2022-11-24 20:53:52 +13:00
|
|
|
<?php
|
|
|
|
|
|
|
|
use Appwrite\Auth\Auth;
|
|
|
|
use Appwrite\Utopia\Request;
|
|
|
|
use Utopia\App;
|
|
|
|
use Appwrite\Extend\Exception;
|
|
|
|
use Utopia\Database\Document;
|
|
|
|
use Utopia\Database\Validator\Authorization;
|
2024-02-02 01:10:41 +13:00
|
|
|
use MaxMind\Db\Reader;
|
2022-11-24 20:53:52 +13:00
|
|
|
|
|
|
|
App::init()
|
|
|
|
->groups(['auth'])
|
|
|
|
->inject('utopia')
|
|
|
|
->inject('request')
|
|
|
|
->inject('project')
|
2024-02-02 01:10:41 +13:00
|
|
|
->inject('geodb')
|
|
|
|
->action(function (App $utopia, Request $request, Document $project, Reader $geodb) {
|
2024-02-03 03:31:54 +13:00
|
|
|
$denylist = App::getEnv('_APP_CONSOLE_COUNTRIES_DENYLIST', '');
|
|
|
|
if (!empty($denylist && $project->getId() === 'console')) {
|
2024-02-02 01:10:41 +13:00
|
|
|
$countries = explode(',', $denylist);
|
|
|
|
$record = $geodb->get($request->getIP()) ?? [];
|
|
|
|
$country = $record['country']['iso_code'] ?? '';
|
|
|
|
if (in_array($country, $countries)) {
|
|
|
|
throw new Exception(Exception::GENERAL_REGION_ACCESS_DENIED);
|
|
|
|
}
|
|
|
|
}
|
2022-11-24 20:53:52 +13:00
|
|
|
|
|
|
|
$route = $utopia->match($request);
|
|
|
|
|
|
|
|
$isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles());
|
|
|
|
$isAppUser = Auth::isAppUser(Authorization::getRoles());
|
|
|
|
|
|
|
|
if ($isAppUser || $isPrivilegedUser) { // Skip limits for app and console devs
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
$auths = $project->getAttribute('auths', []);
|
|
|
|
switch ($route->getLabel('auth.type', '')) {
|
|
|
|
case 'emailPassword':
|
|
|
|
if (($auths['emailPassword'] ?? true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Email / Password authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 'magic-url':
|
|
|
|
if ($project->getAttribute('usersAuthMagicURL', true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Magic URL authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 'anonymous':
|
|
|
|
if (($auths['anonymous'] ?? true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Anonymous authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 'invites':
|
|
|
|
if (($auths['invites'] ?? true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Invites authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 'jwt':
|
|
|
|
if (($auths['JWT'] ?? true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'JWT authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2023-10-26 01:20:29 +13:00
|
|
|
case 'phone':
|
|
|
|
if (($auths['phone'] ?? true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Phone authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2024-02-02 21:33:20 +13:00
|
|
|
case 'email-otp':
|
|
|
|
if (($auths['emailOTP'] ?? true) === false) {
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Email OTP authentication is disabled for this project');
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2022-11-24 20:53:52 +13:00
|
|
|
default:
|
|
|
|
throw new Exception(Exception::USER_AUTH_METHOD_UNSUPPORTED, 'Unsupported authentication route');
|
|
|
|
break;
|
|
|
|
}
|
2022-12-19 21:25:49 +13:00
|
|
|
});
|