melosh/mal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve context key cycle for admin check

Browse Source
This commit is contained in:
mkelvers
2026-04-22 21:23:38 +02:00
parent 77f0daca26
commit ee05ad7511
8 changed files with 23 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
api/admin/handler.go
View File

@@ -11,6 +11,7 @@ import (
"mal/api/auth"
"mal/internal/db"
"mal/internal/middleware"
webcontext "mal/web/context"
"mal/web/templates"
)
@@ -166,7 +167,7 @@ func GetImpersonatedUserID(r *http.Request) string {
}
// Verify the current user is admin
user, ok := r.Context().Value(middleware.UserContextKey).(*database.User)
user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
if !ok || user == nil || !middleware.IsAdmin(user) {
return ""
}

4
api/anime/handler.go
View File

@@ -12,7 +12,7 @@ import (
"mal/integrations/jikan"
"mal/internal/db"
"mal/internal/middleware"
webcontext "mal/web/context"
animecomponents "mal/web/components/anime"
watchcomponents "mal/web/components/watch"
"mal/web/templates"
@@ -65,7 +65,7 @@ func parsePageParam(r *http.Request) int {
}
func userIDFromRequest(r *http.Request) string {
user, ok := r.Context().Value(middleware.UserContextKey).(*database.User)
user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
if !ok || user == nil {
return ""
}

3
api/playback/handler.go
View File

@@ -17,6 +17,7 @@ import (
"mal/integrations/jikan"
"mal/internal/db"
"mal/internal/middleware"
webcontext "mal/web/context"
"mal/web/components/watch"
"mal/web/shared"
"mal/web/templates"
@@ -131,7 +132,7 @@ func (h *Handler) HandleWatchPage(w http.ResponseWriter, r *http.Request) {
}
func watchlistUserIDFromRequest(r *http.Request) string {
user, ok := r.Context().Value(middleware.UserContextKey).(*database.User)
user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
if !ok || user == nil {
return ""
}

3
internal/middleware/access.go
View File

@@ -5,6 +5,7 @@ import (
"strings"
"mal/internal/db"
webcontext "mal/web/context"
)
type AccessPolicy struct {
@@ -46,7 +47,7 @@ func RequireGlobalAuthWithPolicy(policy AccessPolicy) func(http.Handler) http.Ha
return
}
user, ok := r.Context().Value(UserContextKey).(*database.User)
user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
if !ok || user == nil {
if strings.HasPrefix(r.URL.Path, "/api/") || r.Header.Get("HX-Request") == "true" {
w.Header().Set("HX-Redirect", "/login")

3
internal/middleware/admin.go
View File

@@ -4,6 +4,7 @@ import (
"net/http"
"mal/internal/db"
webcontext "mal/web/context"
"mal/web/shared/admin"
)
@@ -13,7 +14,7 @@ func IsAdmin(user *database.User) bool {
func RequireAdmin(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
user, ok := r.Context().Value(UserContextKey).(*database.User)
user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
if !ok || user == nil {
http.Redirect(w, r, "/login", http.StatusFound)
return

18
internal/middleware/auth.go
View File

@@ -7,12 +7,7 @@ import (
"mal/api/auth"
"mal/internal/db"
)
type contextKey string
const (
UserContextKey contextKey = "user"
webcontext "mal/web/context"
)
func Auth(authService *auth.Service) func(http.Handler) http.Handler {
@@ -20,20 +15,17 @@ func Auth(authService *auth.Service) func(http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
cookie, err := r.Cookie("session_id")
if err != nil {
// No session cookie, user is unauthenticated. Proceed, but not logged in.
next.ServeHTTP(w, r)
return
}
user, err := authService.ValidateSession(r.Context(), cookie.Value)
if err != nil {
// Invalid session, proceed as unauthenticated
next.ServeHTTP(w, r)
return
}
// Valid session, bind user to context
ctx := context.WithValue(r.Context(), UserContextKey, user)
ctx := context.WithValue(r.Context(), webcontext.UserKey, user)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
@@ -41,7 +33,7 @@ func Auth(authService *auth.Service) func(http.Handler) http.Handler {
func RequireAuth(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
user, ok := r.Context().Value(UserContextKey).(*database.User)
user, ok := r.Context().Value(webcontext.UserKey).(*database.User)
if !ok || user == nil {
if strings.HasPrefix(r.URL.Path, "/api/") {
w.Header().Set("HX-Redirect", "/login")
@@ -56,9 +48,9 @@ func RequireAuth(next http.Handler) http.Handler {
}
func GetUser(ctx context.Context) *database.User {
user, ok := ctx.Value(UserContextKey).(*database.User)
user, ok := ctx.Value(webcontext.UserKey).(*database.User)
if !ok {
return nil
}
return user
}
}

3
web/context/context.go Normal file
View File

@@ -0,0 +1,3 @@
package context
const UserKey = "mal:user"

22
web/shared/admin/admin.go
View File

@@ -1,15 +1,9 @@
package admin
import (
"context"
"mal/internal/db"
)
type contextKey string
const userContextKey contextKey = "user"
const AdminEmail = "mikkelelvers@outlook.com"
func IsAdmin(user *database.User) bool {
@@ -19,14 +13,8 @@ func IsAdmin(user *database.User) bool {
return user.Username == AdminEmail
}
func GetUser(ctx context.Context) *database.User {
user, ok := ctx.Value(userContextKey).(*database.User)
if !ok {
return nil
}
return user
}
func IsAdminFromContext(ctx context.Context) bool {
return IsAdmin(GetUser(ctx))
}
func IsAdminFromContext(ctx interface{ Value(key interface{}) interface{} }) bool {
const userKey = "mal:user"
user, _ := ctx.Value(userKey).(*database.User)
return IsAdmin(user)
}