forked from alterminal/alterminal
fixup
This commit is contained in:
@@ -21,14 +21,21 @@ var (
|
||||
// 第一個（根）模板，頁面模板僅定義 title/content 等區塊覆寫之，
|
||||
// 故 Execute 仍輸出版面本身。註冊頁與管理列表頁另解析 secretpanel.html
|
||||
// 的一次性成果面板；編輯頁無一次性面板，不在解析之列。
|
||||
loggedInTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/loggedin.html"))
|
||||
loggedInTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/loggedin.html"))
|
||||
// 更新密碼頁（登入者自助變更）以 layout 組合，密碼欄位不預填、
|
||||
// 無一次性面板。
|
||||
passwordTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/password.html"))
|
||||
AdminKeysTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/adminkeys.html"))
|
||||
AdminApplicationsTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/adminapplications.html", "templates/secretpanel.html"))
|
||||
AdminApplicationNewTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/adminapplicationnew.html", "templates/secretpanel.html"))
|
||||
AdminApplicationEditTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/adminapplicationedit.html"))
|
||||
// 授權同意頁供 oidc 套件的 /authorize 使用，與管理頁同以 layout 組合。
|
||||
ConsentTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/consent.html"))
|
||||
notFoundTmpl = template.Must(template.ParseFS(templateFS, "templates/notfound.html"))
|
||||
ConsentTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/consent.html"))
|
||||
// 登出確認頁（layout 組合）與已登出頁（獨立頁，使用者已無 Session
|
||||
// 脈絡）供 oidc 套件的 /logout（RP-Initiated Logout）使用。
|
||||
LogoutConfirmTmpl = template.Must(template.ParseFS(templateFS, "templates/layout.html", "templates/logoutconfirm.html"))
|
||||
LoggedOutTmpl = template.Must(template.ParseFS(templateFS, "templates/loggedout.html"))
|
||||
notFoundTmpl = template.Must(template.ParseFS(templateFS, "templates/notfound.html"))
|
||||
)
|
||||
|
||||
// CSRFCookieName 為登入表單 double-submit CSRF 防護的 Cookie 名稱:
|
||||
|
||||
+14
-6
@@ -37,12 +37,7 @@ func LogoutHandler(db *gorm.DB) http.HandlerFunc {
|
||||
}
|
||||
}
|
||||
|
||||
if c, err := r.Cookie(CookieName); err == nil {
|
||||
if err := DeleteSession(db, c.Value); err != nil {
|
||||
log.Printf("logout: %v", err)
|
||||
}
|
||||
}
|
||||
clearSessionCookie(w, r)
|
||||
ClearSession(db, w, r)
|
||||
|
||||
if isForm {
|
||||
// PRG：以 303 導向 /login 顯示登入表單，避免重新整理重複送出。
|
||||
@@ -53,6 +48,19 @@ func LogoutHandler(db *gorm.DB) http.HandlerFunc {
|
||||
}
|
||||
}
|
||||
|
||||
// ClearSession 刪除資料庫中的 Session 並清除瀏覽器 Cookie，冪等——查無
|
||||
// Session 亦清除 Cookie；資料庫刪除失敗僅記錄不中斷（Session 最遲於效期
|
||||
// 到期失效）。供 LogoutHandler 與 oidc 套件的 RP-Initiated Logout 端點
|
||||
// 共用同一套清理邏輯。
|
||||
func ClearSession(db *gorm.DB, w http.ResponseWriter, r *http.Request) {
|
||||
if c, err := r.Cookie(CookieName); err == nil {
|
||||
if err := DeleteSession(db, c.Value); err != nil {
|
||||
log.Printf("logout: %v", err)
|
||||
}
|
||||
}
|
||||
clearSessionCookie(w, r)
|
||||
}
|
||||
|
||||
// clearSessionCookie 以 Max-Age=0 清除瀏覽器的 Session Cookie（與
|
||||
// setSessionCookie 對稱，屬性一致以免因 Path 或 Secure 差異清不掉）。
|
||||
func clearSessionCookie(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
@@ -0,0 +1,237 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// MinPasswordLen 為密碼最小長度，網頁更新流程與 CLI 帳號作業共用。
|
||||
const MinPasswordLen = 8
|
||||
|
||||
// passwordPageData 為更新密碼頁的模板資料。
|
||||
type passwordPageData struct {
|
||||
Error string // 驗證失敗訊息;空字串表示不顯示
|
||||
Success string // PRG 成功訊息(?saved=1);空字串表示不顯示
|
||||
Username string // 側欄頁尾使用者資訊
|
||||
Email string
|
||||
IsAdmin bool // admin 另顯示管理頁導覽連結
|
||||
CSRF string // 表單隱藏欄位用 CSRF token,與 Cookie 成對輪替
|
||||
}
|
||||
|
||||
// PasswordPageHandler 處理 GET /password(更新密碼頁):持有效 Session 顯示
|
||||
// 表單,未登入導向 /login?next=/password(登入後返回)。?saved=1 為 PRG
|
||||
// 的成功旗標,顯示成功訊息。
|
||||
func PasswordPageHandler(db *gorm.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
s, err := lookupSession(db, r)
|
||||
if err != nil {
|
||||
respondSessionError(w, r, err, true)
|
||||
return
|
||||
}
|
||||
var success string
|
||||
if r.URL.Query().Get("saved") == "1" {
|
||||
success = "密碼已更新，其他裝置的登入已全部登出。"
|
||||
}
|
||||
renderPasswordPage(w, r, http.StatusOK, s, "", success)
|
||||
}
|
||||
}
|
||||
|
||||
// PasswordChangeHandler 處理 POST /password,依 Content-Type 分流(與
|
||||
// 登入/登出一致):表單走瀏覽器流程(需通過 CSRF 驗證),JSON 走 API
|
||||
// 流程。驗證目前密碼後更新密碼,並於單一交易內撤銷該使用者所有
|
||||
// Session(與 CLI update-password 同一套交易邏輯),再為目前瀏覽器重建
|
||||
// Session(輪替 Session ID,避免 fixation)——其他裝置立即登出,目前
|
||||
// 瀏覽器保持登入。成功後表單流程以 303 導回 /password?saved=1(PRG)。
|
||||
func PasswordChangeHandler(db *gorm.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
ct := r.Header.Get("Content-Type")
|
||||
var isForm bool
|
||||
switch {
|
||||
case strings.HasPrefix(ct, "application/json"):
|
||||
case strings.HasPrefix(ct, "application/x-www-form-urlencoded"),
|
||||
strings.HasPrefix(ct, "multipart/form-data"):
|
||||
isForm = true
|
||||
default:
|
||||
WriteError(w, http.StatusUnsupportedMediaType, "Content-Type 須為 application/json 或表單")
|
||||
return
|
||||
}
|
||||
|
||||
s, err := lookupSession(db, r)
|
||||
if err != nil {
|
||||
respondSessionError(w, r, err, isForm)
|
||||
return
|
||||
}
|
||||
|
||||
r.Body = http.MaxBytesReader(w, r.Body, 64<<10)
|
||||
var in passwordRequest
|
||||
if isForm {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
renderPasswordPage(w, r, http.StatusBadRequest, s, "無法解析表單內容", "")
|
||||
return
|
||||
}
|
||||
if !VerifyCSRF(r) {
|
||||
renderPasswordPage(w, r, http.StatusForbidden, s, "表單驗證失敗，請重新整理頁面後再試", "")
|
||||
return
|
||||
}
|
||||
in = passwordRequest{
|
||||
CurrentPassword: r.PostFormValue("current_password"),
|
||||
NewPassword: r.PostFormValue("new_password"),
|
||||
Confirm: r.PostFormValue("confirm_password"),
|
||||
}
|
||||
} else if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
|
||||
WriteError(w, http.StatusBadRequest, "無法解析請求內容")
|
||||
return
|
||||
}
|
||||
|
||||
fail := func(status int, msg string) {
|
||||
if isForm {
|
||||
renderPasswordPage(w, r, status, s, msg, "")
|
||||
return
|
||||
}
|
||||
WriteError(w, status, msg)
|
||||
}
|
||||
if err := in.validate(isForm); err != nil {
|
||||
fail(http.StatusBadRequest, err.Error())
|
||||
return
|
||||
}
|
||||
if !s.User.CheckPassword(in.CurrentPassword) {
|
||||
fail(http.StatusUnauthorized, "目前的密碼錯誤")
|
||||
return
|
||||
}
|
||||
|
||||
if err := s.User.SetPassword(in.NewPassword); err != nil {
|
||||
log.Printf("password: %v", err)
|
||||
fail(http.StatusInternalServerError, "內部錯誤")
|
||||
return
|
||||
}
|
||||
if _, err := UpdateUserPassword(db, &s.User); err != nil {
|
||||
log.Printf("password: %v", err)
|
||||
fail(http.StatusInternalServerError, "內部錯誤")
|
||||
return
|
||||
}
|
||||
// 舊 Session 已隨交易撤銷,重建目前瀏覽器的 Session;失敗時密碼
|
||||
// 已更新,只能請使用者以新密碼重新登入。
|
||||
ns, err := CreateSession(db, s.User.ID)
|
||||
if err != nil {
|
||||
log.Printf("password: %v", err)
|
||||
clearSessionCookie(w, r)
|
||||
if isForm {
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
WriteError(w, http.StatusInternalServerError, "密碼已更新，請重新登入")
|
||||
return
|
||||
}
|
||||
setSessionCookie(w, r, ns)
|
||||
|
||||
if isForm {
|
||||
// PRG:以 303 導回本頁以 ?saved=1 顯示成功訊息,避免重新整理
|
||||
// 重複送出表單。
|
||||
http.Redirect(w, r, "/password?saved=1", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
}
|
||||
}
|
||||
|
||||
// passwordRequest 為 POST /password 的請求欄位(JSON 與表單共用);
|
||||
// 表單流程另以 Confirm 重複輸入新密碼,JSON 流程由呼叫端自行確認。
|
||||
type passwordRequest struct {
|
||||
CurrentPassword string `json:"current_password"`
|
||||
NewPassword string `json:"new_password"`
|
||||
Confirm string `json:"-"` // 僅表單流程的 confirm_password 欄位
|
||||
}
|
||||
|
||||
// validate 檢查欄位:目前與新密碼不可為空、新密碼長度須達最小值且不得
|
||||
// 與目前密碼相同;表單流程另檢查確認欄位與新密碼一致。
|
||||
func (in *passwordRequest) validate(isForm bool) error {
|
||||
if in.CurrentPassword == "" {
|
||||
return errors.New("目前的密碼不可為空")
|
||||
}
|
||||
if in.NewPassword == "" {
|
||||
return errors.New("新密碼不可為空")
|
||||
}
|
||||
if len(in.NewPassword) < MinPasswordLen {
|
||||
return fmt.Errorf("密碼長度至少 %d 字元", MinPasswordLen)
|
||||
}
|
||||
if isForm && in.Confirm != in.NewPassword {
|
||||
return errors.New("兩次輸入的新密碼不一致")
|
||||
}
|
||||
if in.NewPassword == in.CurrentPassword {
|
||||
return errors.New("新密碼不可與目前的密碼相同")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// UpdateUserPassword 於單一交易內寫入新密碼雜湊(須先 SetPassword)並
|
||||
// 刪除該使用者所有 Session,回傳撤銷的 Session 數;交易確保密碼與
|
||||
// Session 不會只更新一半。供網頁的更新密碼流程與 CLI update-password
|
||||
// 共用同一套邏輯。
|
||||
func UpdateUserPassword(db *gorm.DB, u *User) (int64, error) {
|
||||
var revoked int64
|
||||
err := db.Transaction(func(tx *gorm.DB) error {
|
||||
if err := tx.Model(u).Update("password_hash", u.PasswordHash).Error; err != nil {
|
||||
return fmt.Errorf("update password: %w", err)
|
||||
}
|
||||
res := tx.Where("user_id = ?", u.ID).Delete(&Session{})
|
||||
if res.Error != nil {
|
||||
return fmt.Errorf("delete sessions: %w", res.Error)
|
||||
}
|
||||
revoked = res.RowsAffected
|
||||
return nil
|
||||
})
|
||||
return revoked, err
|
||||
}
|
||||
|
||||
// lookupSession 由 Cookie 查詢效期內 Session(含使用者);未帶 Cookie
|
||||
// 與 Session 無效一併回 ErrSessionExpired,不洩漏差異。
|
||||
func lookupSession(db *gorm.DB, r *http.Request) (*Session, error) {
|
||||
c, err := r.Cookie(CookieName)
|
||||
if err != nil {
|
||||
return nil, ErrSessionExpired
|
||||
}
|
||||
return GetSession(db, c.Value)
|
||||
}
|
||||
|
||||
// respondSessionError 依流程處理 lookupSession 的錯誤:未登入在表單
|
||||
// 流程導向 /login?next=/password(登入後返回原頁),JSON 流程回 401;
|
||||
// 其餘錯誤記錄後回 500。
|
||||
func respondSessionError(w http.ResponseWriter, r *http.Request, err error, isForm bool) {
|
||||
switch {
|
||||
case errors.Is(err, ErrSessionExpired):
|
||||
if isForm {
|
||||
http.Redirect(w, r, "/login?next="+url.QueryEscape("/password"), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
WriteError(w, http.StatusUnauthorized, "須登入")
|
||||
default:
|
||||
log.Printf("password: %v", err)
|
||||
http.Error(w, "內部錯誤", http.StatusInternalServerError)
|
||||
}
|
||||
}
|
||||
|
||||
// renderPasswordPage 輸出更新密碼頁;每次輸出都輪替 CSRF token。密碼
|
||||
// 欄位一律不預填,驗證失敗重繪時也不保留輸入。
|
||||
func renderPasswordPage(w http.ResponseWriter, r *http.Request, status int, s *Session, errMsg, success string) {
|
||||
token, err := NewCSRFToken(w, r)
|
||||
if err != nil {
|
||||
log.Printf("csrf token: %v", err)
|
||||
http.Error(w, "內部錯誤", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
RenderHTML(w, status, passwordTmpl, passwordPageData{
|
||||
Error: errMsg,
|
||||
Success: success,
|
||||
Username: s.User.Username,
|
||||
Email: s.User.Email,
|
||||
IsAdmin: s.User.Role == RoleAdmin,
|
||||
CSRF: token,
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,357 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestPasswordRequestValidate(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
in passwordRequest
|
||||
isForm bool
|
||||
wantErr string // 空字串表示應通過
|
||||
}{
|
||||
{"最小欄位", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!"}, false, ""},
|
||||
{"表單確認欄位相符", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!", Confirm: "n3w-secret!"}, true, ""},
|
||||
{"缺目前密碼", passwordRequest{NewPassword: "n3w-secret!"}, false, "目前的密碼"},
|
||||
{"缺新密碼", passwordRequest{CurrentPassword: "sup3r-secret"}, false, "新密碼不可為空"},
|
||||
{"新密碼過短", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "short"}, false, "密碼長度至少"},
|
||||
{"表單確認欄位不一致", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!", Confirm: "other-pass"}, true, "兩次輸入的新密碼不一致"},
|
||||
{"JSON 流程不檢查確認欄位", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "n3w-secret!", Confirm: "other-pass"}, false, ""},
|
||||
{"新密碼與目前密碼相同", passwordRequest{CurrentPassword: "sup3r-secret", NewPassword: "sup3r-secret"}, false, "不可與目前的密碼相同"},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
err := tt.in.validate(tt.isForm)
|
||||
if tt.wantErr == "" {
|
||||
if err != nil {
|
||||
t.Fatalf("validate() = %v, want nil", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
|
||||
t.Fatalf("validate() = %v, want error containing %q", err, tt.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// 未帶 Session Cookie 的路徑不會查詢資料庫,可用 nil db 測試。
|
||||
func TestPasswordHandlersRequireSession(t *testing.T) {
|
||||
t.Run("GET 未登入導向 /login 並攜回 next", func(t *testing.T) {
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordPageHandler(nil)(rec, httptest.NewRequest(http.MethodGet, "/password", nil))
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("status = %d, want 303", rec.Code)
|
||||
}
|
||||
