feat: deploy

backend/internal/web/handler/sso.go

@@ -2,10 +2,12 @@ package handler
 
 import (
 	"errors"
+	"fmt"
 	"net/http"
 
 	goloose "github.com/danyel/go-loose/client"
 
+	"github.com/danyel/go-guess/backend/internal/config"
 	"github.com/danyel/go-guess/backend/internal/golooseauth"
 	webmapper "github.com/danyel/go-guess/backend/internal/web/mapper"
 	webmodel "github.com/danyel/go-guess/backend/internal/web/model"
@@ -14,6 +16,8 @@ import (
 var (
 	errMissingSession = errors.New("missing Go Loose session")
 	errTenantMismatch = errors.New("Go Loose session does not match this tenant")
+	errLoginDisabled  = errors.New("Go Loose browser login is not enabled")
+	errNoTenantHost   = errors.New("this host does not identify a configured tenant")
 )
 
 func (h *Handler) SetBrowserAuth(auth *golooseauth.Registry) {
@@ -28,27 +32,27 @@ func (h *Handler) AppDomain() string {
 }
 
 func (h *Handler) BeginExternalLogin(w http.ResponseWriter, r *http.Request) {
-	auth, ok := h.externalAuth(r)
+	auth, slug, ok := h.externalAuthWithSlug(r)
 	if !ok {
-		http.NotFound(w, r)
+		writeExternalAuthError(w, h, slug)
 		return
 	}
 	auth.LoginHandler(w, r)
 }
 
 func (h *Handler) CompleteExternalLogin(w http.ResponseWriter, r *http.Request) {
-	auth, ok := h.externalAuth(r)
+	auth, slug, ok := h.externalAuthWithSlug(r)
 	if !ok {
-		http.NotFound(w, r)
+		writeExternalAuthError(w, h, slug)
 		return
 	}
 	auth.CallbackHandler(w, r)
 }
 
 func (h *Handler) ExternalLogout(w http.ResponseWriter, r *http.Request) {
-	auth, ok := h.externalAuth(r)
+	auth, slug, ok := h.externalAuthWithSlug(r)
 	if !ok {
-		http.NotFound(w, r)
+		writeExternalAuthError(w, h, slug)
 		return
 	}
 	auth.LogoutHandler(w, r)
@@ -57,7 +61,7 @@ func (h *Handler) ExternalLogout(w http.ResponseWriter, r *http.Request) {
 func (h *Handler) ExternalSession(w http.ResponseWriter, r *http.Request) {
 	auth, slug, ok := h.externalAuthWithSlug(r)
 	if !ok {
-		http.NotFound(w, r)
+		writeExternalAuthError(w, h, slug)
 		return
 	}
 	if _, err := r.Cookie(golooseauth.SessionCookie); err != nil {
@@ -90,3 +94,17 @@ func (h *Handler) externalAuthWithSlug(r *http.Request) (*goloose.BrowserAuth, s
 	}
 	return h.browser.ForHost(r.Host)
 }
+
+func writeExternalAuthError(w http.ResponseWriter, h *Handler, slug string) {
+	if h.browser == nil {
+		writeError(w, http.StatusNotFound, errLoginDisabled)
+		return
+	}
+	if slug == "" {
+		writeError(w, http.StatusNotFound, errNoTenantHost)
+		return
+	}
+	idEnv, secretEnv := config.GoLooseCredentialEnv(slug)
+	writeError(w, http.StatusServiceUnavailable,
+		fmt.Errorf("Go Loose login is not configured for tenant %q: set %s and %s, then restart the API", slug, idEnv, secretEnv))
+}