Merge remote-tracking branch 'upstream/main'

zjjhot · zjjhot · commit 7088b562aa65 · 2022-12-28T17:16:55.000+08:00
* upstream/main: refactor auth interface to return error when verify failure (go-gitea#22119)
diff --git a/modules/context/api.go b/modules/context/api.go
@@ -219,7 +219,13 @@ func (ctx *APIContext) CheckForOTP() {
 func APIAuth(authMethod auth_service.Method) func(*APIContext) {
 	return func(ctx *APIContext) {
 		// Get user from session if logged in.
-		ctx.Doer = authMethod.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		var err error
+		ctx.Doer, err = authMethod.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		if err != nil {
+			ctx.Error(http.StatusUnauthorized, "APIAuth", err)
+			return
+		}
+
 		if ctx.Doer != nil {
 			if ctx.Locale.Language() != ctx.Doer.Language {
 				ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
diff --git a/modules/context/context.go b/modules/context/context.go
@@ -662,7 +662,13 @@ func getCsrfOpts() CsrfOptions {
 // Auth converts auth.Auth as a middleware
 func Auth(authMethod auth.Method) func(*Context) {
 	return func(ctx *Context) {
-		ctx.Doer = authMethod.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		var err error
+		ctx.Doer, err = authMethod.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		if err != nil {
+			log.Error("Failed to verify user %v: %v", ctx.Req.RemoteAddr, err)
+			ctx.Error(http.StatusUnauthorized, "Verify")
+			return
+		}
 		if ctx.Doer != nil {
 			if ctx.Locale.Language() != ctx.Doer.Language {
 				ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
diff --git a/routers/api/packages/api.go b/routers/api/packages/api.go
@@ -11,6 +11,7 @@ import (
 
 	"code.gitea.io/gitea/models/perm"
 	"code.gitea.io/gitea/modules/context"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/web"
 	"code.gitea.io/gitea/routers/api/packages/composer"
@@ -58,7 +59,13 @@ func CommonRoutes(ctx gocontext.Context) *web.Route {
 
 	authGroup := auth.NewGroup(authMethods...)
 	r.Use(func(ctx *context.Context) {
-		ctx.Doer = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		var err error
+		ctx.Doer, err = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		if err != nil {
+			log.Error("Verify: %v", err)
+			ctx.Error(http.StatusUnauthorized, "authGroup.Verify")
+			return
+		}
 		ctx.IsSigned = ctx.Doer != nil
 	})
 
@@ -321,7 +328,13 @@ func ContainerRoutes(ctx gocontext.Context) *web.Route {
 
 	authGroup := auth.NewGroup(authMethods...)
 	r.Use(func(ctx *context.Context) {
-		ctx.Doer = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		var err error
+		ctx.Doer, err = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)
+		if err != nil {
+			log.Error("Failed to verify user: %v", err)
+			ctx.Error(http.StatusUnauthorized, "Verify")
+			return
+		}
 		ctx.IsSigned = ctx.Doer != nil
 	})
 
diff --git a/routers/api/packages/conan/auth.go b/routers/api/packages/conan/auth.go
@@ -19,22 +19,22 @@ func (a *Auth) Name() string {
 }
 
 // Verify extracts the user from the Bearer token
-func (a *Auth) Verify(req *http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) *user_model.User {
+func (a *Auth) Verify(req *http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) (*user_model.User, error) {
 	uid, err := packages.ParseAuthorizationToken(req)
 	if err != nil {
 		log.Trace("ParseAuthorizationToken: %v", err)
-		return nil
+		return nil, err
 	}
 
 	if uid == 0 {
-		return nil
+		return nil, nil
 	}
 
 	u, err := user_model.GetUserByID(req.Context(), uid)
 	if err != nil {
 		log.Error("GetUserByID:  %v", err)
-		return nil
+		return nil, err
 	}
 
-	return u
+	return u, nil
 }
diff --git a/routers/api/packages/container/auth.go b/routers/api/packages/container/auth.go
@@ -20,25 +20,25 @@ func (a *Auth) Name() string {
 