if loc := rec.Header().Get("Location"); loc != "/login?next=%2Fpassword" {
|
||||
t.Fatalf("Location = %q, want /login?next=%%2Fpassword", loc)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("POST 表單未登入導向 /login", func(t *testing.T) {
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(nil)(rec, formPost("csrf_token=token-A", nil))
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("status = %d, want 303", rec.Code)
|
||||
}
|
||||
if loc := rec.Header().Get("Location"); loc != "/login?next=%2Fpassword" {
|
||||
t.Fatalf("Location = %q, want /login?next=%%2Fpassword", loc)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("POST JSON 未登入回 401", func(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodPost, "/password", strings.NewReader(`{}`))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(nil)(rec, req)
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("status = %d, want 401", rec.Code)
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), `"error"`) {
|
||||
t.Fatalf("JSON 流程應回錯誤: %s", rec.Body.String())
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("不支援的 Content-Type 回 415", func(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodPost, "/password", strings.NewReader("x=1"))
|
||||
req.Header.Set("Content-Type", "text/plain")
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(nil)(rec, req)
|
||||
if rec.Code != http.StatusUnsupportedMediaType {
|
||||
t.Fatalf("status = %d, want 415", rec.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// renderPasswordPage 不查詢資料庫,可直接以虛構 Session 測試表單輸出。
|
||||
func TestRenderPasswordPage(t *testing.T) {
|
||||
rec := httptest.NewRecorder()
|
||||
s := &Session{
|
||||
ID: "test-session",
|
||||
User: User{Username: "alice", Email: "alice@example.com"},
|
||||
ExpiresAt: time.Now().Add(24 * time.Hour),
|
||||
}
|
||||
renderPasswordPage(rec, httptest.NewRequest(http.MethodGet, "/password", nil), http.StatusOK, s, "", "")
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200", rec.Code)
|
||||
}
|
||||
body := rec.Body.String()
|
||||
for _, want := range []string{
|
||||
`action="/password"`,
|
||||
`name="csrf_token"`,
|
||||
`name="current_password"`,
|
||||
`name="new_password"`,
|
||||
`name="confirm_password"`,
|
||||
`autocomplete="current-password"`,
|
||||
`autocomplete="new-password"`,
|
||||
`minlength="8"`,
|
||||
"<aside", // layout 側邊導覽欄
|
||||
} {
|
||||
if !strings.Contains(body, want) {
|
||||
t.Errorf("更新密碼頁缺少 %s", want)
|
||||
}
|
||||
}
|
||||
if !strings.Contains(rec.Header().Get("Set-Cookie"), CSRFCookieName) {
|
||||
t.Fatal("輸出表單時應設定 CSRF Cookie")
|
||||
}
|
||||
}
|
||||
|
||||
func TestPasswordChangeIntegration(t *testing.T) {
|
||||
db, err := openTestDB()
|
||||
if err != nil {
|
||||
t.Skipf("資料庫不可用，略過整合測試: %v", err)
|
||||
}
|
||||
suffix, err := NewToken(6)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
u := &User{Username: "pw-" + suffix, Email: "pw-" + suffix + "@example.com", Name: "Password Test"}
|
||||
if err := u.SetPassword("sup3r-secret"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := db.Create(u).Error; err != nil {
|
||||
t.Fatalf("create user: %v", err)
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
db.Delete(&Session{}, "user_id = ?", u.ID)
|
||||
db.Delete(&User{}, u.ID)
|
||||
})
|
||||
|
||||
passwordPost := func(form url.Values, sessionID, csrf string) *http.Request {
|
||||
req := formPost(form.Encode(), &http.Cookie{Name: CSRFCookieName, Value: csrf})
|
||||
if sessionID != "" {
|
||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionID})
|
||||
}
|
||||
return req
|
||||
}
|
||||
validForm := func() url.Values {
|
||||
return url.Values{
|
||||
"csrf_token": {"token-A"},
|
||||
"current_password": {"sup3r-secret"},
|
||||
"new_password": {"n3w-secret!"},
|
||||
"confirm_password": {"n3w-secret!"},
|
||||
}
|
||||
}
|
||||
// sessionCookieValue 從回應的 Set-Cookie 取出新的 Session ID。
|
||||
sessionCookieValue := func(rec *httptest.ResponseRecorder) string {
|
||||
for _, sc := range rec.Header().Values("Set-Cookie") {
|
||||
if strings.HasPrefix(sc, CookieName+"=") {
|
||||
return strings.SplitN(strings.SplitN(sc, ";", 2)[0], "=", 2)[1]
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
