Rewrite authentication forms to ipl forms

Removed description for `rememberme` input, because it wasn't
displayed anywhere.

Author: jrauh01

application/controllers/AuthenticationController.php

@@ -13,16 +13,18 @@
 use Icinga\Application\Logger;
 use Icinga\Authentication\LoginButton;
 use Icinga\Authentication\LoginButtonForm;
+use Icinga\Authentication\Auth;
+use Icinga\Authentication\User\ExternalBackend;
 use Icinga\Common\Database;
 use Icinga\Exception\AuthenticationException;
-use Icinga\Forms\Authentication\Cancel2FAForm;
 use Icinga\Forms\Authentication\Challenge2FAForm;
 use Icinga\Forms\Authentication\LoginForm;
 use Icinga\Web\Controller;
 use Icinga\Web\Helper\CookieHelper;
 use Icinga\Web\RememberMe;
 use Icinga\Web\Session;
 use Icinga\Web\Url;
+use ipl\Html\Contract\Form;
 use RuntimeException;
 use Throwable;
 
@@ -58,11 +60,47 @@ public function loginAction()
             && $user->getTwoFactorEnabled()
             && Session::getSession()->get('2fa_must_challenge_token', false)
         ) {
-            $form = new Challenge2FAForm();
-            $cancel2faForm = new Cancel2FAForm();
-            $cancel2faForm->handleRequest();
+            $form = (new Challenge2FAForm())
+                ->setAction(Url::fromRequest()->getAbsoluteUrl())
+                ->on(Form::ON_SUBMIT, function (Challenge2FAForm $form) {
+                    if ($redirectUrl = $form->getRedirectUrl()) {
+                        $this->redirectNow($redirectUrl);
+                    }
+                })
+                ->on(Form::ON_SENT, function (Challenge2FAForm $form) {
+                    $isCsrfValid = $form->getElement('CSRFToken')->isValid();
+                    $isCancelPressed = $form->getPressedSubmitElement()?->getName() === $form::SUBMIT_CANCEL;
+
+                    if ($isCsrfValid && $isCancelPressed) {
+                        Session::getSession()->purge();
+                        $this->redirectNow(Url::fromRequest());
+                    }
+                });
         } else {
-            $form = new LoginForm();
+            $form = (new LoginForm())
+                ->setAction(Url::fromRequest()->getAbsoluteUrl())
+                ->on(Form::ON_SUBMIT, function (LoginForm $form) {
+                    if ($redirectUrl = $form->getRedirectUrl()) {
+                        $this->redirectNow($redirectUrl);
+                    }
+                })
+                ->on(Form::ON_REQUEST, function ($request, LoginForm $form) {
+                    $auth = Auth::getInstance();
+                    $onlyExternal = true;
+                    // TODO(el): This may be set on the auth chain once iterated. See Auth::authExternal().
+                    foreach ($auth->getAuthChain() as $backend) {
+                        if (! $backend instanceof ExternalBackend) {
+                            $onlyExternal = false;
+                        }
+                    }
+                    if ($onlyExternal) {
+                        $form->addMessage($this->translate(
+                            'You\'re currently not authenticated using any of the web server\'s authentication'
+                            . 'mechanisms. Make sure you\'ll configure such, otherwise you\'ll not be able to login.'
+                        ));
+                        $form->onError();
+                    }
+                });
 
             if (RememberMe::hasCookie() && $this->hasDb()) {
                 $authenticated = false;
@@ -99,7 +137,7 @@ public function loginAction()
                     $this->httpBadRequest('nope');
                 }
             } else {
-                $redirectUrl = $form->getRedirectUrl();
+                $redirectUrl = $form->createRedirectUrl();
             }
 
             $this->redirectNow($redirectUrl);
@@ -114,7 +152,7 @@ public function loginAction()
                     ->sendResponse();
                 exit;
             }
-            $form->handleRequest();
+            $form->handleRequest(ServerRequest::fromGlobals());
         }
 
         $loginButtons = [];

application/forms/Authentication/Cancel2FAForm.php

@@ -6,24 +6,50 @@
 
 use Exception;
 use Icinga\Application\Hook\AuthenticationHook;
+use Icinga\Application\Icinga;
 use Icinga\Application\Logger;
 use Icinga\Authentication\Auth;
 use Icinga\Authentication\TwoFactorTotp;
+use Icinga\Common\Database;
+use Icinga\Web\Response;
 use Icinga\Web\Session;
 use Icinga\Web\Url;
+use ipl\Html\Attributes;
+use ipl\Html\FormDecoration\RenderElementDecorator;
+use ipl\Web\Common\CsrfCounterMeasure;
+use ipl\Web\Common\FormUid;
+use ipl\Web\Compat\CompatForm;
 
-class Challenge2FAForm extends LoginForm
+class Challenge2FAForm extends CompatForm
 {
-    public function init(): void
+    use CsrfCounterMeasure;
+    use Database;
+    use FormUid;
+
+    const SUBMIT_VERIFY = 'btn_submit_verify';
+
+    const SUBMIT_CANCEL = 'btn_submit_cancel';
+
+    public function __construct()
     {
-        $this->setRequiredCue(null);
-        $this->setName('form_challenge_2fa');
-        $this->setSubmitLabel($this->translate('Verify'));
-        $this->setProgressLabel($this->translate('Verifying'));
+        $this->addAttributes(Attributes::create(['name' => '2fa_challenge_form']));
     }
 
-    public function createElements(array $formData): void
+    /**
+     * Return the current Response
+     *
+     * @return Response
+     */
+    protected function getResponse(): Response
     {
+        return Icinga::app()->getFrontController()->getResponse();
+    }
+
+    protected function assemble(): void
+    {
+        $this->addCsrfCounterMeasure(Session::getSession()->getId());
+        $this->addElement($this->createUidElement());
+
         $this->addElement(
             'text',
             'token',
@@ -33,7 +59,31 @@ public function createElements(array $formData): void
                 'placeholder'    => $this->translate('Please enter your 2FA token'),
                 'autocomplete'   => 'off',
                 'autocapitalize' => 'off',
+                'decorators'     => [
+                    'RenderElement' => new RenderElementDecorator(),
+                    'Errors'        => ['name' => 'Errors', 'options' => ['class' => 'errors']]
+                ]
+            ]
+        );
 
+        $this->addElement(
+            'submit',
+            self::SUBMIT_VERIFY,
+            [
+                'data-progress-label' => $this->translate('Verifying'),
+                'label'               => $this->translate('Verify'),
+            ]
+        );
+
+        $this->addElement(
+            'submit',
+            self::SUBMIT_CANCEL,
+            [
+                'ignore'              => true,
+                'formnovalidate'      => true,
+                'class'               => 'btn-cancel',
+                'label'               => $this->translate('Cancel'),
+                'data-progress-label' => $this->translate('Canceling')
             ]
         );
 
@@ -46,7 +96,7 @@ public function createElements(array $formData): void
         );
     }
 
-    public function onSuccess(): bool
+    protected function onSuccess(): void
     {
         $user = Auth::getInstance()->getUser();
         $twoFactor = TwoFactorTotp::loadFromDb($this->getDb(), $user->getUsername());
@@ -73,11 +123,9 @@ public function onSuccess(): bool
 
             $this->getResponse()->setRerenderLayout(true);
 
-            return true;
+            $this->setRedirectUrl(Url::fromRequest());
         }
 
-        $this->getElement('token')->addError($this->translate('Token is invalid!'));
-
-        return false;
+        $this->getElement('token')->addMessage($this->translate('Token is invalid!'));
     }
 }