add email notificator with auth sender

2019-07-02 22:02:36 -05:00
parent af67ec0fc8
commit 24d685c4de
22 changed files with 766 additions and 94 deletions
@@ -0,0 +1,12 @@
+// +build riscv64
+
+package bbolt
+
+// maxMapSize represents the largest mmap size supported by Bolt.
+const maxMapSize = 0xFFFFFFFFFFFF // 256TB
+
+// maxAllocSize is the size used when creating array pointers.
+const maxAllocSize = 0x7FFFFFFF
+
+// Are unaligned load/stores broken on this arch?
+var brokenUnaligned = true
@@ -121,6 +121,7 @@ type DB struct {
 	AllocSize int

 	path     string
+	openFile func(string, int, os.FileMode) (*os.File, error)
 	file     *os.File
 	dataref  []byte // mmap'ed readonly, write throws SEGV
 	data     *[maxMapSize]byte
@@ -199,10 +200,15 @@ func Open(path string, mode os.FileMode, options *Options) (*DB, error) {
 		db.readOnly = true
 	}

+	db.openFile = options.OpenFile
+	if db.openFile == nil {
+		db.openFile = os.OpenFile
+	}
+
 	// Open data file and separate sync handler for metadata writes.
 	db.path = path
 	var err error
-	if db.file, err = os.OpenFile(db.path, flag|os.O_CREATE, mode); err != nil {
+	if db.file, err = db.openFile(db.path, flag|os.O_CREATE, mode); err != nil {
 		_ = db.close()
 		return nil, err
 	}
@@ -1054,6 +1060,10 @@ type Options struct {
 	// set directly on the DB itself when returned from Open(), but this option
 	// is useful in APIs which expose Options but not the underlying DB.
 	NoSync bool
+
+	// OpenFile is used to open files. It defaults to os.OpenFile. This option
+	// is useful for writing hermetic tests.
+	OpenFile func(string, int, os.FileMode) (*os.File, error)
 }

 // DefaultOptions represent the options used if nil options are passed into Open().
@@ -349,6 +349,28 @@ func (f *freelist) reload(p *page) {
 	f.readIDs(a)
 }

+// noSyncReload reads the freelist from pgids and filters out pending items.
+func (f *freelist) noSyncReload(pgids []pgid) {
+	// Build a cache of only pending pages.
+	pcache := make(map[pgid]bool)
+	for _, txp := range f.pending {
+		for _, pendingID := range txp.ids {
+			pcache[pendingID] = true
+		}
+	}
+
+	// Check each page in the freelist and build a new available freelist
+	// with any pages not in the pending lists.
+	var a []pgid
+	for _, id := range pgids {
+		if !pcache[id] {
+			a = append(a, id)
+		}
+	}
+
+	f.readIDs(a)
+}
+
 // reindex rebuilds the free cache based on available and pending free lists.
 func (f *freelist) reindex() {
 	ids := f.getFreePageIDs()
@@ -254,17 +254,36 @@ func (tx *Tx) Rollback() error {
 	if tx.db == nil {
 		return ErrTxClosed
 	}
-	tx.rollback()
+	tx.nonPhysicalRollback()
 	return nil
 }

