Skip to content

Commit 212773d

Browse files
DaneEverittDaneEveritt
committed
Finish authentication flow for 2FA
1 parent 7f3ab8a commit 212773d

File tree

9 files changed

+232
-162
lines changed

9 files changed

+232
-162
lines changed

‎app/Http/Controllers/Auth/AbstractLoginController.php‎

Lines changed: 25 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -6,45 +6,17 @@
66
use Pterodactyl\Models\User;
77
use Illuminate\Auth\AuthManager;
88
use Illuminate\Http\JsonResponse;
9-
use PragmaRX\Google2FA\Google2FA;
109
use Illuminate\Auth\Events\Failed;
10+
use Illuminate\Contracts\Config\Repository;
1111
use Pterodactyl\Exceptions\DisplayException;
1212
use Pterodactyl\Http\Controllers\Controller;
1313
use Illuminate\Contracts\Auth\Authenticatable;
14-
use Illuminate\Contracts\Encryption\Encrypter;
1514
use Illuminate\Foundation\Auth\AuthenticatesUsers;
16-
use Illuminate\Contracts\Cache\Repository as CacheRepository;
17-
use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
1815

1916
abstract class AbstractLoginController extends Controller
2017
{
2118
use AuthenticatesUsers;
2219

23-
/**
24-
* @var \Illuminate\Auth\AuthManager
25-
*/
26-
protected $auth;
27-
28-
/**
29-
* @var \Illuminate\Contracts\Cache\Repository
30-
*/
31-
protected $cache;
32-
33-
/**
34-
* @var \Illuminate\Contracts\Encryption\Encrypter
35-
*/
36-
protected $encrypter;
37-
38-
/**
39-
* @var \PragmaRX\Google2FA\Google2FA
40-
*/
41-
protected $google2FA;
42-
43-
/**
44-
* @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
45-
*/
46-
protected $repository;
47-
4820
/**
4921
* Lockout time for failed login requests.
5022
*
@@ -66,30 +38,29 @@ abstract class AbstractLoginController extends Controller
6638
*/
6739
protected $redirectTo = '/';
6840

41+
/**
42+
* @var \Illuminate\Auth\AuthManager
43+
*/
44+
protected $auth;
45+
46+
/**
47+
* @var \Illuminate\Contracts\Config\Repository
48+
*/
49+
protected $config;
50+
6951
/**
7052
* LoginController constructor.
7153
*
72-
* @param \Illuminate\Auth\AuthManager $auth
73-
* @param \Illuminate\Contracts\Cache\Repository $cache
74-
* @param \Illuminate\Contracts\Encryption\Encrypter $encrypter
75-
* @param \PragmaRX\Google2FA\Google2FA $google2FA
76-
* @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $repository
54+
* @param \Illuminate\Auth\AuthManager $auth
55+
* @param \Illuminate\Contracts\Config\Repository $config
7756
*/
78-
public function __construct(
79-
AuthManager $auth,
80-
CacheRepository $cache,
81-
Encrypter $encrypter,
82-
Google2FA $google2FA,
83-
UserRepositoryInterface $repository
84-
) {
85-
$this->auth = $auth;
86-
$this->cache = $cache;
87-
$this->encrypter = $encrypter;
88-
$this->google2FA = $google2FA;
89-
$this->repository = $repository;
57+
public function __construct(AuthManager $auth, Repository $config)
58+
{
59+
$this->lockoutTime = $config->get('auth.lockout.time');
60+
$this->maxLoginAttempts = $config->get('auth.lockout.attempts');
9061

91-
$this->lockoutTime = config('auth.lockout.time');
92-
$this->maxLoginAttempts = config('auth.lockout.attempts');
62+
$this->auth = $auth;
63+
$this->config = $config;
9364
}
9465

9566
/**
@@ -128,10 +99,12 @@ protected function sendLoginResponse(User $user, Request $request): JsonResponse
12899

129100
$this->auth->guard()->login($user, true);
130101

131-
return response()->json([
132-
'complete' => true,
133-
'intended' => $this->redirectPath(),
134-
'user' => $user->toVueObject(),
102+
return JsonResponse::create([
103+
'data' => [
104+
'complete' => true,
105+
'intended' => $this->redirectPath(),
106+
'user' => $user->toVueObject(),
107+
],
135108
]);
136109
}
137110

‎app/Http/Controllers/Auth/LoginCheckpointController.php‎

Lines changed: 63 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,64 @@
22

33
namespace Pterodactyl\Http\Controllers\Auth;
44

5+
use Illuminate\Auth\AuthManager;
56
use Illuminate\Http\JsonResponse;
7+
use PragmaRX\Google2FA\Google2FA;
8+
use Illuminate\Contracts\Config\Repository;
9+
use Illuminate\Contracts\Encryption\Encrypter;
610
use Pterodactyl\Http\Requests\Auth\LoginCheckpointRequest;
11+
use Illuminate\Contracts\Cache\Repository as CacheRepository;
12+
use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
713
use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
814

