	var err error
	ctx.Doer, err = authMethod.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
	if err != nil {
		return err
	}
	if ctx.Doer != nil {
		if ctx.Locale.Language() != ctx.Doer.Language {
			ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
		}
		ctx.IsBasicAuth = ctx.Data["AuthedMethod"].(string) == BasicMethodName
		ctx.IsSigned = true
		ctx.Data["IsSigned"] = ctx.IsSigned
		ctx.Data["SignedUser"] = ctx.Doer
		ctx.Data["SignedUserID"] = ctx.Doer.ID
		ctx.Data["SignedUserName"] = ctx.Doer.Name
		ctx.Data["IsAdmin"] = ctx.Doer.IsAdmin
	} else {
		ctx.Data["SignedUserID"] = int64(0)
		ctx.Data["SignedUserName"] = ""
	}
	return nil
}