mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2025-08-19 17:01:12 +00:00
feat: Global 2FA enforcement (#8753)
resolves #8549 This PR add a config to enforce 2FA for the whole Forgejo instance. It can be configured to `none`, `admin` or `all`. A user who is required to enable 2FA is like a disabled user. He can only see the `/user/settings/security`-Page to enable 2FA, this should be similar to a user which needs to change his password. Also api and git-commands are not allowed. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [ ] I did not document these changes and I do not expect someone else to do it. I will do it, if the general idea of this PR is a good feature. ### Release notes - [ ] I do not want this change to show in the release notes. - [x] I want the title to show in the release notes with a link to this pull request. - [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Security features - [PR](https://codeberg.org/forgejo/forgejo/pulls/8753): <!--number 8753 --><!--line 0 --><!--description R2xvYmFsIDJGQSBlbmZvcmNlbWVudA==-->Global 2FA enforcement<!--description--> <!--end release-notes-assistant--> Co-authored-by: 0ko <0ko@noreply.codeberg.org> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8753 Reviewed-by: 0ko <0ko@noreply.codeberg.org> Reviewed-by: Ellen Εμιλία Άννα Zscheile <fogti@noreply.codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: zokki <zokki.softwareschmiede@gmail.com> Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
This commit is contained in:
zokki
Earl Warren
parent
ff99331225
commit
d6838462b8
29 changed files with 1179 additions and 62 deletions
|
|
@ -4,7 +4,9 @@
|
|||
package integration
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
|
|
@ -12,6 +14,9 @@ import (
|
|||
"forgejo.org/models/db"
|
||||
"forgejo.org/models/unittest"
|
||||
user_model "forgejo.org/models/user"
|
||||
"forgejo.org/modules/setting"
|
||||
"forgejo.org/modules/test"
|
||||
"forgejo.org/modules/translation"
|
||||
"forgejo.org/tests"
|
||||
|
||||
"github.com/pquerna/otp/totp"
|
||||
|
|
@ -79,3 +84,127 @@ func TestAPIWebAuthn(t *testing.T) {
|
|||
|
||||
assert.Equal(t, "Basic authorization is not allowed while having security keys enrolled", userParsed.Message)
|
||||
}
|
||||
|
||||
func TestAPIWithRequiredTwoFactor(t *testing.T) {
|
||||
defer tests.PrepareTestEnv(t)()
|
||||
|
||||
type userResponse struct {
|
||||
Message string `json:"message"`
|
||||
}
|
||||
|
||||
locale := translation.NewLocale("en-US")
|
||||
|
||||
adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
|
||||
normalUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
|
||||
inactiveUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 9})
|
||||
restrictedUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 29})
|
||||
prohibitLoginUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 37})
|
||||
|
||||
require2FaMessage := locale.TrString("error.must_enable_2fa", fmt.Sprintf("%suser/settings/security", setting.AppURL))
|
||||
const prohibitedMessage = "This account is prohibited from signing in, please contact your site administrator."
|
||||
const loginNotAllowedMessage = "user is not allowed login"
|
||||
|
||||
runTest := func(t *testing.T, user *user_model.User, useTOTP bool, status int, messagePrefix string) {
|
||||
t.Helper()
|
||||
defer unittest.AssertSuccessfulDelete(t, &auth_model.TwoFactor{UID: user.ID})
|
||||
|
||||
passcode := func() string {
|
||||
if !useTOTP {
|
||||
return ""
|
||||
}
|
||||
|
||||
otpKey, err := totp.Generate(totp.GenerateOpts{
|
||||
SecretSize: 40,
|
||||
Issuer: "forgejo-test",
|
||||
AccountName: user.Name,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
require.NoError(t, auth_model.NewTwoFactor(t.Context(), &auth_model.TwoFactor{UID: user.ID}, otpKey.Secret()))
|
||||
|
||||
passcode, err := totp.GenerateCode(otpKey.Secret(), time.Now())
|
||||
require.NoError(t, err)
|
||||
return passcode
|
||||
}()
|
||||
|
||||
req := NewRequest(t, "GET", "/api/v1/user").
|
||||
AddBasicAuth(user.Name)
|
||||
|
||||
if useTOTP {
|
||||
MakeRequest(t, req, http.StatusUnauthorized)
|
||||
|
||||
req = NewRequestf(t, "GET", "/api/v1/user").
