auth: add recovery and account security
This commit is contained in:
@@ -1,8 +1,11 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"mal/internal/database"
|
||||
"mal/internal/templates"
|
||||
)
|
||||
|
||||
@@ -10,6 +13,40 @@ type Handler struct {
|
||||
authService *Service
|
||||
}
|
||||
|
||||
const rateLimitFormError = "Too many attempts in a short time. Please wait a minute and try again."
|
||||
|
||||
const (
|
||||
accountPasswordChangedMessage = "Password updated successfully."
|
||||
accountRecoveryKeyRotatedMessage = "Recovery key rotated. Save this new key now."
|
||||
accountPasswordErrorMessage = "Unable to update password with those details."
|
||||
accountRecoveryErrorMessage = "Unable to rotate recovery key with those details."
|
||||
accountUnexpectedErrorMessage = "Something went wrong. Please try again."
|
||||
accountMissingFieldsErrorMessage = "Please complete all required fields."
|
||||
accountPasswordMismatchErrorMessage = "New password and confirm password must match."
|
||||
)
|
||||
|
||||
func (h *Handler) accountUserFromRequest(r *http.Request) (*database.User, bool) {
|
||||
cookie, err := r.Cookie("session_id")
|
||||
if err != nil {
|
||||
return nil, false
|
||||
}
|
||||
|
||||
user, err := h.authService.ValidateSession(r.Context(), cookie.Value)
|
||||
if err != nil {
|
||||
return nil, false
|
||||
}
|
||||
|
||||
return user, true
|
||||
}
|
||||
|
||||
func accountCreatedAt(createdAt time.Time) string {
|
||||
return createdAt.Local().Format("Jan 2, 2006 at 15:04")
|
||||
}
|
||||
|
||||
func renderAccountPage(w http.ResponseWriter, r *http.Request, user *database.User, passwordError string, passwordSuccess string, recoveryError string, recoverySuccess string, recoveryKey string) {
|
||||
templates.Account(user.Username, accountCreatedAt(user.CreatedAt), passwordError, passwordSuccess, recoveryError, recoverySuccess, recoveryKey).Render(r.Context(), w)
|
||||
}
|
||||
|
||||
func NewHandler(authService *Service) *Handler {
|
||||
return &Handler{authService: authService}
|
||||
}
|
||||
@@ -18,17 +55,21 @@ func NewHandler(authService *Service) *Handler {
|
||||
|
||||
func (h *Handler) HandleLogin(w http.ResponseWriter, r *http.Request) {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
http.Error(w, "invalid request", http.StatusBadRequest)
|
||||
templates.Login("Something went wrong. Please try again.", "").Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
username := r.FormValue("username")
|
||||
password := r.FormValue("password")
|
||||
|
||||
if username == "" || password == "" {
|
||||
templates.Login("The email or password is wrong.", username).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
session, err := h.authService.Login(r.Context(), username, password)
|
||||
if err != nil {
|
||||
// Just handle generically for now, perhaps via HTMX toast
|
||||
http.Error(w, "invalid credentials", http.StatusUnauthorized)
|
||||
templates.Login("The email or password is wrong.", username).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
@@ -41,7 +82,7 @@ func (h *Handler) HandleLogin(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
http.Error(w, "invalid request", http.StatusBadRequest)
|
||||
templates.Register("Something went wrong. Please try again.", "").Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
@@ -49,21 +90,17 @@ func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
|
||||
password := r.FormValue("password")
|
||||
|
||||
if username == "" || password == "" {
|
||||
http.Error(w, "username and password are required", http.StatusBadRequest)
|
||||
templates.Register("Please enter both email and password.", username).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
_, err := h.authService.RegisterUser(r.Context(), username, password)
|
||||
_, recoveryKey, err := h.authService.RegisterUser(r.Context(), username, password)
|
||||
if err != nil {
|
||||
if err == ErrInvalidPassword {
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
if errors.Is(err, ErrInvalidPassword) || errors.Is(err, ErrUserExists) {
|
||||
templates.Register("Unable to create account with those details.", username).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
if err == ErrUserExists {
|
||||
http.Error(w, "username already taken", http.StatusConflict)
|
||||
return
|
||||
}
|
||||
http.Error(w, "registration failed", http.StatusInternalServerError)
|
||||
templates.Register("Something went wrong. Please try again.", username).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
@@ -75,9 +112,7 @@ func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
SetSessionCookie(w, session.ID, session.ExpiresAt)
|
||||
|
||||
w.Header().Set("HX-Redirect", "/")
|
||||
http.Redirect(w, r, "/", http.StatusFound)
|
||||
templates.RegistrationRecoveryKey(recoveryKey).Render(r.Context(), w)
|
||||
}
|
||||
|
||||
func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
|
||||
@@ -92,9 +127,148 @@ func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
func (h *Handler) HandleLoginPage(w http.ResponseWriter, r *http.Request) {
|
||||
templates.Login().Render(r.Context(), w)
|
||||
formError := ""
|
||||
