Commit graph

13 commits

Author SHA1 Message Date
Gabe Kangas
2ccd3aad87
User repository (#3795)
* It builds with the new user repository

* fix(test): fix broken test

* fix(api): fix registration endpoint that was broken after the change

* fix(test): update test to reflect new user repository

* fix: use interface type instead of concrete type

* fix: restore commented out code
2024-07-01 18:58:50 -07:00
Gabe Kangas
a6dbc37a84
fix: add additional validation before making remote requests (#3398) 2023-10-28 08:15:01 -07:00
Gabe Kangas
85e7af3d5f
Update to Go 1.20 + run better align (#2927)
* chore(go): update go version to 1.20. Closes #2185

* chore(go): run better align against project

To optimize struct field order. Closes #2870

* chore(go): update CI jobs to use Go 1.20

* fix(go): linter warnings for Go 1.20 update
2023-05-30 10:31:43 -07:00
Gabe Kangas
f40135dbf2
fix: disable redirects to guard against possible SSRFs 2023-04-24 17:46:58 -07:00
Gabe Kangas
3894f410d2
Enforce https before indieauth parsing. For #2492 2022-12-23 20:50:12 -08:00
Gabe Kangas
87eeeffa1c
Prune expired auth requests + add global max limit. Closes #2490 2022-12-23 20:25:08 -08:00
Matt Owens
e20985ecb4
Treat fediverse usernames as case-insensitive (#2155)
* treat fediverse usernames as case-insensitive for auth

* add test for case insensitive, clean up duplicate import in federverse auth controller

* fix test, there was an issue with state when all the tests were run
2022-10-02 11:16:46 -07:00
Gabe Kangas
b2b77f5eb9
Fix creating table indexes 2022-08-03 10:31:14 -07:00
Gabe Kangas
0b5ddf433b
Limit OTP requests to one per expiry window. Closes #2000 2022-08-02 13:31:41 -07:00
Gabe Kangas
26eebf47d5
Pass back actual error payload 2022-06-05 22:45:20 -07:00
Gabe Kangas
f097238e24
Remove log message 2022-05-23 12:27:09 -07:00
Gabe Kangas
a082cf3a77
Fediverse-based authentication (#1846)
* Able to authenticate user against IndieAuth. For #1273

* WIP server indieauth endpoint. For https://github.com/owncast/owncast/issues/1272

* Add migration to remove access tokens from user

* Add authenticated bool to user for display purposes

* Add indieauth modal and auth flair to display names. For #1273

* Validate URLs and display errors

* Renames, cleanups

* Handle relative auth endpoint paths. Add error handling for missing redirects.

* Disallow using display names in use by registered users. Closes #1810

* Verify code verifier via code challenge on callback

* Use relative path to authorization_endpoint

* Post-rebase fixes

* Use a timestamp instead of a bool for authenticated

* Propertly handle and display error in modal

* Use auth'ed timestamp to derive authenticated flag to display in chat

* Fediverse chat auth via OTP

* Increase validity time just in case

* Add fediverse auth into auth modal

* Text, validation, cleanup updates for fedi auth

* Fix typo

* Remove unused images

* Remove unused file

* Add chat display name to auth modal text
2022-04-22 17:23:14 -07:00
Gabe Kangas
b835de2dc4
IndieAuth support (#1811)
* Able to authenticate user against IndieAuth. For #1273

* WIP server indieauth endpoint. For https://github.com/owncast/owncast/issues/1272

* Add migration to remove access tokens from user

* Add authenticated bool to user for display purposes

* Add indieauth modal and auth flair to display names. For #1273

* Validate URLs and display errors

* Renames, cleanups

* Handle relative auth endpoint paths. Add error handling for missing redirects.

* Disallow using display names in use by registered users. Closes #1810

* Verify code verifier via code challenge on callback

* Use relative path to authorization_endpoint

* Post-rebase fixes

* Use a timestamp instead of a bool for authenticated

* Propertly handle and display error in modal

* Use auth'ed timestamp to derive authenticated flag to display in chat

* don't redirect unless a URL is present

avoids redirecting to `undefined` if there was an error

* improve error message if owncast server URL isn't set

* fix IndieAuth PKCE implementation

use SHA256 instead of SHA1, generates a longer code verifier (must be 43-128 chars long), fixes URL-safe SHA256 encoding

* return real profile data for IndieAuth response

* check the code verifier in the IndieAuth server

* Linting

* Add new chat settings modal anad split up indieauth ui

* Remove logging error

* Update the IndieAuth modal UI. For #1273

* Add IndieAuth repsonse error checking

* Disable IndieAuth client if server URL is not set.

* Add explicit error messages for specific error types

* Fix bad logic

* Return OAuth-keyed error responses for indieauth server

* Display IndieAuth error in plain text with link to return to main page

* Remove redundant check

* Add additional detail to error

* Hide IndieAuth details behind disclosure details

* Break out migration into two steps because some people have been runing dev in production

* Add auth option to user dropdown

Co-authored-by: Aaron Parecki <aaron@parecki.com>
2022-04-21 14:55:26 -07:00