176 lines
8.8 KiB
Go
176 lines
8.8 KiB
Go
package controller
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"slices"
|
|
"strings"
|
|
|
|
"github.com/QuantumNous/new-api/common"
|
|
"github.com/QuantumNous/new-api/logger"
|
|
"github.com/QuantumNous/new-api/middleware"
|
|
"github.com/QuantumNous/new-api/model"
|
|
"github.com/QuantumNous/new-api/oauth"
|
|
"github.com/QuantumNous/new-api/service"
|
|
passkeysvc "github.com/QuantumNous/new-api/service/passkey"
|
|
"github.com/QuantumNous/new-api/setting/system_setting"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/go-webauthn/webauthn/protocol"
|
|
)
|
|
|
|
func GetVerificationMethods(c *gin.Context) {
|
|
identity, ok := middleware.GetStepUpIdentity(c)
|
|
if !ok {
|
|
writeAccountStatusError(c, http.StatusUnauthorized, "The current sign-in method does not support security verification")
|
|
return
|
|
}
|
|
requirements, err := service.GetVerificationRequirements(identity, c.Query("scope"))
|
|
if err != nil {
|
|
writeSecurityOperationError(c, err)
|
|
return
|
|
}
|
|
common.ApiSuccess(c, requirements)
|
|
}
|
|
|
|
// writeSecurityOperationError only exposes known, fixed business messages.
|
|
// Unexpected errors retain their cause for the existing server-side auth logger.
|
|
func writeSecurityOperationError(c *gin.Context, err error) {
|
|
status := http.StatusOK
|
|
var code, message string
|
|
var protocolError *protocol.Error
|
|
switch {
|
|
case errors.Is(err, passkeysvc.ErrRPIDUnavailable):
|
|
code, message = "PASSKEY_RP_ID_UNAVAILABLE", "This Passkey domain is not available on this website. Use its original website or another verification method."
|
|
case errors.Is(err, system_setting.ErrPasskeyRPIDInvalid):
|
|
code, message = "PASSKEY_RP_ID_INVALID", "Invalid Passkey domain. Enter a domain without a scheme, port, path or wildcard."
|
|
case errors.Is(err, service.ErrAccountEmailInvalid), errors.Is(err, service.ErrAccountEmailRestricted):
|
|
code, message = "EMAIL_ADDRESS_REJECTED", err.Error()
|
|
case errors.Is(err, model.ErrEmailAlreadyTaken):
|
|
code, message = "EMAIL_ALREADY_TAKEN", "This email address is already in use."
|
|
case errors.Is(err, service.ErrEmailBindingDelivery):
|
|
code, message = "EMAIL_BINDING_DELIVERY_FAILED", err.Error()
|
|
case errors.Is(err, model.ErrEmailBindingCodeInvalid):
|
|
code, message = "EMAIL_BINDING_CODE_INVALID", err.Error()
|
|
case errors.Is(err, model.ErrEmailBindingLocked):
|
|
code, message = "EMAIL_BINDING_LOCKED", err.Error()
|
|
case errors.Is(err, model.ErrEmailBindingResendWait):
|
|
status = http.StatusTooManyRequests
|
|
code, message = "EMAIL_BINDING_RESEND_WAIT", err.Error()
|
|
case errors.Is(err, common.ErrAccountPasswordLength), errors.Is(err, common.ErrAccountPasswordSame), errors.Is(err, common.ErrPasswordLegacyLimit):
|
|
code, message = "PASSWORD_POLICY_REJECTED", err.Error()
|
|
case errors.Is(err, model.ErrCurrentPasswordInvalid):
|
|
code, message = "CURRENT_PASSWORD_INVALID", err.Error()
|
|
case errors.Is(err, model.ErrAccountPasswordState), errors.Is(err, model.ErrAccountBindingChanged):
