initial commit
This commit is contained in:
Daniel Noulet
commit
23816d00f7
71 changed files with 14497 additions and 0 deletions
237
backend/go-loose/client/webauth.go
Normal file
237
backend/go-loose/client/webauth.go
Normal file
|
|
@ -0,0 +1,237 @@
|
|||
package client
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/subtle"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
defaultSessionCookie = "go_loose_user_session"
|
||||
stateCookie = "go_loose_login_state"
|
||||
)
|
||||
|
||||
type BrowserAuthConfig struct {
|
||||
BaseURL string
|
||||
ClientID string
|
||||
ClientSecret string
|
||||
RedirectURL string
|
||||
AfterLoginURL string
|
||||
AfterLogoutURL string
|
||||
LoginPath string
|
||||
CookieName string
|
||||
CookieSecure bool
|
||||
HTTPClient *http.Client
|
||||
}
|
||||
|
||||
type BrowserAuth struct {
|
||||
config BrowserAuthConfig
|
||||
}
|
||||
|
||||
type User struct {
|
||||
ID string `json:"id"`
|
||||
Email string `json:"email"`
|
||||
DisplayName string `json:"display_name"`
|
||||
AvatarURL string `json:"avatar_url"`
|
||||
TenantID string `json:"tenant_id"`
|
||||
TenantSlug string `json:"tenant_slug"`
|
||||
ApplicationID string `json:"application_id"`
|
||||
Application string `json:"application"`
|
||||
// Role is the user's membership role in the owning tenant, for example
|
||||
// user, operator, developer, admin, or owner.
|
||||
Role string `json:"role"`
|
||||
// Permissions lists the capability names granted by Role, such as
|
||||
// "console.read", "keys.manage", or "profile.edit". Gate application
|
||||
// features on these instead of comparing role names.
|
||||
Permissions []string `json:"permissions"`
|
||||
}
|
||||
|
||||
// Can reports whether the role behind this session grants a capability.
|
||||
func (u User) Can(permission string) bool {
|
||||
for _, granted := range u.Permissions {
|
||||
if granted == permission {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
type userContextKey struct{}
|
||||
|
||||
func NewBrowserAuth(config BrowserAuthConfig) (*BrowserAuth, error) {
|
||||
if config.BaseURL == "" || config.ClientID == "" || config.ClientSecret == "" || config.RedirectURL == "" {
|
||||
return nil, errors.New("browser auth requires BaseURL, ClientID, ClientSecret, and RedirectURL")
|
||||
}
|
||||
redirect, err := url.Parse(config.RedirectURL)
|
||||
if err != nil || !redirect.IsAbs() {
|
||||
return nil, errors.New("RedirectURL must be absolute")
|
||||
}
|
||||
config.BaseURL = strings.TrimRight(config.BaseURL, "/")
|
||||
if config.AfterLoginURL == "" {
|
||||
config.AfterLoginURL = "/"
|
||||
}
|
||||
if config.AfterLogoutURL == "" {
|
||||
config.AfterLogoutURL = "/"
|
||||
}
|
||||
if config.LoginPath == "" {
|
||||
config.LoginPath = "/login"
|
||||
}
|
||||
if config.CookieName == "" {
|
||||
config.CookieName = defaultSessionCookie
|
||||
}
|
||||
if config.HTTPClient == nil {
|
||||
config.HTTPClient = &http.Client{Timeout: 5 * time.Second}
|
||||
}
|
||||
return &BrowserAuth{config: config}, nil
|
||||
}
|
||||
|
||||
func (a *BrowserAuth) LoginHandler(w http.ResponseWriter, r *http.Request) {
|
||||
state, err := randomValue(24)
|
||||
if err != nil {
|
||||
http.Error(w, "could not start login", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: stateCookie, Value: state, Path: callbackPath(a.config.RedirectURL),
|
||||
HttpOnly: true, Secure: a.config.CookieSecure, SameSite: http.SameSiteLaxMode, MaxAge: 600,
|
||||
})
|
||||
query := url.Values{
|
||||
"response_type": {"code"}, "client_id": {a.config.ClientID},
|
||||
"redirect_uri": {a.config.RedirectURL}, "state": {state},
|
||||
}
|
||||
http.Redirect(w, r, a.config.BaseURL+"/connect/authorize?"+query.Encode(), http.StatusFound)
|
||||
}
|
||||
|
||||
func (a *BrowserAuth) CallbackHandler(w http.ResponseWriter, r *http.Request) {
|
||||
state, err := r.Cookie(stateCookie)
|
||||
if err != nil || state.Value == "" || subtle.ConstantTimeCompare([]byte(state.Value), []byte(r.URL.Query().Get("state"))) != 1 {
|
||||
http.Error(w, "invalid login state", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
code := r.URL.Query().Get("code")
|
||||
if code == "" {
|
||||
http.Error(w, "authorization code missing", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
form := url.Values{
|
||||
"grant_type": {"authorization_code"}, "code": {code},
|
||||
"redirect_uri": {a.config.RedirectURL},
|
||||
}
|
||||
