openid: Stop suppressing the email field on the Preferences page.
[ikiwiki.git] / IkiWiki / Plugin / openid.pm
1 #!/usr/bin/perl
2 # OpenID support.
3 package IkiWiki::Plugin::openid;
4
5 use warnings;
6 use strict;
7 use IkiWiki 3.00;
8
9 sub import {
10         add_underlay("openid-selector");
11         add_underlay("jquery");
12         hook(type => "checkconfig", id => "openid", call => \&checkconfig);
13         hook(type => "getsetup", id => "openid", call => \&getsetup);
14         hook(type => "auth", id => "openid", call => \&auth);
15         hook(type => "formbuilder_setup", id => "openid",
16                 call => \&formbuilder_setup, last => 1);
17 }
18
19 sub checkconfig () {
20         if ($config{cgi}) {
21                 # Intercept normal signin form, so the openid selector
22                 # can be displayed.
23                 # 
24                 # When other auth hooks are registered, give the selector
25                 # a reference to the normal signin form.
26                 require IkiWiki::CGI;
27                 my $real_cgi_signin;
28                 if (keys %{$IkiWiki::hooks{auth}} > 1) {
29                         $real_cgi_signin=\&IkiWiki::cgi_signin;
30                 }
31                 inject(name => "IkiWiki::cgi_signin", call => sub ($$) {
32                         openid_selector($real_cgi_signin, @_);
33                 });
34         }
35 }
36
37 sub getsetup () {
38         return
39                 plugin => {
40                         safe => 1,
41                         rebuild => 0,
42                         section => "auth",
43                 },
44                 openid_realm => {
45                         type => "string",
46                         description => "url pattern of openid realm (default is cgiurl)",
47                         safe => 0,
48                         rebuild => 0,
49                 },
50                 openid_cgiurl => {
51                         type => "string",
52                         description => "url to ikiwiki cgi to use for openid authentication (default is cgiurl)",
53                         safe => 0,
54                         rebuild => 0,
55                 },
56 }
57
58 sub openid_selector {
59         my $real_cgi_signin=shift;
60         my $q=shift;
61         my $session=shift;
62
63         my $openid_url=$q->param('openid_identifier');
64         my $openid_error;
65
66         if (! load_openid_module()) {
67                 if ($real_cgi_signin) {
68                         $real_cgi_signin->($q, $session);
69                         exit;
70                 }
71                 error(sprintf(gettext("failed to load openid module: "), @_));
72         }
73         elsif (defined $q->param("action") && $q->param("action") eq "verify") {
74                 validate($q, $session, $openid_url, sub {
75                         $openid_error=shift;
76                 });
77         }
78
79         my $template=IkiWiki::template("openid-selector.tmpl");
80         $template->param(
81                 cgiurl => IkiWiki::cgiurl(),
82                 (defined $openid_error ? (openid_error => $openid_error) : ()),
83                 (defined $openid_url ? (openid_url => $openid_url) : ()),
84                 ($real_cgi_signin ? (nonopenidform => $real_cgi_signin->($q, $session, 1)) : ()),
85         );
86
87         IkiWiki::printheader($session);
88         print IkiWiki::cgitemplate($q, "signin", $template->output);
89         exit;
90 }
91
92 sub formbuilder_setup (@) {
93         my %params=@_;
94
95         my $form=$params{form};
96         my $session=$params{session};
97         my $cgi=$params{cgi};
98         
99         if ($form->title eq "preferences" &&
100                IkiWiki::openiduser($session->param("name"))) {
101                 $form->field(name => "openid_identifier", disabled => 1,
102                         label => htmllink("", "", "ikiwiki/OpenID", noimageinline => 1),
103                         value => "", 
104                         size => 1, force => 1,
105                         fieldset => "login",
106                         comment => $session->param("name"));
107         }
108 }
109
110 sub validate ($$$;$) {
111         my $q=shift;
112         my $session=shift;
113         my $openid_url=shift;
114         my $errhandler=shift;
115
116         my $csr=getobj($q, $session);
117
118         my $claimed_identity = $csr->claimed_identity($openid_url);
119         if (! $claimed_identity) {
120                 if ($errhandler) {
121                         if (ref($errhandler) eq 'CODE') {
122                                 $errhandler->($csr->err);
123                         }
124                         return 0;
125                 }
126                 else {
127                         error($csr->err);
128                 }
129         }
130
131         # Ask for client to provide a name and email, if possible.