+// nonPhysicalRollback is called when user calls Rollback directly, in this case we do not need to reload the free pages from disk.
+func (tx *Tx) nonPhysicalRollback() {
+	if tx.db == nil {
+		return
+	}
+	if tx.writable {
+		tx.db.freelist.rollback(tx.meta.txid)
+	}
+	tx.close()
+}
+
+// rollback needs to reload the free pages from disk in case some system error happens like fsync error.
 func (tx *Tx) rollback() {
 	if tx.db == nil {
 		return
 	}
 	if tx.writable {
 		tx.db.freelist.rollback(tx.meta.txid)
-		tx.db.freelist.reload(tx.db.page(tx.db.meta().freelist))
+		if !tx.db.hasSyncedFreelist() {
+			// Reconstruct free page list by scanning the DB to get the whole free page list.
+			// Note: scaning the whole db is heavy if your db size is large in NoSyncFreeList mode.
+			tx.db.freelist.noSyncReload(tx.db.freepages())
+		} else {
+			// Read free page list from freelist page.
+			tx.db.freelist.reload(tx.db.page(tx.db.meta().freelist))
+		}
 	}
 	tx.close()
 }
@@ -315,7 +334,7 @@ func (tx *Tx) Copy(w io.Writer) error {
 // If err == nil then exactly tx.Size() bytes will be written into the writer.
 func (tx *Tx) WriteTo(w io.Writer) (n int64, err error) {
 	// Attempt to open reader with WriteFlag
-	f, err := os.OpenFile(tx.db.path, os.O_RDONLY|tx.WriteFlag, 0)
+	f, err := tx.db.openFile(tx.db.path, os.O_RDONLY|tx.WriteFlag, 0)
 	if err != nil {
 		return 0, err
 	}
@@ -369,7 +388,7 @@ func (tx *Tx) WriteTo(w io.Writer) (n int64, err error) {
 // A reader transaction is maintained during the copy so it is safe to continue
 // using the database while a copy is in progress.
 func (tx *Tx) CopyFile(path string, mode os.FileMode) error {
-	f, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, mode)
+	f, err := tx.db.openFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, mode)
 	if err != nil {
 		return err
 	}
@@ -4,13 +4,14 @@ services:
  - mongodb

 go:
-  - "1.11.x"
+  - "1.12.x"

 install: true

 before_install:
  - export TZ=America/Chicago
-  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.13.2
+  - curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(go env GOPATH)/bin v1.17.1
+  - golangci-lint --version
  - go get github.com/mattn/goveralls
  - export MONGO_TEST=mongodb://127.0.0.1:27017
  - export PATH=$(pwd)/bin:$PATH
@@ -18,6 +19,6 @@ before_install:
 script:
  - GO111MODULE=on go get ./...
  - GO111MODULE=on go mod vendor
-  - GO111MODULE=on go test  -v -mod=vendor -covermode=count -coverprofile=profile.cov ./... || travis_terminate 1;
+  - GO111MODULE=on go test -v -mod=vendor -covermode=count -coverprofile=profile.cov ./... || travis_terminate 1;
  - golangci-lint run --tests=false  || travis_terminate 1;
  - $GOPATH/bin/goveralls -coverprofile=profile.cov -service=travis-ci
@@ -9,7 +9,8 @@ This library provides "social login" with Github, Google, Facebook and Yandex as
 - JWT stored in a secure cookie with XSRF protection. Cookies can be session-only
 - Minimal scopes with user name, id and picture (avatar) only
 - Direct authentication with user's provided credential checker
- Integrated avatar proxy with FS, boltdb and gridfs storages
+- Verified authentication with user's provided sender (email, im, etc)
+- Integrated avatar proxy with FS, boltdb and gridfs storage
 - Support of user-defined storage for avatars
 - Identicon for default avatars  
 - Black list with user-defined validator
@@ -146,6 +147,41 @@ Such provider acts like any other, i.e. will be registered as `/auth/local/login
 The API for this provider - `GET /auth/<name>/login?user=<user>&passwd=<password>&aud=<site_id>&session=[1|0]`

 _note: password parameter doesn't have to be naked/real password and can be any kind of password hash prepared by caller._ 
+
+### Verified authentication
+
+Another non-oauth2 provider allowing user-confirmed authentication, for example by email or slack or telegram. This is 
+done by adding confirmed provider with `auth.AddVerifProvider`.
+ 
+```go
+    msgTemplate := "Confirmation email, token: {{.Token}}"
+	service.AddVerifProvider("email", msgTemplate, sender)
+```
+
+Message template may use the follow elements:
+
+- `{{.Address}}` - user address, for example email
+- `{{.User}}` - user name
+- `{{.Token}}` - confirmation token
+- `{{.Site}}` - site ID
+
+Sender should be provided by end-user and implements a single function interface
+
+```go
+type Sender interface {
+	Send(address string, text string) error
+}
+```
+
+For convenience a functional wrapper `SenderFunc` provided. Email sender provided in `provider/sender` package and can be 
+used as `Sender`.
+
+The API for this provider:
+
+ - `GET /auth/<name>/login?user=<user>&address=<adsress>&aud=<site_id>&from=<url>` - send confirmation request to user
+ - `GET /auth/<name>/login?token=<conf.token>&sess=[1|0]` - authorize with confirmation token
+
+The provider acts like any other, i.e. will be registered as `/auth/email/login`.
  
