1-- This script may be used with the auth-filter. Be sure to configure it as you wish.
  2--
  3-- Requirements:
  4-- 	luacrypto >= 0.3
  5-- 	<http://mkottman.github.io/luacrypto/>
  6--
  7
  8
  9--
 10--
 11-- Configure these variables for your settings.
 12--
 13--
 14
 15local protected_repos = {
 16	glouglou	= { laurent = true, jason = true },
 17	qt		= { jason = true, bob = true }
 18}
 19
 20local users = {
 21	jason		= "secretpassword",
 22	laurent		= "s3cr3t",
 23	bob		= "ilikelua"
 24}
 25
 26local secret = "BE SURE TO CUSTOMIZE THIS STRING TO SOMETHING BIG AND RANDOM"
 27
 28
 29
 30--
 31--
 32-- Authentication functions follow below. Swap these out if you want different authentication semantics.
 33--
 34--
 35
 36-- Sets HTTP cookie headers based on post and sets up redirection.
 37function authenticate_post()
 38	local password = users[post["username"]]
 39	local redirect = validate_value(post["redirect"])
 40
 41	if redirect == nil then
 42		not_found()
 43		return 0
 44	end
 45
 46	redirect_to(redirect)
 47
 48	-- Lua hashes strings, so these comparisons are time invariant.
 49	if password == nil or password ~= post["password"] then
 50		set_cookie("cgitauth", "")
 51	else
 52		-- One week expiration time
 53		local username = secure_value(post["username"], os.time() + 604800)
 54		set_cookie("cgitauth", username)
 55	end
 56
 57	html("\n")
 58	return 0
 59end
 60
 61
 62-- Returns 1 if the cookie is valid and 0 if it is not.
 63function authenticate_cookie()
 64	accepted_users = protected_repos[cgit["repo"]]
 65	if accepted_users == nil then
 66		-- We return as valid if the repo is not protected.
 67		return 1
 68	end
 69
 70	local username = validate_value(get_cookie(http["cookie"], "cgitauth"))
 71	if username == nil or not accepted_users[username:lower()] then
 72		return 0
 73	else
 74		return 1
 75	end
 76end
 77
 78-- Prints the html for the login form.
 79function body()
 80	html("<h2>Authentication Required</h2>")
 81	html("<form method='post' action='")
 82	html_attr(cgit["login"])
 83	html("'>")
 84	html("<input type='hidden' name='redirect' value='")
 85	html_attr(secure_value(cgit["url"], 0))
 86	html("' />")
 87	html("<table>")
 88	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
 89	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
 90	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
 91	html("</table></form>")
 92
 93	return 0
 94end
 95
 96
 97
 98--
 99--
100-- Wrapper around filter API, exposing the http table, the cgit table, and the post table to the above functions.
101--
102--
103
104local actions = {}
105actions["authenticate-post"] = authenticate_post
106actions["authenticate-cookie"] = authenticate_cookie
107actions["body"] = body
108
109function filter_open(...)
110	action = actions[select(1, ...)]
111
112	http = {}
113	http["cookie"] = select(2, ...)
114	http["method"] = select(3, ...)
115	http["query"] = select(4, ...)
116	http["referer"] = select(5, ...)
117	http["path"] = select(6, ...)
118	http["host"] = select(7, ...)
119	http["https"] = select(8, ...)
120
121	cgit = {}
122	cgit["repo"] = select(9, ...)
123	cgit["page"] = select(10, ...)
124	cgit["url"] = select(11, ...)
125	cgit["login"] = select(12, ...)
126
127end
128
129function filter_close()
130	return action()
131end
132
133function filter_write(str)
134	post = parse_qs(str)
135end
136
137
138--
139--
140-- Utility functions based on keplerproject/wsapi.
141--
142--
143
144function url_decode(str)
145	if not str then
146		return ""
147	end
148	str = string.gsub(str, "+", " ")
149	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
150	str = string.gsub(str, "\r\n", "\n")
151	return str
152end
153
154function url_encode(str)
155	if not str then
156		return ""
157	end
158	str = string.gsub(str, "\n", "\r\n")
159	str = string.gsub(str, "([^%w ])", function (c) return string.format("%%%02X", string.byte(c)) end)
160	str = string.gsub(str, " ", "+")
161	return str
162end
163
164function parse_qs(qs)
165	local tab = {}
166	for key, val in string.gmatch(qs, "([^&=]+)=([^&=]*)&?") do
167		tab[url_decode(key)] = url_decode(val)
168	end
169	return tab
170end
171
172function get_cookie(cookies, name)
173	cookies = string.gsub(";" .. cookies .. ";", "%s*;%s*", ";")
174	return url_decode(string.match(cookies, ";" .. name .. "=(.-);"))
175end
176
177
178--
179--
180-- Cookie construction and validation helpers.
181--
182--
183
184local crypto = require("crypto")
185
186-- Returns value of cookie if cookie is valid. Otherwise returns nil.
187function validate_value(cookie)
188	local i = 0
189	local value = ""
190	local expiration = 0
191	local salt = ""
192	local hmac = ""
193
194	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
195		return nil
196	end
197
198	for component in string.gmatch(cookie, "[^|]+") do
199		if i == 0 then
200			value = component
201		elseif i == 1 then
202			expiration = tonumber(component)
203			if expiration == nil then
204				expiration = 0
205			end
206		elseif i == 2 then
207			salt = component
208		elseif i == 3 then
209			hmac = component
210		else
211			break
212		end
213		i = i + 1
214	end
215
216	if hmac == nil or hmac:len() == 0 then
217		return nil
218	end
219
220	-- Lua hashes strings, so these comparisons are time invariant.
221	if hmac ~= crypto.hmac.digest("sha1", value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
222		return nil
223	end
224
225	if expiration ~= 0 and expiration <= os.time() then
226		return nil
227	end
228
229	return url_decode(value)
230end
231
232function secure_value(value, expiration)
233	if value == nil or value:len() <= 0 then
234		return ""
235	end
236
237	local authstr = ""
238	local salt = crypto.hex(crypto.rand.bytes(16))
239	value = url_encode(value)
240	authstr = value .. "|" .. tostring(expiration) .. "|" .. salt
241	authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret)
242	return authstr
243end
244
245function set_cookie(cookie, value)
246	html("Set-Cookie: " .. cookie .. "=" .. value .. "; HttpOnly")
247	if http["https"] == "yes" or http["https"] == "on" or http["https"] == "1" then
248		html("; secure")
249	end
250	html("\n")
251end
252
253function redirect_to(url)
254	html("Status: 302 Redirect\n")
255	html("Cache-Control: no-cache, no-store\n")
256	html("Location: " .. url .. "\n")
257end
258
259function not_found()
260	html("Status: 404 Not Found\n")
261	html("Cache-Control: no-cache, no-store\n\n")
262end