-
Notifications
You must be signed in to change notification settings - Fork 0
/
middleware.go
119 lines (100 loc) · 2.83 KB
/
middleware.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
package web
import (
"context"
"fmt"
"net/http"
"strings"
g "github.com/samtech09/api-template/global"
)
//APIVersionCtx adds api version to request Context
func APIVersionCtx(version string) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
r = r.WithContext(context.WithValue(r.Context(), KeyAPIVersion, version))
next.ServeHTTP(w, r)
})
}
}
//AuthRequired check whether request contais
//valid JWT token
func AuthRequired() func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Do not check tokens while unit testing
if g.TestEnv {
next.ServeHTTP(w, r)
return
}
ci, err := g.JWTval.ValidateRequest(r)
if err != nil {
w.WriteHeader(http.StatusUnauthorized)
fmt.Fprint(w, err.Error())
return
}
//g.Logger.Debugf("clientinfo: %q", ci)
if ci.Scopes != nil && len(ci.Scopes) < 1 {
w.WriteHeader(http.StatusNotAcceptable)
fmt.Fprint(w, "scope(s) not set")
return
}
// JWT and scopes are fine
// set client info to context
r = r.WithContext(context.WithValue(r.Context(), KeyAppContext, *ci))
// Extract route info
s := strings.Split(r.URL.Path, "/")
ln := len(s)
if ln < 4 {
//invalid URI, it should have
// /version/controller/action
//e.g. /v1/speedtests/getstlist
w.WriteHeader(http.StatusNotFound)
fmt.Fprint(w, "invalid resource uri")
return
}
g.Logger.Debug().Str("endpoint", r.URL.Path).Msg("Requested endpoint")
// s[0] will be blank
//version := s[1]
controller := s[2]
endpoint := s[3]
method := r.Method
//controller := ""
// if ln > 2 {
// controller = s[2]
// }
//Check client's granted scopes has access to this route
scopes, err := g.Routes.GetScopesFromRoute(controller, endpoint, method)
if (err != nil) || (len(*scopes) < 1) {
// failed to get scope for given route
w.WriteHeader(http.StatusNotFound)
fmt.Fprint(w, fmt.Sprintf("no route: %v", err))
return
}
//g.Logger.Debugm("AuthRequired", "Found Scopes: %q\n", scopes)
//scopeFound := false
//check if client has any of allowed scope
hasScope := false
for _, scop := range *scopes {
for _, cscop := range ci.Scopes {
//g.Logger.Debugm("AuthRequired", " %s\n", scop+" == "+cscop)
if scop == cscop {
//g.Logger.Debugm("AuthRequired", " Scope matched calling Next")
// scope found, so allow access to route
//scopeFound = true
hasScope = true
break
}
}
if hasScope {
break
}
}
if hasScope {
next.ServeHTTP(w, r)
} else {
w.WriteHeader(http.StatusForbidden)
fmt.Fprint(w, "no route")
return
}
})
}
}