 ### Customization

@@ -267,6 +303,7 @@ _instructions for google oauth2 setup borrowed from [oauth2_proxy](https://githu
 For more details refer to [Yandex OAuth](https://tech.yandex.com/oauth/doc/dg/concepts/about-docpage/) and [Yandex.Passport](https://tech.yandex.com/passport/doc/dg/index-docpage/) API documentation.


+
 ## Status 

 The library extracted from [remark42](https://github.com/umputun/remark) project. The original code in production use on multiple sites and seems to work fine. 
@@ -26,6 +26,7 @@ type Service struct {
 	authMiddleware middleware.Authenticator
 	avatarProxy    *avatar.Proxy
 	issuer         string
+	useGravatar    bool
 }

 // Opts is a full set of all parameters to initialize Service
@@ -54,6 +55,7 @@ type Opts struct {
 	AvatarStore       avatar.Store // store to save/load avatars, required
 	AvatarResizeLimit int          // resize avatar's limit in pixels
 	AvatarRoutePath   string       // avatar routing prefix, i.e. "/api/v1/avatar", default `/avatar`
+	UseGravatar       bool         // for email based auth (verified provider) use gravatar service

 	AdminPasswd    string                  // if presented, allows basic auth with user admin and given password
 	AudienceReader token.Audience          // list of allowed aud values, default (empty) allows any
@@ -72,7 +74,8 @@ func NewService(opts Opts) (res *Service) {
 			AdminPasswd:  opts.AdminPasswd,
 			RefreshCache: opts.RefreshCache,
 		},
-		issuer: opts.Issuer,
+		issuer:      opts.Issuer,
+		useGravatar: opts.UseGravatar,
 	}

 	if opts.Issuer == "" {
@@ -235,6 +238,22 @@ func (s *Service) AddDirectProvider(name string, credChecker provider.CredChecke
 	s.authMiddleware.Providers = s.providers
 }

+// AddVerifProvider adds provider user's verification sent by sender
+func (s *Service) AddVerifProvider(name string, msgTmpl string, sender provider.Sender) {
+	dh := provider.VerifyHandler{
+		L:            s.logger,
+		ProviderName: name,
+		Issuer:       s.issuer,
+		TokenService: s.jwtService,
+		AvatarSaver:  s.avatarProxy,
+		Sender:       sender,
+		Template:     msgTmpl,
+		UseGravatar:  s.useGravatar,
+	}
+	s.providers = append(s.providers, provider.NewService(dh))
+	s.authMiddleware.Providers = s.providers
+}
+
 // DevAuth makes dev oauth2 server, for testing and development only!
 func (s *Service) DevAuth() (*provider.DevAuthServer, error) {
 	p, err := s.Provider("dev") // peak dev provider
@@ -4,6 +4,8 @@ package avatar

 import (
 	"bytes"
+	"crypto/md5"
+	"encoding/hex"
 	"image"
 	"image/png"
 	"io"
@@ -182,6 +184,25 @@ func GenerateAvatar(user string) ([]byte, error) {
 	return buf.Bytes(), err
 }

+// GetGravatarURL returns url to gravatar picture for given email
+func GetGravatarURL(email string) (res string, err error) {
+
+	hash := md5.Sum([]byte(email))
+	hexHash := hex.EncodeToString(hash[:])
+
+	client := http.Client{Timeout: 1 * time.Second}
+	res = "https://www.gravatar.com/avatar/" + hexHash + ".jpg"
+	resp, err := client.Get(res + "?d=404&s=80")
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return "", errors.New(resp.Status)
+	}
+	return res, nil
+}
+
 func retry(retries int, delay time.Duration, fn func() error) (err error) {
 	for i := 0; i < retries; i++ {
 		if err = fn(); err == nil {
@@ -1,22 +1,22 @@
 module github.com/go-pkgz/auth

