website/pkg/controller/account/login.go

package account

import (
	"net/http"
	"strings"

	"code.nonshy.com/nonshy/website/pkg/config"
	"code.nonshy.com/nonshy/website/pkg/log"
	"code.nonshy.com/nonshy/website/pkg/middleware"
	"code.nonshy.com/nonshy/website/pkg/models"
	"code.nonshy.com/nonshy/website/pkg/ratelimit"
	"code.nonshy.com/nonshy/website/pkg/session"
	"code.nonshy.com/nonshy/website/pkg/templates"
	"golang.org/x/crypto/bcrypt"
)

// Login controller.
func Login() http.HandlerFunc {
	tmpl := templates.Must("account/login.html")
	tmpl2fa := templates.Must("account/two_factor_login.html")
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		var next = r.FormValue("next")

		// Posting?
		if r.Method == http.MethodPost {
			var (
				// Collect form fields.
				username = strings.ToLower(r.PostFormValue("username"))
				password = r.PostFormValue("password")
			)

			// Rate limit login attempts by email or username they are trying (whether it exists or not).
			limiter := &ratelimit.Limiter{
				Namespace:  "login",
				ID:         username,
				Limit:      config.LoginRateLimit,
				Window:     config.LoginRateLimitWindow,
				CooldownAt: config.LoginRateLimitCooldownAt,
				Cooldown:   config.LoginRateLimitCooldown,
			}
			var takebackDeferredError bool
			if err := limiter.Ping(); err != nil {
				// Is it a deferred error? Flash it at the end of the request but continue
				// to process this login attempt as normal.
				if ratelimit.IsDeferredError(err) {
					defer func() {
						if takebackDeferredError {
							return
						}
						session.FlashError(w, r, err.Error())
					}()
				} else {
					// Lock-out error, show it now and quit.
					session.FlashError(w, r, err.Error())
					templates.Redirect(w, r.URL.Path)
					return
				}
			}

			// Look up their account.
			user, err := models.FindUser(username)
			if err != nil {
				// The user wasn't found, but still hash the incoming password to take time:
				// so a mischievous user can't infer whether the username was valid based
				// on the server response time.
				bcrypt.GenerateFromPassword([]byte(password), config.BcryptCost)

				session.FlashError(w, r, "Incorrect username or password.")
				templates.Redirect(w, r.URL.Path)
				return
			}

			// Verify password.
			if err := user.CheckPassword(password); err != nil {
				session.FlashError(w, r, "Incorrect username or password.")
				templates.Redirect(w, r.URL.Path)
				return
			}

			// Is their account banned?
			if user.Status == models.UserStatusBanned {
				session.FlashError(w, r, "Your account has been %s. If you believe this was done in error, please contact support.", user.Status)
				templates.Redirect(w, r.URL.Path)
				return
			}

			// Maintenance mode check.
			if middleware.LoginMaintenance(user, w, r) {
				return
			}

			// Clear their login rate limiter.
			limiter.Clear()

			// Does the user have Two-Factor Auth enabled?
			var (
				tf          = models.Get2FA(user.ID)
				twoFactorOK bool // has successfully entered the code
			)
			if tf.Enabled {
				// Are they submitting the 2FA code?
				var (
					intent = r.PostFormValue("intent")
					code   = strings.ReplaceAll(r.PostFormValue("code"), " ", "")
				)

				// Validate the submitted code.
				if intent == "two-factor" {
					// Verify the TOTP code.
					if err := tf.Validate(code); err != nil {
						session.FlashError(w, r, "Invalid authentication code; please try again.")
					} else {
						// We're in!
						twoFactorOK = true
					}
				}

				// Show the 2FA login form.
				if !twoFactorOK {
					var vars = map[string]interface{}{
						"Next":     next,
						"Username": username,
						"Password": password,
					}
					if err := tmpl2fa.Execute(w, r, vars); err != nil {
						http.Error(w, err.Error(), http.StatusInternalServerError)
					}
					return
				}
			}

			// OK. Log in the user's session.
			session.LoginUser(w, r, user)

			// Clear their rate limiter.
			if err := limiter.Clear(); err != nil {
				log.Error("Failed to clear login rate limiter: %s", err)
			}

			// If there was going to be a deferred ratelimit error, take it back.
			takebackDeferredError = true

			// Redirect to their dashboard.
			session.Flash(w, r, "Login successful.")
			if strings.HasPrefix(next, "/") {
				templates.Redirect(w, next)
			} else {
				templates.Redirect(w, "/me")
			}
			return
		}

		var vars = map[string]interface{}{
			"Next": next,
		}
		if err := tmpl.Execute(w, r, vars); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
	})
}

// Logout controller.
func Logout() http.HandlerFunc {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		session.Flash(w, r, "You have been successfully logged out.")
		session.LogoutUser(w, r)
		templates.Redirect(w, "/")
	})
}