b179e6b2e5
After the mailed code verifies, ActivateByCode consults the login gates with source password, as Login does. A gate answer (for example a second-factor challenge) replaces the token response and sets no session cookie; a gate error answers the opaque 500. The account is activated either way. Without a gate, or when every gate allows, the answer is unchanged. With require_activation off an account can enable a second factor before it activates, so the mailed code no longer stands in for it.
28 lines
988 B
Go
28 lines
988 B
Go
package controllers
|
|
|
|
import (
|
|
"context"
|
|
|
|
"git.golem15.com/golem15/sm-user-plugin/classes"
|
|
"git.golem15.com/golem15/summercms/modules/backpack"
|
|
)
|
|
|
|
// CheckLoginGates consults the published *classes.LoginGates for a
|
|
// first-factor sign-in that already succeeded and returns its answer: nil,
|
|
// nil allows the sign-in, a result replaces the token response, and an error
|
|
// must fail the sign-in closed (answer the opaque 500, issue no token). It
|
|
// looks the registry up on every call and allows the sign-in when none is
|
|
// published. Password Login calls it, activate-by-code calls it after the
|
|
// mailed code verified (source password), and a social-login plugin calls
|
|
// it before it issues a token.
|
|
func CheckLoginGates(ctx context.Context, app *backpack.App, a classes.LoginAttempt) (*classes.LoginGateResult, error) {
|
|
if app == nil {
|
|
return nil, nil
|
|
}
|
|
gates, ok := app.Lookup[*classes.LoginGates]()
|
|
if !ok || gates == nil {
|
|
return nil, nil
|
|
}
|
|
return gates.Check(ctx, a)
|
|
}
|