t.Run("已登入者 GET 顯示表單；帳號首頁含更新密碼連結", func(t *testing.T) {
|
||||
s, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
req := httptest.NewRequest(http.MethodGet, "/password", nil)
|
||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: s.ID})
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordPageHandler(db)(rec, req)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200", rec.Code)
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), `name="current_password"`) {
|
||||
t.Fatal("更新密碼表單缺少目前密碼欄位")
|
||||
}
|
||||
|
||||
home := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
home.AddCookie(&http.Cookie{Name: CookieName, Value: s.ID})
|
||||
homeRec := httptest.NewRecorder()
|
||||
AccountPageHandler(db)(homeRec, home)
|
||||
if !strings.Contains(homeRec.Body.String(), `href="/password"`) {
|
||||
t.Fatal("帳號首頁應含更新密碼連結")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("?saved=1 顯示成功訊息", func(t *testing.T) {
|
||||
s, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
req := httptest.NewRequest(http.MethodGet, "/password?saved=1", nil)
|
||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: s.ID})
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordPageHandler(db)(rec, req)
|
||||
if !strings.Contains(rec.Body.String(), "密碼已更新") {
|
||||
t.Fatal("應顯示成功訊息")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("CSRF 不符回 403 重繪表單", func(t *testing.T) {
|
||||
s, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(db)(rec, passwordPost(validForm(), s.ID, "token-B"))
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403, body = %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), "表單驗證失敗") {
|
||||
t.Fatal("應顯示 CSRF 錯誤訊息")
|
||||
}
|
||||
if _, err := GetSession(db, s.ID); err != nil {
|
||||
t.Fatalf("CSRF 失敗不應影響 Session: %v", err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("確認欄位不一致回 400 且不更新", func(t *testing.T) {
|
||||
s, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
form := validForm()
|
||||
form.Set("confirm_password", "other-pass")
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(db)(rec, passwordPost(form, s.ID, "token-A"))
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Fatalf("status = %d, want 400, body = %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), "兩次輸入的新密碼不一致") {
|
||||
t.Fatal("應顯示確認欄位錯誤訊息")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("目前密碼錯誤回 401 且不更新", func(t *testing.T) {
|
||||
s, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
form := validForm()
|
||||
form.Set("current_password", "wrong-secret")
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(db)(rec, passwordPost(form, s.ID, "token-A"))
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("status = %d, want 401, body = %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), "目前的密碼錯誤") {
|
||||
t.Fatal("應顯示目前密碼錯誤訊息")
|
||||
}
|
||||
var reloaded User
|
||||
if err := db.First(&reloaded, u.ID).Error; err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !reloaded.CheckPassword("sup3r-secret") {
|
||||
t.Fatal("密碼不應被更新")
|
||||
}
|
||||
if _, err := GetSession(db, s.ID); err != nil {
|
||||
t.Fatalf("Session 不應被撤銷: %v", err)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("表單成功：更新密碼、撤銷全部 Session、輪替目前 Session", func(t *testing.T) {
|
||||
current, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
other, err := CreateSession(db, u.ID) // 模擬其他裝置的登入
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(db)(rec, passwordPost(validForm(), current.ID, "token-A"))
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("status = %d, want 303, body = %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if loc := rec.Header().Get("Location"); loc != "/password?saved=1" {
|
||||
t.Fatalf("Location = %q, want /password?saved=1", loc)
|
||||
}
|
||||
|
||||
for _, old := range []string{current.ID, other.ID} {
|
||||
if _, err := GetSession(db, old); !errors.Is(err, ErrSessionExpired) {
|
||||
t.Fatalf("更新後舊 Session %q 應被撤銷, got %v", old, err)
|
||||
}
|
||||
}
|
||||
newID := sessionCookieValue(rec)
|
||||
if newID == "" || newID == current.ID {
|
||||
t.Fatalf("應下發輪替後的新 Session Cookie, got %q", newID)
|
||||
}
|
||||
