package handler import ( "crypto/rand" "io" "log" "net/http" "time" "github.com/dchest/authcookie" "github.com/dchest/passwordreset" "github.com/drone/drone/pkg/database" "github.com/drone/drone/pkg/mail" . "github.com/drone/drone/pkg/model" ) var ( // Secret key used to sign auth cookies, // password reset tokens, etc. secret = generateRandomKey(256) ) // GenerateRandomKey creates a random key of size length bytes func generateRandomKey(strength int) []byte { k := make([]byte, strength) if _, err := io.ReadFull(rand.Reader, k); err != nil { return nil } return k } // Returns an HTML index.html page if the user is // not currently authenticated, otherwise redirects // the user to their personal dashboard screen func Index(w http.ResponseWriter, r *http.Request) error { // is the user already authenticated then // redirect to the dashboard page if _, err := r.Cookie("_sess"); err == nil { http.Redirect(w, r, "/dashboard", http.StatusSeeOther) return nil } // otherwise redirect to the login page http.Redirect(w, r, "/login", http.StatusSeeOther) return nil } // Return an HTML form for the User to login. func Login(w http.ResponseWriter, r *http.Request) error { return RenderTemplate(w, "login.html", nil) } // Terminate the User session. func Logout(w http.ResponseWriter, r *http.Request) error { DelCookie(w, r, "_sess") http.Redirect(w, r, "/login", http.StatusSeeOther) return nil } // Return an HTML form for the User to request a password reset. func Forgot(w http.ResponseWriter, r *http.Request) error { return RenderTemplate(w, "forgot.html", nil) } // Return an HTML form for the User to perform a password reset. // This page must be visited from a Password Reset email that // contains a hash to verify the User's identity. func Reset(w http.ResponseWriter, r *http.Request) error { return RenderTemplate(w, "reset.html", &struct{ Error string }{""}) } // Return an HTML form to register for a new account. This // page must be visited from a Signup email that contains // a hash to verify the Email address is correct. func Register(w http.ResponseWriter, r *http.Request) error { return RenderTemplate(w, "register.html", &struct{ Error string }{""}) } func ForgotPost(w http.ResponseWriter, r *http.Request) error { email := r.FormValue("email") // attempt to retrieve the user by email address user, err := database.GetUserEmail(email) if err != nil { log.Printf("could not find user %s to reset password. %s", email, err) // if we can't find the email, we still display // the template to the user. This prevents someone // from trying to guess passwords through trial & error return RenderTemplate(w, "forgot_sent.html", nil) } // hostname from settings hostname := database.SettingsMust().URL().String() // generate the password reset token token := passwordreset.NewToken(user.Email, 12*time.Hour, []byte(user.Password), secret) data := struct { Host string User *User Token string }{hostname, user, token} // send the email message async go func() { if err := mail.SendPassword(email, data); err != nil { log.Printf("error sending password reset email to %s. %s", email, err) } }() // render the template indicating a success return RenderTemplate(w, "forgot_sent.html", nil) } func ResetPost(w http.ResponseWriter, r *http.Request) error { // verify the token and extract the username token := r.FormValue("token") email, err := passwordreset.VerifyToken(token, database.GetPassEmail, secret) if err != nil { return RenderTemplate(w, "reset.html", &struct{ Error string }{"Your password reset request is expired."}) } // get the user from the database user, err := database.GetUserEmail(email) if err != nil { return RenderTemplate(w, "reset.html", &struct{ Error string }{"Unable to locate user account."}) } // get the new password password := r.FormValue("password") if err := user.SetPassword(password); err != nil { return RenderTemplate(w, "reset.html", &struct{ Error string }{err.Error()}) } // save to the database if err := database.SaveUser(user); err != nil { return RenderTemplate(w, "reset.html", &struct{ Error string }{"Unable to update password. Please try again"}) } // add the user to the session object SetCookie(w, r, "_sess", user.Email) http.Redirect(w, r, "/dashboard", http.StatusSeeOther) return nil } func RegisterPost(w http.ResponseWriter, r *http.Request) error { // verify the token and extract the username token := r.FormValue("token") email := authcookie.Login(token, secret) if len(email) == 0 { return RenderTemplate(w, "register.html", &struct{ Error string }{"Your registration email is expired."}) } // set the email and name user := NewUser(r.FormValue("name"), email) // set the new password password := r.FormValue("password") if err := user.SetPassword(password); err != nil { return RenderTemplate(w, "register.html", &struct{ Error string }{err.Error()}) } // verify fields are correct if err := user.Validate(); err != nil { return RenderTemplate(w, "register.html", &struct{ Error string }{err.Error()}) } // save to the database if err := database.SaveUser(user); err != nil { return err } // add the user to the session object SetCookie(w, r, "_sess", user.Email) // redirect the user to their dashboard http.Redirect(w, r, "/dashboard", http.StatusSeeOther) return nil }