 require (
-	cloud.google.com/go v0.34.0 // indirect
-	github.com/boltdb/bolt v1.3.1 // indirect
-	github.com/coreos/bbolt v1.3.0
+	cloud.google.com/go v0.40.0 // indirect
+	github.com/coreos/bbolt v1.3.3
 	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8
-	github.com/go-pkgz/mongo v1.0.0
-	github.com/go-pkgz/rest v1.2.0
+	github.com/go-pkgz/lgr v0.6.2 // indirect
+	github.com/go-pkgz/mongo v1.1.2
+	github.com/go-pkgz/rest v1.4.1
 	github.com/kr/pretty v0.1.0 // indirect
 	github.com/nullrocks/identicon v0.0.0-20180626043057-7875f45b0022
 	github.com/pkg/errors v0.8.1
 	github.com/stretchr/testify v1.3.0
-	golang.org/x/image v0.0.0-20181116024801-cd38e8056d9b
-	golang.org/x/net v0.0.0-20190107210223-45ffb0cd1ba0 // indirect
-	golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890
-	golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 // indirect
-	golang.org/x/sys v0.0.0-20190109145017-48ac38b7c8cb // indirect
-	google.golang.org/appengine v1.4.0 // indirect
+	go.etcd.io/bbolt v1.3.3 // indirect
+	golang.org/x/image v0.0.0-20190523035834-f03afa92d3ff
+	golang.org/x/net v0.0.0-20190611141213-3f473d35a33a // indirect
+	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
+	golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae // indirect
+	google.golang.org/appengine v1.6.1 // indirect
 	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
 )
@@ -1,24 +1,45 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0 h1:eOI3/cP2VTU6uZLDYAoic+eyzzB9YyGmJ7eIjl8rOPg=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
-github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
-github.com/coreos/bbolt v1.3.0 h1:HIgH5xUWXT914HCI671AxuTTqjj64UOFr7pHn48LUTI=
-github.com/coreos/bbolt v1.3.0/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.40.0 h1:FjSY7bOj+WzJe6TZRVtXI2b9kAYvtNg4lMbcH2+MUkk=
+cloud.google.com/go v0.40.0/go.mod h1:Tk58MuI9rbLMKlAjeO/bDnteAx7tX2gJIXw4T5Jwlro=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.3 h1:n6AiVyVRKQFNb6mJlwESEvvLoDyiTzXX7ORAUlkeBdY=
+github.com/coreos/bbolt v1.3.3/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/globalsign/mgo v0.0.0-20180615134936-113d3961e731/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8 h1:DujepqpGd1hyOd7aW59XpK7Qymp8iy83xq74fLr21is=
 github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
-github.com/go-pkgz/mongo v1.0.0 h1:9jijAK7prCRMetiyTu3c1rv/2lMypzuf2DWcVpTlwzw=
-github.com/go-pkgz/mongo v1.0.0/go.mod h1:R9si/F2aJsjz4MUxhzuppIHY8yLV3YCeuCpgcI50cu4=
-github.com/go-pkgz/rest v1.2.0 h1:75GVv25NmkV2l4dBr/io/ZApJ6zWQu5aZ4wFJA6QQCw=
-github.com/go-pkgz/rest v1.2.0/go.mod h1:COazNj35u3RXAgQNBr6neR599tYP3URiOpsu9p0rOtk=
+github.com/go-pkgz/lgr v0.2.2/go.mod h1:hBM1NM/SoYdlrykgdgJWGrZ/TM/XaZIjRbJfx7NkMm8=
+github.com/go-pkgz/lgr v0.6.2 h1:Twf2YIe2J5tg7mKs+IkDDxrDF7GWlTCl/LzqELWjT5o=
+github.com/go-pkgz/lgr v0.6.2/go.mod h1:hBM1NM/SoYdlrykgdgJWGrZ/TM/XaZIjRbJfx7NkMm8=
+github.com/go-pkgz/mongo v1.1.2 h1:2Vqn3CWQJkkx4gxxDiQUitAW2FN/CH26lKHkipmpKcc=
+github.com/go-pkgz/mongo v1.1.2/go.mod h1:0NkWnzpiUxoL5fYZuttCtJrpC67oNDidfYxcdPqHTf0=
+github.com/go-pkgz/rest v1.4.1 h1:DmaVLPH2O7yLehrWOW0uz01d2mVHz9fBR/iuTiPRzaw=
+github.com/go-pkgz/rest v1.4.1/go.mod h1:COazNj35u3RXAgQNBr6neR599tYP3URiOpsu9p0rOtk=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/hashicorp/golang-lru v0.5.0 h1:CL2msUPvZTLb5O648aiLNJw3hnBxN2+1Jq8rCOH9wdo=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -33,21 +54,78 @@ github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-golang.org/x/image v0.0.0-20181116024801-cd38e8056d9b h1:VHyIDlv3XkfCa5/a81uzaoDkHH4rr81Z62g+xlnO8uM=
-golang.org/x/image v0.0.0-20181116024801-cd38e8056d9b/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
+go.etcd.io/bbolt v1.3.3 h1:MUGmc65QhB3pIlaQ5bB4LwqSj6GIonVJXpZiaKNyaKk=
+go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/image v0.0.0-20190523035834-f03afa92d3ff h1:+2zgJKVDVAz/BWSsuniCmU1kLCjL88Z8/kv39xCI9NQ=
+golang.org/x/image v0.0.0-20190523035834-f03afa92d3ff/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190107210223-45ffb0cd1ba0 h1:1DW40AJQ7AP4nY6ORUGUdkpXyEC9W2GAXcOPaMZK0K8=
-golang.org/x/net v0.0.0-20190107210223-45ffb0cd1ba0/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890 h1:uESlIz09WIHT2I+pasSXcpLYqYK8wHcdCetU3VuMBJE=
-golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190611141213-3f473d35a33a h1:+KkCgOMgnKSgenxTBoiwkMqTiouMIy/3o8RLdmSbGoY=
+golang.org/x/net v0.0.0-20190611141213-3f473d35a33a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190109145017-48ac38b7c8cb h1:1w588/yEchbPNpa9sEvOcMZYbWHedwJjg4VOAdDHWHk=
-golang.org/x/sys v0.0.0-20190109145017-48ac38b7c8cb/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae h1:xiXzMMEQdQcric9hXtr1QU98MHunKK7OTtsoU6bYWs4=
+golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.6.0/go.mod h1:btoxGiFvQNVUZQ8W08zLtrVS08CNpINPEfxXxgJL1Q4=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1 h1:QzqyMA1tlu6CgqCDUtU9V+ZKhLFT2dkJuANu5QaxI3I=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190530194941-fb225487d101/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
@@ -69,9 +69,16 @@ func (p DirectHandler) LoginHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}