 // Verify extracts the user from the Bearer token
 // If it's an anonymous session a ghost user is returned
-func (a *Auth) Verify(req *http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) *user_model.User {
+func (a *Auth) Verify(req *http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) (*user_model.User, error) {
 	uid, err := packages.ParseAuthorizationToken(req)
 	if err != nil {
 		log.Trace("ParseAuthorizationToken: %v", err)
-		return nil
+		return nil, err
 	}
 
 	if uid == 0 {
-		return nil
+		return nil, nil
 	}
 	if uid == -1 {
-		return user_model.NewGhostUser()
+		return user_model.NewGhostUser(), nil
 	}
 
 	u, err := user_model.GetUserByID(req.Context(), uid)
 	if err != nil {
 		log.Error("GetUserByID:  %v", err)
-		return nil
+		return nil, err
 	}
 
-	return u
+	return u, nil
 }
diff --git a/routers/api/packages/nuget/auth.go b/routers/api/packages/nuget/auth.go
@@ -20,25 +20,26 @@ func (a *Auth) Name() string {
 }
 
 // https://docs.microsoft.com/en-us/nuget/api/package-publish-resource#request-parameters
-func (a *Auth) Verify(req *http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) *user_model.User {
+func (a *Auth) Verify(req *http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) (*user_model.User, error) {
 	token, err := auth_model.GetAccessTokenBySHA(req.Header.Get("X-NuGet-ApiKey"))
 	if err != nil {
 		if !(auth_model.IsErrAccessTokenNotExist(err) || auth_model.IsErrAccessTokenEmpty(err)) {
 			log.Error("GetAccessTokenBySHA: %v", err)
+			return nil, err
 		}
-		return nil
+		return nil, nil
 	}
 
 	u, err := user_model.GetUserByID(req.Context(), token.UID)
 	if err != nil {
 		log.Error("GetUserByID:  %v", err)
-		return nil
+		return nil, err
 	}
 
 	token.UpdatedUnix = timeutil.TimeStampNow()
 	if err := auth_model.UpdateAccessToken(token); err != nil {
 		log.Error("UpdateAccessToken:  %v", err)
 	}
 
-	return u
+	return u, nil
 }
diff --git a/services/auth/basic.go b/services/auth/basic.go
@@ -40,20 +40,20 @@ func (b *Basic) Name() string {
 // "Authorization" header of the request and returns the corresponding user object for that
 // name/token on successful validation.
 // Returns nil if header is empty or validation fails.
-func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User {
+func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
 	// Basic authentication should only fire on API, Download or on Git or LFSPaths
 	if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawReleaseOrLFSPath(req) {
-		return nil
+		return nil, nil
 	}
 
 	baHead := req.Header.Get("Authorization")
 	if len(baHead) == 0 {
-		return nil
+		return nil, nil
 	}
 
 	auths := strings.SplitN(baHead, " ", 2)
 	if len(auths) != 2 || (strings.ToLower(auths[0]) != "basic") {
-		return nil
+		return nil, nil
 	}
 
 	uname, passwd, _ := base.BasicAuthDecode(auths[1])
@@ -77,11 +77,11 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 		u, err := user_model.GetUserByID(req.Context(), uid)
 		if err != nil {
 			log.Error("GetUserByID:  %v", err)
-			return nil
+			return nil, err
 		}
 
 		store.GetData()["IsApiToken"] = true
-		return u
+		return u, nil
 	}
 
 	token, err := auth_model.GetAccessTokenBySHA(authToken)
@@ -90,7 +90,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 		u, err := user_model.GetUserByID(req.Context(), token.UID)
 		if err != nil {
 			log.Error("GetUserByID:  %v", err)
-			return nil
+			return nil, err
 		}
 
 		token.UpdatedUnix = timeutil.TimeStampNow()
@@ -99,13 +99,13 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 		}
 
 		store.GetData()["IsApiToken"] = true
-		return u
+		return u, nil
 	} else if !auth_model.IsErrAccessTokenNotExist(err) && !auth_model.IsErrAccessTokenEmpty(err) {
 		log.Error("GetAccessTokenBySha: %v", err)
 	}
 
