feat: transform circuitbreaker layer in authn-network layer

internal/config/layers.go

@@ -3,8 +3,8 @@ package config
 import "time"
 
 type LayersConfig struct {
-	Queue          QueueLayerConfig          `yaml:"queue"`
-	CircuitBreaker CircuitBreakerLayerConfig `yaml:"circuitbreaker"`
+	Queue QueueLayerConfig `yaml:"queue"`
+	Authn AuthnLayerConfig `yaml:"authn"`
 }
 
 func NewDefaultLayersConfig() LayersConfig {
@@ -13,8 +13,8 @@ func NewDefaultLayersConfig() LayersConfig {
 			TemplateDir:      "./layers/queue/templates",
 			DefaultKeepAlive: NewInterpolatedDuration(time.Minute),
 		},
-		CircuitBreaker: CircuitBreakerLayerConfig{
-			TemplateDir: "./layers/circuitbreaker/templates",
+		Authn: AuthnLayerConfig{
+			TemplateDir: "./layers/authn/templates",
 		},
 	}
 }
@@ -24,6 +24,6 @@ type QueueLayerConfig struct {
 	DefaultKeepAlive *InterpolatedDuration `yaml:"defaultKeepAlive"`
 }
 
-type CircuitBreakerLayerConfig struct {
+type AuthnLayerConfig struct {
 	TemplateDir InterpolatedString `yaml:"templateDir"`
 }

internal/proxy/director/layer/authn/layer-options.json

@@ -31,6 +31,24 @@
                 }
             },
             "additionalProperties": false
+        },
+        "templates": {
+            "title": "Options de configuration des templates utilisés en fonction de l'état de l'authentification",
+            "type": "object",
+            "properties": {
+                "forbidden": {
+                    "title": "Options de configuration de rendu de la page affichée en cas d'accès interdit (HTTP 403 Forbidden)",
+                    "type": "object",
+                    "properties": {
+                        "block": {
+                            "title": "Nom du bloc au sein du template à exécuter",
+                            "description": "Voir fichier 'layers/authn/templates/forbidden.gohtml'",
+                            "type": "string",
+                            "default": "default"
+                        }
+                    }
+                }
+            }
         }
     }
 }

internal/proxy/director/layer/authn/layer.go

@@ -1,12 +1,15 @@
 package authn
 
 import (
+	"html/template"
 	"net/http"
+	"path/filepath"
 
 	"forge.cadoles.com/Cadoles/go-proxy"
 	"forge.cadoles.com/Cadoles/go-proxy/wildcard"
 	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
 	"forge.cadoles.com/cadoles/bouncer/internal/store"
+	"github.com/Masterminds/sprig/v3"
 	"github.com/pkg/errors"
 	"gitlab.com/wpetit/goweb/logger"
 )
@@ -14,6 +17,8 @@ import (
 type Layer struct {
 	layerType store.LayerType
 	auth      Authenticator
+
+	templateDir string
 }
 
 func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
@@ -55,6 +60,11 @@ func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
 					return
 				}
 
+				if errors.Is(err, ErrForbidden) {
+					l.renderForbiddenPage(w, r, layer, options, user)
+					return
+				}
+
 				logger.Error(ctx, "could not authenticate user", logger.E(errors.WithStack(err)))
 				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 
@@ -62,6 +72,11 @@ func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
 			}
 
 			if err := l.injectHeaders(r, options, user); err != nil {
+				if errors.Is(err, ErrForbidden) {
+					l.renderForbiddenPage(w, r, layer, options, user)
+					return
+				}
+
 				logger.Error(ctx, "could not inject headers", logger.E(errors.WithStack(err)))
 				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 
@@ -74,6 +89,11 @@ func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
 						return
 					}
 
+					if errors.Is(err, ErrForbidden) {
+						l.renderForbiddenPage(w, r, layer, options, user)
+						return
+					}
+
 					logger.Error(ctx, "could not execute post-auth hook", logger.E(errors.WithStack(err)))
 					http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 
@@ -88,15 +108,58 @@ func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
 	}
 }
 
+func (l *Layer) renderForbiddenPage(w http.ResponseWriter, r *http.Request, layer *store.Layer, options *LayerOptions, user *User) {
+	w.WriteHeader(http.StatusForbidden)
+	l.renderPage(w, r, layer, "forbidden", options.Templates.Forbidden.Block, user)
+}
+
+func (l *Layer) renderPage(w http.ResponseWriter, r *http.Request, layer *store.Layer, page string, block string, user *User) {
+	ctx := r.Context()
+
+	pattern := filepath.Join(l.templateDir, page+".gohtml")
+
+	logger.Info(ctx, "loading authn templates", logger.F("pattern", pattern))
+
+	tmpl, err := template.New("").Funcs(sprig.FuncMap()).ParseGlob(pattern)
+	if err != nil {
+		logger.Error(ctx, "could not load authn templates", logger.E(errors.WithStack(err)))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+
+		return
+	}
+
+	templateData := struct {
+		Layer *store.Layer
+		User  *User
+	}{
+		Layer: layer,
+		User:  user,
+	}
+
+	w.Header().Add("Cache-Control", "no-cache")
+
+	w.WriteHeader(http.StatusOK)
+
+	if err := tmpl.ExecuteTemplate(w, block, templateData); err != nil {
+		logger.Error(ctx, "could not render authn page", logger.E(errors.WithStack(err)))
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+
+		return
+	}
+}
+
 // LayerType implements director.MiddlewareLayer
 func (l *Layer) LayerType() store.LayerType {
 	return l.layerType
 }
 
-func NewLayer(layerType store.LayerType, auth Authenticator) *Layer {
+func NewLayer(layerType store.LayerType, auth Authenticator, funcs ...OptionFunc) *Layer {
+	opts := NewOptions(funcs...)
+
 	return &Layer{
-		layerType: layerType,
-		auth:      auth,
+		layerType:   layerType,
+		auth:        auth,
+		templateDir: opts.TemplateDir,
 	}
 }
 

internal/proxy/director/layer/authn/layer_options.go

@@ -10,14 +10,23 @@ import (
 )
 
 type LayerOptions struct {
-	MatchURLs []string       `mapstructure:"matchURLs"`
-	Headers   HeadersOptions `mapstructure:"headers"`
+	MatchURLs []string         `mapstructure:"matchURLs"`
+	Headers   HeadersOptions   `mapstructure:"headers"`
+	Templates TemplatesOptions `mapstructure:"templates"`
 }
 
 type HeadersOptions struct {
 	Rules []string `mapstructure:"rules"`
 }
 
+type TemplatesOptions struct {
+	Forbidden TemplateOptions `mapstructure:"forbidden"`
+}
+
+type TemplateOptions struct {
+	Block string `mapstructure:"block"`
+}
+
 func DefaultLayerOptions() LayerOptions {
 	return LayerOptions{
 		MatchURLs: []string{"*"},
@@ -36,7 +45,13 @@ func DefaultLayerOptions() LayerOptions {
 				`,
 			},
 		},
+		Templates: TemplatesOptions{
+			Forbidden: TemplateOptions{
+				Block: "default",
+			},
+		},
 	}
+
 }
 
 func fromStoreOptions(storeOptions store.LayerOptions) (*LayerOptions, error) {

internal/proxy/director/layer/authn/network/authenticator.go

@@ -0,0 +1,83 @@
+package network
+
+import (
+	"context"
+	"net"
+	"net/http"
+
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/authn"
+	"forge.cadoles.com/cadoles/bouncer/internal/store"
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+type Authenticator struct {
+}
+
+// Authenticate implements authn.Authenticator.
+func (a *Authenticator) Authenticate(w http.ResponseWriter, r *http.Request, layer *store.Layer) (*authn.User, error) {
+	ctx := r.Context()
+
+	options, err := fromStoreOptions(layer.Options)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	matches, err := a.matchAnyAuthorizedCIDRs(ctx, r.RemoteAddr, options.AuthorizedCIDRs)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	user := authn.NewUser(r.RemoteAddr, map[string]any{})
+
+	if !matches {
+		metricForbiddenTotal.With(prometheus.Labels{
+			metricLabelLayer: string(layer.Name),
+			metricLabelProxy: string(layer.Proxy),
+		}).Add(1)
+
+		return user, errors.WithStack(authn.ErrForbidden)
+	}
+
+	metricAuthorizedTotal.With(prometheus.Labels{
+		metricLabelLayer: string(layer.Name),
+		metricLabelProxy: string(layer.Proxy),
+	}).Add(1)
+
+	return user, nil
+}
+
+func (a *Authenticator) matchAnyAuthorizedCIDRs(ctx context.Context, remoteHostPort string, CIDRs []string) (bool, error) {
+	remoteHost, _, err := net.SplitHostPort(remoteHostPort)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	remoteAddr := net.ParseIP(remoteHost)
+	if remoteAddr == nil {
+		return false, errors.Errorf("remote host '%s' is not a valid ip address", remoteHost)
+	}
+
+	for _, rawCIDR := range CIDRs {
+		_, net, err := net.ParseCIDR(rawCIDR)
+		if err != nil {
+			return false, errors.WithStack(err)
+		}
+
+		match := net.Contains(remoteAddr)
+		if !match {
+			continue
+		}
+
+		return true, nil
+	}
+
+	logger.Debug(ctx, "comparing remote host with authorized cidrs", logger.F("remoteAddr", remoteAddr))
+
+	return false, nil
+}
+
+var (
+	_ authn.Authenticator = &Authenticator{}
+)

internal/proxy/director/layer/authn/network/layer-options.json

@@ -0,0 +1,14 @@
+{
+    "type": "object",
+    "properties": {
+        "authorizedCIDRs": {
+            "title": "Liste des adresses réseau d'origine autorisées (au format CIDR)",
+            "default": [],
+            "type": "array",
+            "items": {
+                "type": "string"
+            }
+        }
+    },
+    "additionalProperties": false
+}

internal/proxy/director/layer/authn/network/layer.go

@@ -0,0 +1,12 @@
+package network
+
+import (
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/authn"
+	"forge.cadoles.com/cadoles/bouncer/internal/store"
+)
+
+const LayerType store.LayerType = "authn-network"
+
+func NewLayer(funcs ...authn.OptionFunc) *authn.Layer {
+	return authn.NewLayer(LayerType, &Authenticator{}, funcs...)
+}

internal/proxy/director/layer/authn/network/layer_options.go

@@ -1,20 +1,21 @@
-package circuitbreaker
+package network
 
 import (
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/authn"
 	"forge.cadoles.com/cadoles/bouncer/internal/store"
 	"github.com/mitchellh/mapstructure"
 	"github.com/pkg/errors"
 )
 
 type LayerOptions struct {
-	MatchURLs       []string `mapstructure:"matchURLs"`
+	authn.LayerOptions
 	AuthorizedCIDRs []string `mapstructure:"authorizedCIDRs"`
 	TemplateBlock   string   `mapstructure:"templateBlock"`
 }
 
 func fromStoreOptions(storeOptions store.LayerOptions) (*LayerOptions, error) {
 	layerOptions := LayerOptions{
-		MatchURLs:       []string{"*"},
+		LayerOptions:    authn.DefaultLayerOptions(),
 		AuthorizedCIDRs: []string{},
 		TemplateBlock:   "default",
 	}

internal/proxy/director/layer/authn/network/metrics.go

@@ -0,0 +1,31 @@
+package network
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+const (
+	metricNamespace  = "bouncer_layer_authn_network"
+	metricLabelProxy = "proxy"
+	metricLabelLayer = "layer"
+)
+
+var (
+	metricAuthorizedTotal = promauto.NewCounterVec(
+		prometheus.CounterOpts{
+			Name:      "authorized_total",
+			Help:      "Bouncer's authn-network layer total authorized accesses",
+			Namespace: metricNamespace,
+		},
+		[]string{metricLabelProxy, metricLabelLayer},
+	)
+	metricForbiddenTotal = promauto.NewCounterVec(
+		prometheus.CounterOpts{
+			Name:      "forbidden_total",
+			Help:      "Bouncer's authn-network layer total forbbiden accesses",
+			Namespace: metricNamespace,
+		},
+		[]string{metricLabelProxy, metricLabelLayer},
+	)
+)

internal/proxy/director/layer/authn/network/schema.go

@@ -1,4 +1,4 @@
-package circuitbreaker
+package network
 
 import (
 	_ "embed"

internal/proxy/director/layer/authn/options.go

@@ -1,4 +1,4 @@
-package circuitbreaker
+package authn
 
 type Options struct {
 	TemplateDir string
@@ -6,10 +6,16 @@ type Options struct {
 
 type OptionFunc func(*Options)
 
