de63217168
- api.go: errors.Is → core.Is - openapi.go: Build returns core.Result, encoding/json → core.JSONMarshal - export.go: rewrite with core.Fs, core.JSONUnmarshal, returns core.Result - codegen.go: rewrite with c.Process(), core.Fs, App.Find — no os/exec - sse.go: encoding/json → core.JSONMarshalString, fmt → core.Sprintf - swagger.go: fmt → core.Sprintf, Build caller updated for core.Result - middleware.go: strings → core.HasPrefix/SplitN/Lower - authentik.go: strings → core.HasPrefix/TrimPrefix/Split/Trim/Contains - brotli.go: strings → core.Contains Transport boundary files (net/http, io for compression) retained. Co-Authored-By: Virgil <virgil@lethean.io>
59 lines
1.6 KiB
Go
59 lines
1.6 KiB
Go
// SPDX-License-Identifier: EUPL-1.2
|
|
|
|
package api
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"net/http"
|
|
core "dappco.re/go/core"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// bearerAuthMiddleware validates the Authorization: Bearer <token> header.
|
|
// Requests to paths in the skip list are allowed through without authentication.
|
|
// Returns 401 with Fail("unauthorised", ...) on missing or invalid tokens.
|
|
func bearerAuthMiddleware(token string, skip []string) gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
// Check whether the request path should bypass authentication.
|
|
for _, path := range skip {
|
|
if core.HasPrefix(c.Request.URL.Path, path) {
|
|
c.Next()
|
|
return
|
|
}
|
|
}
|
|
|
|
header := c.GetHeader("Authorization")
|
|
if header == "" {
|
|
c.AbortWithStatusJSON(http.StatusUnauthorized, Fail("unauthorised", "missing authorization header"))
|
|
return
|
|
}
|
|
|
|
parts := core.SplitN(header, " ", 2)
|
|
if len(parts) != 2 || core.Lower(parts[0]) != "bearer" || parts[1] != token {
|
|
c.AbortWithStatusJSON(http.StatusUnauthorized, Fail("unauthorised", "invalid bearer token"))
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// requestIDMiddleware ensures every response carries an X-Request-ID header.
|
|
// If the client sends one, it is preserved; otherwise a random 16-byte hex
|
|
// string is generated. The ID is also stored in the Gin context as "request_id".
|
|
func requestIDMiddleware() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
id := c.GetHeader("X-Request-ID")
|
|
if id == "" {
|
|
b := make([]byte, 16)
|
|
_, _ = rand.Read(b)
|
|
id = hex.EncodeToString(b)
|
|
}
|
|
|
|
c.Set("request_id", id)
|
|
c.Header("X-Request-ID", id)
|
|
c.Next()
|
|
}
|
|
}
|