quartzgun/middleware/middleware.go

165 lines
4.4 KiB
Go

package middleware
import (
"context"
"fmt"
"net/http"
"nilfm.cc/git/quartzgun/auth"
"nilfm.cc/git/quartzgun/cookie"
"nilfm.cc/git/quartzgun/renderer"
"nilfm.cc/git/quartzgun/util"
"strings"
)
type TokenPayload struct {
AccessToken string `json:"access_token"`
TokenType string `json:"token_type"`
ExpiresIn int `json:"expires_in"`
}
func Protected(next http.Handler, method string, userStore auth.UserStore, login string) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
user, err := cookie.GetToken("user", req)
if err == nil {
session, err := cookie.GetToken("session", req)
if err == nil {
login, err := userStore.ValidateUser(user, session)
if err == nil && login {
fmt.Printf("authorized user: %s\n", user)
req.Method = method
next.ServeHTTP(w, req)
return
} else if err != nil && err.Error() == "Cookie or token expired"{
auth.Logout(user, userStore, w)
}
}
}
fmt.Printf("unauthorized...\n")
req.Method = http.MethodGet
http.Redirect(w, req, login, http.StatusSeeOther)
}
return http.HandlerFunc(handlerFunc)
}
func Bunt(next string, userStore auth.UserStore, denied string) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
user, err := cookie.GetToken("user", req)
if err == nil {
err := auth.Logout(
user,
userStore,
w)
if err == nil {
req.Method = http.MethodGet
http.Redirect(w, req, next, http.StatusSeeOther)
}
}
req.Method = http.MethodGet
http.Redirect(w, req, denied, http.StatusUnauthorized)
}
return http.HandlerFunc(handlerFunc)
}
func Authorize(next string, userStore auth.UserStore, denied string, ttl int) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
err := auth.Login(
req.FormValue("user"),
req.FormValue("password"),
userStore,
w,
ttl)
if err == nil {
req.Method = http.MethodGet
fmt.Printf("logged in as %s\n", req.FormValue("user"))
http.Redirect(w, req, next, http.StatusSeeOther)
} else {
fmt.Printf("login failed!\n")
req.Method = http.MethodGet
http.Redirect(w, req, denied, http.StatusSeeOther)
}
}
return http.HandlerFunc(handlerFunc)
}
func Provision(userStore auth.UserStore, ttl int) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
user, password, ok := req.BasicAuth()
if ok {
token, err := userStore.GrantToken(user, password, ttl)
if err == nil {
token := TokenPayload{
AccessToken: token,
TokenType: "bearer",
ExpiresIn: ttl,
}
util.AddContextValue(req, "token", token)
renderer.JSON("token").ServeHTTP(w, req)
return
}
}
w.Header().Add("WWW-Authenticate", "Basic")
w.WriteHeader(http.StatusUnauthorized)
return
}
return http.HandlerFunc(handlerFunc)
}
func Validate(next http.Handler, userStore auth.UserStore, scopes map[string]string) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
authHeader := req.Header.Get("Authorization")
if strings.HasPrefix(authHeader, "Bearer ") {
authToken := strings.Split(authHeader, "Bearer ")[1]
validated, err := userStore.ValidateTokenWithScopes(authToken, scopes)
if validated && err == nil {
next.ServeHTTP(w, req)
return
}
}
w.Header().Add("WWW-Authenticate", "Basic")
w.WriteHeader(http.StatusUnauthorized)
}
return http.HandlerFunc(handlerFunc)
}
func Fortify(next http.Handler) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
token, err := cookie.GetToken("csrfToken", req)
if err == nil {
*req = *req.WithContext(
context.WithValue(
req.Context(),
"csrfToken",
token))
}
next.ServeHTTP(w, req)
}
return http.HandlerFunc(handlerFunc)
}
func Defend(next http.Handler, userStore auth.UserStore, denied string) http.Handler {
handlerFunc := func(w http.ResponseWriter, req *http.Request) {
user, err := cookie.GetToken("user", req)
if err == nil {
masterToken, err := userStore.GetData(user, "csrfToken")
if err == nil {
cookieToken, err := cookie.GetToken("csrfToken", req)
if err == nil {
formToken := req.FormValue("csrfToken")
if formToken == cookieToken && formToken == masterToken.(string) {
next.ServeHTTP(w, req)
return
}
}
}
}
http.Redirect(w, req, denied, http.StatusUnauthorized)
}
return http.HandlerFunc(handlerFunc)
}