-func defaultOptions() *Options {
-	return &Options{
+func NewOptions(funcs ...OptionFunc) *Options {
+	opts := &Options{
 		TemplateDir: "./templates",
 	}
+
+	for _, fn := range funcs {
+		fn(opts)
+	}
+
+	return opts
 }
 
 func WithTemplateDir(templateDir string) OptionFunc {

internal/proxy/director/layer/circuitbreaker/layer-options.json

@@ -1,31 +0,0 @@
-{
-    "type": "object",
-    "properties": {
-        "matchURLs": {
-            "title": "Liste de filtrage des URLs sur lesquelles le layer est actif",
-            "description": "Par exemple, si vous souhaitez limiter votre layer à l'ensemble d'une section '`/blog`' d'un site, vous pouvez déclarer la valeur `['*/blog*']`. Les autres URLs du site ne seront pas affectées par ce layer.",
-            "default": [
-                "*"
-            ],
-            "type": "array",
-            "items": {
-                "type": "string"
-            }
-        },
-        "authorizedCIDRs": {
-            "title": "Liste des adressages réseau d'origine autorisés (au format CIDR)",
-            "default": [],
-            "type": "array",
-            "items": {
-                "type": "string"
-            }
-        },
-        "templateBlock": {
-            "title": "Nom du bloc au sein du template de la page d'information à rendre",
-            "default": "default",
-            "description": "Voir fichier layers/circuitbreaker/templates/default.gohtml",
-            "type": "string"
-        }
-    },
-    "additionalProperties": false
-}

