97 lines
2.5 KiB
Go
97 lines
2.5 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"git.gobha.me/xcaliber/chat-switchboard/config"
|
|
"git.gobha.me/xcaliber/chat-switchboard/database"
|
|
"git.gobha.me/xcaliber/chat-switchboard/store"
|
|
)
|
|
|
|
// AuthOrRedirect validates JWT tokens for page routes.
|
|
// Unlike Auth() which returns 401 JSON for API calls, this redirects
|
|
// to the login page — appropriate for browser navigation.
|
|
//
|
|
// Token is read from the "sb_token" cookie (set by the login page JS)
|
|
// since page requests don't have Authorization headers.
|
|
func AuthOrRedirect(cfg *config.Config, users store.UserStore, cache *UserStatusCache) gin.HandlerFunc {
|
|
loginPath := cfg.BasePath + "/login"
|
|
|
|
return func(c *gin.Context) {
|
|
// Skip auth when running without a database (unmanaged mode)
|
|
if !database.IsConnected() {
|
|
c.Next()
|
|
return
|
|
}
|
|
|
|
// Try cookie first (set by login page), then Authorization header,
|
|
// then query param (for edge cases)
|
|
tokenString := ""
|
|
if cookie, err := c.Cookie("sb_token"); err == nil && cookie != "" {
|
|
tokenString = cookie
|
|
}
|
|
if tokenString == "" {
|
|
header := c.GetHeader("Authorization")
|
|
if strings.HasPrefix(header, "Bearer ") {
|
|
tokenString = strings.TrimPrefix(header, "Bearer ")
|
|
}
|
|
}
|
|
if tokenString == "" {
|
|
tokenString = c.Query("token")
|
|
}
|
|
|
|
if tokenString == "" {
|
|
redirectToLogin(c, loginPath)
|
|
return
|
|
}
|
|
|
|
claims, ok := parseAndValidateJWT(tokenString, cfg.JWTSecret)
|
|
if !ok {
|
|
redirectToLogin(c, loginPath)
|
|
return
|
|
}
|
|
|
|
// Verify user is active and resolve current role from DB
|
|
role, valid := verifyUser(c, claims, users, cache)
|
|
if !valid {
|
|
// verifyUser sent a JSON error, but for page routes we want a redirect.
|
|
// The abort already happened, so just return.
|
|
return
|
|
}
|
|
|
|
c.Set("user_id", claims.UserID)
|
|
c.Set("email", claims.Email)
|
|
c.Set("role", role)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// RequireAdminPage aborts with 403 if the user isn't an admin.
|
|
// Use after AuthOrRedirect for admin-only page routes.
|
|
func RequireAdminPage() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
role, _ := c.Get("role")
|
|
if role != "admin" {
|
|
c.String(http.StatusForbidden, "Admin access required")
|
|
c.Abort()
|
|
return
|
|
}
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
func redirectToLogin(c *gin.Context, loginPath string) {
|
|
// Save intended destination for post-login redirect
|
|
intended := c.Request.URL.Path
|
|
if c.Request.URL.RawQuery != "" {
|
|
intended += "?" + c.Request.URL.RawQuery
|
|
}
|
|
c.SetCookie("redirect_after_login", url.QueryEscape(intended), 300, "/", "", false, true)
|
|
c.Redirect(http.StatusFound, loginPath)
|
|
c.Abort()
|
|
}
|