v1.0.0: import: import code from accounts

Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>

lib/authMiddleware.go

@@ -0,0 +1,73 @@
+package lib
+
+import (
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/biscuit-auth/biscuit-go/v2"
+	"github.com/biscuit-auth/biscuit-go/v2/parser"
+	"github.com/labstack/echo/v4"
+)
+
+func queryUser(authorizer biscuit.Authorizer) (biscuit.FactSet, error) {
+	rule, err := parser.FromStringRule(`data($name) <- user($name)`)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse check: %v", err)
+	}
+
+	return authorizer.Query(rule)
+}
+
+func AuthMiddleware(skipper_auth func(echo.Context) bool) echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			if skipper_auth(c) {
+				return next(c)
+			}
+			tokens := strings.Split(c.Request().Header.Get("Authorization"), " ")
+
+			if len(tokens) != 2 {
+				return c.String(http.StatusUnauthorized, "Header d'authentification manquant")
+			}
+
+			c.Set("token", tokens[1])
+			byteToken, _ := base64.URLEncoding.DecodeString(tokens[1])
+			b, err := biscuit.Unmarshal(byteToken)
+
+			if err != nil {
+				return c.JSON(http.StatusUnauthorized, err)
+			}
+
+			authorizer, err := b.Authorizer(PublicKey)
+
+			if err != nil {
+				return c.JSON(http.StatusUnauthorized, err)
+			}
+
+			now := time.Now()
+			authorizerContents, err := parser.FromStringAuthorizerWithParams(`
+			time(`+now.Format("2006-01-02T15:04:05Z")+`);
+			allow if time($time), $time <= `+now.Format("2006-01-02T15:04:05Z")+`;
+			`, map[string]biscuit.Term{})
+			if err != nil {
+				return c.JSON(http.StatusUnauthorized, err)
+			}
+			authorizer.AddAuthorizer(authorizerContents)
+
+			if err := authorizer.Authorize(); err != nil {
+				return c.JSON(http.StatusUnauthorized, err)
+			}
+
+			fact, err := queryUser(authorizer)
+			if err != nil {
+				return c.JSON(http.StatusUnauthorized, err)
+			}
+			c.Set("username", strings.Split(fact[0].IDs[0].String(), "\"")[1])
+
+			return next(c)
+		}
+	}
+}

lib/initBiscuit.go

@@ -0,0 +1,67 @@
+package lib
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"io/ioutil"
+	"os"
+	"time"
+)
+
+var PrivateKey ed25519.PrivateKey
+var PublicKey ed25519.PublicKey
+var filePrivateKey string = "/keys/privatekey.pem"
+var filePublicKey string = "/keys/publickey.pem"
+
+func InitLoginBiscuit() error {
+
+	if _, err := os.Stat(filePrivateKey); os.IsNotExist(err) {
+		rng := rand.Reader
+		PublicKey, PrivateKey, _ = ed25519.GenerateKey(rng)
+		if err := ioutil.WriteFile(filePrivateKey, PrivateKey, 0600); err != nil {
+			return err
+		}
+		if err := ioutil.WriteFile(filePublicKey, PublicKey, 0600); err != nil {
+			return err
+		}
+	} else {
+		var err error = nil
+		PrivateKey, err = ioutil.ReadFile(filePrivateKey)
+		if err != nil {
+			return err
+		}
+		PublicKey, err = ioutil.ReadFile(filePublicKey)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func InitGlobalBiscuit() error {
+	for {
+		time.Sleep(1 * time.Second)
+		_, err := os.Stat(filePublicKey)
+		if err == nil {
+			break
+		}
+	}
+	for {
+		time.Sleep(1 * time.Second)
+		_, err := os.Stat(filePrivateKey)
+		if err == nil {
+			break
+		}
+	}
+	var err error = nil
+	PrivateKey, err = ioutil.ReadFile(filePrivateKey)
+	if err != nil {
+		return err
+	}
+	PublicKey, err = ioutil.ReadFile(filePublicKey)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}