105 lines
2.7 KiB
Go
105 lines
2.7 KiB
Go
package authn
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"forge.cadoles.com/Cadoles/go-proxy"
|
|
"forge.cadoles.com/Cadoles/go-proxy/wildcard"
|
|
"forge.cadoles.com/cadoles/bouncer/internal/proxy/director"
|
|
"forge.cadoles.com/cadoles/bouncer/internal/store"
|
|
"github.com/gorilla/sessions"
|
|
"github.com/pkg/errors"
|
|
"gitlab.com/wpetit/goweb/logger"
|
|
)
|
|
|
|
type Layer struct {
|
|
layerType store.LayerType
|
|
auth Authenticator
|
|
store sessions.Store
|
|
}
|
|
|
|
func (l *Layer) Middleware(layer *store.Layer) proxy.Middleware {
|
|
return func(next http.Handler) http.Handler {
|
|
fn := func(w http.ResponseWriter, r *http.Request) {
|
|
ctx := r.Context()
|
|
|
|
options, err := fromStoreOptions(layer.Options)
|
|
if err != nil {
|
|
logger.Error(ctx, "could not parse layer options", logger.E(errors.WithStack(err)))
|
|
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
|
|
sess, err := l.store.Get(r, options.Session.Name)
|
|
if err != nil {
|
|
logger.Error(ctx, "could not retrieve session", logger.E(errors.WithStack(err)))
|
|
}
|
|
|
|
if preAuth, ok := l.auth.(PreAuthentication); ok {
|
|
if err := preAuth.PreAuthentication(w, r, layer, sess); err != nil {
|
|
if errors.Is(err, ErrSkipRequest) {
|
|
return
|
|
}
|
|
|
|
logger.Error(ctx, "could not execute pre-auth hook", logger.E(errors.WithStack(err)))
|
|
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
}
|
|
|
|
matches := wildcard.MatchAny(r.URL.String(), options.MatchURLs...)
|
|
if !matches {
|
|
next.ServeHTTP(w, r)
|
|
|
|
return
|
|
}
|
|
|
|
user, err := l.auth.Authenticate(w, r, layer, sess)
|
|
if err != nil {
|
|
if errors.Is(err, ErrSkipRequest) {
|
|
return
|
|
}
|
|
|
|
logger.Error(ctx, "could not authenticate user", logger.E(errors.WithStack(err)))
|
|
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
|
|
if postAuth, ok := l.auth.(PostAuthentication); ok {
|
|
if err := postAuth.PostAuthentication(w, r, layer, sess, user); err != nil {
|
|
if errors.Is(err, ErrSkipRequest) {
|
|
return
|
|
}
|
|
|
|
logger.Error(ctx, "could not execute post-auth hook", logger.E(errors.WithStack(err)))
|
|
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
}
|
|
|
|
return http.HandlerFunc(fn)
|
|
}
|
|
}
|
|
|
|
// LayerType implements director.MiddlewareLayer
|
|
func (l *Layer) LayerType() store.LayerType {
|
|
return l.layerType
|
|
}
|
|
|
|
func NewLayer(layerType store.LayerType, auth Authenticator, adapter StoreAdapter) *Layer {
|
|
return &Layer{
|
|
layerType: layerType,
|
|
auth: auth,
|
|
store: NewStore(adapter),
|
|
}
|
|
}
|
|
|
|
var _ director.MiddlewareLayer = &Layer{}
|