 	if !setting.Service.EnableBasicAuth {
-		return nil
+		return nil, nil
 	}
 
 	log.Trace("Basic Authorization: Attempting SignIn for %s", uname)
@@ -114,7 +114,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 		if !user_model.IsErrUserNotExist(err) {
 			log.Error("UserSignIn: %v", err)
 		}
-		return nil
+		return nil, err
 	}
 
 	if skipper, ok := source.Cfg.(LocalTwoFASkipper); ok && skipper.IsSkipLocalTwoFA() {
@@ -123,5 +123,5 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 
 	log.Trace("Basic Authorization: Logged in user %-v", u)
 
-	return u
+	return u, nil
 }
diff --git a/services/auth/group.go b/services/auth/group.go
@@ -9,7 +9,6 @@ import (
 	"reflect"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
 	user_model "code.gitea.io/gitea/models/user"
 )
 
@@ -80,23 +79,23 @@ func (b *Group) Free() error {
 }
 
 // Verify extracts and validates
-func (b *Group) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User {
-	if !db.HasEngine {
-		return nil
-	}
-
+func (b *Group) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
 	// Try to sign in with each of the enabled plugins
 	for _, ssoMethod := range b.methods {
-		user := ssoMethod.Verify(req, w, store, sess)
+		user, err := ssoMethod.Verify(req, w, store, sess)
+		if err != nil {
+			return nil, err
+		}
+
 		if user != nil {
 			if store.GetData()["AuthedMethod"] == nil {
 				if named, ok := ssoMethod.(Named); ok {
 					store.GetData()["AuthedMethod"] = named.Name()
 				}
 			}
-			return user
+			return user, nil
 		}
 	}
 
-	return nil
+	return nil, nil
 }
diff --git a/services/auth/httpsign.go b/services/auth/httpsign.go
@@ -39,10 +39,10 @@ func (h *HTTPSign) Name() string {
 // Verify extracts and validates HTTPsign from the Signature header of the request and returns
 // the corresponding user object on successful validation.
 // Returns nil if header is empty or validation fails.
-func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User {
+func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
 	sigHead := req.Header.Get("Signature")
 	if len(sigHead) == 0 {
-		return nil
+		return nil, nil
 	}
 
 	var (
@@ -53,36 +53,36 @@ func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataSt
 	if len(req.Header.Get("X-Ssh-Certificate")) != 0 {
 		// Handle Signature signed by SSH certificates
 		if len(setting.SSH.TrustedUserCAKeys) == 0 {
-			return nil
+			return nil, nil
 		}
 
 		publicKey, err = VerifyCert(req)
 		if err != nil {
 			log.Debug("VerifyCert on request from %s: failed: %v", req.RemoteAddr, err)
 			log.Warn("Failed authentication attempt from %s", req.RemoteAddr)
-			return nil
+			return nil, nil
 		}
 	} else {
 		// Handle Signature signed by Public Key
 		publicKey, err = VerifyPubKey(req)
 		if err != nil {
 			log.Debug("VerifyPubKey on request from %s: failed: %v", req.RemoteAddr, err)
 			log.Warn("Failed authentication attempt from %s", req.RemoteAddr)
-			return nil
+			return nil, nil
 		}
 	}
 
 	u, err := user_model.GetUserByID(req.Context(), publicKey.OwnerID)
 	if err != nil {
 		log.Error("GetUserByID:  %v", err)
-		return nil
+		return nil, err
 	}
 
 	store.GetData()["IsApiToken"] = true
 
 	log.Trace("HTTP Sign: Logged in user %-v", u)
 
-	return u
+	return u, nil
 }
 
 func VerifyPubKey(r *http.Request) (*asymkey_model.PublicKey, error) {
diff --git a/services/auth/interface.go b/services/auth/interface.go
@@ -24,8 +24,9 @@ type Method interface {
 	// If verification is successful returns either an existing user object (with id > 0)
 	// or a new user object (with id = 0) populated with the information that was found
 	// in the authentication data (username or email).
-	// Returns nil if verification fails.
-	Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User
+	// Second argument returns err if verification fails, otherwise
+	// First return argument returns nil if no matched verification condition
+	Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)
 }
 