internal/proxy/director/layer/circuitbreaker/layer.go

@@ -1,151 +0,0 @@
-package circuitbreaker
-
-import (
-	"context"
-	"html/template"
-	"net"
-	"net/http"
-	"path/filepath"
-	"sync"
-
-	"forge.cadoles.com/Cadoles/go-proxy"
-	"forge.cadoles.com/Cadoles/go-proxy/wildcard"
-	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
-	"forge.cadoles.com/cadoles/bouncer/internal/store"
-	"github.com/Masterminds/sprig/v3"
-	"github.com/pkg/errors"
-	"gitlab.com/wpetit/goweb/logger"
-)
-
-const LayerType store.LayerType = "circuitbreaker"
-
-type Layer struct {
-	templateDir string
-	loadOnce    sync.Once
-	tmpl        *template.Template
-}
-
-// LayerType implements director.MiddlewareLayer
-func (l *Layer) LayerType() store.LayerType {
-	return LayerType
-}
-
-// Middleware implements director.MiddlewareLayer
-func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
-	return func(h http.Handler) http.Handler {
-		fn := func(w http.ResponseWriter, r *http.Request) {
-			ctx := r.Context()
-
-			options, err := fromStoreOptions(layer.Options)
-			if err != nil {
-				logger.Error(ctx, "could not parse layer options", logger.E(errors.WithStack(err)))
-				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-
-				return
-			}
-
-			matches, err := l.matchAnyAuthorizedCIDRs(ctx, r.RemoteAddr, options.AuthorizedCIDRs)
-			if err != nil {
-				logger.Error(ctx, "could not match authorized cidrs", logger.E(errors.WithStack(err)))
-				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-
-				return
-			}
-
-			if matches {
-				h.ServeHTTP(w, r)
-
-				return
-			}
-
-			matches = wildcard.MatchAny(r.URL.String(), options.MatchURLs...)
-			if !matches {
-				h.ServeHTTP(w, r)
-
-				return
-			}
-
-			l.renderCircuitBreakerPage(w, r, layer, options)
-		}
-
-		return http.HandlerFunc(fn)
-	}
-}
-
-func (l *Layer) matchAnyAuthorizedCIDRs(ctx context.Context, remoteHostPort string, CIDRs []string) (bool, error) {
-	remoteHost, _, err := net.SplitHostPort(remoteHostPort)
-	if err != nil {
-		return false, errors.WithStack(err)
-	}
-
-	remoteAddr := net.ParseIP(remoteHost)
-	if remoteAddr == nil {
-		return false, errors.Errorf("remote host '%s' is not a valid ip address", remoteHost)
-	}
-
-	for _, rawCIDR := range CIDRs {
-		_, net, err := net.ParseCIDR(rawCIDR)
-		if err != nil {
-			return false, errors.WithStack(err)
-		}
-
-		match := net.Contains(remoteAddr)
-		if !match {
-			continue
-		}
-
-		return true, nil
-	}
-
-	logger.Debug(ctx, "comparing remote host with authorized cidrs", logger.F("remoteAddr", remoteAddr))
-
-	return false, nil
-}
-
-func (l *Layer) renderCircuitBreakerPage(w http.ResponseWriter, r *http.Request, layer *store.Layer, options *LayerOptions) {
-	ctx := r.Context()
-
-	pattern := filepath.Join(l.templateDir, "*.gohtml")
-
-	logger.Info(ctx, "loading circuit breaker page templates", logger.F("pattern", pattern))
-
-	tmpl, err := template.New("").Funcs(sprig.FuncMap()).ParseGlob(pattern)
-	if err != nil {
-		logger.Error(ctx, "could not load circuit breaker templates", logger.E(errors.WithStack(err)))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-
-		return
-	}
-
-	templateData := struct {
-		Layer        *store.Layer
-		LayerOptions *LayerOptions
-	}{
-		Layer:        layer,
-		LayerOptions: options,
-	}
-
-	w.Header().Add("Cache-Control", "no-cache")
-
-	w.WriteHeader(http.StatusOK)
-
-	if err := tmpl.ExecuteTemplate(w, options.TemplateBlock, templateData); err != nil {
-		logger.Error(ctx, "could not render circuit breaker page", logger.E(errors.WithStack(err)))
-		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
-
-		return
-	}
-}
-
-func New(funcs ...OptionFunc) *Layer {
-	opts := defaultOptions()
-	for _, fn := range funcs {
-		fn(opts)
-	}
-
-	return &Layer{
-		templateDir: opts.TemplateDir,
-	}
-}
-
-var _ director.MiddlewareLayer = &Layer{}

internal/setup/authn_network_layer.go

@@ -0,0 +1,27 @@
+package setup
+
+import (
+	"forge.cadoles.com/cadoles/bouncer/internal/config"
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/authn"
+	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/authn/network"
+	"forge.cadoles.com/cadoles/bouncer/internal/schema"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	extended, err := schema.Extend(authn.RawLayerOptionsSchema, network.RawLayerOptionsSchema)
+	if err != nil {
+		panic(errors.Wrap(err, "could not extend authn base layer options schema"))
+	}
+
+	RegisterLayer(network.LayerType, setupAuthnNetworkLayer, extended)
+}
+
+func setupAuthnNetworkLayer(conf *config.Config) (director.Layer, error) {
+	options := []authn.OptionFunc{
+		authn.WithTemplateDir(string(conf.Layers.Authn.TemplateDir)),
+	}
+
+	return network.NewLayer(options...), nil
+}

internal/setup/circuitbreaker_layer.go

@@ -1,21 +0,0 @@
-package setup
-
-import (
-	"forge.cadoles.com/cadoles/bouncer/internal/config"
-	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
-	"forge.cadoles.com/cadoles/bouncer/internal/proxy/director/layer/circuitbreaker"
-)
-
-func init() {
-	RegisterLayer(circuitbreaker.LayerType, setupCircuitBreakerLayer, circuitbreaker.RawLayerOptionsSchema)
-}
-
-func setupCircuitBreakerLayer(conf *config.Config) (director.Layer, error) {
-	options := []circuitbreaker.OptionFunc{
-		circuitbreaker.WithTemplateDir(string(conf.Layers.CircuitBreaker.TemplateDir)),
-	}
-
-	return circuitbreaker.New(
-		options...,
-	), nil
-}