1819c4b59b
This allows for usernames, and emails connected to them to be reserved and not reused. Use case, I manage an instance with open registration, and sometimes when users are deleted for spam (or other purposes), their usernames are freed up and they sign up again with the same information. This could also be used to reserve usernames, and block them from being registered (in case an instance would like to block certain things without hardcoding the list in code and compiling from scratch). This is an MVP, that will allow for future work where you can set something as reserved via the interface. --------- Co-authored-by: delvh <dev.lh@web.de> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
52 lines
1.6 KiB
Go
52 lines
1.6 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package db
|
|
|
|
import (
|
|
"code.gitea.io/gitea/models/db"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
)
|
|
|
|
// Authenticate authenticates the provided user against the DB
|
|
func Authenticate(user *user_model.User, login, password string) (*user_model.User, error) {
|
|
if user == nil {
|
|
return nil, user_model.ErrUserNotExist{Name: login}
|
|
}
|
|
|
|
if !user.IsPasswordSet() || !user.ValidatePassword(password) {
|
|
return nil, user_model.ErrUserNotExist{UID: user.ID, Name: user.Name}
|
|
}
|
|
|
|
// Update password hash if server password hash algorithm have changed
|
|
// Or update the password when the salt length doesn't match the current
|
|
// recommended salt length, this in order to migrate user's salts to a more secure salt.
|
|
if user.PasswdHashAlgo != setting.PasswordHashAlgo || len(user.Salt) != user_model.SaltByteLength*2 {
|
|
if err := user.SetPassword(password); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := user_model.UpdateUserCols(db.DefaultContext, user, "passwd", "passwd_hash_algo", "salt"); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
// WARN: DON'T check user.IsActive, that will be checked on reqSign so that
|
|
// user could be hint to resend confirm email.
|
|
if user.ProhibitLogin {
|
|
return nil, user_model.ErrUserProhibitLogin{
|
|
UID: user.ID,
|
|
Name: user.Name,
|
|
}
|
|
}
|
|
|
|
// attempting to login as a non-user account
|
|
if user.Type != user_model.UserTypeIndividual {
|
|
return nil, user_model.ErrUserProhibitLogin{
|
|
UID: user.ID,
|
|
Name: user.Name,
|
|
}
|
|
}
|
|
|
|
return user, nil
|
|
}
|