1-- This script may be used with the auth-filter. Be sure to configure it as you wish.
  2--
  3-- Requirements:
  4-- 	luacrypto >= 0.3
  5-- 	<http://mkottman.github.io/luacrypto/>
  6--
  7
  8
  9--
 10--
 11-- Configure these variables for your settings.
 12--
 13--
 14
 15-- A list of password protected repositories along with the users who can access them.
 16local protected_repos = {
 17	glouglou	= { laurent = true, jason = true },
 18	qt		= { jason = true, bob = true }
 19}
 20
 21-- Please note that, in production, you'll want to replace this simple lookup
 22-- table with either a table of salted and hashed passwords (using something
 23-- smart like scrypt), or replace this table lookup with an external support,
 24-- such as consulting your system's pam / shadow system, or an external
 25-- database, or an external validating web service. For testing, or for
 26-- extremely low-security usage, you may be able, however, to get away with
 27-- compromising on hardcoding the passwords in cleartext, as we have done here.
 28local users = {
 29	jason		= "secretpassword",
 30	laurent		= "s3cr3t",
 31	bob		= "ilikelua"
 32}
 33
 34-- All cookies will be authenticated based on this secret. Make it something
 35-- totally random and impossible to guess. It should be large.
 36local secret = "BE SURE TO CUSTOMIZE THIS STRING TO SOMETHING BIG AND RANDOM"
 37
 38
 39
 40--
 41--
 42-- Authentication functions follow below. Swap these out if you want different authentication semantics.
 43--
 44--
 45
 46-- Sets HTTP cookie headers based on post and sets up redirection.
 47function authenticate_post()
 48	local password = users[post["username"]]
 49	local redirect = validate_value(post["redirect"])
 50
 51	if redirect == nil then
 52		not_found()
 53		return 0
 54	end
 55
 56	redirect_to(redirect)
 57
 58	-- Lua hashes strings, so these comparisons are time invariant.
 59	if password == nil or password ~= post["password"] then
 60		set_cookie("cgitauth", "")
 61	else
 62		-- One week expiration time
 63		local username = secure_value(post["username"], os.time() + 604800)
 64		set_cookie("cgitauth", username)
 65	end
 66
 67	html("\n")
 68	return 0
 69end
 70
 71
 72-- Returns 1 if the cookie is valid and 0 if it is not.
 73function authenticate_cookie()
 74	accepted_users = protected_repos[cgit["repo"]]
 75	if accepted_users == nil then
 76		-- We return as valid if the repo is not protected.
 77		return 1
 78	end
 79
 80	local username = validate_value(get_cookie(http["cookie"], "cgitauth"))
 81	if username == nil or not accepted_users[username:lower()] then
 82		return 0
 83	else
 84		return 1
 85	end
 86end
 87
 88-- Prints the html for the login form.
 89function body()
 90	html("<h2>Authentication Required</h2>")
 91	html("<form method='post' action='")
 92	html_attr(cgit["login"])
 93	html("'>")
 94	html("<input type='hidden' name='redirect' value='")
 95	html_attr(secure_value(cgit["url"], 0))
 96	html("' />")
 97	html("<table>")
 98	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
 99	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
100	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
101	html("</table></form>")
102
103	return 0
104end
105
106
107
108--
109--
110-- Wrapper around filter API, exposing the http table, the cgit table, and the post table to the above functions.
111--
112--
113
114local actions = {}
115actions["authenticate-post"] = authenticate_post
116actions["authenticate-cookie"] = authenticate_cookie
117actions["body"] = body
118
119function filter_open(...)
120	action = actions[select(1, ...)]
121
122	http = {}
123	http["cookie"] = select(2, ...)
124	http["method"] = select(3, ...)
125	http["query"] = select(4, ...)
126	http["referer"] = select(5, ...)
127	http["path"] = select(6, ...)
128	http["host"] = select(7, ...)
129	http["https"] = select(8, ...)
130
131	cgit = {}
132	cgit["repo"] = select(9, ...)
133	cgit["page"] = select(10, ...)
134	cgit["url"] = select(11, ...)
135	cgit["login"] = select(12, ...)
136
137end
138
139function filter_close()
140	return action()
141end
142
143function filter_write(str)
144	post = parse_qs(str)
145end
146
147
148--
149--
150-- Utility functions based on keplerproject/wsapi.
151--
152--
153
154function url_decode(str)
155	if not str then
156		return ""
157	end
158	str = string.gsub(str, "+", " ")
159	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
160	str = string.gsub(str, "\r\n", "\n")
161	return str
162end
163
164function url_encode(str)
165	if not str then
166		return ""
167	end
168	str = string.gsub(str, "\n", "\r\n")
169	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
170	str = string.gsub(str, " ", "+")
171	return str
172end
173
174function parse_qs(qs)
175	local tab = {}
176	for key, val in string.gmatch(qs, "([^&=]+)=([^&=]*)&?") do
177		tab[url_decode(key)] = url_decode(val)
178	end
179	return tab
180end
181
182function get_cookie(cookies, name)
183	cookies = string.gsub(";" .. cookies .. ";", "%s*;%s*", ";")
184	return url_decode(string.match(cookies, ";" .. name .. "=(.-);"))
185end
186
187
188--
189--
190-- Cookie construction and validation helpers.
191--
192--
193
194local crypto = require("crypto")
195
196-- Returns value of cookie if cookie is valid. Otherwise returns nil.
197function validate_value(cookie)
198	local i = 0
199	local value = ""
200	local expiration = 0
201	local salt = ""
202	local hmac = ""
203
204	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
205		return nil
206	end
207
208	for component in string.gmatch(cookie, "[^|]+") do
209		if i == 0 then
210			value = component
211		elseif i == 1 then
212			expiration = tonumber(component)
213			if expiration == nil then
214				expiration = 0
215			end
216		elseif i == 2 then
217			salt = component
218		elseif i == 3 then
219			hmac = component
220		else
221			break
222		end
223		i = i + 1
224	end
225
226	if hmac == nil or hmac:len() == 0 then
227		return nil
228	end
229
230	-- Lua hashes strings, so these comparisons are time invariant.
231	if hmac ~= crypto.hmac.digest("sha1", value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
232		return nil
233	end
234
235	if expiration ~= 0 and expiration <= os.time() then
236		return nil
237	end
238
239	return url_decode(value)
240end
241
242function secure_value(value, expiration)
243	if value == nil or value:len() <= 0 then
244		return ""
245	end
246
247	local authstr = ""
248	local salt = crypto.hex(crypto.rand.bytes(16))
249	value = url_encode(value)
250	authstr = value .. "|" .. tostring(expiration) .. "|" .. salt
251	authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret)
252	return authstr
253end
254
255function set_cookie(cookie, value)
256	html("Set-Cookie: " .. cookie .. "=" .. value .. "; HttpOnly")
257	if http["https"] == "yes" or http["https"] == "on" or http["https"] == "1" then
258		html("; secure")
259	end
260	html("\n")
261end
262
263function redirect_to(url)
264	html("Status: 302 Redirect\n")
265	html("Cache-Control: no-cache, no-store\n")
266	html("Location: " .. url .. "\n")
267end
268
269function not_found()
270	html("Status: 404 Not Found\n")
271	html("Cache-Control: no-cache, no-store\n\n")
272end