snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/auth/handlers/handle_login.go

@@ -0,0 +1,163 @@
+package handlers
+
+import (
+	"fmt"
+
+	"github.com/cortezaproject/corteza/server/auth/request"
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/errors"
+	"github.com/cortezaproject/corteza/server/system/service"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"go.uber.org/zap"
+)
+
+type (
+	provider struct {
+		Label, Handle, Icon string
+	}
+)
+
+func (h *AuthHandlers) loginForm(req *request.AuthReq) error {
+	req.Template = TmplLogin
+	kv := req.PopKV()
+
+	if kv == nil && h.Settings.SplitCredentialsCheck {
+		// Force login form to show only email input
+		//
+		// KV is nil (means that this is first load of the form)
+		// and credentials check is split into two parts (email first then credentials)
+		kv = map[string]string{
+			"splitCredentialsCheck": "split",
+		}
+	}
+
+	req.Data["form"] = kv
+	req.Data["enableRememberMe"] = h.Opt.SessionPermLifetime > 0
+	return nil
+}
+
+func (h *AuthHandlers) loginProc(req *request.AuthReq) (err error) {
+	// In most cases, we want to redirect back to login
+	req.RedirectTo = GetLinks().Login
+	req.SetKV(nil)
+
+	var (
+		user     *types.User
+		email    = req.Request.PostFormValue("email")
+		password = req.Request.PostFormValue("password")
+	)
+
+	err = func() (err error) {
+		if len(email) > 0 && len(password) == 0 && h.Settings.SplitCredentialsCheck {
+			// Email provided but no password and the
+			// split credentials check enabled
+			//
+			// SetKV w/ email will prevent the login form to show only email input
+			req.SetKV(map[string]string{"email": email})
+
+			// If user does not have password set (or in case there is no user with such email)
+			// and there is exactly one IdP we redirect user to that IdP
+			if !h.AuthService.PasswordSet(req.Context(), email) && len(h.Settings.Providers) == 1 {
+				// User w/o the password
+				// In case there is one single IdP automatically redirect user there
+				req.RedirectTo = fmt.Sprintf("%s/%s", GetLinks().External, h.Settings.Providers[0].Handle)
+
+				// for the clarity of the flow
+				// keeping this optional return here
+				return
+			}
+
+			// This user has existing password credentials or with more than one IdP
+			//
+			// Take user back to the login form and ask for the password
+			// or any other kind of login
+			return
+		}
+
+		user, err = h.AuthService.InternalLogin(req.Context(), email, password)
+
+		if err != nil {
+			return
+		}
+
+		var (
+			isPerm   = len(req.Request.PostFormValue("keep-session")) > 0
+			lifetime = h.Opt.SessionLifetime
+		)
+
+		if isPerm {
+			lifetime = h.Opt.SessionPermLifetime
+		}
+
+		req.AuthUser = request.NewAuthUser(h.Settings, user, isPerm)
+
+		req.AuthUser.Save(req.Session)
+
+		h.Log.Info(
+			"login with password successful",
+			zap.Any("mfa", req.AuthUser.MFAStatus),
+			zap.Bool("perm-login", isPerm),
+			zap.Duration("lifetime", lifetime),
+		)
+
+		if req.AuthUser.PendingEmailOTP() {
+			// Email OTP enforced (globally or by user sec. policy)
+			//
+			// @todo this should probably be part of login in auth service?
+			if err = h.AuthService.SendEmailOTP(auth.SetIdentityToContext(req.Context(), req.AuthUser.User)); err != nil {
+				return errors.Internal("could not send OTP via email, contact your administrator").Wrap(err)
+			}
+		}
+
+		handleSuccessfulAuth(req)
+
+		return
+	}()
+
+	if err == nil {
+		return nil
+	}
+
+	switch {
+	case service.AuthErrInternalLoginDisabledByConfig().Is(err):
+		h.localDisabledAlert(req)
+		return nil
+	case service.AuthErrInvalidEmailFormat().Is(err),
+		service.AuthErrInvalidCredentials().Is(err),
+		service.AuthErrCredentialsLinkedToInvalidUser().Is(err):
+		req.SetKV(map[string]string{
+			"error": err.Error(),
+			"email": email,
+		})
+
+		h.Log.Warn("handled error", zap.Error(err))
+		return nil
+
+	default:
+		h.Log.Error("unhandled error", zap.Error(err))
+		return err
+	}
+}
+
+func (h *AuthHandlers) onlyIfLocalEnabled(fn handlerFn) handlerFn {
+	return func(req *request.AuthReq) error {
+		if !h.Settings.LocalEnabled {
+			h.localDisabledAlert(req)
+			return nil
+		}
+
+		return fn(req)
+	}
+}
+
+func (h *AuthHandlers) localDisabledAlert(req *request.AuthReq) {
+	if req.AuthUser.User != nil {
+		req.RedirectTo = GetLinks().Profile
+	} else {
+		req.RedirectTo = GetLinks().Login
+	}
+
+	t := translator(req, "auth")
+
+	req.PushDangerAlert(t("login.alert.local-disabled"))
+}