feat(*): initial commit

internal/auth/routes.go

@@ -0,0 +1,125 @@
+package auth
+
+import (
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+func IsAuth(r *http.Request) (bool, error) {
+	jwt, err := getAuthToken(r)
+	if err != nil {
+		return false, err
+	}
+	_, err = ValidateJWT(jwt)
+	if err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func LogoutEndpoint(w http.ResponseWriter, r *http.Request) {
+	setAuthCookie(w, r, "")
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func AuthMiddleware(next http.HandlerFunc) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		jwt, err := getAuthToken(r)
+		if err != nil {
+			log.Println("Error during token retrieval", err)
+			Redirect(w, r)
+			return
+		}
+		user, err := ValidateJWT(jwt)
+		if err != nil {
+			log.Println("Error during authorization", err)
+			Redirect(w, r)
+			return
+		}
+		log.Printf("%s: Authorized user %s", r.URL.Path, user)
+		w.Header().Add("user", user)
+		next.ServeHTTP(w, r)
+	})
+}
+
+func CallbackHandler(mux *http.ServeMux) {
+
+	url, err := url.Parse(config.RedirectURL)
+
+	if err != nil {
+		log.Fatalf("Invalid Redirect URL Submitted: %s\n", config.RedirectURL)
+	}
+
+	mux.HandleFunc(url.Path, func(w http.ResponseWriter, r *http.Request) {
+		if err := CheckState(r); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		code := r.URL.Query().Get("code")
+
+		idtoken, err := GetToken(code)
+
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		if err := CheckAudience(idtoken); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		if err := CheckNonce(r, idtoken); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		jwt, err := NewJWT(idtoken.Subject)
+
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		setAuthCookie(w, r, jwt)
+
+		redirect := GetRedirect(r.URL.Query().Get("state"))
+		log.Printf("DEBUG: REDIRECT %s\n", redirect)
+		http.Redirect(w, r, redirect, http.StatusFound)
+	})
+}
+
+func setAuthCookie(w http.ResponseWriter, r *http.Request, jwt string) {
+	c := &http.Cookie{
+		Name:     authCookie,
+		Value:    jwt,
+		MaxAge:   int(time.Hour.Seconds()),
+		Secure:   r.TLS != nil,
+		Path:     "/",
+		HttpOnly: true,
+	}
+	http.SetCookie(w, c)
+}
+
+func getAuthToken(r *http.Request) (string, error) {
+	header := strings.Split(r.Header.Get("Authorization"), " ")
+	if len(header) > 1 {
+		token := header[1]
+		if len(strings.TrimSpace(token)) > 0 {
+			log.Printf("Got Auth Header %s\n", header[1])
+
+			return token, nil
+		}
+	}
+
+	cookie, err := r.Cookie(authCookie)
+
+	if err != nil {
+		return "", err
+	}
+	return cookie.Value, nil
+}