dex/user/email/email.go

185 lines
5.5 KiB
Go
Raw Normal View History

2015-08-18 05:57:27 +05:30
package email
import (
"net/url"
"time"
"github.com/coreos/go-oidc/jose"
"github.com/coreos/dex/email"
"github.com/coreos/dex/pkg/log"
"github.com/coreos/dex/user"
)
// UserEmailer provides functions for sending emails to Users.
type UserEmailer struct {
ur user.UserRepo
pwi user.PasswordInfoRepo
signerFn signerFunc
tokenValidityWindow time.Duration
issuerURL url.URL
emailer *email.TemplatizedEmailer
fromAddress string
passwordResetURL url.URL
verifyEmailURL url.URL
}
// NewUserEmailer creates a new UserEmailer.
func NewUserEmailer(ur user.UserRepo,
pwi user.PasswordInfoRepo,
signerFn signerFunc,
tokenValidityWindow time.Duration,
issuerURL url.URL,
emailer *email.TemplatizedEmailer,
fromAddress string,
passwordResetURL url.URL,
verifyEmailURL url.URL,
) *UserEmailer {
return &UserEmailer{
ur: ur,
pwi: pwi,
signerFn: signerFn,
tokenValidityWindow: tokenValidityWindow,
issuerURL: issuerURL,
emailer: emailer,
fromAddress: fromAddress,
passwordResetURL: passwordResetURL,
verifyEmailURL: verifyEmailURL,
}
}
// SendResetPasswordEmail sends a password reset email to the user specified by the email addresss, containing a link with a signed token which can be visitied to initiate the password change/reset process.
// This method DOES NOT check for client ID, redirect URL validity - it is expected that upstream users have already done so.
// If there is no emailer is configured, the URL of the aforementioned link is returned, otherwise nil is returned.
func (u *UserEmailer) SendResetPasswordEmail(email string, redirectURL url.URL, clientID string) (*url.URL, error) {
return u.sendResetPasswordOrInviteEmail(email, redirectURL, clientID, false)
}
// SendInviteEmail is exactly the same as SendResetPasswordEmail, except that it uses the invite template and subject name.
// In the near future, invite emails might diverge further.
func (u *UserEmailer) SendInviteEmail(email string, redirectURL url.URL, clientID string) (*url.URL, error) {
return u.sendResetPasswordOrInviteEmail(email, redirectURL, clientID, true)
}
func (u *UserEmailer) sendResetPasswordOrInviteEmail(email string, redirectURL url.URL, clientID string, invite bool) (*url.URL, error) {
2015-08-18 05:57:27 +05:30
usr, err := u.ur.GetByEmail(nil, email)
if err == user.ErrorNotFound {
log.Errorf("No Such user for email: %q", email)
return nil, err
}
if err != nil {
log.Errorf("Error getting user: %q", err)
return nil, err
}
pwi, err := u.pwi.Get(nil, usr.ID)
if err == user.ErrorNotFound {
// TODO(bobbyrullo): In this case, maybe send a different email explaining that
// they don't have a local password.
log.Errorf("No Password for userID: %q", usr.ID)
return nil, err
}
if err != nil {
log.Errorf("Error getting password: %q", err)
return nil, err
}
signer, err := u.signerFn()
if err != nil || signer == nil {
log.Errorf("error getting signer: %v (%v)", err, signer)
2015-08-18 05:57:27 +05:30
return nil, err
}
passwordReset := user.NewPasswordReset(usr, pwi.Password, u.issuerURL,
clientID, redirectURL, u.tokenValidityWindow)
jwt, err := jose.NewSignedJWT(passwordReset.Claims, signer)
2015-08-18 05:57:27 +05:30
if err != nil {
log.Errorf("error constructing or signing PasswordReset JWT: %v", err)
2015-08-18 05:57:27 +05:30
return nil, err
}
token := jwt.Encode()
2015-08-18 05:57:27 +05:30
resetURL := u.passwordResetURL
q := resetURL.Query()
q.Set("token", token)
resetURL.RawQuery = q.Encode()
var tmplName, subj string
if invite {
tmplName = "invite"
subj = "Activate Your Account"
} else {
tmplName = "password-reset"
subj = "Reset Your Password"
}
2015-08-18 05:57:27 +05:30
if u.emailer != nil {
err = u.emailer.SendMail(u.fromAddress, subj, tmplName,
2015-08-18 05:57:27 +05:30
map[string]interface{}{
"email": usr.Email,
"link": resetURL.String(),
}, usr.Email)
if err != nil {
log.Errorf("error sending password reset email %v: ", err)
}
return nil, err
}
return &resetURL, nil
2015-08-18 05:57:27 +05:30
}
// SendEmailVerification sends an email to the user with the given userID containing a link which when visited marks the user as having had their email verified.
// If there is no emailer is configured, the URL of the aforementioned link is returned, otherwise nil is returned.
func (u *UserEmailer) SendEmailVerification(userID, clientID string, redirectURL url.URL) (*url.URL, error) {
usr, err := u.ur.Get(nil, userID)
if err == user.ErrorNotFound {
log.Errorf("No Such user for ID: %q", userID)
return nil, err
}
if err != nil {
log.Errorf("Error getting user: %q", err)
return nil, err
}
ev := user.NewEmailVerification(usr, clientID, u.issuerURL, redirectURL, u.tokenValidityWindow)
signer, err := u.signerFn()
if err != nil || signer == nil {
log.Errorf("error getting signer: %v (signer: %v)", err, signer)
2015-08-18 05:57:27 +05:30
return nil, err
}
jwt, err := jose.NewSignedJWT(ev.Claims, signer)
2015-08-18 05:57:27 +05:30
if err != nil {
log.Errorf("error constructing or signing EmailVerification JWT: %v", err)
2015-08-18 05:57:27 +05:30
return nil, err
}
token := jwt.Encode()
2015-08-18 05:57:27 +05:30
verifyURL := u.verifyEmailURL
q := verifyURL.Query()
q.Set("token", token)
verifyURL.RawQuery = q.Encode()
if u.emailer != nil {
err = u.emailer.SendMail(u.fromAddress, "Please verify your email address.", "verify-email",
map[string]interface{}{
"email": usr.Email,
"link": verifyURL.String(),
}, usr.Email)
if err != nil {
log.Errorf("error sending email verification email %v: ", err)
}
return nil, err
}
return &verifyURL, nil
}
func (u *UserEmailer) SetEmailer(emailer *email.TemplatizedEmailer) {
u.emailer = emailer
}
type signerFunc func() (jose.Signer, error)