deploy configuration

internal/golooseauth/browser.go

@@ -0,0 +1,142 @@
+// Package golooseauth builds the Go Loose hosted-login client used by the CMS.
+package golooseauth
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	goloose "github.com/danyel/go-loose/client"
+
+	"github.com/danyel/go-tell/internal/config"
+)
+
+const (
+	// SessionCookie holds the Go Loose session token after a successful login.
+	SessionCookie = "go_loose_user_session"
+	// LoginPath starts the browser login flow.
+	LoginPath = "/api/auth/login"
+	// CallbackPath is the redirect URI registered with Go Loose.
+	CallbackPath = "/api/auth/callback"
+	// LogoutPath ends the browser session, locally and at the identity provider.
+	LogoutPath = "/api/auth/logout"
+)
+
+// Auth is the Go Loose browser client plus the session lookup the API needs.
+// The login, callback, and logout handlers come from the Go Loose client; this
+// type only adds a non-redirecting way to turn a request into a user, because
+// the client middleware answers anonymous requests with a redirect and the CMS
+// has to answer its own API with a status code.
+type Auth struct {
+	*goloose.BrowserAuth
+	baseURL    string
+	httpClient *http.Client
+}
+
+// New returns the browser client for the configured Go Loose application, or a
+// nil client when no credentials are set, which leaves the CMS with its other
+// identity sources. ClientID and ClientSecret are the values Go Loose shows once
+// when a client application is configured.
+func New(cfg config.GoLooseConfig) (*Auth, error) {
+	if !cfg.Enabled() {
+		return nil, nil
+	}
+	tenant := domain(cfg.Tenant)
+	if tenant == "" || strings.Contains(tenant, ".") {
+		return nil, fmt.Errorf("GO_LOOSE_TENANT must be a single lowercase tenant slug")
+	}
+	authDomain := domain(cfg.AuthDomain)
+	if authDomain == "" {
+		return nil, fmt.Errorf("GO_LOOSE_AUTH_DOMAIN is required when client credentials are configured")
+	}
+	appDomain := domain(cfg.AppDomain)
+	if appDomain == "" {
+		return nil, fmt.Errorf("GO_LOOSE_APP_DOMAIN is required when client credentials are configured")
+	}
+	httpClient, err := client(cfg.CAFile)
+	if err != nil {
+		return nil, err
+	}
+	baseURL := "https://" + tenant + "." + authDomain
+	browser, err := goloose.NewBrowserAuth(goloose.BrowserAuthConfig{
+		BaseURL:        baseURL,
+		ClientID:       cfg.ClientID,
+		ClientSecret:   cfg.ClientSecret,
+		RedirectURL:    "https://" + appDomain + CallbackPath,
+		AfterLoginURL:  "/",
+		AfterLogoutURL: "/",
+		LoginPath:      LoginPath,
+		CookieName:     SessionCookie,
+		CookieSecure:   true,
+		HTTPClient:     httpClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &Auth{BrowserAuth: browser, baseURL: baseURL, httpClient: httpClient}, nil
+}
+
+// Tenant reports the Go Loose tenant that owns the login.
+func (a *Auth) Tenant() string { return a.baseURL }
+
+// SessionUser resolves the Go Loose session cookie of a request into a user.
+// Requests without a cookie, with a rejected session, or without a reachable
+// identity provider are simply not signed in.
+func (a *Auth) SessionUser(r *http.Request) (goloose.User, bool) {
+	if a == nil {
+		return goloose.User{}, false
+	}
+	cookie, err := r.Cookie(SessionCookie)
+	if err != nil || cookie.Value == "" {
+		return goloose.User{}, false
+	}
+	request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, a.baseURL+"/connect/userinfo", nil)
+	if err != nil {
+		return goloose.User{}, false
+	}
+	request.Header.Set("Authorization", "Bearer "+cookie.Value)
+	response, err := a.httpClient.Do(request)
+	if err != nil {
+		return goloose.User{}, false
+	}
+	defer response.Body.Close()
+	var user goloose.User
+	if response.StatusCode != http.StatusOK ||
+		json.NewDecoder(io.LimitReader(response.Body, 1<<20)).Decode(&user) != nil {
+		return goloose.User{}, false
+	}
+	return user, true
+}
+
+// domain normalizes a configured host or tenant slug.
+func domain(value string) string {
+	return strings.Trim(strings.ToLower(strings.TrimSpace(value)), ".")
+}
+
+// client returns the HTTP client used to talk to Go Loose, trusting the extra
+// certificate authorities in caFile when one is configured. It is needed while
+// the identity domain is served by an internal certificate authority.
+func client(caFile string) (*http.Client, error) {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	if caFile != "" {
+		pem, err := os.ReadFile(caFile)
+		if err != nil {
+			return nil, fmt.Errorf("read Go Loose CA: %w", err)
+		}
+		pool, err := x509.SystemCertPool()
+		if err != nil || pool == nil {
+			pool = x509.NewCertPool()
+		}
+		if !pool.AppendCertsFromPEM(pem) {
+			return nil, fmt.Errorf("parse Go Loose CA %s", caFile)
+		}
+		transport.TLSClientConfig = &tls.Config{RootCAs: pool, MinVersion: tls.VersionTLS12}
+	}
+	return &http.Client{Timeout: 5 * time.Second, Transport: transport}, nil
+}