auth: add basic authentication filter framework

This leverages the new lua support. See
filters/simple-authentication.lua for explaination of how this works.
There is also additional documentation in cgitrc.5.txt.

Though this is a cookie-based approach, cgit's caching mechanism is
preserved for authenticated pages.

Very plugable and extendable depending on user needs.

The sample script uses an HMAC-SHA1 based cookie to store the
currently logged in user, with an expiration date.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

1 files changed, 16 insertions, 12 deletions

diff --git a/ui-shared.c b/ui-shared.c
index abe15cd..4f47c50 100644
--- a/ui-shared.c
+++ b/ui-shared.c
@@ -641,6 +641,8 @@ void cgit_print_http_headers(struct cgit_context *ctx)
         if (ctx->page.filename)
                 htmlf("Content-Disposition: inline; filename=\"%s\"\n",
                       ctx->page.filename);
+        if (!ctx->env.authenticated)
+                html("Cache-Control: no-cache, no-store\n");
         htmlf("Last-Modified: %s\n", http_date(ctx->page.modified));
         htmlf("Expires: %s\n", http_date(ctx->page.expires));
         if (ctx->page.etag)
@@ -814,14 +816,16 @@ static void print_header(struct cgit_context *ctx)
                 cgit_index_link("index", NULL, NULL, NULL, NULL, 0);
                 html(" : ");
                 cgit_summary_link(ctx->repo->name, ctx->repo->name, NULL, NULL);
-                html("</td><td class='form'>");
-                html("<form method='get' action=''>\n");
-                cgit_add_hidden_formfields(0, 1, ctx->qry.page);
-                html("<select name='h' onchange='this.form.submit();'>\n");
-                for_each_branch_ref(print_branch_option, ctx->qry.head);
-                html("</select> ");
-                html("<input type='submit' name='' value='switch'/>");
-                html("</form>");
+                if (ctx->env.authenticated) {
+                        html("</td><td class='form'>");
+                        html("<form method='get' action=''>\n");
+                        cgit_add_hidden_formfields(0, 1, ctx->qry.page);
+                        html("<select name='h' onchange='this.form.submit();'>\n");
+                        for_each_branch_ref(print_branch_option, ctx->qry.head);
+                        html("</select> ");
+                        html("<input type='submit' name='' value='switch'/>");
+                        html("</form>");
+                }
         } else
                 html_txt(ctx->cfg.root_title);
         html("</td></tr>\n");
@@ -843,11 +847,11 @@ static void print_header(struct cgit_context *ctx)
 void cgit_print_pageheader(struct cgit_context *ctx)
 {
         html("<div id='cgit'>");
-        if (!ctx->cfg.noheader)
+        if (!ctx->env.authenticated || !ctx->cfg.noheader)
                 print_header(ctx);
 
         html("<table class='tabs'><tr><td>\n");
-        if (ctx->repo) {
+        if (ctx->env.authenticated && ctx->repo) {
                 cgit_summary_link("summary", NULL, hc(ctx, "summary"),
                                   ctx->qry.head);
                 cgit_refs_link("refs", NULL, hc(ctx, "refs"), ctx->qry.head,
@@ -886,7 +890,7 @@ void cgit_print_pageheader(struct cgit_context *ctx)
                 html("'/>\n");
                 html("<input type='submit' value='search'/>\n");
                 html("</form>\n");
-        } else {
+        } else if (ctx->env.authenticated) {
                 site_link(NULL, "index", NULL, hc(ctx, "repolist"), NULL, NULL, 0);
                 if (ctx->cfg.root_readme)
                         site_link("about", "about", NULL, hc(ctx, "about"),
@@ -902,7 +906,7 @@ void cgit_print_pageheader(struct cgit_context *ctx)
                 html("</form>");
         }
         html("</td></tr></table>\n");
-        if (ctx->qry.vpath) {
+        if (ctx->env.authenticated && ctx->qry.vpath) {
                 html("<div class='path'>");
                 html("path: ");
                 cgit_print_path_crumbs(ctx, ctx->qry.vpath);