Allow local login,closes #6800 (#6803)

* WIP

* reset groups cache after every suite

src/cli/reset.js

@@ -11,6 +11,7 @@ var events = require('../events');
 var meta = require('../meta');
 var plugins = require('../plugins');
 var widgets = require('../widgets');
+var privileges = require('../privileges');
 
 var dirname = require('./paths').baseDir;
 
@@ -86,9 +87,13 @@ exports.reset = function (options, callback) {
 };
 
 function resetSettings(callback) {
-	meta.configs.set('allowLocalLogin', 1, function (err) {
+	privileges.global.give(['local:login'], 'registered-users', function (err) {
+		if (err) {
+			return callback(err);
+		}
+		winston.info('[reset] registered-users given login privilege');
 		winston.info('[reset] Settings reset to default');
-		callback(err);
+		callback();
 	});
 }
 

src/controllers/authentication.js

@@ -14,7 +14,7 @@ var plugins = require('../plugins');
 var utils = require('../utils');
 var translator = require('../translator');
 var helpers = require('./helpers');
-
+var privileges = require('../privileges');
 var sockets = require('../socket.io');
 
 var authenticationController = module.exports;
@@ -404,6 +404,9 @@ authenticationController.localLogin = function (req, username, password, next) {
 				banned: function (next) {
 					user.isBanned(uid, next);
 				},
+				hasLoginPrivilege: function (next) {
+					privileges.global.can('local:login', uid, next);
+				},
 			}, next);
 		},
 		function (result, next) {
@@ -412,7 +415,7 @@ authenticationController.localLogin = function (req, username, password, next) {
 				isAdminOrGlobalMod: result.isAdminOrGlobalMod,
 			});
 
-			if (!result.isAdminOrGlobalMod && parseInt(meta.config.allowLocalLogin, 10) === 0) {
+			if (parseInt(uid, 10) && !result.hasLoginPrivilege) {
 				return next(new Error('[[error:local-login-disabled]]'));
 			}
 

src/controllers/index.js

@@ -7,6 +7,7 @@ var validator = require('validator');
 var meta = require('../meta');
 var user = require('../user');
 var plugins = require('../plugins');
+var privileges = require('../privileges');
 var helpers = require('./helpers');
 
 var Controllers = module.exports;
@@ -106,7 +107,6 @@ Controllers.login = function (req, res, next) {
 
 	data.alternate_logins = loginStrategies.length > 0;
 	data.authentication = loginStrategies;
-	data.allowLocalLogin = parseInt(meta.config.allowLocalLogin, 10) === 1 || parseInt(req.query.local, 10) === 1;
 	data.allowRegistration = registrationType === 'normal' || registrationType === 'admin-approval' || registrationType === 'admin-approval-ip';
 	data.allowLoginWith = '[[login:' + allowLoginWith + ']]';
 	data.breadcrumbs = helpers.buildBreadcrumbs([{
@@ -115,26 +115,33 @@ Controllers.login = function (req, res, next) {
 	data.error = req.flash('error')[0] || errorText;
 	data.title = '[[pages:login]]';
 
-	if (!data.allowLocalLogin && !data.allowRegistration && data.alternate_logins && data.authentication.length === 1) {
-		if (res.locals.isAPI) {
-			return helpers.redirect(res, {
-				external: nconf.get('relative_path') + data.authentication[0].url,
-			});
+	privileges.global.canGroup('local:login', 'registered-users', function (err, hasLoginPrivilege) {
+		if (err) {
+			return next(err);
 		}
-		return res.redirect(nconf.get('relative_path') + data.authentication[0].url);
-	}
-	if (req.loggedIn) {
-		user.getUserFields(req.uid, ['username', 'email'], function (err, user) {
-			if (err) {
-				return next(err);
+
+		data.allowLocalLogin = hasLoginPrivilege || parseInt(req.query.local, 10) === 1;
+		if (!data.allowLocalLogin && !data.allowRegistration && data.alternate_logins && data.authentication.length === 1) {
+			if (res.locals.isAPI) {
+				return helpers.redirect(res, {
+					external: nconf.get('relative_path') + data.authentication[0].url,
+				});
 			}
-			data.username = allowLoginWith === 'email' ? user.email : user.username;
-			data.alternate_logins = false;
+			return res.redirect(nconf.get('relative_path') + data.authentication[0].url);
+		}
+		if (req.loggedIn) {
+			user.getUserFields(req.uid, ['username', 'email'], function (err, user) {
+				if (err) {
+					return next(err);
+				}
+				data.username = allowLoginWith === 'email' ? user.email : user.username;
+				data.alternate_logins = false;
+				res.render('login', data);
+			});
+		} else {
 			res.render('login', data);
-		});
-	} else {
-		res.render('login', data);
-	}
+		}
+	});
 };
 
