patrickandClaude Sonnet 5
22e0cbf1dd
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Mandant kommt ausschliesslich aus dem Core-Modul-Token (mail/internal/moduleauth, Kopie des DMS-Verfahrens, eigenstaendig weil separates Go-Modul); der tenant-Query-Parameter wird nicht mehr gelesen. Jede Route in mailapi und mailrulesapi verlangt einzeln ein gueltiges Token. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
77 lines
2.1 KiB
Go
77 lines
2.1 KiB
Go
package moduleauth
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// Identity ist die aus einem gueltigen Modul-Token gewonnene Identitaet.
|
|
// Der Mandant kommt ausschliesslich hieraus, nie aus einem Anfrageparameter
|
|
// (INT-18, Befund F-20: Mail-API las den Mandanten bisher aus "?tenant=").
|
|
type Identity struct {
|
|
UserID string
|
|
Tenant string
|
|
Role string
|
|
}
|
|
|
|
type identityKey struct{}
|
|
|
|
func WithIdentity(ctx context.Context, id Identity) context.Context {
|
|
return context.WithValue(ctx, identityKey{}, id)
|
|
}
|
|
|
|
func IdentityFrom(ctx context.Context) (Identity, bool) {
|
|
id, ok := ctx.Value(identityKey{}).(Identity)
|
|
return id, ok
|
|
}
|
|
|
|
type errorResponse struct {
|
|
Error string `json:"error"`
|
|
}
|
|
|
|
func writeError(w http.ResponseWriter, status int, message string) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(status)
|
|
_ = json.NewEncoder(w).Encode(errorResponse{Error: message})
|
|
}
|
|
|
|
// RequireAuth verlangt ein gueltiges Modul-Token (Bearer) fuer next. Es gibt
|
|
// hier bewusst keinen "caller"-Uebergangsmodus wie im DMS: die Mail-API war
|
|
// bislang nirgends verdrahtet (kein cmd/-Aufrufer), es gibt also keinen
|
|
// bestehenden Client, dessen Kompatibilitaet zu wahren waere.
|
|
func RequireAuth(v *Verifier, next http.Handler) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
token, ok := bearer(r)
|
|
if !ok {
|
|
writeError(w, http.StatusUnauthorized, "nicht angemeldet")
|
|
return
|
|
}
|
|
if v == nil {
|
|
writeError(w, http.StatusUnauthorized, "nicht angemeldet")
|
|
return
|
|
}
|
|
claims, err := v.Verify(r.Context(), token)
|
|
if err != nil {
|
|
if errors.Is(err, ErrInvalidToken) {
|
|
writeError(w, http.StatusUnauthorized, "nicht angemeldet")
|
|
} else {
|
|
writeError(w, http.StatusServiceUnavailable, "identitaetsdienst nicht erreichbar")
|
|
}
|
|
return
|
|
}
|
|
id := Identity{UserID: claims.Subject, Tenant: claims.Tenant, Role: claims.Role}
|
|
next.ServeHTTP(w, r.WithContext(WithIdentity(r.Context(), id)))
|
|
}
|
|
}
|
|
|
|
func bearer(r *http.Request) (string, bool) {
|
|
h := r.Header.Get("Authorization")
|
|
if len(h) > 7 && strings.EqualFold(h[:7], "bearer ") {
|
|
return strings.TrimSpace(h[7:]), true
|
|
}
|
|
return "", false
|
|
}
|