132         # Try sreg and ax
133         if ($claimed_identity->can("set_extension_args")) {
134                 $claimed_identity->set_extension_args(
135                         'http://openid.net/extensions/sreg/1.1',
136                         {
137                                 optional => 'email,fullname,nickname',
138                         },
139                 );
140                 $claimed_identity->set_extension_args(
141                         'http://openid.net/srv/ax/1.0',
142                         {
143                                 mode => 'fetch_request',
144                                 'required' => 'email,fullname,nickname,firstname',
145                                 'type.email' => "http://schema.openid.net/contact/email",
146                                 'type.fullname' => "http://axschema.org/namePerson",
147                                 'type.nickname' => "http://axschema.org/namePerson/friendly",
148                                 'type.firstname' => "http://axschema.org/namePerson/first",
149                         },
150                 );
151         }
152
153         my $cgiurl=$config{openid_cgiurl};
154         $cgiurl=$q->url if ! defined $cgiurl;
155
156         my $trust_root=$config{openid_realm};
157         $trust_root=$cgiurl if ! defined $trust_root;
158
159         my $check_url = $claimed_identity->check_url(
160                 return_to => auto_upgrade_https($q, "$cgiurl?do=postsignin"),
161                 trust_root => auto_upgrade_https($q, $trust_root),
162                 delayed_return => 1,
163         );
164         # Redirect the user to the OpenID server, which will
165         # eventually bounce them back to auth()
166         IkiWiki::redirect($q, $check_url);
167         exit 0;
168 }
169
170 sub auth ($$) {
171         my $q=shift;
172         my $session=shift;
173
174         if (defined $q->param('openid.mode')) {
175                 my $csr=getobj($q, $session);
176
177                 if (my $setup_url = $csr->user_setup_url) {
178                         IkiWiki::redirect($q, $setup_url);
179                 }
180                 elsif ($csr->user_cancel) {
181                         IkiWiki::redirect($q, IkiWiki::baseurl(undef));
182                 }
183                 elsif (my $vident = $csr->verified_identity) {
184                         $session->param(name => $vident->url);
185
186                         my @extensions;
187                         if ($vident->can("signed_extension_fields")) {
188                                 @extensions=grep { defined } (
189                                         $vident->signed_extension_fields('http://openid.net/extensions/sreg/1.1'),
190                                         $vident->signed_extension_fields('http://openid.net/srv/ax/1.0'),
191                                 );
192                         }
193                         my $nickname;
194                         foreach my $ext (@extensions) {
195                                 foreach my $field (qw{value.email email}) {
196                                         if (exists $ext->{$field} &&
197                                             defined $ext->{$field} &&
198                                             length $ext->{$field}) {
199                                                 $session->param(email => $ext->{$field});
200                                                 if (! defined $nickname &&
201                                                     $ext->{$field}=~/(.+)@.+/) {
202                                                         $nickname = $1;
203                                                 }
204                                                 last;
205                                         }
206                                 }
207                                 foreach my $field (qw{value.nickname nickname value.fullname fullname value.firstname}) {
208                                         if (exists $ext->{$field} &&
209                                             defined $ext->{$field} &&
210                                             length $ext->{$field}) {
211                                                 $nickname=$ext->{$field};
212                                                 last;
213                                         }
214                                 }
215                         }
216                         if (defined $nickname) {
217                                 $session->param(nickname =>
218                                         Encode::decode_utf8($nickname));
219                         }
220                 }
221                 else {
222                         error("OpenID failure: ".$csr->err);
223                 }
224         }
225         elsif (defined $q->param('openid_identifier')) {
226                 # myopenid.com affiliate support
227                 validate($q, $session, scalar $q->param('openid_identifier'));
228         }
229 }
230
231 sub getobj ($$) {
232         my $q=shift;
233         my $session=shift;
234
235         eval q{use Net::INET6Glue::INET_is_INET6}; # may not be available
236         eval q{use Net::OpenID::Consumer};
237         error($@) if $@;
238
239         my $ua;
240         eval q{use LWPx::ParanoidAgent};
241         if (! $@) {
242                 $ua=LWPx::ParanoidAgent->new(agent => $config{useragent});
243         }
244         else {
245                 $ua=useragent();
246         }
247
248         # Store the secret in the session.
249         my $secret=$session->param("openid_secret");
250         if (! defined $secret) {
251                 $secret=rand;
252                 $session->param(openid_secret => $secret);
253         }
254         
255         my $cgiurl=$config{openid_cgiurl};
256         $cgiurl=$q->url if ! defined $cgiurl;
257
258         return Net::OpenID::Consumer->new(
259                 ua => $ua,
260                 args => $q,
261                 consumer_secret => sub { return shift()+$secret },
262                 required_root => auto_upgrade_https($q, $cgiurl),
263         );
264 }
265
266 sub auto_upgrade_https {
267         my $q=shift;
268         my $url=shift;
269         if ($q->https()) {
270                 $url=~s/^http:/https:/i;
271         }
272         return $url;
273 }
274
275 sub load_openid_module {
276         # Give up if module is unavailable to avoid needing to depend on it.
277         eval q{use Net::OpenID::Consumer};
278         if ($@) {
279                 debug("unable to load Net::OpenID::Consumer, not enabling OpenID login ($@)");
280                 return;
281         }
282         return 1;
283 }
284
285 1