mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-12-05 09:23:01 +01:00
bd820aa9c5
To avoid duplicated load of the same data in an HTTP request, we can set a context cache to do that. i.e. Some pages may load a user from a database with the same id in different areas on the same page. But the code is hidden in two different deep logic. How should we share the user? As a result of this PR, now if both entry functions accept `context.Context` as the first parameter and we just need to refactor `GetUserByID` to reuse the user from the context cache. Then it will not be loaded twice on an HTTP request. But of course, sometimes we would like to reload an object from the database, that's why `RemoveContextData` is also exposed. The core context cache is here. It defines a new context ```go type cacheContext struct { ctx context.Context data map[any]map[any]any lock sync.RWMutex } var cacheContextKey = struct{}{} func WithCacheContext(ctx context.Context) context.Context { return context.WithValue(ctx, cacheContextKey, &cacheContext{ ctx: ctx, data: make(map[any]map[any]any), }) } ``` Then you can use the below 4 methods to read/write/del the data within the same context. ```go func GetContextData(ctx context.Context, tp, key any) any func SetContextData(ctx context.Context, tp, key, value any) func RemoveContextData(ctx context.Context, tp, key any) func GetWithContextCache[T any](ctx context.Context, cacheGroupKey string, cacheTargetID any, f func() (T, error)) (T, error) ``` Then let's take a look at how `system.GetString` implement it. ```go func GetSetting(ctx context.Context, key string) (string, error) { return cache.GetWithContextCache(ctx, contextCacheKey, key, func() (string, error) { return cache.GetString(genSettingCacheKey(key), func() (string, error) { res, err := GetSettingNoCache(ctx, key) if err != nil { return "", err } return res.SettingValue, nil }) }) } ``` First, it will check if context data include the setting object with the key. If not, it will query from the global cache which may be memory or a Redis cache. If not, it will get the object from the database. In the end, if the object gets from the global cache or database, it will be set into the context cache. An object stored in the context cache will only be destroyed after the context disappeared.
178 lines
5.9 KiB
Go
178 lines
5.9 KiB
Go
// Copyright 2014 The Gogs Authors. All rights reserved.
|
|
// Copyright 2019 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
"code.gitea.io/gitea/modules/log"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
"code.gitea.io/gitea/modules/util"
|
|
"code.gitea.io/gitea/modules/web/middleware"
|
|
"code.gitea.io/gitea/services/mailer"
|
|
|
|
gouuid "github.com/google/uuid"
|
|
)
|
|
|
|
// Ensure the struct implements the interface.
|
|
var (
|
|
_ Method = &ReverseProxy{}
|
|
_ Named = &ReverseProxy{}
|
|
)
|
|
|
|
// ReverseProxyMethodName is the constant name of the ReverseProxy authentication method
|
|
const ReverseProxyMethodName = "reverse_proxy"
|
|
|
|
// ReverseProxy implements the Auth interface, but actually relies on
|
|
// a reverse proxy for authentication of users.
|
|
// On successful authentication the proxy is expected to populate the username in the
|
|
// "setting.ReverseProxyAuthUser" header. Optionally it can also populate the email of the
|
|
// user in the "setting.ReverseProxyAuthEmail" header.
|
|
type ReverseProxy struct{}
|
|
|
|
// getUserName extracts the username from the "setting.ReverseProxyAuthUser" header
|
|
func (r *ReverseProxy) getUserName(req *http.Request) string {
|
|
return strings.TrimSpace(req.Header.Get(setting.ReverseProxyAuthUser))
|
|
}
|
|
|
|
// Name represents the name of auth method
|
|
func (r *ReverseProxy) Name() string {
|
|
return ReverseProxyMethodName
|
|
}
|
|
|
|
// getUserFromAuthUser extracts the username from the "setting.ReverseProxyAuthUser" header
|
|
// of the request and returns the corresponding user object for that name.
|
|
// Verification of header data is not performed as it should have already been done by
|
|
// the reverse proxy.
|
|
// If a username is available in the "setting.ReverseProxyAuthUser" header an existing
|
|
// user object is returned (populated with username or email found in header).
|
|
// Returns nil if header is empty.
