Noah Petherbridge
0caf12eb00
* Add "forgot password" workflow. * Add ability to change user email address (confirmation link sent) * Add ability to change user's password. * Add rate limiter to deter brute force login attempts. * Add user deep delete functionality (delete account). * Ping user LastLoginAt every 8 hours for long-lived session cookies. * Add age filters to user search page. * Add sort options to user search (last login, created, username/name)
83 lines
2.5 KiB
Go
83 lines
2.5 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
"git.kirsle.net/apps/gosocial/pkg/config"
|
|
"git.kirsle.net/apps/gosocial/pkg/controller/photo"
|
|
"git.kirsle.net/apps/gosocial/pkg/log"
|
|
"git.kirsle.net/apps/gosocial/pkg/session"
|
|
"git.kirsle.net/apps/gosocial/pkg/templates"
|
|
)
|
|
|
|
// LoginRequired middleware.
|
|
func LoginRequired(handler http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
// User must be logged in.
|
|
user, err := session.CurrentUser(r)
|
|
if err != nil {
|
|
log.Error("LoginRequired: %s", err)
|
|
errhandler := templates.MakeErrorPage("Login Required", "You must be signed in to view this page.", http.StatusForbidden)
|
|
errhandler.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
// Ping LastLoginAt for long lived sessions.
|
|
if time.Since(user.LastLoginAt) > config.LastLoginAtCooldown {
|
|
user.LastLoginAt = time.Now()
|
|
if err := user.Save(); err != nil {
|
|
log.Error("LoginRequired: couldn't refresh LastLoginAt for user %s: %s", user.Username, err)
|
|
}
|
|
}
|
|
|
|
handler.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// AdminRequired middleware.
|
|
func AdminRequired(handler http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
// User must be logged in.
|
|
if currentUser, err := session.CurrentUser(r); err != nil {
|
|
log.Error("AdminRequired: %s", err)
|
|
errhandler := templates.MakeErrorPage("Login Required", "You must be signed in to view this page.", http.StatusForbidden)
|
|
errhandler.ServeHTTP(w, r)
|
|
return
|
|
} else if !currentUser.IsAdmin {
|
|
log.Error("AdminRequired: %s", err)
|
|
errhandler := templates.MakeErrorPage("Admin Required", "You do not have permission for this page.", http.StatusForbidden)
|
|
errhandler.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
handler.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// CertRequired middleware: like LoginRequired but user must also have their verification pic certified.
|
|
func CertRequired(handler http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
// User must be logged in.
|
|
currentUser, err := session.CurrentUser(r)
|
|
if err != nil {
|
|
log.Error("LoginRequired: %s", err)
|
|
errhandler := templates.MakeErrorPage("Login Required", "You must be signed in to view this page.", http.StatusForbidden)
|
|
errhandler.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
// User must be certified.
|
|
if !currentUser.Certified || currentUser.ProfilePhoto.ID == 0 {
|
|
log.Error("CertRequired: user is not certified")
|
|
photo.CertificationRequiredError().ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
handler.ServeHTTP(w, r)
|
|
})
|
|
}
|