if r.URL.Query().Get("error") == "rate_limited" {
|
||||
formError = rateLimitFormError
|
||||
}
|
||||
templates.Login(formError, "").Render(r.Context(), w)
|
||||
}
|
||||
|
||||
func (h *Handler) HandleRegisterPage(w http.ResponseWriter, r *http.Request) {
|
||||
templates.Register().Render(r.Context(), w)
|
||||
formError := ""
|
||||
if r.URL.Query().Get("error") == "rate_limited" {
|
||||
formError = rateLimitFormError
|
||||
}
|
||||
templates.Register(formError, "").Render(r.Context(), w)
|
||||
}
|
||||
|
||||
func (h *Handler) HandleRecoverPage(w http.ResponseWriter, r *http.Request) {
|
||||
formError := ""
|
||||
if r.URL.Query().Get("error") == "rate_limited" {
|
||||
formError = rateLimitFormError
|
||||
}
|
||||
templates.Recover(formError, "", "").Render(r.Context(), w)
|
||||
}
|
||||
|
||||
func (h *Handler) HandleRecover(w http.ResponseWriter, r *http.Request) {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
templates.Recover("Something went wrong. Please try again.", "", "").Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
username := r.FormValue("username")
|
||||
recoveryKey := r.FormValue("recovery_key")
|
||||
newPassword := r.FormValue("new_password")
|
||||
|
||||
if username == "" || recoveryKey == "" || newPassword == "" {
|
||||
templates.Recover("Unable to recover account with those details.", username, recoveryKey).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
newRecoveryKey, err := h.authService.RecoverAccount(r.Context(), username, recoveryKey, newPassword)
|
||||
if err != nil {
|
||||
if errors.Is(err, ErrInvalidRecoveryKey) || errors.Is(err, ErrInvalidPassword) {
|
||||
templates.Recover("Unable to recover account with those details.", username, recoveryKey).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
templates.Recover("Something went wrong. Please try again.", username, recoveryKey).Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
templates.RecoveryComplete(newRecoveryKey).Render(r.Context(), w)
|
||||
}
|
||||
|
||||
func (h *Handler) HandleAccountPage(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodGet {
|
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
|
||||
user, ok := h.accountUserFromRequest(r)
|
||||
if !ok {
|
||||
http.Redirect(w, r, "/login", http.StatusFound)
|
||||
return
|
||||
}
|
||||
|
||||
renderAccountPage(w, r, user, "", "", "", "", "")
|
||||
}
|
||||
|
||||
func (h *Handler) HandleAccountPassword(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodPost {
|
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
|
||||
user, ok := h.accountUserFromRequest(r)
|
||||
if !ok {
|
||||
http.Redirect(w, r, "/login", http.StatusFound)
|
||||
return
|
||||
}
|
||||
|
||||
if err := r.ParseForm(); err != nil {
|
||||
renderAccountPage(w, r, user, accountUnexpectedErrorMessage, "", "", "", "")
|
||||
return
|
||||
}
|
||||
|
||||
currentPassword := r.FormValue("current_password")
|
||||
newPassword := r.FormValue("new_password")
|
||||
confirmNewPassword := r.FormValue("confirm_new_password")
|
||||
|
||||
if currentPassword == "" || newPassword == "" || confirmNewPassword == "" {
|
||||
renderAccountPage(w, r, user, accountMissingFieldsErrorMessage, "", "", "", "")
|
||||
return
|
||||
}
|
||||
|
||||
if newPassword != confirmNewPassword {
|
||||
renderAccountPage(w, r, user, accountPasswordMismatchErrorMessage, "", "", "", "")
|
||||
return
|
||||
}
|
||||
|
||||
err := h.authService.ChangePassword(r.Context(), user.ID, currentPassword, newPassword)
|
||||
if err != nil {
|
||||
if errors.Is(err, ErrInvalidCredentials) || errors.Is(err, ErrInvalidPassword) {
|
||||
renderAccountPage(w, r, user, accountPasswordErrorMessage, "", "", "", "")
|
||||
return
|
||||
}
|
||||
renderAccountPage(w, r, user, accountUnexpectedErrorMessage, "", "", "", "")
|
||||
return
|
||||
}
|
||||
|
||||
renderAccountPage(w, r, user, "", accountPasswordChangedMessage, "", "", "")
|
||||
}
|
||||
|
||||
func (h *Handler) HandleAccountRecoveryKey(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method != http.MethodPost {
|
||||
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
|
||||
return
|
||||
}
|
||||
|
||||
user, ok := h.accountUserFromRequest(r)
|
||||
if !ok {
|
||||
http.Redirect(w, r, "/login", http.StatusFound)
|
||||
return
|
||||
}
|
||||
|
||||
if err := r.ParseForm(); err != nil {
|
||||
renderAccountPage(w, r, user, "", "", accountUnexpectedErrorMessage, "", "")
|
||||
return
|
||||
}
|
||||
|
||||
password := r.FormValue("password")
|
||||
if password == "" {
|
||||
renderAccountPage(w, r, user, "", "", accountMissingFieldsErrorMessage, "", "")
|
||||
return
|
||||
}
|
||||
|
||||
newRecoveryKey, err := h.authService.RegenerateRecoveryKey(r.Context(), user.ID, password)
|
||||
if err != nil {
|
||||
if errors.Is(err, ErrInvalidCredentials) {
|
||||
renderAccountPage(w, r, user, "", "", accountRecoveryErrorMessage, "", "")
|
||||
return
|
||||
}
|
||||
renderAccountPage(w, r, user, "", "", accountUnexpectedErrorMessage, "", "")
|
||||
return
|
||||
}
|
||||
|
||||
renderAccountPage(w, r, user, "", "", "", accountRecoveryKeyRotatedMessage, newRecoveryKey)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user