fixing style

internal/golooseauth/browser.go

@@ -2,6 +2,7 @@
 package golooseauth
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/json"
@@ -28,15 +29,24 @@ const (
 	LogoutPath = "/api/auth/logout"
 )
 
+// Auth is the Go Loose browser client plus the session lookup the API needs.
+// The login, callback, and logout handlers come from the Go Loose client; this
+// type only adds a non-redirecting way to turn a request into a user, because
+// the client middleware answers anonymous requests with a redirect and the CMS
+// has to answer its own API with a status code.
 // Auth is the Go Loose browser client plus the session lookup the API needs.
 // The login, callback, and logout handlers come from the Go Loose client; this
 // type only adds a non-redirecting way to turn a request into a user, because
 // the client middleware answers anonymous requests with a redirect and the CMS
 // has to answer its own API with a status code.
 type Auth struct {
-	*goloose.BrowserAuth
-	baseURL    string
-	httpClient *http.Client
+	defaultAuth *goloose.BrowserAuth
+	urpiAuth    *goloose.BrowserAuth
+	devAuth     *goloose.BrowserAuth
+	baseURL     string
+	urpiBase    string
+	devBase     string
+	httpClient  *http.Client
 }
 
 // New returns the browser client for the configured Go Loose application, or a
@@ -64,7 +74,7 @@ func New(cfg config.GoLooseConfig) (*Auth, error) {
 		return nil, err
 	}
 	baseURL := "https://" + tenant + "." + authDomain
-	browser, err := goloose.NewBrowserAuth(goloose.BrowserAuthConfig{
+	defaultAuth, err := goloose.NewBrowserAuth(goloose.BrowserAuthConfig{
 		BaseURL:        baseURL,
 		ClientID:       cfg.ClientID,
 		ClientSecret:   cfg.ClientSecret,
@@ -79,12 +89,98 @@ func New(cfg config.GoLooseConfig) (*Auth, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &Auth{BrowserAuth: browser, baseURL: baseURL, httpClient: httpClient}, nil
+
+	urpiBase := "https://" + tenant + ".auth.urpi.be"
+	urpiAuth, _ := goloose.NewBrowserAuth(goloose.BrowserAuthConfig{
+		BaseURL:        urpiBase,
+		ClientID:       cfg.ClientID,
+		ClientSecret:   cfg.ClientSecret,
+		RedirectURL:    "https://tell.urpi.be" + CallbackPath,
+		AfterLoginURL:  "/",
+		AfterLogoutURL: "/",
+		LoginPath:      LoginPath,
+		CookieName:     SessionCookie,
+		CookieSecure:   true,
+		HTTPClient:     httpClient,
+	})
+
+	devBase := "https://" + tenant + ".auth.dev"
+	devAuth, _ := goloose.NewBrowserAuth(goloose.BrowserAuthConfig{
+		BaseURL:        devBase,
+		ClientID:       cfg.ClientID,
+		ClientSecret:   cfg.ClientSecret,
+		RedirectURL:    "https://tell.dev" + CallbackPath,
+		AfterLoginURL:  "/",
+		AfterLogoutURL: "/",
+		LoginPath:      LoginPath,
+		CookieName:     SessionCookie,
+		CookieSecure:   true,
+		HTTPClient:     httpClient,
+	})
+
+	return &Auth{
+		defaultAuth: defaultAuth,
+		urpiAuth:    urpiAuth,
+		devAuth:     devAuth,
+		baseURL:     baseURL,
+		urpiBase:    urpiBase,
+		devBase:     devBase,
+		httpClient:  httpClient,
+	}, nil
+}
+
+func (a *Auth) forRequest(r *http.Request) (*goloose.BrowserAuth, string) {
+	if r != nil {
+		host := strings.ToLower(r.Host)
+		if fwd := r.Header.Get("X-Forwarded-Host"); fwd != "" {
+			host = strings.ToLower(fwd)
+		}
+		if strings.Contains(host, "urpi.be") && a.urpiAuth != nil {
+			return a.urpiAuth, a.urpiBase
+		}
+		if (strings.Contains(host, "dev") || strings.Contains(host, "localhost")) && a.devAuth != nil {
+			return a.devAuth, a.devBase
+		}
+	}
+	if a.defaultAuth != nil {
+		return a.defaultAuth, a.baseURL
+	}
+	if a.devAuth != nil {
+		return a.devAuth, a.devBase
+	}
+	return a.urpiAuth, a.urpiBase
 }
 
 // Tenant reports the Go Loose tenant that owns the login.
 func (a *Auth) Tenant() string { return a.baseURL }
 
+func (a *Auth) LoginHandler(w http.ResponseWriter, r *http.Request) {
+	auth, _ := a.forRequest(r)
+	if auth != nil {
+		auth.LoginHandler(w, r)
+		return
+	}
+	http.Error(w, "auth provider unavailable", http.StatusServiceUnavailable)
+}
+
+func (a *Auth) CallbackHandler(w http.ResponseWriter, r *http.Request) {
+	auth, _ := a.forRequest(r)
+	if auth != nil {
+		auth.CallbackHandler(w, r)
+		return
+	}
+	http.Error(w, "auth provider unavailable", http.StatusServiceUnavailable)
+}
+
+func (a *Auth) LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	auth, _ := a.forRequest(r)
+	if auth != nil {
+		auth.LogoutHandler(w, r)
+		return
+	}
+	http.Error(w, "auth provider unavailable", http.StatusServiceUnavailable)
+}
+
 // SessionUser resolves the Go Loose session cookie of a request into a user.
 // Requests without a cookie, with a rejected session, or without a reachable
 // identity provider are simply not signed in.
@@ -96,11 +192,34 @@ func (a *Auth) SessionUser(r *http.Request) (goloose.User, bool) {
 	if err != nil || cookie.Value == "" {
 		return goloose.User{}, false
 	}
-	request, err := http.NewRequestWithContext(r.Context(), http.MethodGet, a.baseURL+"/connect/userinfo", nil)
+	_, targetBase := a.forRequest(r)
+	if user, ok := a.checkUser(r.Context(), targetBase, cookie.Value); ok {
+		return user, true
+	}
+	if targetBase != a.baseURL && a.baseURL != "" {
+		if user, ok := a.checkUser(r.Context(), a.baseURL, cookie.Value); ok {
+			return user, true
+		}
+	}
+	if targetBase != a.urpiBase && a.urpiBase != "" {
+		if user, ok := a.checkUser(r.Context(), a.urpiBase, cookie.Value); ok {
+			return user, true
+		}
+	}
+	if targetBase != a.devBase && a.devBase != "" {
+		if user, ok := a.checkUser(r.Context(), a.devBase, cookie.Value); ok {
+			return user, true
+		}
+	}
+	return goloose.User{}, false
+}
+
+func (a *Auth) checkUser(ctx context.Context, baseURL, token string) (goloose.User, bool) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, baseURL+"/connect/userinfo", nil)
 	if err != nil {
 		return goloose.User{}, false
 	}
-	request.Header.Set("Authorization", "Bearer "+cookie.Value)
+	request.Header.Set("Authorization", "Bearer "+token)
 	response, err := a.httpClient.Do(request)
 	if err != nil {
 		return goloose.User{}, false