angel/inventory-plus-plus
1
0
Fork 0
Code Issues 34 Pull Requests Actions Packages Projects 4 Releases Wiki Activity

moved auth into middleware

Browse Source
This commit is contained in:
angel
2026-01-23 23:34:22 -07:00
parent 649595718c
commit e4069e18e2
6 changed files with 103 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/domains/authentication/auth.go
+7 -6
View File
@@ -44,18 +44,19 @@ type (
// AccessTokenClaims is the claims Auth0 provides in access tokens
AccessTokenClaims struct {
Audience string `json:"aud"`
Audience string `json:"aud"` // TODO: fill in from db
Expires int64 `json:"exp"`
Expiration time.Time `json:"-"` // parsed Expires
FamilyName string `json:"family_name"`
GivenName string `json:"given_name"`
IssuedAt int64 `json:"iat"`
Issuer string `json:"iss"`
IssuedAt int64 `json:"iat"` // TODO: fill in from db
Issuer string `json:"iss"` // TODO: fill in from db
Name string `json:"name"`
Nickname string `json:"nickname"`
Picture string `json:"picture"`
SessionID string `json:"sid"`
Subject string `json:"sub"`
UpdatedAt time.Time `json:"updated_at"`
SessionID string `json:"sid"` // TODO: fill in from db
Subject string `json:"sub"` // TODO: fill in from db
UpdatedAt time.Time `json:"updated_at"` // TODO: fill in from db
}
)
internal/domains/authentication/store.go
+7 -5
View File
@@ -95,7 +95,7 @@ func (a *Authenticator) DeleteOAuthTokens(ctx context.Context, accessToken strin
return nil
}
func (a *Authenticator) GetAccessTokenClaimsAndExpiration(ctx context.Context, accessToken string) (claims AccessTokenClaims, expiration time.Time, err error) {
func (a *Authenticator) GetAccessTokenClaimsAndExpiration(ctx context.Context, accessToken string) (claims AccessTokenClaims, err error) {
rows, err := a.db.Query(
ctx,
`
@@ -119,7 +119,7 @@ func (a *Authenticator) GetAccessTokenClaimsAndExpiration(ctx context.Context, a
},
)
if err != nil {
return AccessTokenClaims{}, time.Time{}, fmt.Errorf("failed to perform query: %w", err)
return AccessTokenClaims{}, fmt.Errorf("failed to perform query: %w", err)
}
type Row struct {
@@ -135,11 +135,13 @@ func (a *Authenticator) GetAccessTokenClaimsAndExpiration(ctx context.Context, a
r, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByNameLax[Row])
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return AccessTokenClaims{}, time.Time{}, consts.ErrNotFound
return AccessTokenClaims{}, consts.ErrNotFound
}
return AccessTokenClaims{}, time.Time{}, fmt.Errorf("failed to scan row: %w", err)
return AccessTokenClaims{}, fmt.Errorf("failed to scan row: %w", err)
}
claims.Expires = r.Expiry.Unix()
claims.Expiration = r.Expiry
claims.Name = r.Id_token_custom_claims_name
claims.Picture = r.Id_token_custom_claims_picture
claims.Nickname = r.Id_token_custom_claims_nickname
@@ -147,7 +149,7 @@ func (a *Authenticator) GetAccessTokenClaimsAndExpiration(ctx context.Context, a
claims.FamilyName = r.Id_token_custom_claims_family_name
claims.UpdatedAt = r.Id_token_custom_claims_updated_at
return claims, r.Expiry, nil
return claims, nil
}
func (a *Authenticator) getRefreshTokenForAccessToken(ctx context.Context, accessToken string) (refreshToken, tokenType string, err error) {
internal/server/api/sse/router.go
+1 -2
View File
@@ -29,7 +29,6 @@ func Routes(
r gin.IRouter,
logger *logging.Logger,
sq *sse.Queue,
auth *middleware.Auth,
) {
s := &sseRouter{
log: logger,
@@ -37,7 +36,7 @@ func Routes(
users: make(map[string][maxNumOpenConnectionsPerUser]context.CancelFunc),
}
r.GET("/", auth.AuthenticateAndAddIdentityGin(), response.Handler(s.serveEvents))
r.GET("/", response.Handler(s.serveEvents))
}
func (r *sseRouter) serveEvents(c *gin.Context) (response.Response, error) {
internal/server/api/templates/router.go
+4 -26
View File
@@ -29,7 +29,6 @@ type (
rawEvents *raw_events.Store
accts *accounts.Store
etsy *etsy_platform.Platform
authMiddleware *middleware.Auth
}
// ErrTemplateNotFound is returned if the reason the template failed to compile
@@ -41,12 +40,12 @@ type (
func SetupRoutes(
logger *logging.Logger,
r gin.IRouter,
r gin.IRoutes,
contentDir string,
rawEvents *raw_events.Store,
accts *accounts.Store,
etsy *etsy_platform.Platform,
authMiddleware *middleware.Auth,
auth *middleware.Auth,
) {
s := &webpageRouter{
@@ -93,31 +92,10 @@ func SetupRoutes(
rawEvents: rawEvents,
accts: accts,
etsy: etsy,
authMiddleware: authMiddleware,
}
authenticate := s.authMiddleware.AuthenticateAndAddIdentityToRequest()
r.GET("/*rest", response.Handler(func(c *gin.Context) (response.Response, error) {
c.Request.URL.Path = c.Request.URL.Path[3:]
defer func() {
c.Request.URL.Path = "/ui" + c.Request.URL.Path
}()
p := c.Request.URL.Path
if p == "/" || p == "" {
c, err := s.authMiddleware.AddIdentityToRequest(c)
if err != nil {
return nil, err
}
return s.serveTemplate(c)
}
if res, err := authenticate(c); res != nil || err != nil {
return res, err
}
return s.serveTemplate(c)
}))
r.GET("", response.Handler(s.serveTemplate))
r.GET("/*rest", response.Handler(auth.Authenticate()), response.Handler(s.serveTemplate))
}
// GET /
internal/server/middleware/auth.go
+45 -77
View File
@@ -52,91 +52,69 @@ func NewAuth(
}
}
func (a *Auth) AddIdentity(fn response.HandlerFunc) response.HandlerFunc {
return func(c *gin.Context) (response.Response, error) {
c, err := a.AddIdentityToRequest(c)
if err != nil {
return nil, err
}
return fn(c)
// AddIdentityToRequest will add an Identity to the context that can then be retrieved via GetIdentity.
func (a *Auth) AddIdentityToRequest(c *gin.Context) {
if err := a.addIdentityToRequest(c); err != nil {
c.Error(err)
c.Abort()
}
}
func (a *Auth) AddIdentityToRequest(c *gin.Context) (*gin.Context, error) {
func (a *Auth) addIdentityToRequest(c *gin.Context) error {
r := c.Request
ck, err := r.Cookie("access_token")
if err != nil {
return c, nil
return nil
}
ctx := r.Context()
accessToken := ck.Value
claims, expiration, err := a.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
claims, err := a.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
if err != nil {
if errors.Is(err, consts.ErrNotFound) {
return c, nil
return nil
}
return c, response.Errorf("failed to load authentication details: %w", err)
return response.Errorf("failed to load authentication details: %w", err)
}
expiration := claims.Expiration
if expiration.Before(time.Now()) {
return c, nil
return nil
}
user, acct, err := a.accts.GetUserAndAccountByAccessToken(ctx, accessToken)
if err != nil {
return c, response.Errorf("failed to load user and account defails: %w", err)
return response.Errorf("failed to load user and account defails: %w", err)
}
c.Request = r.WithContext(SetIdentity(ctx, Identity{
c.Request = r.WithContext(SetIdentity(c, Identity{
AccessToken: accessToken,
Claims: claims,
User: user,
Account: acct,
}))
return c, nil
return nil
}
// TODO: use the new middleware pattern
// auth middleware to verify access_token cookie and set custom claims in the request context
func (a *Auth) AuthenticateAndAddIdentityGin(assertions ...AuthorizationAssertions) gin.HandlerFunc {
fn := a.AuthenticateAndAddIdentityToRequest(assertions...)
return response.Handler(fn)
}
func (a *Auth) AuthenticateAndAddIdentityToRequest(assertions ...AuthorizationAssertions) response.HandlerFunc {
// Authenticate should only be used along with and after AddIdentityToRequest
// Typically used with response.Handler to make a gin.HandlerFunc.
func (a *Auth) Authenticate(assertions ...AuthorizationAssertions) func(c *gin.Context) (response.Response, error) {
return func(c *gin.Context) (response.Response, error) {
r := c.Request
ck, err := r.Cookie("access_token")
if err != nil {
return response.TemporaryRedirect("/").
JSON("no access_token cookie provided"), nil
}
ctx := r.Context()
accessToken := ck.Value
claims, expiration, err := a.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
if err != nil {
if errors.Is(err, consts.ErrNotFound) {
u, err := a.newLoginURL(ctx, a.auth, r.URL.String())
if err != nil {
return nil, response.Errorf("failed to generate login url: %w", err)
}
return response.TemporaryRedirect(u), nil
}
return nil, response.Errorf("failed to authenticate: %w", err)
id, ok := getIdentity(c)
if !ok {
return nil, response.Unauthorized().
