93 lines
3.3 KiB
Go
93 lines
3.3 KiB
Go
package handlers
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/authelia/authelia/v4/internal/authentication"
|
|
"github.com/authelia/authelia/v4/internal/authorization"
|
|
"github.com/authelia/authelia/v4/internal/middlewares"
|
|
"github.com/authelia/authelia/v4/internal/session"
|
|
"github.com/authelia/authelia/v4/internal/utils"
|
|
)
|
|
|
|
func friendlyMethod(m string) (fm string) {
|
|
switch m {
|
|
case "":
|
|
return "unknown"
|
|
default:
|
|
return m
|
|
}
|
|
}
|
|
|
|
func friendlyUsername(username string) (fusername string) {
|
|
switch username {
|
|
case "":
|
|
return "<anonymous>"
|
|
default:
|
|
return username
|
|
}
|
|
}
|
|
|
|
func isAuthzResult(level authentication.Level, required authorization.Level, ruleHasSubject bool) AuthzResult {
|
|
switch {
|
|
case required == authorization.Bypass:
|
|
return AuthzResultAuthorized
|
|
case required == authorization.Denied && (level != authentication.NotAuthenticated || !ruleHasSubject):
|
|
// If the user is not anonymous, it means that we went through all the rules related to that user identity and
|
|
// can safely conclude their access is actually forbidden. If a user is anonymous however this is not actually
|
|
// possible without some more advanced logic.
|
|
return AuthzResultForbidden
|
|
case required == authorization.OneFactor && level >= authentication.OneFactor,
|
|
required == authorization.TwoFactor && level >= authentication.TwoFactor:
|
|
return AuthzResultAuthorized
|
|
default:
|
|
return AuthzResultUnauthorized
|
|
}
|
|
}
|
|
|
|
// generateVerifySessionHasUpToDateProfileTraceLogs is used to generate trace logs only when trace logging is enabled.
|
|
// The information calculated in this function is completely useless other than trace for now.
|
|
func generateVerifySessionHasUpToDateProfileTraceLogs(ctx *middlewares.AutheliaCtx, userSession *session.UserSession,
|
|
details *authentication.UserDetails) {
|
|
groupsAdded, groupsRemoved := utils.StringSlicesDelta(userSession.Groups, details.Groups)
|
|
emailsAdded, emailsRemoved := utils.StringSlicesDelta(userSession.Emails, details.Emails)
|
|
nameDelta := userSession.DisplayName != details.DisplayName
|
|
|
|
var groupsDelta []string
|
|
if len(groupsAdded) != 0 {
|
|
groupsDelta = append(groupsDelta, fmt.Sprintf("added: %s.", strings.Join(groupsAdded, ", ")))
|
|
}
|
|
|
|
if len(groupsRemoved) != 0 {
|
|
groupsDelta = append(groupsDelta, fmt.Sprintf("removed: %s.", strings.Join(groupsRemoved, ", ")))
|
|
}
|
|
|
|
if len(groupsDelta) != 0 {
|
|
ctx.Logger.Tracef("Updated groups detected for %s. %s", userSession.Username, strings.Join(groupsDelta, " "))
|
|
} else {
|
|
ctx.Logger.Tracef("No updated groups detected for %s", userSession.Username)
|
|
}
|
|
|
|
var emailsDelta []string
|
|
if len(emailsAdded) != 0 {
|
|
emailsDelta = append(emailsDelta, fmt.Sprintf("added: %s.", strings.Join(emailsAdded, ", ")))
|
|
}
|
|
|
|
if len(emailsRemoved) != 0 {
|
|
emailsDelta = append(emailsDelta, fmt.Sprintf("removed: %s.", strings.Join(emailsRemoved, ", ")))
|
|
}
|
|
|
|
if len(emailsDelta) != 0 {
|
|
ctx.Logger.Tracef("Updated emails detected for %s. %s", userSession.Username, strings.Join(emailsDelta, " "))
|
|
} else {
|
|
ctx.Logger.Tracef("No updated emails detected for %s", userSession.Username)
|
|
}
|
|
|
|
if nameDelta {
|
|
ctx.Logger.Tracef("Updated display name detected for %s. Added: %s. Removed: %s.", userSession.Username, details.DisplayName, userSession.DisplayName)
|
|
} else {
|
|
ctx.Logger.Tracef("No updated display name detected for %s", userSession.Username)
|
|
}
|
|
}
|