|
||||
AddBasicAuth(user.Name)
|
||||
req.Header.Set("X-Forgejo-OTP", passcode)
|
||||
}
|
||||
|
||||
resp := MakeRequest(t, req, status)
|
||||
|
||||
if messagePrefix != "" {
|
||||
var response userResponse
|
||||
DecodeJSON(t, resp, &response)
|
||||
|
||||
assert.True(t, strings.HasPrefix(response.Message, messagePrefix))
|
||||
}
|
||||
}
|
||||
|
||||
t.Run("NoneTwoFactorRequirement", func(t *testing.T) {
|
||||
// this should be the default, so don't have to set the variable
|
||||
|
||||
t.Run("no 2fa", func(t *testing.T) {
|
||||
runTest(t, adminUser, false, http.StatusOK, "")
|
||||
runTest(t, normalUser, false, http.StatusOK, "")
|
||||
runTest(t, inactiveUser, false, http.StatusForbidden, prohibitedMessage)
|
||||
runTest(t, restrictedUser, false, http.StatusOK, "")
|
||||
runTest(t, prohibitLoginUser, false, http.StatusUnauthorized, loginNotAllowedMessage)
|
||||
})
|
||||
|
||||
t.Run("enabled 2fa", func(t *testing.T) {
|
||||
runTest(t, adminUser, true, http.StatusOK, "")
|
||||
runTest(t, normalUser, true, http.StatusOK, "")
|
||||
runTest(t, inactiveUser, true, http.StatusForbidden, prohibitedMessage)
|
||||
runTest(t, restrictedUser, true, http.StatusOK, "")
|
||||
runTest(t, prohibitLoginUser, true, http.StatusUnauthorized, loginNotAllowedMessage)
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("AllTwoFactorRequirement", func(t *testing.T) {
|
||||
defer test.MockVariableValue(&setting.GlobalTwoFactorRequirement, setting.AllTwoFactorRequirement)()
|
||||
|
||||
t.Run("no 2fa", func(t *testing.T) {
|
||||
runTest(t, adminUser, false, http.StatusForbidden, require2FaMessage)
|
||||
runTest(t, normalUser, false, http.StatusForbidden, require2FaMessage)
|
||||
runTest(t, inactiveUser, false, http.StatusForbidden, prohibitedMessage)
|
||||
runTest(t, restrictedUser, false, http.StatusForbidden, require2FaMessage)
|
||||
runTest(t, prohibitLoginUser, false, http.StatusUnauthorized, loginNotAllowedMessage)
|
||||
})
|
||||
|
||||
t.Run("enabled 2fa", func(t *testing.T) {
|
||||
runTest(t, adminUser, true, http.StatusOK, "")
|
||||
runTest(t, normalUser, true, http.StatusOK, "")
|
||||
runTest(t, inactiveUser, true, http.StatusForbidden, prohibitedMessage)
|
||||
runTest(t, restrictedUser, true, http.StatusOK, "")
|
||||
runTest(t, prohibitLoginUser, true, http.StatusUnauthorized, loginNotAllowedMessage)
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("AdminTwoFactorRequirement", func(t *testing.T) {
|
||||
defer test.MockVariableValue(&setting.GlobalTwoFactorRequirement, setting.AdminTwoFactorRequirement)()
|
||||
|
||||
t.Run("no 2fa", func(t *testing.T) {
|
||||
runTest(t, adminUser, false, http.StatusForbidden, require2FaMessage)
|
||||
runTest(t, normalUser, false, http.StatusOK, "")
|
||||
runTest(t, inactiveUser, false, http.StatusForbidden, prohibitedMessage)
|
||||
runTest(t, restrictedUser, false, http.StatusOK, "")
|
||||
runTest(t, prohibitLoginUser, false, http.StatusUnauthorized, loginNotAllowedMessage)
|
||||
})
|
||||
|
||||
t.Run("enabled 2fa", func(t *testing.T) {
|
||||
runTest(t, adminUser, true, http.StatusOK, "")
|
||||
runTest(t, normalUser, true, http.StatusOK, "")
|
||||
runTest(t, inactiveUser, true, http.StatusForbidden, prohibitedMessage)
|
||||
runTest(t, restrictedUser, true, http.StatusOK, "")
|
||||
runTest(t, prohibitLoginUser, true, http.StatusUnauthorized, loginNotAllowedMessage)
|
||||
})
|
||||
})
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue