mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
142 lines
4.2 KiB
Go
142 lines
4.2 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2018 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package security
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"strconv"
|
|
"time"
|
|
|
|
"github.com/hanzoai/git/models/auth"
|
|
user_model "github.com/hanzoai/git/models/user"
|
|
wa "github.com/hanzoai/git/modules/auth/webauthn"
|
|
"github.com/hanzoai/git/modules/log"
|
|
"github.com/hanzoai/git/modules/session"
|
|
"github.com/hanzoai/git/modules/setting"
|
|
"github.com/hanzoai/git/modules/web"
|
|
"github.com/hanzoai/git/services/context"
|
|
"github.com/hanzoai/git/services/forms"
|
|
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
"github.com/go-webauthn/webauthn/webauthn"
|
|
)
|
|
|
|
// WebAuthnRegister initializes the webauthn registration procedure
|
|
func WebAuthnRegister(ctx *context.Context) {
|
|
if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageMFA) {
|
|
ctx.HTTPError(http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
form := web.GetForm(ctx).(*forms.WebauthnRegistrationForm)
|
|
if form.Name == "" {
|
|
// Set name to the hexadecimal of the current time
|
|
form.Name = strconv.FormatInt(time.Now().UnixNano(), 16)
|
|
}
|
|
|
|
cred, err := auth.GetWebAuthnCredentialByName(ctx, ctx.Doer.ID, form.Name)
|
|
if err != nil && !auth.IsErrWebAuthnCredentialNotExist(err) {
|
|
ctx.ServerError("GetWebAuthnCredentialsByUID", err)
|
|
return
|
|
}
|
|
if cred != nil {
|
|
ctx.HTTPError(http.StatusConflict, "Name already taken")
|
|
return
|
|
}
|
|
|
|
_ = ctx.Session.Delete("webauthnRegistration")
|
|
if err := ctx.Session.Set("webauthnName", form.Name); err != nil {
|
|
ctx.ServerError("Unable to set session key for webauthnName", err)
|
|
return
|
|
}
|
|
|
|
webAuthnUser := wa.NewWebAuthnUser(ctx, ctx.Doer)
|
|
credentialOptions, sessionData, err := wa.WebAuthn.BeginRegistration(webAuthnUser, webauthn.WithAuthenticatorSelection(protocol.AuthenticatorSelection{
|
|
ResidentKey: protocol.ResidentKeyRequirementRequired,
|
|
}))
|
|
if err != nil {
|
|
ctx.ServerError("Unable to BeginRegistration", err)
|
|
return
|
|
}
|
|
|
|
// Save the session data as marshaled JSON
|
|
if err = ctx.Session.Set("webauthnRegistration", sessionData); err != nil {
|
|
ctx.ServerError("Unable to set session", err)
|
|
return
|
|
}
|
|
|
|
ctx.JSON(http.StatusOK, credentialOptions)
|
|
}
|
|
|
|
// WebauthnRegisterPost receives the response of the security key
|
|
func WebauthnRegisterPost(ctx *context.Context) {
|
|
if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageMFA) {
|
|
ctx.HTTPError(http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
name, ok := ctx.Session.Get("webauthnName").(string)
|
|
if !ok || name == "" {
|
|
ctx.ServerError("Get webauthnName", errors.New("no webauthnName"))
|
|
return
|
|
}
|
|
|
|
// Load the session data
|
|
sessionData, ok := ctx.Session.Get("webauthnRegistration").(*webauthn.SessionData)
|
|
if !ok || sessionData == nil {
|
|
ctx.ServerError("Get registration", errors.New("no registration"))
|
|
return
|
|
}
|
|
defer func() {
|
|
_ = ctx.Session.Delete("webauthnRegistration")
|
|
}()
|
|
|
|
// Verify that the challenge succeeded
|
|
webAuthnUser := wa.NewWebAuthnUser(ctx, ctx.Doer)
|
|
cred, err := wa.WebAuthn.FinishRegistration(webAuthnUser, *sessionData, ctx.Req)
|
|
if err != nil {
|
|
if pErr, ok := err.(*protocol.Error); ok {
|
|
log.Error("Unable to finish registration due to error: %v\nDevInfo: %s", pErr, pErr.DevInfo)
|
|
}
|
|
ctx.ServerError("CreateCredential", err)
|
|
return
|
|
}
|
|
|
|
dbCred, err := auth.GetWebAuthnCredentialByName(ctx, ctx.Doer.ID, name)
|
|
if err != nil && !auth.IsErrWebAuthnCredentialNotExist(err) {
|
|
ctx.ServerError("GetWebAuthnCredentialsByUID", err)
|
|
return
|
|
}
|
|
if dbCred != nil {
|
|
ctx.HTTPError(http.StatusConflict, "Name already taken")
|
|
return
|
|
}
|
|
|
|
// Create the credential
|
|
_, err = auth.CreateCredential(ctx, ctx.Doer.ID, name, cred)
|
|
if err != nil {
|
|
ctx.ServerError("CreateCredential", err)
|
|
return
|
|
}
|
|
_ = ctx.Session.Delete("webauthnName")
|
|
_ = ctx.Session.Set(session.KeyUserHasTwoFactorAuth, true)
|
|
ctx.JSON(http.StatusCreated, cred)
|
|
}
|
|
|
|
// WebauthnDelete deletes an security key by id
|
|
func WebauthnDelete(ctx *context.Context) {
|
|
if user_model.IsFeatureDisabledWithLoginType(ctx.Doer, setting.UserFeatureManageMFA) {
|
|
ctx.HTTPError(http.StatusNotFound)
|
|
return
|
|
}
|
|
|
|
if _, err := auth.DeleteCredential(ctx, ctx.FormInt64("id"), ctx.Doer.ID); err != nil {
|
|
ctx.ServerError("GetWebAuthnCredentialByID", err)
|
|
return
|
|
}
|
|
ctx.JSONRedirect(setting.AppSubURL + "/user/settings/security")
|
|
}
|