 // Initializable represents a structure that requires initialization
diff --git a/services/auth/oauth2.go b/services/auth/oauth2.go
@@ -108,18 +108,14 @@ func (o *OAuth2) userIDFromToken(req *http.Request, store DataStore) int64 {
 // or the "Authorization" header and returns the corresponding user object for that ID.
 // If verification is successful returns an existing user object.
 // Returns nil if verification fails.
-func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User {
-	if !db.HasEngine {
-		return nil
-	}
-
+func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
 	if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isAuthenticatedTokenRequest(req) {
-		return nil
+		return nil, nil
 	}
 
 	id := o.userIDFromToken(req, store)
 	if id <= 0 {
-		return nil
+		return nil, nil
 	}
 	log.Trace("OAuth2 Authorization: Found token for user[%d]", id)
 
@@ -128,11 +124,11 @@ func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, store DataStor
 		if !user_model.IsErrUserNotExist(err) {
 			log.Error("GetUserByName: %v", err)
 		}
-		return nil
+		return nil, err
 	}
 
 	log.Trace("OAuth2 Authorization: Logged in user %-v", user)
-	return user
+	return user, nil
 }
 
 func isAuthenticatedTokenRequest(req *http.Request) bool {
diff --git a/services/auth/reverseproxy.go b/services/auth/reverseproxy.go
diff --git a/services/auth/session.go b/services/auth/session.go
diff --git a/services/auth/sspi_windows.go b/services/auth/sspi_windows.go
diff --git a/services/packages/auth.go b/services/packages/auth.go

