nexarch/dms/internal/moduleauth/middleware.go

package moduleauth

import (
	"context"
	"errors"
	"net/http"
	"strings"

	"gitea.perlbach24.de/scripte/nexarch/dms/internal/apierror"
)

type Identity struct {
	UserID string
	Tenant string
	Role   string
}

type identityKey struct{}

func WithIdentity(ctx context.Context, id Identity) context.Context {
	return context.WithValue(ctx, identityKey{}, id)
}

func IdentityFrom(ctx context.Context) (Identity, bool) {
	id, ok := ctx.Value(identityKey{}).(Identity)
	return id, ok
}

type Config struct {
	Verifier *Verifier
	Prefix   string
	// AllowCaller laesst Anfragen ohne Bearer-Token mit der Interimsidentitaet
	// (caller/X-User-Id) durch; ein vorhandenes Token wird immer geprueft.
	AllowCaller bool
	// Public sind Pfade unterhalb von Prefix ohne Nutzeridentitaet.
	Public map[string]bool
}

func Authenticate(cfg Config, next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		rest, underPrefix := strings.CutPrefix(r.URL.Path, cfg.Prefix)
		if !underPrefix || cfg.Public[rest] {
			next.ServeHTTP(w, r)
			return
		}
		token, hasBearer := bearer(r)
		if !hasBearer {
			if cfg.AllowCaller && (r.URL.Query().Get("caller") != "" || r.Header.Get("X-User-Id") != "") {
				next.ServeHTTP(w, r)
				return
			}
			apierror.Write(w, http.StatusUnauthorized, "unauthenticated", "nicht angemeldet")
			return
		}
		if cfg.Verifier == nil {
			apierror.Write(w, http.StatusUnauthorized, "unauthenticated", "nicht angemeldet")
			return
		}
		claims, err := cfg.Verifier.Verify(r.Context(), token)
		if err != nil {
			if errors.Is(err, ErrInvalidToken) {
				apierror.Write(w, http.StatusUnauthorized, "unauthenticated", "nicht angemeldet")
			} else {
				apierror.Write(w, http.StatusServiceUnavailable, "unavailable", "identitaetsdienst nicht erreichbar")
			}
			return
		}
		q := r.URL.Query()
		q.Set("caller", claims.Subject)
		r2 := r.Clone(context.WithValue(r.Context(), identityKey{}, Identity{UserID: claims.Subject, Tenant: claims.Tenant, Role: claims.Role}))
		r2.URL.RawQuery = q.Encode()
		r2.Header.Set("X-User-Id", claims.Subject)
		next.ServeHTTP(w, r2)
	})
}

func bearer(r *http.Request) (string, bool) {
	h := r.Header.Get("Authorization")
	if len(h) > 7 && strings.EqualFold(h[:7], "bearer ") {
		return strings.TrimSpace(h[7:]), true
	}
	return "", false
}