915
class LoginCheckpointController extends AbstractLoginController
1016
{
17+
/**
18+
* @var \Illuminate\Contracts\Cache\Repository
19+
*/
20+
private $cache;
21+
22+
/**
23+
* @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
24+
*/
25+
private $repository;
26+
27+
/**
28+
* @var \PragmaRX\Google2FA\Google2FA
29+
*/
30+
private $google2FA;
31+
32+
/**
33+
* @var \Illuminate\Contracts\Encryption\Encrypter
34+
*/
35+
private $encrypter;
36+
37+
/**
38+
* LoginCheckpointController constructor.
39+
*
40+
* @param \Illuminate\Auth\AuthManager $auth
41+
* @param \Illuminate\Contracts\Encryption\Encrypter $encrypter
42+
* @param \PragmaRX\Google2FA\Google2FA $google2FA
43+
* @param \Illuminate\Contracts\Config\Repository $config
44+
* @param \Illuminate\Contracts\Cache\Repository $cache
45+
* @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $repository
46+
*/
47+
public function __construct(
48+
AuthManager $auth,
49+
Encrypter $encrypter,
50+
Google2FA $google2FA,
51+
Repository $config,
52+
CacheRepository $cache,
53+
UserRepositoryInterface $repository
54+
) {
55+
parent::__construct($auth, $config);
56+
57+
$this->google2FA = $google2FA;
58+
$this->cache = $cache;
59+
$this->repository = $repository;
60+
$this->encrypter = $encrypter;
61+
}
62+
1163
/**
1264
* Handle a login where the user is required to provide a TOTP authentication
1365
* token. Once a user has reached this stage it is assumed that they have already
@@ -16,29 +68,28 @@ class LoginCheckpointController extends AbstractLoginController
1668
* @param \Pterodactyl\Http\Requests\Auth\LoginCheckpointRequest $request
1769
* @return \Illuminate\Http\JsonResponse
1870
*
71+
* @throws \PragmaRX\Google2FA\Exceptions\IncompatibleWithGoogleAuthenticatorException
72+
* @throws \PragmaRX\Google2FA\Exceptions\InvalidCharactersException
73+
* @throws \PragmaRX\Google2FA\Exceptions\SecretKeyTooShortException
1974
* @throws \Pterodactyl\Exceptions\DisplayException
2075
*/
2176
public function __invoke(LoginCheckpointRequest $request): JsonResponse
2277
{
2378
try {
24-
$cache = $this->cache->pull($request->input('confirmation_token'), []);
25-
$user = $this->repository->find(array_get($cache, 'user_id', 0));
79+
$user = $this->repository->find(
80+
$this->cache->pull($request->input('confirmation_token'), 0)
81+
);
2682
} catch (RecordNotFoundException $exception) {
2783
return $this->sendFailedLoginResponse($request);
2884
}
2985

30-
if (array_get($cache, 'request_ip') !== $request->ip()) {
31-
return $this->sendFailedLoginResponse($request, $user);
32-
}
86+
$decrypted = $this->encrypter->decrypt($user->totp_secret);
87+
$window = $this->config->get('pterodactyl.auth.2fa.window');
3388

34-
if (! $this->google2FA->verifyKey(
35-
$this->encrypter->decrypt($user->totp_secret),
36-
$request->input('authentication_code'),
37-
config('pterodactyl.auth.2fa.window')
38-
)) {
39-
return $this->sendFailedLoginResponse($request, $user);
89+
if ($this->google2FA->verifyKey($decrypted, $request->input('authentication_code'), $window)) {
90+
return $this->sendLoginResponse($user, $request);
4091
}
4192

42-
return $this->sendLoginResponse($user, $request);
93+
return $this->sendFailedLoginResponse($request, $user);
4394
}
4495
}

‎app/Http/Controllers/Auth/LoginController.php‎

Lines changed: 54 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,57 @@
22

33
namespace Pterodactyl\Http\Controllers\Auth;
44

5+
use Illuminate\Support\Str;
56
use Illuminate\Http\Request;
7+
use Illuminate\Auth\AuthManager;
68
use Illuminate\Http\JsonResponse;
79
use Illuminate\Contracts\View\View;
10+
use Illuminate\Contracts\Config\Repository;
11+
use Illuminate\Contracts\View\Factory as ViewFactory;
12+
use Illuminate\Contracts\Cache\Repository as CacheRepository;
13+
use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
814
use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
915

