459 lines
11 KiB
Go
459 lines
11 KiB
Go
// Copyright (C) 2022 Marius Schellenberger
|
|
|
|
package server
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"html/template"
|
|
"net/http"
|
|
"strconv"
|
|
"time"
|
|
|
|
"git.giftfish.de/ston1th/goacc/pkg/core"
|
|
"git.giftfish.de/ston1th/jwt/v3"
|
|
"github.com/go-logr/logr"
|
|
"github.com/gorilla/mux"
|
|
|
|
client "github.com/ory/hydra-client-go"
|
|
)
|
|
|
|
const (
|
|
userClaim = "user"
|
|
adminClaim = "admin"
|
|
totpClaim = "totp"
|
|
createdClaim = "created"
|
|
rememberClaim = "remember"
|
|
|
|
empty = "(empty)"
|
|
)
|
|
|
|
func newContext(w http.ResponseWriter, r *http.Request, s *Server) *Context {
|
|
h := w.Header()
|
|
h.Set("X-Frame-Options", "DENY")
|
|
h.Set("X-Content-Type-Options", "nosniff")
|
|
h.Set("X-XSS-Protection", "1; mode=block")
|
|
h.Set("Content-Security-Policy", "default-src 'none';style-src 'self';img-src 'self' https: data:;connect-src 'self';frame-ancestors 'none'")
|
|
h.Set("Referrer-Policy", "same-origin")
|
|
return &Context{
|
|
log: s.log,
|
|
Request: r,
|
|
Response: w,
|
|
Srv: s,
|
|
Time: time.Now(),
|
|
}
|
|
}
|
|
|
|
type Context struct {
|
|
log logr.Logger
|
|
Request *http.Request
|
|
Response http.ResponseWriter
|
|
Srv *Server
|
|
T *template.Template
|
|
Status int
|
|
Err error
|
|
Time time.Time
|
|
|
|
Token jwt.Token
|
|
|
|
Data webData
|
|
}
|
|
|
|
type webData struct {
|
|
Version string
|
|
Time string
|
|
|
|
Title string
|
|
BodyTitle string
|
|
|
|
Admin bool
|
|
Login bool
|
|
|
|
Key string
|
|
|
|
User string
|
|
Token string
|
|
Msg string
|
|
|
|
Data interface{}
|
|
}
|
|
|
|
type loginData struct {
|
|
User string
|
|
LoginChallenge string
|
|
Referer string
|
|
}
|
|
|
|
type consentData struct {
|
|
ConsentChallenge string
|
|
Info *consentInfo
|
|
}
|
|
|
|
func (c *Context) Exec() {
|
|
defer c.accessLog()
|
|
if c.T == nil {
|
|
c.Status = http.StatusInternalServerError
|
|
c.Err = errors.New("template is nil")
|
|
return
|
|
}
|
|
sig := c.Token.RawSig()
|
|
if len(sig) >= keySize {
|
|
c.Data.Token = newXsrf(sig[:keySize])
|
|
}
|
|
|
|
c.Data.Version = c.Srv.Config.Version
|
|
if c.Data.BodyTitle == "" {
|
|
c.Data.BodyTitle = c.Data.Title
|
|
}
|
|
c.Data.Admin = c.Admin()
|
|
c.Data.User = c.User()
|
|
c.Data.Login = c.LoggedOn()
|
|
|
|
t := strconv.Itoa(int(time.Since(c.Time).Nanoseconds()/1e6)) + "ms"
|
|
if t == "0ms" {
|
|
t = strconv.Itoa(int(time.Since(c.Time).Nanoseconds()/1e5)) + "µs"
|
|
}
|
|
c.Data.Time = t
|
|
|
|
if c.Data.Msg != "" {
|
|
c.Status = http.StatusBadRequest
|
|
}
|
|
|
|
c.Err = c.T.Execute(c.Response, c.Data)
|
|
if c.Err != nil {
|
|
c.Status = http.StatusInternalServerError
|
|
}
|
|
if c.Status == 0 {
|
|
c.Status = http.StatusOK
|
|
}
|
|
}
|
|
|
|
func (c *Context) accessLog() {
|
|
log := c.log.WithValues("addr", c.Request.RemoteAddr,
|
|
"method", c.Request.Method,
|
|
"uri", c.Request.RequestURI,
|
|
"status", c.Status,
|
|
)
|
|
if c.Err != nil {
|
|
log.Error(c.Err, "access")
|
|
return
|
|
}
|
|
log.Info("access")
|
|
}
|
|
|
|
func (c *Context) Error(i interface{}) {
|
|
switch v := i.(type) {
|
|
case string:
|
|
c.Data.Msg = v
|
|
case error:
|
|
c.Data.Msg = v.Error()
|
|
}
|
|
c.Exec()
|
|
}
|
|
|
|
func (c *Context) NotFound() {
|
|
c.Template("notFoundHandler")
|
|
c.Data = webData{Title: "404"}
|
|
c.Status = http.StatusNotFound
|
|
c.Response.WriteHeader(http.StatusNotFound)
|
|
c.Exec()
|
|
}
|
|
|
|
func (c *Context) Forbidden() {
|
|
c.Template("forbiddenHandler")
|
|
c.Data = webData{Title: "403"}
|
|
c.Status = http.StatusForbidden
|
|
c.Response.WriteHeader(http.StatusForbidden)
|
|
c.Exec()
|
|
}
|
|
|
|
func (c *Context) Template(name string) {
|
|
c.T = c.Srv.ts.Get(name)
|
|
}
|
|
|
|
func (c *Context) Write(buf []byte) (err error) {
|
|
_, err = c.Response.Write(buf)
|
|
return
|
|
}
|
|
|
|
func (c *Context) SetHeader(name, value string) {
|
|
c.Response.Header().Set(name, value)
|
|
}
|
|
|
|
func (c *Context) Redirect(uri string, code int) {
|
|
c.log.Info("access", "addr", c.Request.RemoteAddr,
|
|
"method", c.Request.Method,
|
|
"uri", c.Request.RequestURI,
|
|
"status", code,
|
|
"redirect", uri,
|
|
)
|
|
http.Redirect(c.Response, c.Request, uri, code)
|
|
}
|
|
|
|
func (c *Context) Method() string {
|
|
return c.Request.Method
|
|
}
|
|
|
|
func (c *Context) Path() string {
|
|
return c.Request.URL.Path
|
|
}
|
|
|
|
func (c *Context) FormSlice(name string) []string {
|
|
// does nothing if called twice
|
|
c.Request.ParseForm()
|
|
return c.Request.PostForm[name]
|
|
}
|
|
|
|
func (c *Context) Form(name string) string {
|
|
return c.Request.PostFormValue(name)
|
|
}
|
|
|
|
func (c *Context) Query(name string) string {
|
|
// does nothing if called twice
|
|
c.Request.ParseForm()
|
|
return c.Request.Form.Get(name)
|
|
}
|
|
|
|
func (c *Context) Var(name string) (ret string) {
|
|
ret = mux.Vars(c.Request)[name]
|
|
return
|
|
}
|
|
|
|
func (c *Context) Forwarded() (ret string) {
|
|
ret = c.Request.Header.Get("X-Forwarded-For")
|
|
if ret == "" {
|
|
ret = empty
|
|
}
|
|
return
|
|
}
|
|
|
|
// CheckXsrf validates the xsrf token
|
|
func (c *Context) CheckXsrf() (ok bool) {
|
|
ok = checkXsrf(c.Form("token"), c.Token.RawSig()[:keySize])
|
|
if !ok {
|
|
c.Error("wrong csrf token")
|
|
}
|
|
return
|
|
}
|
|
|
|
func (c *Context) LoggedOn() (ok bool) {
|
|
_, ok = c.Token.Claims.Get(userClaim)
|
|
return
|
|
}
|
|
|
|
func (c *Context) LogSetCookie(err error, msg string) {
|
|
c.log.Error(err, msg)
|
|
c.SetCookie(nil, 0)
|
|
}
|
|
|
|
func (c *Context) Login(u *core.User, remember string) {
|
|
var d time.Duration
|
|
if remember != "" {
|
|
d = day * 7
|
|
}
|
|
c.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin}, d)
|
|
}
|
|
|
|
func (c *Context) SetCookie(claims jwt.Claims, d time.Duration) {
|
|
c.setCookie(jwt.NewToken(claims, nil), d)
|
|
}
|
|
|
|
func (c *Context) setCookie(t *jwt.Token, d time.Duration) {
|
|
if d == 0 {
|
|
d = jwt.DefaultExpiry
|
|
}
|
|
t.Claims[jwt.ExpClaim] = jwt.NewExp(d)
|
|
if err := c.Srv.JWT.Sign(t); err != nil {
|
|
c.log.Error(err, "jwt sign")
|
|
return
|
|
}
|
|
c.Token = *t
|
|
cookie := &http.Cookie{
|
|
Name: cookieName,
|
|
Value: c.Token.String(),
|
|
Path: "/",
|
|
MaxAge: int(d.Seconds()),
|
|
Secure: c.Srv.Config.SecureCookie,
|
|
HttpOnly: true,
|
|
SameSite: http.SameSiteStrictMode,
|
|
}
|
|
if cookie.MaxAge > 0 {
|
|
cookie.Expires = time.Now().Add(d)
|
|
} else if cookie.MaxAge < 0 {
|
|
cookie.Expires = time.Unix(1, 0)
|
|
}
|
|
http.SetCookie(c.Response, cookie)
|
|
}
|
|
|
|
func (c *Context) User() string {
|
|
return c.Token.Claims.GetString(userClaim)
|
|
}
|
|
|
|
func (c *Context) Totp() string {
|
|
return c.Token.Claims.GetString(totpClaim)
|
|
}
|
|
|
|
func (c *Context) Remember() string {
|
|
return c.Token.Claims.GetString(rememberClaim)
|
|
}
|
|
|
|
func (c *Context) Admin() bool {
|
|
return c.Token.Claims.GetBool(adminClaim)
|
|
}
|
|
|
|
type respBody struct {
|
|
URL string `json:"redirect_to,omitempty"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|
|
|
|
func (c *Context) ApproveLogin(user, challenge string) (rdr string, err error) {
|
|
req := c.Srv.API.AdminApi.AcceptLoginRequest(context.Background())
|
|
req.AcceptLoginRequest(*client.NewAcceptLoginRequest(user))
|
|
req.LoginChallenge(challenge)
|
|
_, resp, err := req.Execute()
|
|
if err != nil {
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
rb := new(respBody)
|
|
err = json.NewDecoder(resp.Body).Decode(rb)
|
|
if err != nil {
|
|
return
|
|
}
|
|
if rb.Error != "" {
|
|
err = errors.New(rb.Error)
|
|
return
|
|
}
|
|
rdr = rb.URL
|
|
return
|
|
}
|
|
|
|
func (c *Context) ApproveConsent(challenge string) (rdr string, err error) {
|
|
req := c.Srv.API.AdminApi.AcceptConsentRequest(context.Background()).
|
|
AcceptConsentRequest(*client.NewAcceptConsentRequest()).
|
|
ConsentChallenge(challenge)
|
|
_, resp, err := req.Execute()
|
|
if err != nil {
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
rb := new(respBody)
|
|
err = json.NewDecoder(resp.Body).Decode(rb)
|
|
if err != nil {
|
|
return
|
|
}
|
|
if rb.Error != "" {
|
|
err = errors.New(rb.Error)
|
|
return
|
|
}
|
|
rdr = rb.URL
|
|
return
|
|
}
|
|
|
|
func (c *Context) RejectConsent(challenge string) (rdr string, err error) {
|
|
req := c.Srv.API.AdminApi.RejectConsentRequest(context.Background()).
|
|
RejectRequest(*client.NewRejectRequest()).
|
|
ConsentChallenge(challenge)
|
|
_, resp, err := req.Execute()
|
|
if err != nil {
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
rb := new(respBody)
|
|
err = json.NewDecoder(resp.Body).Decode(rb)
|
|
if err != nil {
|
|
return
|
|
}
|
|
if rb.Error != "" {
|
|
err = errors.New(rb.Error)
|
|
return
|
|
}
|
|
rdr = rb.URL
|
|
return
|
|
}
|
|
|
|
func (c *Context) Consent(challenge string) (ci *consentInfo, err error) {
|
|
fmt.Println(challenge)
|
|
req := c.Srv.API.AdminApi.GetConsentRequest(context.Background()).
