-
Notifications
You must be signed in to change notification settings - Fork 0
/
handler.go
146 lines (124 loc) · 4.81 KB
/
handler.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
package oidcauth
import (
"fmt"
"log/slog"
"net/http"
)
// LoadSessionHandler loads the session and makes it available in the context
// for subsequent handler.
func LoadSessionHandler(sm *sessionManager, next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
currentSessionCtx, _ := sm.GetSession(w, r)
r = r.WithContext(ContextWithSession(r.Context(), currentSessionCtx))
next.ServeHTTP(w, r)
})
}
// RemoveSessionHandler removes the session.
func RemoveSessionHandler(sm *sessionManager) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
sm.RemoveSession(w, r)
})
}
// AuthenticateHandler loads the session and sets it in the context. If there
// is no session available it initiates a login be redirecting the request to
// the login endpoint.
// If a session is available but it is no longer valid and if the session
// contains a refresh_token it tries to obtain a new session using the refresh
// token.
func AuthenticateHandler(sm *sessionManager, loginEndpoint string, next http.Handler) http.Handler {
redirectToLogin := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if !(r.Method == "GET" || r.Method == "HEAD") {
http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
return
}
originURI := r.URL.RequestURI()
_ = sm.SetLoginState(w, r, &LoginState{URI: originURI})
http.Redirect(w, r, loginEndpoint, http.StatusSeeOther)
})
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
currentSession, _ := sm.GetSession(w, r)
if currentSession == nil {
slog.DebugContext(r.Context(), "no session available: initiate login")
redirectToLogin(w, r)
return
}
// run silent refresh or redirect to login if session expired
if !currentSession.Valid() {
if !currentSession.HasRefreshToken() {
slog.DebugContext(r.Context(), "no refresh token available: initiate login")
redirectToLogin(w, r)
return
}
newSession, err := currentSession.Provider.Refresh(r.Context(), currentSession.Session)
if err != nil {
slog.InfoContext(r.Context(), "token refresh failed. initiate login", "err", err)
redirectToLogin(w, r)
return
}
slog.InfoContext(r.Context(), "token refreshed", "access_token", newSession.HasAccessToken(), "refresh_token", newSession.HasRefreshToken(), "id_token", newSession.HasIDToken())
err = sm.SetSession(w, r, newSession)
if err != nil {
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
currentSession.Session = newSession
}
r = r.WithContext(ContextWithSession(r.Context(), currentSession))
next.ServeHTTP(w, r)
})
}
func RefreshHandler(sm *sessionManager, postRefreshHandler http.Handler, errorHandler ErrorHandler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
session, _ := sm.GetSession(w, r)
if session == nil {
errorHandler(w, r, ErrDirect(http.StatusUnauthorized, fmt.Errorf("no session")))
return
}
newSession, err := session.Provider.Refresh(r.Context(), session.Session)
if err != nil {
errorHandler(w, r, fmt.Errorf("token refresh failed: %w", err))
return
}
slog.Info("token refreshed", "access_token", newSession.HasAccessToken(), "refresh_token", newSession.HasRefreshToken(), "id_token", newSession.HasIDToken())
err = sm.SetSession(w, r, newSession)
if err != nil {
errorHandler(w, r, err)
return
}
session.Session = newSession
r = r.WithContext(ContextWithSession(r.Context(), session))
postRefreshHandler.ServeHTTP(w, r)
})
}
// LogoutHandler deletes the session cookies, revokes the token (if supportd by
// the provider) and redirects to the end_session_uri of the provider (if
// supported by the provider). If no end_session_uri is available the
// postLogoutHandler is run.
func LogoutHandler(sm *sessionManager, postLogoutHandler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// remove session (delete cookie)
sm.RemoveSession(w, r)
session, _ := sm.GetSession(w, r)
if session == nil {
postLogoutHandler.ServeHTTP(w, r)
return
}
// revoke tokens
if session.HasRefreshToken() {
err := session.Provider.Revoke(r.Context(), session.RefreshToken())
if err != nil && err != ErrNotSupported {
slog.WarnContext(r.Context(), "failed to revoke token", "err", err)
}
}
// redirect to end session endpoint if available
endSessionURL, err := session.Provider.EndSessionEndpoint(r.Context(), session.Session)
if err != nil && err != ErrNotSupported {
slog.WarnContext(r.Context(), "failed to obtain end session endpoint", "err", err)
}
if err == nil {
http.Redirect(w, r, endSessionURL, http.StatusSeeOther)
return
}
postLogoutHandler.ServeHTTP(w, r)
})
}