ns, err := GetSession(db, newID)
|
||||
if err != nil {
|
||||
t.Fatalf("輪替後的 Session 應有效: %v", err)
|
||||
}
|
||||
if ns.UserID != u.ID {
|
||||
t.Fatalf("輪替後 Session 的 UserID = %d, want %d", ns.UserID, u.ID)
|
||||
}
|
||||
|
||||
var reloaded User
|
||||
if err := db.First(&reloaded, u.ID).Error; err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if reloaded.CheckPassword("sup3r-secret") {
|
||||
t.Fatal("舊密碼不應再通過驗證")
|
||||
}
|
||||
if !reloaded.CheckPassword("n3w-secret!") {
|
||||
t.Fatal("新密碼應可通過驗證")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("JSON 成功回 204；目前密碼錯誤回 401", func(t *testing.T) {
|
||||
s, err := CreateSession(db, u.ID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
jsonPost := func(sessionID, body string) *http.Request {
|
||||
req := httptest.NewRequest(http.MethodPost, "/password", strings.NewReader(body))
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionID})
|
||||
return req
|
||||
}
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
PasswordChangeHandler(db)(rec, jsonPost(s.ID, `{"current_password":"wrong-secret","new_password":"f1nal-secret!"}`))
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("status = %d, want 401, body = %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
|
||||
rec = httptest.NewRecorder()
|
||||
PasswordChangeHandler(db)(rec, jsonPost(s.ID, `{"current_password":"n3w-secret!","new_password":"f1nal-secret!"}`))
|
||||
if rec.Code != http.StatusNoContent {
|
||||
t.Fatalf("status = %d, want 204, body = %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if _, err := GetSession(db, s.ID); !errors.Is(err, ErrSessionExpired) {
|
||||
t.Fatal("JSON 流程亦應撤銷舊 Session")
|
||||
}
|
||||
if newID := sessionCookieValue(rec); newID == "" {
|
||||
t.Fatal("JSON 流程亦應下發輪替後的 Session Cookie")
|
||||
}
|
||||
var reloaded User
|
||||
if err := db.First(&reloaded, u.ID).Error; err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !reloaded.CheckPassword("f1nal-secret!") {
|
||||
t.Fatal("新密碼應可通過驗證")
|
||||
}
|
||||
})
|
||||
}
|
||||
@@ -88,6 +88,12 @@
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">{{.Form.RedirectURIs}}</textarea>
|
||||
<p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">須為絕對 URI；http 僅允許 localhost／127.0.0.1／::1，其餘請使用 https；原生應用可用自訂 scheme（如 com.example.app:/cb）。</p>
|
||||
</div>
|
||||
<div>
|
||||
<label for="app-post-logout-uris" class="mb-1 block text-sm font-medium">登出後返回 URI（每行一個，選填）</label>
|
||||
<textarea id="app-post-logout-uris" name="post_logout_redirect_uris" rows="2"
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">{{.Form.PostLogoutRedirectURIs}}</textarea>
|
||||
<p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">RP-Initiated Logout 的 post_logout_redirect_uri 白名單（精確比對，格式規則同 redirect URI）；留空表示不接受登出後重導回應用程式。</p>
|
||||
</div>
|
||||
<fieldset>
|
||||
<legend class="mb-1 text-sm font-medium">允許的 grant type</legend>
|
||||
<div class="space-y-1.5 text-sm">
|
||||
|
||||
@@ -75,6 +75,12 @@
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">{{.Form.RedirectURIs}}</textarea>
|
||||
<p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">須為絕對 URI；http 僅允許 localhost／127.0.0.1／::1，其餘請使用 https；原生應用可用自訂 scheme（如 com.example.app:/cb）。</p>
|
||||
</div>
|
||||
<div>
|
||||
<label for="app-post-logout-uris" class="mb-1 block text-sm font-medium">登出後返回 URI（每行一個，選填）</label>
|
||||
<textarea id="app-post-logout-uris" name="post_logout_redirect_uris" rows="2"
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">{{.Form.PostLogoutRedirectURIs}}</textarea>
|
||||
<p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">RP-Initiated Logout 的 post_logout_redirect_uri 白名單（精確比對，格式規則同 redirect URI）；留空表示不接受登出後重導回應用程式。</p>
|
||||
</div>
|
||||
<fieldset>
|
||||
<legend class="mb-1 text-sm font-medium">允許的 grant type</legend>
|
||||
<div class="space-y-1.5 text-sm">
|
||||
|
||||
@@ -64,6 +64,7 @@
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">client_id</th>
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">類型</th>
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">redirect URI</th>
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">登出後返回 URI</th>
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">grant type</th>
