mirror of
https://github.com/mjl-/mox.git
synced 2025-06-28 08:58:16 +03:00
2d3d726f05
to facilitate migrations from/to other mail setups. a domain can be added in "disabled" mode (or can be disabled/enabled later on). you can configure a disabled domain, but incoming/outgoing messages involving the domain are rejected with temporary error codes (as this may occur during a migration, remote servers will try again, hopefully to the correct machine or after this machine has been configured correctly). also, no acme tls certs will be requested for disabled domains (the autoconfig/mta-sts dns records may still point to the current/previous machine). accounts with addresses at disabled domains can still login, unless logins are disabled for their accounts. an account now has an option to disable logins. you can specify an error message to show. this will be shown in smtp, imap and the web interfaces. it could contain a message about migrations, and possibly a URL to a page with information about how to migrate. incoming/outgoing email involving accounts with login disabled are still accepted/delivered as normal (unless the domain involved in the messages is disabled too). account operations by the admin, such as importing/exporting messages still works. in the admin web interface, listings of domains/accounts show if they are disabled. domains & accounts can be enabled/disabled through the config file, cli commands and admin web interface. for issue #175 by RobSlgm
48 lines
1.7 KiB
Go
48 lines
1.7 KiB
Go
package webauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"github.com/mjl-/mox/mlog"
|
|
"github.com/mjl-/mox/store"
|
|
)
|
|
|
|
// AccountAuth is for user accounts, with username/password, and sessions stored in
|
|
// memory and in the database with lifetimes that are automatically extended.
|
|
var Accounts SessionAuth = accountSessionAuth{}
|
|
|
|
type accountSessionAuth struct{}
|
|
|
|
func (accountSessionAuth) login(ctx context.Context, log mlog.Log, username, password string) (valid, disabled bool, accName string, rerr error) {
|
|
acc, err := store.OpenEmailAuth(log, username, password, true)
|
|
if err != nil && errors.Is(err, store.ErrUnknownCredentials) {
|
|
return false, false, "", nil
|
|
} else if err != nil && errors.Is(err, store.ErrLoginDisabled) {
|
|
return false, true, "", err // Returning error, for its message.
|
|
} else if err != nil {
|
|
return false, false, "", err
|
|
}
|
|
defer func() {
|
|
err := acc.Close()
|
|
log.Check(err, "closing account")
|
|
}()
|
|
return true, false, acc.Name, nil
|
|
}
|
|
|
|
func (accountSessionAuth) add(ctx context.Context, log mlog.Log, accountName string, loginAddress string) (sessionToken store.SessionToken, csrfToken store.CSRFToken, rerr error) {
|
|
return store.SessionAdd(ctx, log, accountName, loginAddress)
|
|
}
|
|
|
|
func (accountSessionAuth) use(ctx context.Context, log mlog.Log, accountName string, sessionToken store.SessionToken, csrfToken store.CSRFToken) (loginAddress string, rerr error) {
|
|
ls, err := store.SessionUse(ctx, log, accountName, sessionToken, csrfToken)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return ls.LoginAddress, nil
|
|
}
|
|
|
|
func (accountSessionAuth) remove(ctx context.Context, log mlog.Log, accountName string, sessionToken store.SessionToken) error {
|
|
return store.SessionRemove(ctx, log, accountName, sessionToken)
|
|
}
|