1016
class LoginController extends AbstractLoginController
1117
{
18+
/**
19+
* @var \Illuminate\Contracts\View\Factory
20+
*/
21+
private $view;
22+
23+
/**
24+
* @var \Illuminate\Contracts\Cache\Repository
25+
*/
26+
private $cache;
27+
28+
/**
29+
* @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
30+
*/
31+
private $repository;
32+
33+
/**
34+
* LoginController constructor.
35+
*
36+
* @param \Illuminate\Auth\AuthManager $auth
37+
* @param \Illuminate\Contracts\Config\Repository $config
38+
* @param \Illuminate\Contracts\Cache\Repository $cache
39+
* @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $repository
40+
* @param \Illuminate\Contracts\View\Factory $view
41+
*/
42+
public function __construct(
43+
AuthManager $auth,
44+
Repository $config,
45+
CacheRepository $cache,
46+
UserRepositoryInterface $repository,
47+
ViewFactory $view
48+
) {
49+
parent::__construct($auth, $config);
50+
51+
$this->view = $view;
52+
$this->cache = $cache;
53+
$this->repository = $repository;
54+
}
55+
1256
/**
1357
* Handle all incoming requests for the authentication routes and render the
1458
* base authentication view component. Vuejs will take over at this point and
@@ -18,7 +62,7 @@ class LoginController extends AbstractLoginController
1862
*/
1963
public function index(): View
2064
{
21-
return view('templates/auth.core');
65+
return $this->view->make('templates/auth.core');
2266
}
2367

2468
/**
@@ -55,85 +99,19 @@ public function login(Request $request): JsonResponse
5599
}
56100

57101
if ($user->use_totp) {
58-
$token = str_random(64);
59-
$this->cache->put($token, ['user_id' => $user->id, 'valid_credentials' => true], 5);
60-
61-
return redirect()->route('auth.totp')->with('authentication_token', $token);
102+
$token = Str::random(64);
103+
$this->cache->put($token, $user->id, 5);
104+
105+
return JsonResponse::create([
106+
'data' => [
107+
'complete' => false,
108+
'confirmation_token' => $token,
109+
],
110+
]);
62111
}
63112

64113
$this->auth->guard()->login($user, true);
65114

66115
return $this->sendLoginResponse($user, $request);
67116
}
68-
69-
/**
70-
* Handle a TOTP implementation page.
71-
*
72-
* @param \Illuminate\Http\Request $request
73-
* @return \Illuminate\Http\RedirectResponse|\Illuminate\View\View
74-
*/
75-
public function totp(Request $request)
76-
{
77-
$token = $request->session()->get('authentication_token');
78-
if (is_null($token) || $this->auth->guard()->user()) {
79-
return redirect()->route('auth.login');
80-
}
81-
82-
return view('auth.totp', ['verify_key' => $token]);
83-
}
84-
85-
/**
86-
* Handle a login where the user is required to provide a TOTP authentication
87-
* token.
88-
*
89-
* @param \Illuminate\Http\Request $request
90-
* @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\Response
91-
*
92-
* @throws \PragmaRX\Google2FA\Exceptions\IncompatibleWithGoogleAuthenticatorException
93-
* @throws \PragmaRX\Google2FA\Exceptions\InvalidCharactersException
94-
* @throws \PragmaRX\Google2FA\Exceptions\SecretKeyTooShortException
95-
* @throws \Pterodactyl\Exceptions\DisplayException
96-
*/
97-
public function loginUsingTotp(Request $request)
98-
{
99-
if (is_null($request->input('verify_token'))) {
100-
return $this->sendFailedLoginResponse($request);
101-
}
102-
103-
try {
104-
$cache = $this->cache->pull($request->input('verify_token'), []);
105-
$user = $this->repository->find(array_get($cache, 'user_id', 0));
106-
} catch (RecordNotFoundException $exception) {
107-
return $this->sendFailedLoginResponse($request);
108-
}
109-
110-
if (is_null($request->input('2fa_token'))) {
111-
return $this->sendFailedLoginResponse($request, $user);
112-
}
113-
114-
if (! $this->google2FA->verifyKey(
115-
$this->encrypter->decrypt($user->totp_secret),
116-
$request->input('2fa_token'),
117-
$this->config->get('pterodactyl.auth.2fa.window')
118-
)) {
119-
return $this->sendFailedLoginResponse($request, $user);
120-
}
121-
122-
// If the user is using 2FA we do not actually log them in at this step, we return
123-
// a one-time token to link the 2FA credentials to this account via the UI.
124-
if ($user->use_totp) {
125-
$token = str_random(128);
126-
$this->cache->put($token, [
127-
'user_id' => $user->id,
128-
'request_ip' => $request->ip(),
129-
], 5);
130-
131-
return response()->json([
132-
'complete' => false,
133-
'login_token' => $token,
134-
]);
135-
}
136-
137-
return $this->sendLoginResponse($user, $request);
138-
}
139117
}

0 commit comments

Comments
 (0)