core/server/middleware/page_auth.go

package middleware

import (
	"net/http"
	"net/url"
	"strings"

	"github.com/gin-gonic/gin"

	"armature/auth"
	"armature/config"
	"armature/database"
	"armature/store"
)

// AuthOrRedirect validates JWT tokens for page routes.
// Unlike Auth() which returns 401 JSON for API calls, this redirects
// to the login page — appropriate for browser navigation.
//
// Token is read from the "arm_token" cookie (set by the login page JS)
// since page requests don't have Authorization headers.
func AuthOrRedirect(cfg *config.Config, users store.UserStore, cache *UserStatusCache) gin.HandlerFunc {
	loginPath := cfg.BasePath + "/login"

	return func(c *gin.Context) {
		// Skip auth when running without a database (unmanaged mode)
		if !database.IsConnected() {
			c.Next()
			return
		}

		// Try cookie first (set by login page), then Authorization header,
		// then query param (for edge cases)
		tokenString := ""
		if cookie, err := c.Cookie("arm_token"); err == nil && cookie != "" {
			tokenString = cookie
		}
		if tokenString == "" {
			header := c.GetHeader("Authorization")
			if strings.HasPrefix(header, "Bearer ") {
				tokenString = strings.TrimPrefix(header, "Bearer ")
			}
		}
		if tokenString == "" {
			tokenString = c.Query("token")
		}

		if tokenString == "" {
			redirectToLogin(c, loginPath)
			return
		}

		claims, ok := parseAndValidateJWT(tokenString, cfg.JWTSecret)
		if !ok {
			redirectToLogin(c, loginPath)
			return
		}

		if claims.UserID == "" {
			redirectToLogin(c, loginPath)
			return
		}

		// Check user is active — redirect (not JSON) on failure.
		if entry, hit := cache.get(claims.UserID); hit {
			if !entry.isActive {
				redirectToLogin(c, loginPath)
				return
			}
		} else {
			user, err := users.GetByID(c.Request.Context(), claims.UserID)
			if err != nil || !user.IsActive {
				redirectToLogin(c, loginPath)
				return
			}
			cache.set(claims.UserID, user.IsActive)
		}

		c.Set("user_id", claims.UserID)
		c.Set("email", claims.Email)
		c.Next()
	}
}

// RequireAdminPage aborts with 403 if the user lacks surface.admin.access.
// Use after AuthOrRedirect for admin-only page routes.
func RequireAdminPage(stores store.Stores) gin.HandlerFunc {
	return func(c *gin.Context) {
		userID := c.GetString("user_id")
		perms, err := resolveAndCachePerms(c, stores, userID)
		if err != nil || !perms[auth.PermSurfaceAdminAccess] {
			c.String(http.StatusForbidden, "Admin access required")
			c.Abort()
			return
		}
		c.Next()
	}
}

// OptionalAuth authenticates the user if a valid token is present (cookie,
// header, or query param) but allows anonymous pass-through otherwise.
// Use for page routes that should be accessible by both authenticated users
// and anonymous visitors (e.g. public workflow entry pages).
func OptionalAuth(cfg *config.Config, users store.UserStore, cache *UserStatusCache) gin.HandlerFunc {
	return func(c *gin.Context) {
		if !database.IsConnected() {
			c.Next()
			return
		}

		tokenString := ""
		if cookie, err := c.Cookie("arm_token"); err == nil && cookie != "" {
			tokenString = cookie
		}
		if tokenString == "" {
			header := c.GetHeader("Authorization")
			if strings.HasPrefix(header, "Bearer ") {
				tokenString = strings.TrimPrefix(header, "Bearer ")
			}
		}
		if tokenString == "" {
			tokenString = c.Query("token")
		}

		// No token → anonymous pass-through
		if tokenString == "" {
			c.Next()
			return
		}

		claims, ok := parseAndValidateJWT(tokenString, cfg.JWTSecret)
		if !ok {
			// Invalid token → treat as anonymous
			c.Next()
			return
		}

		if claims.UserID != "" {
			if entry, hit := cache.get(claims.UserID); hit {
				if entry.isActive {
					c.Set("user_id", claims.UserID)
					c.Set("email", claims.Email)
				}
			} else {
				user, err := users.GetByID(c.Request.Context(), claims.UserID)
				if err == nil && user.IsActive {
					cache.set(claims.UserID, true)
					c.Set("user_id", claims.UserID)
					c.Set("email", claims.Email)
				}
			}
		}

		c.Next()
	}
}

func redirectToLogin(c *gin.Context, loginPath string) {
	// Save intended destination for post-login redirect
	intended := c.Request.URL.Path
	if c.Request.URL.RawQuery != "" {
		intended += "?" + c.Request.URL.RawQuery
	}
	c.SetCookie("redirect_after_login", url.QueryEscape(intended), 300, "/", "", false, true)
	c.Redirect(http.StatusFound, loginPath)
	c.Abort()
}