-
Notifications
You must be signed in to change notification settings - Fork 2
/
auth.go
102 lines (92 loc) · 2.9 KB
/
auth.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
// Copyright (C) Cyrill@Schumacher.fm @SchumacherFM Twitter/GitHub
// Wanderlust - a cache warmer for your web app with priorities
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
package picnic
import (
. "github.com/SchumacherFM/wanderlust/picnic/api"
"net/http"
)
type authLevel int
const (
AUTH_LEVEL_IGNORE authLevel = iota + 1 // we don't need the user in this handler
AUTH_LEVEL_CHECK // prefetch user, doesn't matter if not logged in
AUTH_LEVEL_LOGIN_WAIT // user required, 412 if not available
AUTH_LEVEL_LOGIN // user required, 401 if not available
AUTH_LEVEL_ADMIN // admin required, 401 if no user, 403 if not admin
)
func checkAuthLevel(l authLevel, u UserSessionIf) error {
var (
errLoginRequired = httpError{
Status: http.StatusUnauthorized,
Description: "You must be logged in!",
}
errWaitingForLogin = httpError{
Status: http.StatusPreconditionFailed,
Description: "Waiting for login ...",
}
falseUser = nil == u || false == u.IsLoggedIn()
)
switch l {
case AUTH_LEVEL_LOGIN_WAIT:
if falseUser {
logger.Debug("checkAuthLevel 46: user %#v", u)
return errWaitingForLogin
}
break
case AUTH_LEVEL_LOGIN:
if falseUser {
logger.Debug("checkAuthLevel 52: user %#v", u)
return errLoginRequired
}
break
case AUTH_LEVEL_ADMIN:
if falseUser {
logger.Debug("checkAuthLevel 59: user %#v", u)
return errLoginRequired
}
if false == u.IsAdministrator() {
return httpError{
Status: http.StatusForbidden,
Description: "You must be an admin!",
}
}
}
return nil
}
// lazily fetches the current session user
// check also JWT
func (p *PicnicApp) authenticate(r *http.Request, l authLevel) (UserSessionIf, error) {
if l == AUTH_LEVEL_IGNORE {
return nil, nil
}
uid, expiresIn, err := p.session.ReadToken(r)
if err != nil {
return nil, err
}
u := NewUserModel(uid)
if "" == uid {
logger.Debug("p.authenticate: userID from token is empty")
return nil, checkAuthLevel(l, nil)
}
var f bool
f, err = u.FindMe(rsdb)
if false == f || err != nil {
logger.Debug("p.authenticate: user not found in DB %#v", u)
return nil, checkAuthLevel(l, nil)
}
u.SetAuthenticated(true)
u.SetSessionExpiresIn(expiresIn)
return u, checkAuthLevel(l, u)
}