gitea/modules/setting/recovery_token.go

// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package setting

import (
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"os"
	"path/filepath"
	"slices"
	"strings"
	"time"

	"code.gitea.io/gitea/modules/generate"

	"github.com/golang-jwt/jwt/v5"
)

// start edit/add - by petru @ codex
var (
	ErrRecoveryTokenInvalid       = errors.New("invalid recovery token")
	ErrRecoveryTokenUsed          = errors.New("recovery token already used")
	ErrRecoveryTokenMisconfigured = errors.New("recovery token configuration is incomplete")
)

const (
	recoveryTokenTypeAccess = "access"
	recoveryTokenTypeUnlock = "unlock"
)

type RecoveryTokenClaims struct {
	Email string `json:"email"`
	Type  string `json:"type"`
	jwt.RegisteredClaims
}

func IssueRecoveryToken(data *RecoveryConfig, email string, now time.Time) (string, error) {
	return issueRecoveryToken(data, email, now, recoveryTokenTypeAccess)
}

func IssueRecoveryUnlockToken(data *RecoveryConfig, email string, now time.Time) (string, error) {
	return issueRecoveryToken(data, email, now, recoveryTokenTypeUnlock)
}

func issueRecoveryToken(data *RecoveryConfig, email string, now time.Time, tokenType string) (string, error) {
	if data == nil || strings.TrimSpace(data.TokenSecret) == "" {
		return "", ErrRecoveryTokenMisconfigured
	}

	tokenID, err := generate.NewSecretKey()
	if err != nil {
		return "", err
	}

	claims := RecoveryTokenClaims{
		Email: strings.TrimSpace(email),
		Type:  tokenType,
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(now.Add(data.EffectiveTokenTTL())),
			IssuedAt:  jwt.NewNumericDate(now),
			NotBefore: jwt.NewNumericDate(now),
			ID:        tokenID,
		},
	}

	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(data.TokenSecret))
}

func ValidateRecoveryToken(data *RecoveryConfig, token string, now time.Time) (*RecoveryTokenClaims, error) {
	return validateRecoveryToken(data, token, now, recoveryTokenTypeAccess)
}

func ValidateRecoveryUnlockToken(data *RecoveryConfig, token string, now time.Time) (*RecoveryTokenClaims, error) {
	return validateRecoveryToken(data, token, now, recoveryTokenTypeUnlock)
}

func validateRecoveryToken(data *RecoveryConfig, token string, now time.Time, expectedType string) (*RecoveryTokenClaims, error) {
	if data == nil || strings.TrimSpace(data.TokenSecret) == "" {
		return nil, ErrRecoveryTokenMisconfigured
	}

	parsedToken, err := jwt.ParseWithClaims(token, &RecoveryTokenClaims{}, func(_ *jwt.Token) (any, error) {
		return []byte(data.TokenSecret), nil
	}, jwt.WithTimeFunc(func() time.Time {
		return now
	}))
	if err != nil {
		return nil, ErrRecoveryTokenInvalid
	}

	claims, ok := parsedToken.Claims.(*RecoveryTokenClaims)
	if !ok || !parsedToken.Valid || strings.TrimSpace(claims.Email) == "" || strings.TrimSpace(claims.ID) == "" || claims.Type != expectedType {
		return nil, ErrRecoveryTokenInvalid
	}
	return claims, nil
}

func ConsumeRecoveryToken(tokenID string) error {
	tokenID = strings.TrimSpace(tokenID)
	if tokenID == "" {
		return ErrRecoveryTokenInvalid
	}

	usedPath := RecoveryUsedTokensPath()
	if usedPath == "" {
		return errors.New("setting.CustomConf is not set")
	}
	if err := os.MkdirAll(filepath.Dir(usedPath), 0o755); err != nil {
		return err
	}

	tokenHash := hashRecoveryTokenID(tokenID)
	usedHashes, err := loadRecoveryTokenHashes(usedPath)
	if err != nil {
		return err
	}
	if slices.Contains(usedHashes, tokenHash) {
		return ErrRecoveryTokenUsed
	}

	usedHashes = append(usedHashes, tokenHash)
	return os.WriteFile(usedPath, []byte(strings.Join(usedHashes, "\n")+"\n"), 0o600)
}

func loadRecoveryTokenHashes(usedPath string) ([]string, error) {
	data, err := os.ReadFile(usedPath)
	if err != nil {
		if os.IsNotExist(err) {
			return nil, nil
		}
		return nil, err
	}

	lines := strings.Split(string(data), "\n")
	hashes := make([]string, 0, len(lines))
	for _, line := range lines {
		line = strings.TrimSpace(line)
		if line != "" {
			hashes = append(hashes, line)
		}
	}
	return hashes, nil
}

func hashRecoveryTokenID(tokenID string) string {
	hash := sha256.Sum256([]byte(tokenID))
	return hex.EncodeToString(hash[:])
}

// end edit/add - by petru @ codex