rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Extract authn & authz utils

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-01-09 11:23:42 +01:00
committed by Bryan Frimin
parent bbdea575d1
commit 1257347df9
21 changed files with 185 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

94
pkg/server/api/authn/api_key_middleware.go Normal file
View File

@@ -0,0 +1,94 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package authn
import (
"errors"
"fmt"
"net/http"
"github.com/99designs/gqlgen/graphql"
"github.com/vektah/gqlparser/v2/gqlerror"
"go.gearno.de/kit/httpserver"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/securetoken"
"go.probo.inc/probo/pkg/server/gqlutils"
)
func NewAPIKeyMiddleware(svc *iam.Service, tokenSecret string) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
tokenValue, err := securetoken.Get(r, tokenSecret)
if err != nil {
next.ServeHTTP(w, r)
return
}
keyID, err := gid.ParseGID(tokenValue)
if err != nil {
next.ServeHTTP(w, r)
return
}
session := SessionFromContext(ctx)
if keyID != gid.Nil && session != nil {
httpserver.RenderJSON(
w,
http.StatusUnauthorized,
&graphql.Response{
Errors: gqlerror.List{
gqlutils.Conflictf(ctx, "API key authentication cannot be used with session authentication"),
},
},
)
return
}
apiKey, err := svc.APIKeyService.GetAPIKey(ctx, keyID)
if err != nil {
var errPersonalAPIKeyNotFound *iam.ErrPersonalAPIKeyNotFound
var errPersonalAPIKeyExpired *iam.ErrPersonalAPIKeyExpired
if errors.As(err, &errPersonalAPIKeyNotFound) || errors.As(err, &errPersonalAPIKeyExpired) {
next.ServeHTTP(w, r)
return
}
panic(fmt.Errorf("cannot get personal API key: %w", err))
}
identity, err := svc.AccountService.GetIdentity(ctx, apiKey.IdentityID)
if err != nil {
var errIdentityNotFound *iam.ErrIdentityNotFound
if errors.As(err, &errIdentityNotFound) {
next.ServeHTTP(w, r)
return
}
panic(fmt.Errorf("cannot get identity: %w", err))
}
ctx = ContextWithAPIKey(ctx, apiKey)
ctx = ContextWithIdentity(ctx, identity)
next.ServeHTTP(w, r.WithContext(ctx))
},
)
}
}

58
pkg/server/api/authn/context.go Normal file
View File

@@ -0,0 +1,58 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package authn
import (
"context"
"go.probo.inc/probo/pkg/coredata"
)
type (
ctxKey struct{ name string }
)
var (
identityContextKey = &ctxKey{name: "identity"}
sessionContextKey = &ctxKey{name: "session"}
apiKeyContextKey = &ctxKey{name: "api_key"}
)
func SessionFromContext(ctx context.Context) *coredata.Session {
session, _ := ctx.Value(sessionContextKey).(*coredata.Session)
return session
}
func ContextWithSession(ctx context.Context, session *coredata.Session) context.Context {
return context.WithValue(ctx, sessionContextKey, session)
}
func IdentityFromContext(ctx context.Context) *coredata.Identity {
identity, _ := ctx.Value(identityContextKey).(*coredata.Identity)
return identity
}
func ContextWithIdentity(ctx context.Context, identity *coredata.Identity) context.Context {
return context.WithValue(ctx, identityContextKey, identity)
}
func APIKeyFromContext(ctx context.Context) *coredata.PersonalAPIKey {
apiKey, _ := ctx.Value(apiKeyContextKey).(*coredata.PersonalAPIKey)
return apiKey
}
func ContextWithAPIKey(ctx context.Context, apiKey *coredata.PersonalAPIKey) context.Context {
return context.WithValue(ctx, apiKeyContextKey, apiKey)
}

52
pkg/server/api/authn/identity_presence_middleware.go Normal file
View File

@@ -0,0 +1,52 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package authn
import (
"net/http"
"github.com/99designs/gqlgen/graphql"
"github.com/vektah/gqlparser/v2/gqlerror"
"go.gearno.de/kit/httpserver"
"go.probo.inc/probo/pkg/server/gqlutils"
)
func NewIdentityPresenceMiddleware() func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
identity := IdentityFromContext(r.Context())
if identity == nil {
httpserver.RenderJSON(
w,
http.StatusUnauthorized,
&graphql.Response{
Errors: gqlerror.List{
gqlutils.Unauthenticatedf(
r.Context(),
"authentication is required to access this resouce",
),
},
},
)
return
}
next.ServeHTTP(w, r)
},
)
}
}

117
pkg/server/api/authn/session_middleware.go Normal file
View File

@@ -0,0 +1,117 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package authn
import (
"errors"
"fmt"
"net"
"net/http"
"github.com/99designs/gqlgen/graphql"
"github.com/vektah/gqlparser/v2/gqlerror"
"go.gearno.de/kit/httpserver"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/gqlutils"
)
func NewSessionMiddleware(svc *iam.Service, cookieConfig securecookie.Config) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
cookieValue, err := securecookie.Get(r, cookieConfig)
if err != nil {
next.ServeHTTP(w, r)
return
}
sessionID, err := gid.ParseGID(cookieValue)
if err != nil {
securecookie.Clear(w, cookieConfig)
next.ServeHTTP(w, r)
return
}
apiKey := APIKeyFromContext(ctx)
if sessionID != gid.Nil && apiKey != nil {
httpserver.RenderJSON(
w,
http.StatusUnauthorized,
&graphql.Response{
Errors: gqlerror.List{
gqlutils.Conflictf(ctx, "session authentication cannot be used with API key authentication"),
},
},
)
return
}
session, err := svc.SessionService.GetSession(ctx, sessionID)
if err != nil {
var errSessionNotFound *iam.ErrSessionNotFound
var errSessionExpired *iam.ErrSessionExpired
if errors.As(err, &errSessionNotFound) || errors.As(err, &errSessionExpired) {
securecookie.Clear(w, cookieConfig)
next.ServeHTTP(w, r)
return
}
panic(fmt.Errorf("cannot get session: %w", err))
}
identity, err := svc.AccountService.GetIdentity(ctx, session.IdentityID)
if err != nil {
var errIdentityNotFound *iam.ErrIdentityNotFound
if errors.As(err, &errIdentityNotFound) {
securecookie.Clear(w, cookieConfig)
next.ServeHTTP(w, r)
return
}
panic(fmt.Errorf("cannot get identity: %w", err))
}
userAgent := r.UserAgent()
// TODO: will work well when no layer 7 proxy is in front of the server
var ipAddress net.IP
if host, _, err := net.SplitHostPort(r.RemoteAddr); err == nil {
ipAddress = net.ParseIP(host)
} else {
ipAddress = net.ParseIP(r.RemoteAddr)
}
err = svc.SessionService.UpdateSessionInfo(ctx, session.ID, userAgent, ipAddress)
if err != nil {
panic(fmt.Errorf("cannot update session info: %w", err))
}
ctx = ContextWithSession(ctx, session)
ctx = ContextWithIdentity(ctx, identity)
next.ServeHTTP(w, r.WithContext(ctx))
err = svc.SessionService.UpdateSessionData(ctx, session.ID, session.Data)
if err != nil {
panic(fmt.Errorf("cannot update session data: %w", err))
}
},
)
}
}