+	cid, err := randToken()
+	if err != nil {
+		rest.SendErrorJSON(w, r, p.L, http.StatusInternalServerError, err, "can't make token id")
+		return
+	}
+
 	claims := token.Claims{
 		User: &u,
 		StandardClaims: jwt.StandardClaims{
+			Id:       cid,
 			Issuer:   p.Issuer,
 			Audience: aud,
 		},
@@ -0,0 +1,151 @@
+package sender
+
+import (
+	"bytes"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/smtp"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/go-pkgz/auth/logger"
+)
+
+// Email implements sender interface for VerifyHandler
+// Uses common subject line and "from" for all messages
+type Email struct {
+	logger.L
+	SMTPClient
+	EmailParams
+}
+
+// EmailParams  with all needed to make new Email client with smtp
+type EmailParams struct {
+	Host        string // SMTP host
+	Port        int    // SMTP port
+	From        string // From email field
+	Subject     string // Email subject
+	ContentType string // Content type, optional. Will trigger MIME and Content-Type headers
+
+	TLS          bool   // TLS auth
+	SMTPUserName string // user name
+	SMTPPassword string // password
+	TimeOut      time.Duration
+}
+
+// SMTPClient interface defines subset of net/smtp used by email client
+type SMTPClient interface {
+	Mail(string) error
+	Auth(smtp.Auth) error
+	Rcpt(string) error
+	Data() (io.WriteCloser, error)
+	Quit() error
+	Close() error
+}
+
+// NewEmailClient creates email client with prepared smtp
+func NewEmailClient(p EmailParams, l logger.L) *Email {
+	return &Email{EmailParams: p, L: l, SMTPClient: nil}
+}
+
+// Send email with given text
+// If SMTPClient defined in Email struct it will be used, if not - new smtp.Client on each send.
+// Always closes client on completion or failure.
+func (em *Email) Send(to string, text string) error {
+
+	client := em.SMTPClient
+	if client == nil { // if client not set make new net/smtp
+		c, err := em.client()
+		if err != nil {
+			return errors.Wrap(err, "failed to make smtp client")
+		}
+		client = c
+	}
+
+	var quit bool
+	defer func() {
+		if quit { // quit set if Quit() call passed because it's closing connection as well.
+			return
+		}
+		if err := client.Close(); err != nil {
+			em.Logf("[WARN] can't close smtp connection, %v", err)
+		}
+	}()
+
+	if em.SMTPUserName != "" && em.SMTPPassword != "" {
+		auth := smtp.PlainAuth("", em.SMTPUserName, em.SMTPPassword, em.Host)
+		if err := client.Auth(auth); err != nil {
+			return errors.Wrapf(err, "failed to auth to smtp %s:%d", em.Host, em.Port)
+		}
+	}
+
+	if err := client.Mail(em.From); err != nil {
+		return errors.Wrapf(err, "bad from address %q", em.From)
+	}
+	if err := client.Rcpt(to); err != nil {
+		return errors.Wrapf(err, "bad to address %q", to)
+	}
+
+	writer, err := client.Data()
+	if err != nil {
+		return errors.Wrap(err, "can't make email writer")
+	}
+
+	buf := bytes.NewBufferString(em.buildMessage(text, to))
+	if _, err = buf.WriteTo(writer); err != nil {
+		return errors.Wrapf(err, "failed to send email body to %q", to)
+	}
+	if err = writer.Close(); err != nil {
+		em.Logf("[WARN] can't close smtp body writer, %v", err)
+	}
+
+	if err = client.Quit(); err != nil {
+		em.Logf("[WARN] failed to send quit command to %s:%d, %v", em.Host, em.Port, err)
+	} else {
+		quit = true
+	}
+	return nil
+}
+
+func (em *Email) client() (c *smtp.Client, err error) {
+	srvAddress := fmt.Sprintf("%s:%d", em.Host, em.Port)
+	if em.TLS {
+		tlsConf := &tls.Config{
+			InsecureSkipVerify: false,
+			ServerName:         em.Host,
+		}