|
|
status = http.StatusConflict
|
|
code, message = "ACCOUNT_SECURITY_STATE_CHANGED", err.Error()
|
|
case errors.Is(err, model.ErrLastLoginMethod):
|
|
code, message = "LAST_LOGIN_METHOD", err.Error()
|
|
case errors.Is(err, oauth.ErrTelegramOAuthNotConfigured):
|
|
code, message = "TELEGRAM_OAUTH_NOT_CONFIGURED", oauth.ErrTelegramOAuthNotConfigured.Error()
|
|
case errors.Is(err, oauth.ErrTelegramOAuthConflict):
|
|
code, message = "TELEGRAM_OAUTH_CONFLICT", oauth.ErrTelegramOAuthConflict.Error()
|
|
case errors.Is(err, oauth.ErrTelegramOAuthFailed):
|
|
code, message = "TELEGRAM_OAUTH_FAILED", oauth.ErrTelegramOAuthFailed.Error()
|
|
case errors.Is(err, oauth.ErrTelegramAccountNotBound):
|
|
code, message = "TELEGRAM_ACCOUNT_NOT_BOUND", oauth.ErrTelegramAccountNotBound.Error()
|
|
case errors.Is(err, model.ErrExternalIdentityAlreadyClaimed):
|
|
code, message = "ACCOUNT_ALREADY_BOUND", "This external account is already bound."
|
|
if c.Param("provider") == "telegram" {
|
|
code, message = "TELEGRAM_BIND_ALREADY_BOUND", "This Telegram account is already bound."
|
|
}
|
|
case errors.Is(err, service.ErrVerificationContextInvalid):
|
|
status = http.StatusBadRequest
|
|
code, message = "SECURITY_CONTEXT_INVALID", service.ErrVerificationContextInvalid.Error()
|
|
case errors.Is(err, service.ErrVerificationForbidden):
|
|
status = http.StatusForbidden
|
|
code, message = "SECURITY_ACTION_FORBIDDEN", service.ErrVerificationForbidden.Error()
|
|
case errors.Is(err, service.ErrVerificationFailed), errors.As(err, &protocolError):
|
|
code, message = "SECURITY_VERIFICATION_FAILED", service.ErrVerificationFailed.Error()
|
|
case errors.Is(err, service.ErrVerificationLocked):
|
|
code, message = "SECURITY_VERIFICATION_LOCKED", service.ErrVerificationLocked.Error()
|
|
case errors.Is(err, service.ErrVerificationUnavailable):
|
|
code, message = "SECURITY_METHOD_UNAVAILABLE", service.ErrVerificationUnavailable.Error()
|
|
case errors.Is(err, service.ErrVerificationFlowRequired):
|
|
status = http.StatusBadRequest
|
|
code, message = "SECURITY_VERIFICATION_FLOW_REQUIRED", service.ErrVerificationFlowRequired.Error()
|
|
case errors.Is(err, service.ErrProofMethod):
|
|
code, message = "SECURITY_PROOF_METHOD_MISMATCH", "This verification method is not allowed for this action."
|
|
case errors.Is(err, service.ErrProofScope):
|
|
code, message = "SECURITY_PROOF_SCOPE_MISMATCH", "Verification does not match this action."
|
|
case errors.Is(err, service.ErrOAuthAccountMismatch):
|
|
code, message = "OAUTH_ACCOUNT_MISMATCH", service.ErrOAuthAccountMismatch.Error()
|
|
case errors.Is(err, model.ErrTwoFASetupInvalid):
|
|
status = http.StatusConflict
|
|
code, message = "TWOFA_SETUP_INVALID", model.ErrTwoFASetupInvalid.Error()
|
|
case errors.Is(err, model.ErrTwoFACodeInvalid):
|
|
code, message = "TWOFA_CODE_INVALID", model.ErrTwoFACodeInvalid.Error()
|
|
case errors.Is(err, model.ErrTwoFAAlreadyEnabled):
|
|
code, message = "TWOFA_ALREADY_ENABLED", "Two-factor authentication is already enabled."
