dnoulet/go-guess
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: deploy

Browse source
This commit is contained in:
Daniel Noulet 2026-10-03 04:39:14 +02:00
parent 560014d0b8
commit 9bbf8a96aa
16 changed files with 542 additions and 292 deletions
Download patch file Download diff file Expand all files Collapse all files

32
backend/internal/web/handler/sso.go
View file

@ -2,10 +2,12 @@ package handler
import (
"errors"
"fmt"
"net/http"
goloose "github.com/danyel/go-loose/client"
"github.com/danyel/go-guess/backend/internal/config"
"github.com/danyel/go-guess/backend/internal/golooseauth"
webmapper "github.com/danyel/go-guess/backend/internal/web/mapper"
webmodel "github.com/danyel/go-guess/backend/internal/web/model"
@ -14,6 +16,8 @@ import (
var (
errMissingSession = errors.New("missing Go Loose session")
errTenantMismatch = errors.New("Go Loose session does not match this tenant")
errLoginDisabled = errors.New("Go Loose browser login is not enabled")
errNoTenantHost = errors.New("this host does not identify a configured tenant")
)
func (h *Handler) SetBrowserAuth(auth *golooseauth.Registry) {
@ -28,27 +32,27 @@ func (h *Handler) AppDomain() string {
}
func (h *Handler) BeginExternalLogin(w http.ResponseWriter, r *http.Request) {
auth, ok := h.externalAuth(r)
auth, slug, ok := h.externalAuthWithSlug(r)
if !ok {
http.NotFound(w, r)
writeExternalAuthError(w, h, slug)
return
}
auth.LoginHandler(w, r)
}
func (h *Handler) CompleteExternalLogin(w http.ResponseWriter, r *http.Request) {
auth, ok := h.externalAuth(r)
auth, slug, ok := h.externalAuthWithSlug(r)
if !ok {
http.NotFound(w, r)
writeExternalAuthError(w, h, slug)
return
}
auth.CallbackHandler(w, r)
}
func (h *Handler) ExternalLogout(w http.ResponseWriter, r *http.Request) {
auth, ok := h.externalAuth(r)
auth, slug, ok := h.externalAuthWithSlug(r)
if !ok {
http.NotFound(w, r)
writeExternalAuthError(w, h, slug)
return
}
auth.LogoutHandler(w, r)
@ -57,7 +61,7 @@ func (h *Handler) ExternalLogout(w http.ResponseWriter, r *http.Request) {
func (h *Handler) ExternalSession(w http.ResponseWriter, r *http.Request) {
auth, slug, ok := h.externalAuthWithSlug(r)
if !ok {
http.NotFound(w, r)
writeExternalAuthError(w, h, slug)
return
}
if _, err := r.Cookie(golooseauth.SessionCookie); err != nil {
@ -90,3 +94,17 @@ func (h *Handler) externalAuthWithSlug(r *http.Request) (*goloose.BrowserAuth, s
}
return h.browser.ForHost(r.Host)
}
func writeExternalAuthError(w http.ResponseWriter, h *Handler, slug string) {
if h.browser == nil {
writeError(w, http.StatusNotFound, errLoginDisabled)
return
}
if slug == "" {
writeError(w, http.StatusNotFound, errNoTenantHost)
return
}
idEnv, secretEnv := config.GoLooseCredentialEnv(slug)
writeError(w, http.StatusServiceUnavailable,
fmt.Errorf("Go Loose login is not configured for tenant %q: set %s and %s, then restart the API", slug, idEnv, secretEnv))
}

46
backend/internal/web/router/router_test.go
View file

@ -341,6 +341,52 @@ func TestTenantHostLoginRedirectsToMatchingGoLooseClient(t *testing.T) {
}
}
func TestTenantHostLoginExplainsUnconfiguredGoLooseTenant(t *testing.T) {
h := newTestHandler(t, nil)
browser, err := golooseauth.New(config.GoLooseConfig{
AuthDomain: "auth.dev",
AppDomain: "guess.dev",
Tenants: map[string]config.GoLooseTenant{"nmbs": {ClientID: "glc_nmbs", ClientSecret: "secret"}},
})
if err != nil {
t.Fatal(err)
}
h.SetBrowserAuth(browser)
api := New(h, security.NewTokenManager("01234567890123456789012345678901", time.Hour), "http://localhost:5173")
request := httptest.NewRequest(http.MethodGet, "/api/auth/login", nil)
request.Host = "ypto.guess.dev"
response := httptest.NewRecorder()
api.ServeHTTP(response, request)
if response.Code != http.StatusServiceUnavailable ||
!strings.Contains(response.Body.String(), "GO_LOOSE_YPTO_CLIENT_ID") {
t.Fatalf("ypto login = %d %s", response.Code, response.Body.String())
}
request = httptest.NewRequest(http.MethodGet, "/api/auth/login", nil)
request.Host = "guess.dev"
response = httptest.NewRecorder()
api.ServeHTTP(response, request)
if response.Code != http.StatusNotFound || !strings.Contains(response.Body.String(), "tenant") {
t.Fatalf("apex login = %d %s", response.Code, response.Body.String())
}
}
func TestLoginWithoutGoLooseRegistryIsNotFound(t *testing.T) {
api := New(
newTestHandler(t, nil),
security.NewTokenManager("01234567890123456789012345678901", time.Hour),
"http://localhost:5173",
)
request := httptest.NewRequest(http.MethodGet, "/api/auth/login", nil)
request.Host = "nmbs.guess.dev"
response := httptest.NewRecorder()
api.ServeHTTP(response, request)
if response.Code != http.StatusNotFound || !strings.Contains(response.Body.String(), "not enabled") {
t.Fatalf("login without registry = %d %s", response.Code, response.Body.String())
}
}
type stubDriver struct{}
func (stubDriver) Open(string) (driver.Conn, error) { return stubConn{}, nil }