+		conn, err := tls.Dial("tcp", srvAddress, tlsConf)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to dial smtp tls to %s", srvAddress)
+		}
+		if c, err = smtp.NewClient(conn, em.Host); err != nil {
+			return nil, errors.Wrapf(err, "failed to make smtp client for %s", srvAddress)
+		}
+		return c, nil
+	}
+
+	conn, err := net.DialTimeout("tcp", srvAddress, em.TimeOut)
+	if err != nil {
+		return nil, errors.Wrapf(err, "timeout connecting to %s", srvAddress)
+	}
+
+	c, err = smtp.NewClient(conn, srvAddress)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to dial")
+	}
+	return c, nil
+}
+
+func (em *Email) buildMessage(msg string, to string) (message string) {
+	message += fmt.Sprintf("From: %s\n", em.From)
+	message += fmt.Sprintf("To: %s\n", to)
+	message += fmt.Sprintf("Subject: %s\n", em.Subject)
+	if em.ContentType != "" {
+		message += fmt.Sprintf("MIME-version: 1.0;\nContent-Type: %s; charset=\"UTF-8\";\n", em.ContentType)
+	}
+	message += "\n" + msg
+	return message
+}
@@ -0,0 +1,202 @@
+package provider
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"net/http"
+	"strings"
+	"text/template"
+	"time"
+
+	"github.com/dgrijalva/jwt-go"
+	"github.com/go-pkgz/rest"
+	"github.com/pkg/errors"
+
+	"github.com/go-pkgz/auth/avatar"
+	"github.com/go-pkgz/auth/logger"
+	"github.com/go-pkgz/auth/token"
+)
+
+// VerifyHandler implements non-oauth2 provider authorizing users with some confirmation.
+// can be email, IM or anything else implementing Sender interface
+type VerifyHandler struct {
+	logger.L
+	ProviderName string
+	TokenService VerifTokenService
+	Issuer       string
+	AvatarSaver  AvatarSaver
+	Sender       Sender
+	Template     string
+	UseGravatar  bool
+}
+
+// Sender defines interface to send emails
+type Sender interface {
+	Send(address string, text string) error
+}
+
+// SenderFunc type is an adapter to allow the use of ordinary functions as Sender.
+type SenderFunc func(address string, text string) error
+
+// Send calls f(address,text) to implement Sender interface
+func (f SenderFunc) Send(address string, text string) error {
+	return f(address, text)
+}
+
+// TokenService defines interface accessing tokens
+type VerifTokenService interface {
+	Token(claims token.Claims) (string, error)
+	Parse(tokenString string) (claims token.Claims, err error)
+	Set(w http.ResponseWriter, claims token.Claims) (token.Claims, error)
+	Reset(w http.ResponseWriter)
+}
+
+// Name of the handler
+func (e VerifyHandler) Name() string { return e.ProviderName }
+
+// LoginHandler gets name and address from query, makes confirmation token and sends it to user.
+// In case if confirmation token presented in the query uses it to create auth token
+func (e VerifyHandler) LoginHandler(w http.ResponseWriter, r *http.Request) {
+
+	// GET /login?site=site&&user=name&address=someone@example.com
+	tkn := r.URL.Query().Get("token")
+	if tkn == "" { // no token, ask confirmation via email
+		e.sendConfirmation(w, r)
+		return
+	}
+
+	// confirmation token presented
+	// GET /login?token=confirmation-jwt&sess=1
+	confClaims, err := e.TokenService.Parse(tkn)
+	if err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusForbidden, err, "failed to verify confirmation token")
+		return
+	}
+
+	elems := strings.Split(confClaims.Handshake.ID, "::")
+	if len(elems) != 2 {
+		rest.SendErrorJSON(w, r, e.L, http.StatusBadRequest, errors.New(confClaims.Handshake.ID), "invalid handshake token")
+		return
+	}
+	user, address := elems[0], elems[1]
+	sessOnly := r.URL.Query().Get("sess") == "1"
+
+	u := token.User{
+		Name: user,
+		ID:   e.ProviderName + "_" + token.HashID(sha1.New(), address),
+	}
+	// try to get gravatar for email
+	if e.UseGravatar && strings.Contains(address, "@") { // TODO: better email check to avoid silly hits to gravatar api
+		if picURL, err := avatar.GetGravatarURL(address); err == nil {
+			u.Picture = picURL
+		}
+	}
+
+	if u, err = setAvatar(e.AvatarSaver, u); err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusInternalServerError, err, "failed to save avatar to proxy")
+		return
+	}
+
+	cid, err := randToken()
+	if err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusInternalServerError, err, "can't make token id")
+		return
+	}
+
+	claims := token.Claims{
+		User: &u,
+		StandardClaims: jwt.StandardClaims{
+			Id:       cid,
+			Issuer:   e.Issuer,
+			Audience: confClaims.Audience,
+		},
+		SessionOnly: sessOnly,
+	}
+
+	if _, err = e.TokenService.Set(w, claims); err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusInternalServerError, err, "failed to set token")
+		return
+	}
+	if confClaims.Handshake != nil && confClaims.Handshake.From != "" {
+		http.Redirect(w, r, confClaims.Handshake.From, http.StatusTemporaryRedirect)
+		return
+	}
+	rest.RenderJSON(w, r, claims.User)
+}
+
+// GET /login?site=site&&user=name&address=someone@example.com
+func (e VerifyHandler) sendConfirmation(w http.ResponseWriter, r *http.Request) {
+	user, address := r.URL.Query().Get("user"), r.URL.Query().Get("address")
+	if user == "" || address == "" {
+		rest.SendErrorJSON(w, r, e.L, http.StatusBadRequest, errors.New("wrong request"), "can't get user and address")
+		return
+	}
+	claims := token.Claims{
+		Handshake: &token.Handshake{
+			State: "",
+			From:  r.URL.Query().Get("from"),
+			ID:    user + "::" + address,
+		},
+		SessionOnly: r.URL.Query().Get("session") != "" && r.URL.Query().Get("session") != "0",
+		StandardClaims: jwt.StandardClaims{
+			Audience:  r.URL.Query().Get("site"),
+			ExpiresAt: time.Now().Add(30 * time.Minute).Unix(),
+			NotBefore: time.Now().Add(-1 * time.Minute).Unix(),
+			Issuer:    e.Issuer,
+		},
+	}
+
+	tkn, err := e.TokenService.Token(claims)
+	if err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusForbidden, err, "failed to make login token")
+		return
+	}
+
+	tmpl := msgTemplate
+	if e.Template != "" {
+		tmpl = e.Template
+	}
+	emailTmpl, err := template.New("confirm").Parse(tmpl)
+	if err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusInternalServerError, err, "can't parse confirmation template")
+		return
+	}
+
+	tmplData := struct {
+		User    string
+		Address string
+		Token   string
+		Site    string
+	}{
+		User:    user,
+		Address: address,
+		Token:   tkn,
+		Site:    r.URL.Query().Get("site"),
+	}
+	buf := bytes.Buffer{}
+	if err = emailTmpl.Execute(&buf, tmplData); err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusInternalServerError, err, "can't execute confirmation template")
+		return
+	}
+
+	if err := e.Sender.Send(address, buf.String()); err != nil {
+		rest.SendErrorJSON(w, r, e.L, http.StatusInternalServerError, err, "failed to send confirmation")
+		return
+	}
+
+	rest.RenderJSON(w, r, rest.JSON{"user": user, "address": address})
+}
+
+// AuthHandler doesn't do anything for direct login as it has no callbacks
+func (e VerifyHandler) AuthHandler(w http.ResponseWriter, r *http.Request) {}
+
+// LogoutHandler - GET /logout
+func (e VerifyHandler) LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	e.TokenService.Reset(w)
+}
+
+var msgTemplate = `
+Remark42 confirmation for {{.User}} {{.Address}}, site {{.Site}}
+
+Token: {{.Token}}
+`
@@ -13,6 +13,9 @@ before_install:

 script:
  - GO111MODULE=on go get ./...
+  - GO111MODULE=on go mod vendor
+  - GO111MODULE=on go test  -v -mod=vendor -covermode=count -coverprofile=profile.cov ./... || travis_terminate 1;
  - GO111MODULE=on go test -v -covermode=count -coverprofile=profile.cov ./... || travis_terminate 1;
-  - golangci-lint run || travis_terminate 1;
+  - golangci-lint run  || travis_terminate 1;
  - $GOPATH/bin/goveralls -coverprofile=profile.cov -service=travis-ci
+
@@ -170,12 +170,18 @@ func (l *Logger) logf(format string, args ...interface{}) {
 	// write to err as well for high levels, exit(1) on fatal and panic and dump stack on panic level
 	switch lv {
 	case "ERROR":
-		_, _ = l.stderr.Write(data)
+		if l.stderr != l.stdout {
+			_, _ = l.stderr.Write(data)
+		}
 	case "FATAL":
-		_, _ = l.stderr.Write(data)
+		if l.stderr != l.stdout {
+			_, _ = l.stderr.Write(data)
+		}
 		l.fatal()
 	case "PANIC":
-		_, _ = l.stderr.Write(data)
+		if l.stderr != l.stdout {
+			_, _ = l.stderr.Write(data)
+		}
 		_, _ = l.stderr.Write(getDump())
 		l.fatal()
 	}
@@ -224,7 +230,7 @@ func (l *Logger) reportCaller(calldepth int) (res callerInfo) {
 	}

 	_, pkgInfo := path.Split(path.Dir(filePath))
-	res.Pkg = pkgInfo
+	res.Pkg = strings.Split(pkgInfo, "@")[0] // remove version from package name

 	res.File = filePath
 	if pathElems := strings.Split(filePath, "/"); len(pathElems) > 2 {
@@ -294,10 +300,10 @@ func (l *Logger) formatLevel(lv string) string {
 func (l *Logger) extractLevel(line string) (level, msg string) {
 	for _, lv := range levels {
 		if strings.HasPrefix(line, lv) {
-			return lv, line[len(lv)+1:]
+			return lv, strings.TrimSpace(line[len(lv):])
 		}
 		if strings.HasPrefix(line, "["+lv+"]") {
-			return lv, line[len(lv)+3:]
+			return lv, strings.TrimSpace(line[len("["+lv+"]"):])
 		}
 	}
 	return "INFO", line