request, err := http.NewRequestWithContext(r.Context(), http.MethodPost, a.config.BaseURL+"/connect/token", strings.NewReader(form.Encode()))
|
||||
if err != nil {
|
||||
http.Error(w, "could not complete login", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
request.SetBasicAuth(a.config.ClientID, a.config.ClientSecret)
|
||||
response, err := a.config.HTTPClient.Do(request)
|
||||
if err != nil {
|
||||
http.Error(w, "identity service unavailable", http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
defer response.Body.Close()
|
||||
var tokenResponse struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
}
|
||||
if err := json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&tokenResponse); err != nil || response.StatusCode != http.StatusOK || tokenResponse.AccessToken == "" {
|
||||
http.Error(w, "authorization code exchange failed", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: a.config.CookieName, Value: tokenResponse.AccessToken, Path: "/",
|
||||
HttpOnly: true, Secure: a.config.CookieSecure, SameSite: http.SameSiteLaxMode,
|
||||
MaxAge: tokenResponse.ExpiresIn,
|
||||
})
|
||||
http.SetCookie(w, &http.Cookie{Name: stateCookie, Value: "", Path: callbackPath(a.config.RedirectURL), MaxAge: -1, HttpOnly: true})
|
||||
http.Redirect(w, r, a.config.AfterLoginURL, http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *BrowserAuth) LogoutHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var revokeErr error
|
||||
if cookie, err := r.Cookie(a.config.CookieName); err == nil {
|
||||
request, requestErr := http.NewRequestWithContext(r.Context(), http.MethodPost, a.config.BaseURL+"/connect/logout", nil)
|
||||
if requestErr != nil {
|
||||
revokeErr = requestErr
|
||||
} else {
|
||||
request.Header.Set("Authorization", "Bearer "+cookie.Value)
|
||||
response, responseErr := a.config.HTTPClient.Do(request)
|
||||
if responseErr != nil {
|
||||
revokeErr = responseErr
|
||||
} else {
|
||||
response.Body.Close()
|
||||
if response.StatusCode != http.StatusNoContent {
|
||||
revokeErr = fmt.Errorf("Go Loose logout returned HTTP %d", response.StatusCode)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: a.config.CookieName, Value: "", Path: "/", MaxAge: -1,
|
||||
HttpOnly: true, Secure: a.config.CookieSecure, SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
if revokeErr != nil {
|
||||
http.Error(w, "local session cleared, but central session revocation failed", http.StatusBadGateway)
|
||||
return
|
||||
}
|
||||
http.Redirect(w, r, a.config.AfterLogoutURL, http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *BrowserAuth) Middleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
cookie, err := r.Cookie(a.config.CookieName)
|
||||
if err != nil || cookie.Value == "" {
|
||||
http.Redirect(w, r, a.config.LoginPath, http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, a.config.BaseURL+"/connect/userinfo", nil)
|
||||
if err != nil {
|
||||
http.Error(w, "could not validate session", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
request.Header.Set("Authorization", "Bearer "+cookie.Value)
|
||||
response, err := a.config.HTTPClient.Do(request)
|
||||
if err != nil {
|
||||
http.Error(w, "identity service unavailable", http.StatusServiceUnavailable)
|
||||
return
|
||||
}
|
||||
defer response.Body.Close()
|
||||
var user User
|
||||
if response.StatusCode != http.StatusOK || json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&user) != nil {
|
||||
http.SetCookie(w, &http.Cookie{Name: a.config.CookieName, Value: "", Path: "/", MaxAge: -1, HttpOnly: true})
|
||||
http.Redirect(w, r, a.config.LoginPath, http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), userContextKey{}, user)))
|
||||
})
|
||||
}
|
||||
|
||||
func UserFromContext(ctx context.Context) (User, bool) {
|
||||
user, ok := ctx.Value(userContextKey{}).(User)
|
||||
return user, ok
|
||||
}
|
||||
|
||||
func randomValue(size int) (string, error) {
|
||||
value := make([]byte, size)
|
||||
if _, err := rand.Read(value); err != nil {
|
||||
return "", fmt.Errorf("generate random value: %w", err)
|
||||
}
|
||||
return base64.RawURLEncoding.EncodeToString(value), nil
|
||||
}
|
||||
|
||||
func callbackPath(rawURL string) string {
|
||||
parsed, err := url.Parse(rawURL)
|
||||
if err != nil || parsed.Path == "" {
|
||||
return "/"
|
||||
}
|
||||
return parsed.Path
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue