119 lines
2.8 KiB
Go
119 lines
2.8 KiB
Go
package auth
|
|
|
|
import (
|
|
"mal/internal/domain"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type publicRoute struct {
|
|
method string
|
|
path string
|
|
prefix bool
|
|
}
|
|
|
|
var publicRoutes = []publicRoute{
|
|
// Pages.
|
|
{method: http.MethodGet, path: "/login"},
|
|
{method: http.MethodPost, path: "/login"},
|
|
{method: http.MethodGet, path: "/logout"},
|
|
|
|
// Static assets.
|
|
{path: "/static", prefix: true},
|
|
{path: "/dist", prefix: true},
|
|
|
|
// Auth API.
|
|
{method: http.MethodPost, path: "/api/auth/login"},
|
|
}
|
|
|
|
func isPublicRequest(method string, path string) bool {
|
|
for _, r := range publicRoutes {
|
|
if r.method != "" && r.method != method {
|
|
continue
|
|
}
|
|
if r.prefix {
|
|
if strings.HasPrefix(path, r.path) {
|
|
return true
|
|
}
|
|
continue
|
|
}
|
|
if path == r.path {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func authenticateAPIRequest(c *gin.Context, svc domain.AuthService) (*domain.User, string, bool, error) {
|
|
authHeader := strings.TrimSpace(c.GetHeader("Authorization"))
|
|
if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") {
|
|
token := strings.TrimSpace(authHeader[7:])
|
|
user, err := svc.ValidateAPIToken(c.Request.Context(), token)
|
|
return user, "", false, err
|
|
}
|
|
|
|
sessionID, err := c.Cookie("session_id")
|
|
if err != nil {
|
|
return nil, "", false, err
|
|
}
|
|
|
|
user, err := svc.ValidateSession(c.Request.Context(), sessionID)
|
|
return user, sessionID, true, err
|
|
}
|
|
|
|
func authenticatePageRequest(c *gin.Context, svc domain.AuthService) (*domain.User, string, error) {
|
|
sessionID, err := c.Cookie("session_id")
|
|
if err != nil {
|
|
return nil, "", err
|
|
}
|
|
|
|
user, err := svc.ValidateSession(c.Request.Context(), sessionID)
|
|
return user, sessionID, err
|
|
}
|
|
|
|
func AuthMiddleware(svc domain.AuthService) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
path := c.Request.URL.Path
|
|
|
|
if isPublicRequest(c.Request.Method, path) {
|
|
c.Next()
|
|
return
|
|
}
|
|
|
|
var user *domain.User
|
|
var err error
|
|
var sessionID string
|
|
var usesCookieSession bool
|
|
|
|
// API routes can authenticate via Bearer token OR cookie session.
|
|
if strings.HasPrefix(path, "/api/") {
|
|
user, sessionID, usesCookieSession, err = authenticateAPIRequest(c, svc)
|
|
if err != nil || user == nil {
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
|
|
c.Abort()
|
|
return
|
|
}
|
|
} else {
|
|
// Non-API routes only use cookie sessions and redirect to /login.
|
|
user, sessionID, err = authenticatePageRequest(c, svc)
|
|
usesCookieSession = true
|
|
if err != nil || user == nil {
|
|
c.Redirect(http.StatusSeeOther, "/login")
|
|
c.Abort()
|
|
return
|
|
}
|
|
}
|
|
|
|
if usesCookieSession {
|
|
if refreshErr := svc.RefreshSession(c.Request.Context(), sessionID); refreshErr == nil {
|
|
c.SetCookie("session_id", sessionID, int(domain.SessionLifetime.Seconds()), "/", "", false, true)
|
|
}
|
|
}
|
|
|
|
c.Set("User", user)
|
|
c.Next()
|
|
}
|
|
}
|