Rewrite files/v1 handler with public and private endpoints

Add GET /public/{fileID} (unauthenticated, public files only) and
GET /{fileID} (session+API key+OAuth2, all files, core:file:get IAM
check). IAM and not-found errors both return 404 to prevent leaking
whether a file exists.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/files/v1/handler.go

@@ -22,26 +22,50 @@ import (
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/filesign"
+	"go.probo.inc/probo/pkg/file"
 	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/probo"
+	"go.probo.inc/probo/pkg/securecookie"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/jsonutil"
 )
 
 const presignedURLExpiry = 1 * time.Hour
 
 type Handler struct {
 	logger  *log.Logger
-	fileSvc *filesign.Service
+	fileSvc *file.Service
+	probo   *probo.Service
+	iamSvc  *iam.Service
 }
 
-func NewMux(logger *log.Logger, fileSvc *filesign.Service) *chi.Mux {
+func NewMux(
+	logger *log.Logger,
+	fileSvc *file.Service,
+	proboSvc *probo.Service,
+	iamSvc *iam.Service,
+	cookieConfig securecookie.Config,
+	tokenSecret string,
+) *chi.Mux {
 	h := &Handler{
 		logger:  logger,
 		fileSvc: fileSvc,
+		probo:   proboSvc,
+		iamSvc:  iamSvc,
 	}
 
 	r := chi.NewRouter()
 
-	r.Get("/{fileID}", h.handleGetPublicFile)
+	r.Get("/public/{fileID}", h.handleGetPublicFile)
+
+	r.Group(func(r chi.Router) {
+		r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
+		r.Use(authn.NewAPIKeyMiddleware(iamSvc, tokenSecret))
+		r.Use(authn.NewOAuth2AccessTokenMiddleware(iamSvc))
+		r.Use(authn.NewIdentityPresenceMiddleware())
+		r.Get("/{fileID}", h.handleGetFile)
+	})
 
 	return r
 }
@@ -51,14 +75,14 @@ func (h *Handler) handleGetPublicFile(w http.ResponseWriter, r *http.Request) {
 
 	fileID, err := gid.ParseGID(fileIDStr)
 	if err != nil {
-		http.NotFound(w, r)
+		jsonutil.RenderNotFound(w, fmt.Errorf("file not found"))
 		return
 	}
 
-	presignedURL, err := h.fileSvc.GeneratePresignedFileURL(r.Context(), fileID, presignedURLExpiry)
+	presignedURL, err := h.fileSvc.GeneratePublicPresignedURL(r.Context(), fileID, presignedURLExpiry)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
-			http.NotFound(w, r)
+			jsonutil.RenderNotFound(w, fmt.Errorf("file not found"))
 			return
 		}
 
@@ -68,7 +92,60 @@ func (h *Handler) handleGetPublicFile(w http.ResponseWriter, r *http.Request) {
 			log.Error(err),
 			log.String("file_id", fileIDStr),
 		)
-		http.Error(w, "internal server error", http.StatusInternalServerError)
+		jsonutil.RenderInternalServerError(w)
+
+		return
+	}
+
+	http.Redirect(w, r, presignedURL, http.StatusTemporaryRedirect)
+}
+
+func (h *Handler) handleGetFile(w http.ResponseWriter, r *http.Request) {
+	fileIDStr := chi.URLParam(r, "fileID")
+
+	fileID, err := gid.ParseGID(fileIDStr)
+	if err != nil {
+		jsonutil.RenderNotFound(w, fmt.Errorf("file not found"))
+		return
+	}
+
+	ctx := r.Context()
+	identity := authn.IdentityFromContext(ctx)
+	session := authn.SessionFromContext(ctx)
+
+	params := iam.AuthorizeParams{
+		Principal:          identity.ID,
+		Resource:           fileID,
+		Action:             probo.ActionFileGet,
+		ResourceAttributes: make(map[string]string),
+	}
+	if session != nil {
+		params.Session = &session.ID
+	}
+
+	scope, err := h.iamSvc.Authorizer.Authorize(ctx, params)
+	if err != nil {
+		jsonutil.RenderNotFound(w, fmt.Errorf("file not found"))
+		return
+	}
+
+	f, err := h.probo.Files.Get(ctx, scope, fileID)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) {
+			jsonutil.RenderNotFound(w, fmt.Errorf("file not found"))
+			return
+		}
+
+		h.logger.ErrorCtx(ctx, "cannot get file", log.Error(err), log.String("file_id", fileIDStr))
+		jsonutil.RenderInternalServerError(w)
+
+		return
+	}
+
+	presignedURL, err := h.fileSvc.GeneratePresignedURL(ctx, f, presignedURLExpiry)
+	if err != nil {
+		h.logger.ErrorCtx(ctx, "cannot generate file URL", log.Error(err), log.String("file_id", fileIDStr))
+		jsonutil.RenderInternalServerError(w)
 
 		return
 	}