73 lines
1.8 KiB
Go
73 lines
1.8 KiB
Go
package lib
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/biscuit-auth/biscuit-go/v2"
|
|
"github.com/biscuit-auth/biscuit-go/v2/parser"
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
func queryUser(authorizer biscuit.Authorizer) (biscuit.FactSet, error) {
|
|
rule, err := parser.FromStringRule(`data($name) <- user($name)`)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse check: %v", err)
|
|
}
|
|
|
|
return authorizer.Query(rule)
|
|
}
|
|
|
|
func AuthMiddleware(skipper_auth func(echo.Context) bool) echo.MiddlewareFunc {
|
|
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
|
return func(c echo.Context) error {
|
|
if skipper_auth(c) {
|
|
return next(c)
|
|
}
|
|
tokens := strings.Split(c.Request().Header.Get("Authorization"), " ")
|
|
|
|
if len(tokens) != 2 {
|
|
return c.String(http.StatusUnauthorized, "Header d'authentification manquant")
|
|
}
|
|
|
|
c.Set("token", tokens[1])
|
|
byteToken, _ := base64.URLEncoding.DecodeString(tokens[1])
|
|
b, err := biscuit.Unmarshal(byteToken)
|
|
|
|
if err != nil {
|
|
return c.JSON(http.StatusUnauthorized, err)
|
|
}
|
|
|
|
authorizer, err := b.Authorizer(PublicKey)
|
|
|
|
if err != nil {
|
|
return c.JSON(http.StatusUnauthorized, err)
|
|
}
|
|
|
|
now := time.Now()
|
|
authorizerContents, err := parser.FromStringAuthorizerWithParams(`
|
|
time(`+now.Format("2006-01-02T15:04:05Z")+`);
|
|
allow if time($time), $time <= `+now.Format("2006-01-02T15:04:05Z")+`;
|
|
`, map[string]biscuit.Term{})
|
|
if err != nil {
|
|
return c.JSON(http.StatusUnauthorized, err)
|
|
}
|
|
authorizer.AddAuthorizer(authorizerContents)
|
|
|
|
if err := authorizer.Authorize(); err != nil {
|
|
return c.JSON(http.StatusUnauthorized, err)
|
|
}
|
|
|
|
fact, err := queryUser(authorizer)
|
|
if err != nil {
|
|
return c.JSON(http.StatusUnauthorized, err)
|
|
}
|
|
c.Set("username", strings.Split(fact[0].IDs[0].String(), "\"")[1])
|
|
|
|
return next(c)
|
|
}
|
|
}
|
|
}
|