1-- This script may be used with the auth-filter. Be sure to configure it as you wish.
  2--
  3-- Requirements:
  4-- 	luacrypto >= 0.3
  5-- 	<http://mkottman.github.io/luacrypto/>
  6--
  7
  8
  9--
 10--
 11-- Configure these variables for your settings.
 12--
 13--
 14
 15local protected_repos = {
 16	glouglou	= { laurent = true, jason = true },
 17	qt		= { jason = true, bob = true }
 18}
 19
 20local users = {
 21	jason		= "secretpassword",
 22	laurent		= "s3cr3t",
 23	bob		= "ilikelua"
 24}
 25
 26local secret = "BE SURE TO CUSTOMIZE THIS STRING TO SOMETHING BIG AND RANDOM"
 27
 28
 29
 30--
 31--
 32-- Authentication functions follow below. Swap these out if you want different authentication semantics.
 33--
 34--
 35
 36-- Sets HTTP cookie headers based on post and sets up redirection.
 37function authenticate_post()
 38	local password = users[post["username"]]
 39	local redirect = validate_value(post["redirect"])
 40
 41	if redirect == nil then
 42		not_found()
 43		return 0
 44	end
 45
 46	redirect_to(redirect)
 47
 48	-- Lua hashes strings, so these comparisons are time invariant.
 49	if password == nil or password ~= post["password"] then
 50		set_cookie("cgitauth", "")
 51	else
 52		-- One week expiration time
 53		local username = secure_value(post["username"], os.time() + 604800)
 54		set_cookie("cgitauth", username)
 55	end
 56
 57	html("\n")
 58	return 0
 59end
 60
 61
 62-- Returns 1 if the cookie is valid and 0 if it is not.
 63function authenticate_cookie()
 64	accepted_users = protected_repos[cgit["repo"]]
 65	if accepted_users == nil then
 66		-- We return as valid if the repo is not protected.
 67		return 1
 68	end
 69
 70	local username = validate_value(get_cookie(http["cookie"], "cgitauth"))
 71	if username == nil or not accepted_users[username:lower()] then
 72		return 0
 73	else
 74		return 1
 75	end
 76end
 77
 78-- Prints the html for the login form.
 79function body()
 80	html("<h2>Authentication Required</h2>")
 81	html("<form method='post' action='")
 82	html_attr(cgit["login"])
 83	html("'>")
 84	html("<input type='hidden' name='redirect' value='")
 85	html_attr(secure_value(cgit["url"], 0))
 86	html("' />")
 87	html("<table>")
 88	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
 89	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
 90	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
 91	html("</table></form>")
 92
 93	return 0
 94end
 95
 96
 97
 98--
 99--
100-- Wrapper around filter API, exposing the http table, the cgit table, and the post table to the above functions.
101--
102--
103
104local actions = {}
105actions["authenticate-post"] = authenticate_post
106actions["authenticate-cookie"] = authenticate_cookie
107actions["body"] = body
108
109function filter_open(...)
110	action = actions[select(1, ...)]
111
112	http = {}
113	http["cookie"] = select(2, ...)
114	http["method"] = select(3, ...)
115	http["query"] = select(4, ...)
116	http["referer"] = select(5, ...)
117	http["path"] = select(6, ...)
118	http["host"] = select(7, ...)
119	http["https"] = select(8, ...)
120
121	cgit = {}
122	cgit["repo"] = select(9, ...)
123	cgit["page"] = select(10, ...)
124	cgit["url"] = select(11, ...)
125
126	cgit["login"] = ""
127	for _ in cgit["url"]:gfind("/") do
128		cgit["login"] = cgit["login"] .. "../"
129	end
130	cgit["login"] = cgit["login"] .. "?p=login"
131
132end
133
134function filter_close()
135	return action()
136end
137
138function filter_write(str)
139	post = parse_qs(str)
140end
141
142
143--
144--
145-- Utility functions based on keplerproject/wsapi.
146--
147--
148
149function url_decode(str)
150	if not str then
151		return ""
152	end
153	str = string.gsub(str, "+", " ")
154	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
155	str = string.gsub(str, "\r\n", "\n")
156	return str
157end
158
159function url_encode(str)
160	if not str then
161		return ""
162	end
163	str = string.gsub(str, "\n", "\r\n")
164	str = string.gsub(str, "([^%w ])", function (c) return string.format("%%%02X", string.byte(c)) end)
165	str = string.gsub(str, " ", "+")
166	return str
167end
168
169function parse_qs(qs)
170	local tab = {}
171	for key, val in string.gmatch(qs, "([^&=]+)=([^&=]*)&?") do
172		tab[url_decode(key)] = url_decode(val)
173	end
174	return tab
175end
176
177function get_cookie(cookies, name)
178	cookies = string.gsub(";" .. cookies .. ";", "%s*;%s*", ";")
179	return url_decode(string.match(cookies, ";" .. name .. "=(.-);"))
180end
181
182
183--
184--
185-- Cookie construction and validation helpers.
186--
187--
188
189local crypto = require("crypto")
190
191-- Returns value of cookie if cookie is valid. Otherwise returns nil.
192function validate_value(cookie)
193	local i = 0
194	local value = ""
195	local expiration = 0
196	local salt = ""
197	local hmac = ""
198
199	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
200		return nil
201	end
202
203	for component in string.gmatch(cookie, "[^|]+") do
204		if i == 0 then
205			value = component
206		elseif i == 1 then
207			expiration = tonumber(component)
208			if expiration == nil then
209				expiration = 0
210			end
211		elseif i == 2 then
212			salt = component
213		elseif i == 3 then
214			hmac = component
215		else
216			break
217		end
218		i = i + 1
219	end
220
221	if hmac == nil or hmac:len() == 0 then
222		return nil
223	end
224
225	-- Lua hashes strings, so these comparisons are time invariant.
226	if hmac ~= crypto.hmac.digest("sha1", value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
227		return nil
228	end
229
230	if expiration ~= 0 and expiration <= os.time() then
231		return nil
232	end
233
234	return url_decode(value)
235end
236
237function secure_value(value, expiration)
238	if value == nil or value:len() <= 0 then
239		return ""
240	end
241
242	local authstr = ""
243	local salt = crypto.hex(crypto.rand.bytes(16))
244	value = url_encode(value)
245	authstr = value .. "|" .. tostring(expiration) .. "|" .. salt
246	authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret)
247	return authstr
248end
249
250function set_cookie(cookie, value)
251	html("Set-Cookie: " .. cookie .. "=" .. value .. "; HttpOnly")
252	if http["https"] == "yes" or http["https"] == "on" or http["https"] == "1" then
253		html("; secure")
254	end
255	html("\n")
256end
257
258function redirect_to(url)
259	html("Status: 302 Redirect\n")
260	html("Cache-Control: no-cache, no-store\n")
261	html("Location: " .. url .. "\n")
262end
263
264function not_found()
265	html("Status: 404 Not Found\n")
266	html("Cache-Control: no-cache, no-store\n\n")
267end