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">scope</th>
|
||||
<th scope="col" class="px-3 py-2 text-xs font-medium tracking-wide text-neutral-500 uppercase dark:text-neutral-400">建立時間</th>
|
||||
@@ -83,6 +84,7 @@
|
||||
{{end}}
|
||||
</td>
|
||||
<td class="px-3 py-3 font-mono text-xs break-all whitespace-pre-line">{{.RedirectURIs}}</td>
|
||||
<td class="px-3 py-3 font-mono text-xs break-all whitespace-pre-line">{{if .PostLogoutRedirectURIs}}{{.PostLogoutRedirectURIs}}{{else}}<span class="font-sans text-neutral-400 dark:text-neutral-500">—</span>{{end}}</td>
|
||||
<td class="px-3 py-3 text-xs">{{.GrantTypes}}</td>
|
||||
<td class="px-3 py-3 font-mono text-xs break-all">{{.Scope}}</td>
|
||||
<td class="px-3 py-3 whitespace-nowrap text-neutral-500 dark:text-neutral-400">{{.CreatedAt}}</td>
|
||||
|
||||
@@ -17,6 +17,15 @@
|
||||
<dt class="text-sm text-neutral-500 dark:text-neutral-400">Session 到期</dt>
|
||||
<dd class="mt-0.5 mb-3.5 text-[15px] break-all">{{.ExpiresAt}}</dd>
|
||||
</dl>
|
||||
<div class="mt-6 flex flex-wrap gap-3">
|
||||
<a href="/password"
|
||||
class="flex items-center gap-2 rounded-lg border border-neutral-300 px-4 py-2.5 text-sm font-semibold hover:bg-neutral-100 dark:border-neutral-600 dark:hover:bg-neutral-700">
|
||||
<svg class="size-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25Z"/>
|
||||
</svg>
|
||||
更新密碼
|
||||
</a>
|
||||
</div>
|
||||
<p class="mt-4 text-sm text-neutral-500 dark:text-neutral-400">授權流程（/authorize）完成後，登入將自動導回應用程式。</p>
|
||||
</section>
|
||||
{{end}}
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="zh-Hant">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="referrer" content="no-referrer">
|
||||
<title>已登出 - alterminal</title>
|
||||
<link rel="stylesheet" href="/static/css/main.css">
|
||||
</head>
|
||||
<body class="flex min-h-screen items-center justify-center bg-neutral-100 font-sans text-neutral-900 antialiased dark:bg-neutral-900 dark:text-neutral-100">
|
||||
<main class="m-4 w-full max-w-88 rounded-xl bg-white p-8 shadow-lg dark:bg-neutral-800 dark:shadow-black/40">
|
||||
<h1 class="mb-1 text-xl font-semibold">您已登出</h1>
|
||||
<p class="mb-6 text-sm text-neutral-500 dark:text-neutral-400">單一登入服務</p>
|
||||
{{if .Warning}}<p class="mb-4 rounded-lg bg-amber-500/10 px-3 py-2.5 text-sm text-amber-700 dark:text-amber-400" role="alert">{{.Warning}}</p>{{end}}
|
||||
<a href="/login"
|
||||
class="block w-full rounded-lg border border-neutral-300 py-2.5 text-center text-base font-semibold hover:bg-neutral-100 dark:border-neutral-600 dark:hover:bg-neutral-700">重新登入</a>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,28 @@
|
||||
{{/* 登出確認頁（GET /logout）。以 layout.html（側邊導覽欄版面）為根模板
|
||||
組合渲染，本檔僅定義區塊。RP-Initiated Logout 1.0 §2：未提供
|
||||
id_token_hint、或提示的 ID token 不屬於目前 Session 時，OP 必須先
|
||||
詢問 End-User 是否登出——使用者直接造訪 /logout 亦同。原始請求的
|
||||
每個參數以隱藏欄位原封帶回 POST /logout（decision=logout 確認登出；
|
||||
decision=cancel 維持登入並返回帳號首頁）。 */}}
|
||||
{{define "title"}}登出確認 - alterminal{{end}}
|
||||
|
||||
{{define "content"}}
|
||||
<section class="rounded-xl bg-white p-8 shadow-lg dark:bg-neutral-800 dark:shadow-black/40">
|
||||
<h1 class="mb-1 text-xl font-semibold">您確定要登出嗎？</h1>
|
||||
<p class="mb-6 text-sm text-neutral-500 dark:text-neutral-400">
|
||||
{{if .AppName}}應用程式 <strong class="text-neutral-900 dark:text-neutral-100">{{.AppName}}</strong> 要求登出您在本服務的帳號。{{else}}登出將結束您在本服務的 Session。{{end}}
|
||||
</p>
|
||||
{{if .Error}}<p class="mb-4 rounded-lg bg-red-500/10 px-3 py-2.5 text-sm text-red-600 dark:text-red-400" role="alert">{{.Error}}</p>{{end}}
|
||||
<form method="post" action="/logout">
|
||||
{{range $k, $vs := .Params}}{{range $vs}}<input type="hidden" name="{{$k}}" value="{{.}}">{{end}}{{end}}
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<div class="flex flex-col gap-3 sm:flex-row">
|
||||
<button type="submit" name="decision" value="logout"
|
||||
class="rounded-lg bg-brand px-5 py-2.5 text-sm font-semibold text-white hover:bg-brand-strong">登出</button>
|
||||
<button type="submit" name="decision" value="cancel"
|
||||