HTML([]byte(`
<h1>Unauthorized</h1>
<a href="/">Return to app</a>
`)) // TODO: would be nice to have a better page for this
}
expiration := id.Claims.Expiration
now := time.Now()
// refresh tokens, when the access token is "old enough"
@@ -144,7 +122,7 @@ func (a *Auth) AuthenticateAndAddIdentityToRequest(assertions ...AuthorizationAs
// id token lifetime is 48 hours, allowing a person to use the app everyday comfortably, with wiggle room, without having to log in.
const idTokenLifetime = 48 * time.Hour
if refreshFloor := expiration.Add(-(idTokenLifetime / 4)); refreshFloor.Before(now) {
accessToken, expiration, err = a.auth.RefreshAccessToken(ctx, accessToken)
accessToken, expiration, err := a.auth.RefreshAccessToken(c, id.AccessToken)
if err != nil {
a.log.Warn("failed to refresh access token", "error", err)
return response.TemporaryRedirect("/").
@@ -153,65 +131,55 @@ func (a *Auth) AuthenticateAndAddIdentityToRequest(assertions ...AuthorizationAs
}
// 'redirect' to same url, to set the new access_token cookie
return response.TemporaryRedirect(r.URL.String()).
return response.TemporaryRedirect(c.Request.URL.String()).
Cookie(cookies.AccessToken(accessToken, expiration)), nil
}
// add identity info to request context
user, acct, err := a.accts.GetUserAndAccountByAccessToken(ctx, accessToken)
if err != nil {
return nil, response.Errorf("failed to authorize: %w", err)
}
for _, as := range assertions {
res, err := as(c)
if res != nil || err != nil {
if res, err := as(c); res != nil || err != nil {
return res, err
}
}
id := Identity{
AccessToken: accessToken,
Claims: claims,
User: user,
Account: acct,
}
c.Set(identityKeyString, id)
c.Request = r.WithContext(SetIdentity(ctx, id))
return nil, nil
}
}
type identityKey struct{}
const identityKeyString = "identity"
// stores identity in context
func SetIdentity(ctx context.Context, id Identity) context.Context {
c, ok := ctx.(*gin.Context)
if ok {
c.Set(identityKey{}, id)
ctx = c.Request.Context()
}
return context.WithValue(ctx, identityKey{}, id)
}
// get identity from context
func GetIdentity(ctx context.Context) Identity {
id, _ := getIdentity(ctx)
return id
}
func getIdentity(ctx context.Context) (Identity, bool) {
id, ok := ctx.Value(identityKey{}).(Identity)
if ok {
return id
return id, true
}
c, ok := ctx.(*gin.Context)
if !ok {
return Identity{}
return Identity{}, false
}
v, ok := c.Get(identityKeyString)
v, ok := c.Get(identityKey{})
if !ok {
return Identity{}
return Identity{}, false
}
id, _ = v.(Identity)
id, ok = v.(Identity)
return id
return id, ok
}
internal/server/server.go
+30 -4
View File
@@ -79,7 +79,11 @@ func NewRouter(
// kind of a dumb way to capture routes for webpages
templates_api.SetupRoutes(
logger.WithGroup("templates"),
r.Group("/ui"),
r.Group(
"/ui",
stripPrefix("/ui"),
authMiddleware.AddIdentityToRequest,
),
contentDir,
rawEvents,
accts,
@@ -107,13 +111,20 @@ func NewRouter(
auth,
)
sse_api.Routes(
api.Group("/events"),
api.Group(
"/events",
authMiddleware.AddIdentityToRequest,
response.Handler(authMiddleware.Authenticate()),
),
apiLogger.WithGroup("/events"),
sq,
authMiddleware,
)
accounts_api.Routes(
api.Group("/accounts", authMiddleware.AuthenticateAndAddIdentityGin()),
api.Group(
"/accounts",
authMiddleware.AddIdentityToRequest,
response.Handler(authMiddleware.Authenticate()),
),
apiLogger.WithGroup("/accounts"),
accts,
unp.Group("/accounts"),
@@ -158,3 +169,18 @@ func fileServer(urlPrefix, dir string, beforeServe func(c *gin.Context)) gin.Han
// TODO: need a c.Next()?
}
}
func stripPrefix(prefix string) gin.HandlerFunc {
return func(c *gin.Context) {
if !strings.HasPrefix(c.Request.URL.Path, prefix) {
return
}
c.Request.URL.Path = c.Request.URL.Path[len(prefix):]
defer func() {
c.Request.URL.Path = prefix + c.Request.URL.Path
}()
c.Next()
}
}