|
|
case errors.Is(err, model.ErrTwoFANotEnabled):
|
|
code, message = "TWOFA_NOT_ENABLED", "Two-factor authentication is not enabled."
|
|
case errors.Is(err, model.ErrPasskeyNotFound):
|
|
code, message = "PASSKEY_NOT_FOUND", "No Passkey is registered."
|
|
case errors.Is(err, model.ErrAuthFlowInvalid), errors.Is(err, model.ErrAuthFlowExpired), errors.Is(err, model.ErrAuthFlowConsumed):
|
|
code, message = "AUTH_FLOW_INVALID", "Verification flow expired"
|
|
case errors.Is(err, model.ErrUserSessionInvalid), errors.Is(err, model.ErrUserSessionInactive):
|
|
writeAuthSessionError(c, service.ErrAuthTokenInvalid)
|
|
return
|
|
default:
|
|
c.Set("security_error_code", "AUTH_INTERNAL_ERROR")
|
|
writeAuthSessionError(c, err)
|
|
return
|
|
}
|
|
c.Set("security_error_code", code)
|
|
if strings.Contains(c.Request.URL.Path, "/passkey/") {
|
|
reason := "verification_failed"
|
|
if errors.As(err, &protocolError) && slices.Contains([]string{"invalid_request", "challenge_mismatch", "parse_error", "auth_data", "verification_error", "invalid_signature", "invalid_key_type", "unsupported_key_algorithm"}, protocolError.Type) {
|
|
reason = protocolError.Type
|
|
}
|
|
// Protocol details can contain challenges and client-controlled data.
|
|
// Only fixed categories and the server-selected public RP ID are logged.
|
|
logger.LogWarn(c.Request.Context(), common.LogText("passkey verification rejected: code=%s reason=%s rp_id=%q", code, reason, c.GetString("passkey_rp_id")))
|
|
}
|
|
// Every message above is fixed English text, so it is also the key the web
|
|
// console translates.
|
|
common.ApiErrorStatus(c, status, common.NewMessage(message), gin.H{"code": code})
|
|
}
|
|
|
|
// writeAccountStatusError responds with a web console message under a non-200
|
|
// status.
|
|
func writeAccountStatusError(c *gin.Context, status int, key string) {
|
|
common.ApiErrorStatus(c, status, common.NewMessage(key))
|
|
}
|
|
|
|
// requireAdminUserProof consumes the step-up proof for an administrative user
|
|
// operation after the caller has already authorized the operator against the
|
|
// managed user. context is one of the service.AdminUser*Context structs.
|
|
func requireAdminUserProof(c *gin.Context, scope string, context any) *model.AuthFlowAuthorization {
|
|
payload, err := common.Marshal(context)
|
|
if err != nil {
|
|
_ = c.Error(err)
|
|
c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"success": false, "code": "AUTH_INTERNAL_ERROR", "message": "Please try again later."})
|
|
return nil
|
|
}
|
|
return middleware.RequireSecurityProof(c, service.VerificationOperation{Scope: scope, Context: payload})
|
|
}
|
|
|
|
func UniversalVerify(c *gin.Context) {
|
|
identity, ok := middleware.GetStepUpIdentity(c)
|
|
if !ok {
|
|
writeAccountStatusError(c, http.StatusUnauthorized, "The current sign-in method does not support security verification")
|
|
return
|
|
}
|
|
var request service.VerificationInput
|
|
if err := common.DecodeJson(c.Request.Body, &request); err != nil {
|
|
common.ApiErrorT(c, "Invalid parameters")
|
|
return
|
|
}
|
|
proof, err := service.VerifySecurityInput(identity, request)
|
|
if err != nil {
|
|
writeSecurityOperationError(c, err)
|
|
return
|
|
}
|
|
recordUserSecurityAudit(c, identity.UserID, "user.security_verify", map[string]any{"method": proof.Method, "scope": proof.Scope})
|
|
common.ApiSuccess(c, proof)
|
|
}
|