|
|
func (r *ReverseProxy) getUserFromAuthUser(req *http.Request) (*user_model.User, error) {
|
|
username := r.getUserName(req)
|
|
if len(username) == 0 {
|
|
return nil, nil
|
|
}
|
|
log.Trace("ReverseProxy Authorization: Found username: %s", username)
|
|
|
|
user, err := user_model.GetUserByName(req.Context(), username)
|
|
if err != nil {
|
|
if !user_model.IsErrUserNotExist(err) || !r.isAutoRegisterAllowed() {
|
|
log.Error("GetUserByName: %v", err)
|
|
return nil, err
|
|
}
|
|
user = r.newUser(req)
|
|
}
|
|
return user, nil
|
|
}
|
|
|
|
// getEmail extracts the email from the "setting.ReverseProxyAuthEmail" header
|
|
func (r *ReverseProxy) getEmail(req *http.Request) string {
|
|
return strings.TrimSpace(req.Header.Get(setting.ReverseProxyAuthEmail))
|
|
}
|
|
|
|
// getUserFromAuthEmail extracts the username from the "setting.ReverseProxyAuthEmail" header
|
|
// of the request and returns the corresponding user object for that email.
|
|
// Verification of header data is not performed as it should have already been done by
|
|
// the reverse proxy.
|
|
// If an email is available in the "setting.ReverseProxyAuthEmail" header an existing
|
|
// user object is returned (populated with the email found in header).
|
|
// Returns nil if header is empty or if "setting.EnableReverseProxyEmail" is disabled.
|
|
func (r *ReverseProxy) getUserFromAuthEmail(req *http.Request) *user_model.User {
|
|
if !setting.Service.EnableReverseProxyEmail {
|
|
return nil
|
|
}
|
|
email := r.getEmail(req)
|
|
if len(email) == 0 {
|
|
return nil
|
|
}
|
|
log.Trace("ReverseProxy Authorization: Found email: %s", email)
|
|
|
|
user, err := user_model.GetUserByEmail(req.Context(), email)
|
|
if err != nil {
|
|
// Do not allow auto-registration, we don't have a username here
|
|
if !user_model.IsErrUserNotExist(err) {
|
|
log.Error("GetUserByEmail: %v", err)
|
|
}
|
|
return nil
|
|
}
|
|
return user
|
|
}
|
|
|
|
// Verify attempts to load a user object based on headers sent by the reverse proxy.
|
|
// First it will attempt to load it based on the username (see docs for getUserFromAuthUser),
|
|
// and failing that it will attempt to load it based on the email (see docs for getUserFromAuthEmail).
|
|
// Returns nil if the headers are empty or the user is not found.
|
|
func (r *ReverseProxy) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
|
|
user, err := r.getUserFromAuthUser(req)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if user == nil {
|
|
user = r.getUserFromAuthEmail(req)
|
|
if user == nil {
|
|
return nil, nil
|
|
}
|
|
}
|
|
|
|
// Make sure requests to API paths, attachment downloads, git and LFS do not create a new session
|
|
if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isGitRawReleaseOrLFSPath(req) {
|
|
if sess != nil && (sess.Get("uid") == nil || sess.Get("uid").(int64) != user.ID) {
|
|
handleSignIn(w, req, sess, user)
|
|
}
|
|
}
|
|
store.GetData()["IsReverseProxy"] = true
|
|
|
|
log.Trace("ReverseProxy Authorization: Logged in user %-v", user)
|
|
return user, nil
|
|
}
|
|
|
|
// isAutoRegisterAllowed checks if EnableReverseProxyAutoRegister setting is true
|
|
func (r *ReverseProxy) isAutoRegisterAllowed() bool {
|
|
return setting.Service.EnableReverseProxyAutoRegister
|
|
}
|
|
|
|
// newUser creates a new user object for the purpose of automatic registration
|
|
// and populates its name and email with the information present in request headers.
|
|
func (r *ReverseProxy) newUser(req *http.Request) *user_model.User {
|
|
username := r.getUserName(req)
|
|
if len(username) == 0 {
|
|
return nil
|
|
}
|
|
|
|
email := gouuid.New().String() + "@localhost"
|
|
if setting.Service.EnableReverseProxyEmail {
|
|
webAuthEmail := req.Header.Get(setting.ReverseProxyAuthEmail)
|
|
if len(webAuthEmail) > 0 {
|
|
email = webAuthEmail
|
|
}
|
|
}
|
|
|
|
var fullname string
|
|
if setting.Service.EnableReverseProxyFullName {
|
|
fullname = req.Header.Get(setting.ReverseProxyAuthFullName)
|
|
}
|
|
|
|
user := &user_model.User{
|
|
Name: username,
|
|
Email: email,
|
|
FullName: fullname,
|
|
}
|
|
|
|
overwriteDefault := user_model.CreateUserOverwriteOptions{
|
|
IsActive: util.OptionalBoolTrue,
|
|
}
|
|
|
|
if err := user_model.CreateUser(user, &overwriteDefault); err != nil {
|
|
// FIXME: should I create a system notice?
|
|
log.Error("CreateUser: %v", err)
|
|
return nil
|
|
}
|
|
|
|
mailer.SendRegisterNotifyMail(user)
|
|
|
|
return user
|
|
}
|