 Controllers.register = function (req, res, next) {

src/install.js

@@ -381,7 +381,10 @@ function createGlobalModeratorsGroup(next) {
 
 function giveGlobalPrivileges(next) {
 	var privileges = require('./privileges');
-	var defaultPrivileges = ['chat', 'upload:post:image', 'signature', 'search:content', 'search:users', 'search:tags'];
+	var defaultPrivileges = [
+		'chat', 'upload:post:image', 'signature', 'search:content',
+		'search:users', 'search:tags', 'local:login',
+	];
 	privileges.global.give(defaultPrivileges, 'registered-users', next);
 }
 

src/privileges/global.js

@@ -21,6 +21,7 @@ module.exports = function (privileges) {
 		{ name: '[[admin/manage/privileges:search-content]]' },
 		{ name: '[[admin/manage/privileges:search-users]]' },
 		{ name: '[[admin/manage/privileges:search-tags]]' },
+		{ name: '[[admin/manage/privileges:allow-local-login]]' },
 	];
 
 	privileges.global.userPrivilegeList = [
@@ -32,6 +33,7 @@ module.exports = function (privileges) {
 		'search:content',
 		'search:users',
 		'search:tags',
+		'local:login',
 	];
 
 	privileges.global.groupPrivilegeList = privileges.global.userPrivilegeList.map(function (privilege) {
@@ -111,6 +113,10 @@ module.exports = function (privileges) {
 		], callback);
 	};
 
+	privileges.global.canGroup = function (privilege, groupName, callback) {
+		groups.isMember(groupName, 'cid:0:privileges:groups:' + privilege, callback);
+	};
+
 	privileges.global.give = function (privileges, groupName, callback) {
 		helpers.giveOrRescind(groups.join, privileges, 0, groupName, callback);
 	};

src/upgrades/1.10.2/local_login_privileges.js

@@ -0,0 +1,17 @@
+'use strict';
+
+module.exports = {
+	name: 'Give global local login privileges',
+	timestamp: Date.UTC(2018, 8, 28),
+	method: function (callback) {
+		var meta = require('../../meta');
+		var privileges = require('../../privileges');
+		var allowLocalLogin = parseInt(meta.config.allowLocalLogin, 10) === 1;
+
+		if (allowLocalLogin) {
+			privileges.global.give(['local:login'], 'registered-users', callback);
+		} else {
+			callback();
+		}
+	},
+};

src/views/admin/settings/user.tpl

@@ -4,13 +4,6 @@
 	<div class="col-sm-2 col-xs-12 settings-header">[[admin/settings/user:authentication]]</div>
 	<div class="col-sm-10 col-xs-12">
 		<form role="form">
-			<div class="checkbox">
-				<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
-					<input class="mdl-switch__input" type="checkbox" data-field="allowLocalLogin" checked>
-					<span class="mdl-switch__label"><strong>[[admin/settings/user:allow-local-login]]</strong></span>
-				</label>
-			</div>
-
 			<div class="checkbox">
 				<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
 					<input class="mdl-switch__input" type="checkbox" data-field="requireEmailConfirmation">