Original file line number	Diff line number	Diff line change
`@@ -19,22 +19,22 @@ func (a *Auth) Name() string {`
`19`	`19`	`}`
`20`	`20`
`21`	`21`	`// Verify extracts the user from the Bearer token`
`22`		`-func (a Auth) Verify(req http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) *user_model.User {`
	`22`	`+func (a Auth) Verify(req http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) (*user_model.User, error) {`
`23`	`23`	`uid, err := packages.ParseAuthorizationToken(req)`
`24`	`24`	`if err != nil {`
`25`	`25`	`log.Trace("ParseAuthorizationToken: %v", err)`
`26`		`- return nil`
	`26`	`+ return nil, err`
`27`	`27`	`}`
`28`	`28`
`29`	`29`	`if uid == 0 {`
`30`		`- return nil`
	`30`	`+ return nil, nil`
`31`	`31`	`}`
`32`	`32`
`33`	`33`	`u, err := user_model.GetUserByID(req.Context(), uid)`
`34`	`34`	`if err != nil {`
`35`	`35`	`log.Error("GetUserByID: %v", err)`
`36`		`- return nil`
	`36`	`+ return nil, err`
`37`	`37`	`}`
`38`	`38`
`39`		`- return u`
	`39`	`+ return u, nil`
`40`	`40`	`}`
Original file line number	Diff line number	Diff line change
`@@ -20,25 +20,25 @@ func (a *Auth) Name() string {`
`20`	`20`
`21`	`21`	`// Verify extracts the user from the Bearer token`
`22`	`22`	`// If it's an anonymous session a ghost user is returned`
`23`		`-func (a Auth) Verify(req http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) *user_model.User {`
	`23`	`+func (a Auth) Verify(req http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) (*user_model.User, error) {`
`24`	`24`	`uid, err := packages.ParseAuthorizationToken(req)`
`25`	`25`	`if err != nil {`
`26`	`26`	`log.Trace("ParseAuthorizationToken: %v", err)`
`27`		`- return nil`
	`27`	`+ return nil, err`
`28`	`28`	`}`
`29`	`29`
`30`	`30`	`if uid == 0 {`
`31`		`- return nil`
	`31`	`+ return nil, nil`
`32`	`32`	`}`
`33`	`33`	`if uid == -1 {`
`34`		`- return user_model.NewGhostUser()`
	`34`	`+ return user_model.NewGhostUser(), nil`
`35`	`35`	`}`
`36`	`36`
`37`	`37`	`u, err := user_model.GetUserByID(req.Context(), uid)`
`38`	`38`	`if err != nil {`
`39`	`39`	`log.Error("GetUserByID: %v", err)`
`40`		`- return nil`
	`40`	`+ return nil, err`
`41`	`41`	`}`
`42`	`42`
`43`		`- return u`
	`43`	`+ return u, nil`
`44`	`44`	`}`
Original file line number	Diff line number	Diff line change
`@@ -20,25 +20,26 @@ func (a *Auth) Name() string {`
`20`	`20`	`}`
`21`	`21`
`22`	`22`	`// https://docs.microsoft.com/en-us/nuget/api/package-publish-resource#request-parameters`
`23`		`-func (a Auth) Verify(req http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) *user_model.User {`
	`23`	`+func (a Auth) Verify(req http.Request, w http.ResponseWriter, store auth.DataStore, sess auth.SessionStore) (*user_model.User, error) {`
`24`	`24`	`token, err := auth_model.GetAccessTokenBySHA(req.Header.Get("X-NuGet-ApiKey"))`
`25`	`25`	`if err != nil {`
`26`	`26`	`if !(auth_model.IsErrAccessTokenNotExist(err) \|\| auth_model.IsErrAccessTokenEmpty(err)) {`
`27`	`27`	`log.Error("GetAccessTokenBySHA: %v", err)`
	`28`	`+ return nil, err`
`28`	`29`	`}`
`29`		`- return nil`
	`30`	`+ return nil, nil`
`30`	`31`	`}`
`31`	`32`
`32`	`33`	`u, err := user_model.GetUserByID(req.Context(), token.UID)`
`33`	`34`	`if err != nil {`
`34`	`35`	`log.Error("GetUserByID: %v", err)`
`35`		`- return nil`
	`36`	`+ return nil, err`
`36`	`37`	`}`
`37`	`38`
`38`	`39`	`token.UpdatedUnix = timeutil.TimeStampNow()`
`39`	`40`	`if err := auth_model.UpdateAccessToken(token); err != nil {`
`40`	`41`	`log.Error("UpdateAccessToken: %v", err)`
`41`	`42`	`}`
`42`	`43`
`43`		`- return u`
	`44`	`+ return u, nil`
`44`	`45`	`}`
Original file line number	Diff line number	Diff line change
`@@ -40,20 +40,20 @@ func (b *Basic) Name() string {`
`40`	`40`	`// "Authorization" header of the request and returns the corresponding user object for that`
`41`	`41`	`// name/token on successful validation.`
`42`	`42`	`// Returns nil if header is empty or validation fails.`
`43`		`-func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User {`
	`43`	`+func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {`