class="rounded-lg border border-neutral-300 px-5 py-2.5 text-sm font-semibold hover:bg-neutral-100 dark:border-neutral-600 dark:hover:bg-neutral-700">取消</button>
|
||||
</div>
|
||||
</form>
|
||||
<p class="mt-4 text-xs text-neutral-400 dark:text-neutral-500">登出後，所有以本帳號單一登入的應用程式都需要重新登入。</p>
|
||||
</section>
|
||||
{{end}}
|
||||
@@ -0,0 +1,69 @@
|
||||
{{/* 更新密碼頁（登入者自助變更，GET/POST /password）。以 layout.html
|
||||
（側邊導覽欄版面）為根模板組合渲染，本檔僅定義區塊，不應單獨解析
|
||||
執行。導覽覆寫版面預設：「帳號資訊」不標記 aria-current（本頁非
|
||||
帳號首頁），admin 另顯示管理頁連結。密碼欄位一律不預填——驗證失敗
|
||||
重繪亦同；成功後 PRG 回本頁以 ?saved=1 顯示成功訊息。 */}}
|
||||
{{define "title"}}更新密碼 - alterminal{{end}}
|
||||
|
||||
{{define "navitems"}}
|
||||
<li>
|
||||
<a href="/"
|
||||
class="flex items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium text-neutral-600 hover:bg-neutral-100 dark:text-neutral-300 dark:hover:bg-neutral-700/60">
|
||||
<svg class="size-5 shrink-0" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M15.75 6a3.75 3.75 0 1 1-7.5 0 3.75 3.75 0 0 1 7.5 0ZM4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.933 17.933 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632Z"/>
|
||||
</svg>
|
||||
帳號資訊
|
||||
</a>
|
||||
</li>
|
||||
{{if .IsAdmin}}
|
||||
<li>
|
||||
<a href="/admin/keys"
|
||||
class="flex items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium text-neutral-600 hover:bg-neutral-100 dark:text-neutral-300 dark:hover:bg-neutral-700/60">
|
||||
<svg class="size-5 shrink-0" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25Z"/>
|
||||
</svg>
|
||||
金鑰管理
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="/admin/applications"
|
||||
class="flex items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium text-neutral-600 hover:bg-neutral-100 dark:text-neutral-300 dark:hover:bg-neutral-700/60">
|
||||
<svg class="size-5 shrink-0" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M21 7.5l-9-5.25L3 7.5m18 0l-9 5.25m9-5.25v9l-9 5.25M3 7.5l9 5.25M3 7.5v9l9 5.25m0-9v9"/>
|
||||
</svg>
|
||||
應用程式管理
|
||||
</a>
|
||||
</li>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
{{define "content"}}
|
||||
<section class="rounded-xl bg-white p-8 shadow-lg dark:bg-neutral-800 dark:shadow-black/40">
|
||||
<h1 class="mb-1 text-xl font-semibold">更新密碼</h1>
|
||||
<p class="mb-6 text-sm text-neutral-500 dark:text-neutral-400">驗證目前的密碼後設定新密碼</p>
|
||||
{{if .Error}}<p class="mb-4 rounded-lg bg-red-500/10 px-3 py-2.5 text-sm text-red-600 dark:text-red-400" role="alert">{{.Error}}</p>{{end}}
|
||||
{{if .Success}}<p class="mb-4 rounded-lg bg-emerald-500/10 px-3 py-2.5 text-sm text-emerald-700 dark:text-emerald-400" role="status">{{.Success}}</p>{{end}}
|
||||
<form method="post" action="/password" class="space-y-4">
|
||||
<input type="hidden" name="csrf_token" value="{{.CSRF}}">
|
||||
<div>
|
||||
<label for="current-password" class="mb-1 block text-sm font-medium">目前的密碼</label>
|
||||
<input type="password" id="current-password" name="current_password" autocomplete="current-password" autofocus required
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm dark:border-neutral-600 dark:bg-neutral-900">
|
||||
</div>
|
||||
<div>
|
||||
<label for="new-password" class="mb-1 block text-sm font-medium">新密碼</label>
|
||||
<input type="password" id="new-password" name="new_password" autocomplete="new-password" minlength="8" required
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm dark:border-neutral-600 dark:bg-neutral-900">
|
||||
<p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">至少 8 字元。</p>
|
||||
</div>
|
||||
<div>
|
||||
<label for="confirm-password" class="mb-1 block text-sm font-medium">確認新密碼</label>
|
||||
<input type="password" id="confirm-password" name="confirm_password" autocomplete="new-password" minlength="8" required
|
||||
class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm dark:border-neutral-600 dark:bg-neutral-900">
|
||||
</div>
|
||||
<button type="submit"
|
||||
class="rounded-lg bg-brand px-4 py-2.5 text-sm font-semibold text-white hover:bg-brand-strong">更新密碼</button>
|
||||
</form>
|
||||
<p class="mt-4 text-xs text-neutral-400 dark:text-neutral-500">更新成功後，其他裝置的登入將全部登出；本瀏覽器會保持登入狀態。</p>
|
||||
</section>
|
||||
{{end}}
|
||||
Reference in New Issue
Block a user