|
|
ConsentChallenge(challenge)
|
|
_, resp, err := req.Execute()
|
|
if err != nil {
|
|
fmt.Println(err)
|
|
return
|
|
}
|
|
defer resp.Body.Close()
|
|
ci = new(consentInfo)
|
|
err = json.NewDecoder(resp.Body).Decode(ci)
|
|
if err != nil {
|
|
return
|
|
}
|
|
if ci.Error != "" {
|
|
err = errors.New(ci.Error)
|
|
}
|
|
return
|
|
}
|
|
|
|
type consentInfo struct {
|
|
Acr string `json:"acr"`
|
|
Amr []string `json:"amr"`
|
|
Challenge string `json:"challenge"`
|
|
Error string `json:"error,omitempty"`
|
|
Client struct {
|
|
AllowedCorsOrigins []string `json:"allowed_cors_origins"`
|
|
Audience []string `json:"audience"`
|
|
BackchannelLogoutSessionRequired bool `json:"backchannel_logout_session_required"`
|
|
BackchannelLogoutURI string `json:"backchannel_logout_uri"`
|
|
ClientID string `json:"client_id"`
|
|
ClientName string `json:"client_name"`
|
|
ClientSecret string `json:"client_secret"`
|
|
ClientSecretExpiresAt int `json:"client_secret_expires_at"`
|
|
ClientURI string `json:"client_uri"`
|
|
Contacts []string `json:"contacts"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
FrontchannelLogoutSessionRequired bool `json:"frontchannel_logout_session_required"`
|
|
FrontchannelLogoutURI string `json:"frontchannel_logout_uri"`
|
|
GrantTypes []string `json:"grant_types"`
|
|
Jwks struct {
|
|
} `json:"jwks"`
|
|
JwksURI string `json:"jwks_uri"`
|
|
LogoURI string `json:"logo_uri"`
|
|
Metadata struct {
|
|
} `json:"metadata"`
|
|
Owner string `json:"owner"`
|
|
PolicyURI string `json:"policy_uri"`
|
|
PostLogoutRedirectUris []string `json:"post_logout_redirect_uris"`
|
|
RedirectUris []string `json:"redirect_uris"`
|
|
RegistrationAccessToken string `json:"registration_access_token"`
|
|
RegistrationClientURI string `json:"registration_client_uri"`
|
|
RequestObjectSigningAlg string `json:"request_object_signing_alg"`
|
|
RequestUris []string `json:"request_uris"`
|
|
ResponseTypes []string `json:"response_types"`
|
|
Scope string `json:"scope"`
|
|
SectorIdentifierURI string `json:"sector_identifier_uri"`
|
|
SubjectType string `json:"subject_type"`
|
|
TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"`
|
|
TokenEndpointAuthSigningAlg string `json:"token_endpoint_auth_signing_alg"`
|
|
TosURI string `json:"tos_uri"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
UserinfoSignedResponseAlg string `json:"userinfo_signed_response_alg"`
|
|
} `json:"client"`
|
|
LoginChallenge string `json:"login_challenge"`
|
|
LoginSessionID string `json:"login_session_id"`
|
|
OidcContext struct {
|
|
AcrValues []string `json:"acr_values"`
|
|
Display string `json:"display"`
|
|
IDTokenHintClaims struct {
|
|
} `json:"id_token_hint_claims"`
|
|
LoginHint string `json:"login_hint"`
|
|
UILocales []string `json:"ui_locales"`
|
|
} `json:"oidc_context"`
|
|
RequestURL string `json:"request_url"`
|
|
RequestedAccessTokenAudience []string `json:"requested_access_token_audience"`
|
|
RequestedScope []string `json:"requested_scope"`
|
|
Skip bool `json:"skip"`
|
|
Subject string `json:"subject"`
|
|
}
|
|
|
|
type ctxHandler func(*Context)
|