`44`	`44`	`// Basic authentication should only fire on API, Download or on Git or LFSPaths`
`45`	`45`	`if !middleware.IsAPIPath(req) && !isContainerPath(req) && !isAttachmentDownload(req) && !isGitRawReleaseOrLFSPath(req) {`
`46`		`- return nil`
	`46`	`+ return nil, nil`
`47`	`47`	`}`
`48`	`48`
`49`	`49`	`baHead := req.Header.Get("Authorization")`
`50`	`50`	`if len(baHead) == 0 {`
`51`		`- return nil`
	`51`	`+ return nil, nil`
`52`	`52`	`}`
`53`	`53`
`54`	`54`	`auths := strings.SplitN(baHead, " ", 2)`
`55`	`55`	`if len(auths) != 2 \|\| (strings.ToLower(auths[0]) != "basic") {`
`56`		`- return nil`
	`56`	`+ return nil, nil`
`57`	`57`	`}`
`58`	`58`
`59`	`59`	`uname, passwd, _ := base.BasicAuthDecode(auths[1])`
`@@ -77,11 +77,11 @@ func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore`
`77`	`77`	`u, err := user_model.GetUserByID(req.Context(), uid)`
`78`	`78`	`if err != nil {`
`79`	`79`	`log.Error("GetUserByID: %v", err)`
`80`		`- return nil`
	`80`	`+ return nil, err`
`81`	`81`	`}`
`82`	`82`
`83`	`83`	`store.GetData()["IsApiToken"] = true`
`84`		`- return u`
	`84`	`+ return u, nil`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`token, err := auth_model.GetAccessTokenBySHA(authToken)`
`@@ -90,7 +90,7 @@ func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore`
`90`	`90`	`u, err := user_model.GetUserByID(req.Context(), token.UID)`
`91`	`91`	`if err != nil {`
`92`	`92`	`log.Error("GetUserByID: %v", err)`
`93`		`- return nil`
	`93`	`+ return nil, err`
`94`	`94`	`}`
`95`	`95`
`96`	`96`	`token.UpdatedUnix = timeutil.TimeStampNow()`
`@@ -99,13 +99,13 @@ func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore`
`99`	`99`	`}`
`100`	`100`
`101`	`101`	`store.GetData()["IsApiToken"] = true`
`102`		`- return u`
	`102`	`+ return u, nil`
`103`	`103`	`} else if !auth_model.IsErrAccessTokenNotExist(err) && !auth_model.IsErrAccessTokenEmpty(err) {`
`104`	`104`	`log.Error("GetAccessTokenBySha: %v", err)`
`105`	`105`	`}`
`106`	`106`
`107`	`107`	`if !setting.Service.EnableBasicAuth {`
`108`		`- return nil`
	`108`	`+ return nil, nil`
`109`	`109`	`}`
`110`	`110`
`111`	`111`	`log.Trace("Basic Authorization: Attempting SignIn for %s", uname)`
`@@ -114,7 +114,7 @@ func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore`
`114`	`114`	`if !user_model.IsErrUserNotExist(err) {`
`115`	`115`	`log.Error("UserSignIn: %v", err)`
`116`	`116`	`}`
`117`		`- return nil`
	`117`	`+ return nil, err`
`118`	`118`	`}`
`119`	`119`
`120`	`120`	`if skipper, ok := source.Cfg.(LocalTwoFASkipper); ok && skipper.IsSkipLocalTwoFA() {`
`@@ -123,5 +123,5 @@ func (b Basic) Verify(req http.Request, w http.ResponseWriter, store DataStore`
`123`	`123`
`124`	`124`	`log.Trace("Basic Authorization: Logged in user %-v", u)`
`125`	`125`
`126`		`- return u`
	`126`	`+ return u, nil`
`127`	`127`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,6 @@ import (`
`9`	`9`	`"reflect"`
`10`	`10`	`"strings"`
`11`	`11`
`12`		`- "code.gitea.io/gitea/models/db"`
`13`	`12`	`user_model "code.gitea.io/gitea/models/user"`
`14`	`13`	`)`
`15`	`14`
`@@ -80,23 +79,23 @@ func (b *Group) Free() error {`
`80`	`79`	`}`
`81`	`80`
`82`	`81`	`// Verify extracts and validates`
`83`		`-func (b Group) Verify(req http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User {`
`84`		`- if !db.HasEngine {`
`85`		`- return nil`
`86`		`- }`
`87`		`-`
	`82`	`+func (b Group) Verify(req http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {`
`88`	`83`	`// Try to sign in with each of the enabled plugins`
`89`	`84`	`for _, ssoMethod := range b.methods {`
`90`		`- user := ssoMethod.Verify(req, w, store, sess)`
	`85`	`+ user, err := ssoMethod.Verify(req, w, store, sess)`
	`86`	`+ if err != nil {`
	`87`	`+ return nil, err`
	`88`	`+ }`
	`89`	`+`
`91`	`90`	`if user != nil {`
`92`	`91`	`if store.GetData()["AuthedMethod"] == nil {`
`93`	`92`	`if named, ok := ssoMethod.(Named); ok {`
`94`	`93`	`store.GetData()["AuthedMethod"] = named.Name()`
`95`	`94`	`}`
`96`	`95`	`}`
`97`		`- return user`
	`96`	`+ return user, nil`
`98`	`97`	`}`
`99`	`98`	`}`
`100`	`99`
`101`		`- return nil`
	`100`	`+ return nil, nil`
`102`	`101`	`}`