golem15/sm-user-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: activate-by-code asks the login gates before it signs in

Browse Source 
After the mailed code verifies, ActivateByCode consults the login gates
with source password, as Login does. A gate answer (for example a
second-factor challenge) replaces the token response and sets no session
cookie; a gate error answers the opaque 500. The account is activated
either way. Without a gate, or when every gate allows, the answer is
unchanged. With require_activation off an account can enable a second
factor before it activates, so the mailed code no longer stands in for it.
This commit is contained in:
Jakub Zych
2026-11-05 17:54:21 +01:00
parent 97f83cc2cf
commit b179e6b2e5
5 changed files with 181 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
controllers/login_gates.go
View File

@@ -12,8 +12,9 @@ import (
// nil allows the sign-in, a result replaces the token response, and an error
// must fail the sign-in closed (answer the opaque 500, issue no token). It
// looks the registry up on every call and allows the sign-in when none is
// published. Password Login calls it; a social-login plugin calls it before
// it issues a token.
// published. Password Login calls it, activate-by-code calls it after the
// mailed code verified (source password), and a social-login plugin calls
// it before it issues a token.
func CheckLoginGates(ctx context.Context, app *backpack.App, a classes.LoginAttempt) (*classes.LoginGateResult, error) {
if app == nil {
return nil, nil