1
0
mirror of https://github.com/volatiletech/authboss.git synced 2024-12-12 10:45:11 +02:00
authboss/confirm/confirm.go

201 lines
5.0 KiB
Go
Raw Normal View History

// Package confirm implements confirmation of user registration via e-mail
package confirm
import (
"crypto/md5"
"crypto/rand"
"encoding/base64"
"errors"
"fmt"
"net/http"
2015-02-10 10:43:45 +02:00
"net/url"
"path"
"gopkg.in/authboss.v0"
"gopkg.in/authboss.v0/internal/response"
)
2015-03-16 23:42:45 +02:00
// Storer and FormValue constants
const (
StoreConfirmToken = "confirm_token"
StoreConfirmed = "confirmed"
FormValueConfirm = "cnf"
tplConfirmHTML = "confirm_email.html.tpl"
tplConfirmText = "confirm_email.txt.tpl"
)
var (
2015-02-22 10:09:52 +02:00
errUserMissing = errors.New("confirm: After registration user must be loaded")
)
2015-02-24 21:04:27 +02:00
// ConfirmStorer must be implemented in order to satisfy the confirm module's
// storage requirements.
type ConfirmStorer interface {
authboss.Storer
// ConfirmUser looks up a user by a confirm token. See confirm module for
// attribute names. If the token is not found in the data store,
// simply return nil, ErrUserNotFound.
ConfirmUser(confirmToken string) (interface{}, error)
}
func init() {
authboss.RegisterModule("confirm", &Confirm{})
}
2015-03-16 23:42:45 +02:00
// Confirm module
type Confirm struct {
2015-04-01 00:27:47 +02:00
*authboss.Authboss
emailHTMLTemplates response.Templates
emailTextTemplates response.Templates
}
2015-03-16 23:42:45 +02:00
// Initialize the module
2015-04-01 00:27:47 +02:00
func (c *Confirm) Initialize(ab *authboss.Authboss) (err error) {
c.Authboss = ab
2015-02-10 10:43:45 +02:00
var ok bool
2015-04-01 00:27:47 +02:00
storer, ok := c.Storer.(ConfirmStorer)
if storer == nil || !ok {
2015-03-16 23:42:45 +02:00
return errors.New("confirm: Need a ConfirmStorer")
}
2015-04-01 00:27:47 +02:00
c.emailHTMLTemplates, err = response.LoadTemplates(ab, c.LayoutHTMLEmail, c.ViewsPath, tplConfirmHTML)
if err != nil {
return err
}
2015-04-01 00:27:47 +02:00
c.emailTextTemplates, err = response.LoadTemplates(ab, c.LayoutTextEmail, c.ViewsPath, tplConfirmText)
if err != nil {
return err
}
c.Callbacks.After(authboss.EventGetUser, func(ctx *authboss.Context) error {
_, err := c.beforeGet(ctx)
return err
})
2015-04-01 00:27:47 +02:00
c.Callbacks.Before(authboss.EventAuth, c.beforeGet)
c.Callbacks.After(authboss.EventRegister, c.afterRegister)
return nil
}
2015-03-16 23:42:45 +02:00
// Routes for the module
func (c *Confirm) Routes() authboss.RouteTable {
return authboss.RouteTable{
"/confirm": c.confirmHandler,
}
}
2015-03-16 23:42:45 +02:00
// Storage requirements
func (c *Confirm) Storage() authboss.StorageOptions {
return authboss.StorageOptions{
2015-04-01 00:27:47 +02:00
c.PrimaryID: authboss.String,
authboss.StoreEmail: authboss.String,
StoreConfirmToken: authboss.String,
StoreConfirmed: authboss.Bool,
}
}
2015-03-16 23:42:45 +02:00
func (c *Confirm) beforeGet(ctx *authboss.Context) (authboss.Interrupt, error) {
2015-02-22 10:09:52 +02:00
if confirmed, err := ctx.User.BoolErr(StoreConfirmed); err != nil {
return authboss.InterruptNone, err
} else if !confirmed {
return authboss.InterruptAccountNotConfirmed, nil
}
2015-02-10 10:43:45 +02:00
2015-02-22 10:09:52 +02:00
return authboss.InterruptNone, nil
}
// AfterRegister ensures the account is not activated.
