89 lines
2.6 KiB
Go
89 lines
2.6 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/ultisuite/ulti-backend/internal/api/apiresponse"
|
|
"github.com/ultisuite/ulti-backend/internal/auth"
|
|
"github.com/ultisuite/ulti-backend/internal/securityaudit"
|
|
)
|
|
|
|
type ctxKey string
|
|
|
|
const claimsKey ctxKey = "claims"
|
|
|
|
func Auth(verifier *auth.Verifier, audit *securityaudit.Logger) func(http.Handler) http.Handler {
|
|
return func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if verifier == nil {
|
|
apiresponse.WriteError(w, r, http.StatusServiceUnavailable, apiresponse.CodeAuthUnavailable, "authentication unavailable", nil)
|
|
if audit != nil {
|
|
audit.Log(r.Context(), "system", securityaudit.ActionTokenRejected, map[string]any{
|
|
"reason": "verifier_unavailable",
|
|
"path": r.URL.Path,
|
|
"method": r.Method,
|
|
})
|
|
}
|
|
return
|
|
}
|
|
|
|
header := r.Header.Get("Authorization")
|
|
if header == "" {
|
|
apiresponse.WriteError(w, r, http.StatusUnauthorized, apiresponse.CodeAuthMissingAuthorization, "missing authorization header", nil)
|
|
if audit != nil {
|
|
audit.Log(r.Context(), "anonymous", securityaudit.ActionTokenRejected, map[string]any{
|
|
"reason": "missing_authorization_header",
|
|
"path": r.URL.Path,
|
|
"method": r.Method,
|
|
})
|
|
}
|
|
return
|
|
}
|
|
|
|
token, found := strings.CutPrefix(header, "Bearer ")
|
|
if !found {
|
|
apiresponse.WriteError(w, r, http.StatusUnauthorized, apiresponse.CodeAuthInvalidAuthorization, "invalid authorization header", nil)
|
|
if audit != nil {
|
|
audit.Log(r.Context(), "anonymous", securityaudit.ActionTokenRejected, map[string]any{
|
|
"reason": "invalid_authorization_header",
|
|
"path": r.URL.Path,
|
|
"method": r.Method,
|
|
})
|
|
}
|
|
return
|
|
}
|
|
|
|
claims, err := verifier.Verify(r.Context(), token)
|
|
if err != nil {
|
|
apiresponse.WriteError(w, r, http.StatusUnauthorized, apiresponse.CodeAuthInvalidToken, "invalid token", nil)
|
|
if audit != nil {
|
|
audit.Log(r.Context(), "anonymous", securityaudit.ActionTokenRejected, map[string]any{
|
|
"reason": "token_verification_failed",
|
|
"path": r.URL.Path,
|
|
"method": r.Method,
|
|
})
|
|
}
|
|
return
|
|
}
|
|
|
|
if audit != nil {
|
|
audit.Log(r.Context(), claims.Sub, securityaudit.ActionLogin, map[string]any{
|
|
"email": claims.Email,
|
|
"path": r.URL.Path,
|
|
"method": r.Method,
|
|
})
|
|
}
|
|
|
|
ctx := context.WithValue(r.Context(), claimsKey, claims)
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
}
|
|
|
|
func ClaimsFromContext(ctx context.Context) *auth.Claims {
|
|
claims, _ := ctx.Value(claimsKey).(*auth.Claims)
|
|
return claims
|
|
}
|