2015-03-16 23:42:45 +02:00
func (c *Confirm) afterRegister(ctx *authboss.Context) error {
if ctx.User == nil {
2015-02-22 10:09:52 +02:00
return errUserMissing
}
token := make([]byte, 32)
if _, err := rand.Read(token); err != nil {
2015-02-22 10:09:52 +02:00
return err
}
sum := md5.Sum(token)
ctx.User[StoreConfirmToken] = base64.StdEncoding.EncodeToString(sum[:])
if err := ctx.SaveUser(); err != nil {
2015-02-22 10:09:52 +02:00
return err
}
2015-02-22 10:09:52 +02:00
email, err := ctx.User.StringErr(authboss.StoreEmail)
if err != nil {
return err
}
2015-02-22 10:09:52 +02:00
goConfirmEmail(c, email, base64.URLEncoding.EncodeToString(token))
2015-02-22 10:09:52 +02:00
return nil
}
2015-02-10 10:43:45 +02:00
var goConfirmEmail = func(c *Confirm, to, token string) {
go c.confirmEmail(to, token)
}
// confirmEmail sends a confirmation e-mail.
func (c *Confirm) confirmEmail(to, token string) {
2015-04-01 00:27:47 +02:00
p := path.Join(c.MountPath, "confirm")
url := fmt.Sprintf("%s%s?%s=%s", c.RootURL, p, url.QueryEscape(FormValueConfirm), url.QueryEscape(token))
2015-02-22 10:09:52 +02:00
email := authboss.Email{
To: []string{to},
2015-04-01 00:27:47 +02:00
From: c.EmailFrom,
Subject: c.EmailSubjectPrefix + "Confirm New Account",
}
2015-04-01 00:27:47 +02:00
err := response.Email(c.Mailer, email, c.emailHTMLTemplates, tplConfirmHTML, c.emailTextTemplates, tplConfirmText, url)
2015-02-22 10:09:52 +02:00
if err != nil {
2015-04-01 00:27:47 +02:00
fmt.Fprintf(c.LogWriter, "confirm: Failed to send e-mail: %v", err)
}
}
2015-02-22 10:09:52 +02:00
func (c *Confirm) confirmHandler(ctx *authboss.Context, w http.ResponseWriter, r *http.Request) error {
token := r.FormValue(FormValueConfirm)
if len(token) == 0 {
return authboss.ClientDataErr{FormValueConfirm}
2015-02-10 10:43:45 +02:00
}
toHash, err := base64.URLEncoding.DecodeString(token)
if err != nil {
2015-02-22 10:09:52 +02:00
return authboss.ErrAndRedirect{
Location: "/", Err: fmt.Errorf("confirm: token failed to decode %q => %v\n", token, err),
2015-02-22 10:09:52 +02:00
}
2015-02-10 10:43:45 +02:00
}
sum := md5.Sum(toHash)
dbTok := base64.StdEncoding.EncodeToString(sum[:])
2015-04-01 00:27:47 +02:00
user, err := c.Storer.(ConfirmStorer).ConfirmUser(dbTok)
2015-02-10 10:43:45 +02:00
if err == authboss.ErrUserNotFound {
return authboss.ErrAndRedirect{Location: "/", Err: errors.New("confirm: token not found")}
2015-02-10 10:43:45 +02:00
} else if err != nil {
2015-02-22 10:09:52 +02:00
return err
}
2015-02-10 10:43:45 +02:00
ctx.User = authboss.Unbind(user)
ctx.User[StoreConfirmToken] = ""
ctx.User[StoreConfirmed] = true
2015-04-01 00:27:47 +02:00
key, err := ctx.User.StringErr(c.PrimaryID)
2015-02-22 10:09:52 +02:00
if err != nil {
return err
}
if err := ctx.SaveUser(); err != nil {
2015-02-22 10:09:52 +02:00
return err
2015-02-10 10:43:45 +02:00
}
2015-02-22 10:09:52 +02:00
ctx.SessionStorer.Put(authboss.SessionKey, key)
2015-04-01 00:27:47 +02:00
response.Redirect(ctx, w, r, c.RegisterOKPath, "You have successfully confirmed your account.", "", true)
2015-02-22 10:09:52 +02:00
return nil
}