mirror of
https://github.com/therootcompany/golib.git
synced 2026-03-02 23:57:59 +00:00
103 lines
3.3 KiB
Go
103 lines
3.3 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"slices"
|
|
"strings"
|
|
)
|
|
|
|
// ErrNoCredentials is returned by RequestAuthenticator.Authenticate when the
|
|
// request contains no recognizable form of credentials.
|
|
var ErrNoCredentials = errors.New("no credentials provided")
|
|
|
|
// RequestAuthenticator extracts credentials from an HTTP request and delegates
|
|
// verification to a BasicAuthenticator. It supports Basic Auth, Authorization
|
|
// header tokens, custom token headers, and query-parameter tokens.
|
|
//
|
|
// Use NewRequestAuthenticator for sane defaults.
|
|
type RequestAuthenticator struct {
|
|
// Authenticator is the credential verifier called with the extracted
|
|
// username/password or token. Must be set before calling Authenticate.
|
|
Authenticator BasicAuthenticator
|
|
|
|
// AuthenticateBasic enables HTTP Basic Auth (Authorization: Basic …).
|
|
AuthenticateBasic bool
|
|
|
|
// AuthorizationSchemes lists accepted schemes for "Authorization: <scheme> <token>".
|
|
// nil or an empty slice skips the Authorization header entirely;
|
|
// ["*"] accepts any scheme; ["Bearer", "Token"] restricts to those schemes.
|
|
AuthorizationSchemes []string
|
|
|
|
// TokenHeaders lists header names checked for bearer tokens,
|
|
// e.g. []string{"API-Key", "X-API-Key"}.
|
|
TokenHeaders []string
|
|
|
|
// TokenQueryParams lists query parameter names checked for tokens,
|
|
// e.g. []string{"access_token", "token"}.
|
|
TokenQueryParams []string
|
|
}
|
|
|
|
// NewRequestAuthenticator returns a RequestAuthenticator with sane defaults:
|
|
// Basic Auth enabled, Bearer/Token Authorization schemes, common API-key
|
|
// headers, and access_token/token query params.
|
|
func NewRequestAuthenticator() *RequestAuthenticator {
|
|
return &RequestAuthenticator{
|
|
AuthenticateBasic: true,
|
|
AuthorizationSchemes: []string{"Bearer", "Token"},
|
|
TokenHeaders: []string{"X-API-Key", "X-Auth-Token", "X-Access-Token"},
|
|
TokenQueryParams: []string{"access_token", "token"},
|
|
}
|
|
}
|
|
|
|
// Authenticate extracts credentials from r in this order:
|
|
// 1. Basic Auth (Authorization: Basic …)
|
|
// 2. Authorization: <scheme> <token> (filtered by AuthorizationSchemes)
|
|
// 3. Token headers (TokenHeaders)
|
|
// 4. Query parameters (TokenQueryParams)
|
|
//
|
|
// Returns ErrNoCredentials if no credential form is present in the request.
|
|
func (ra *RequestAuthenticator) Authenticate(r *http.Request) (BasicPrinciple, error) {
|
|
a := ra.Authenticator
|
|
|
|
// 1. Basic Auth
|
|
if ra.AuthenticateBasic {
|
|
if username, password, ok := r.BasicAuth(); ok {
|
|
return a.Authenticate(username, password)
|
|
}
|
|
}
|
|
|
|
// 2. Authorization: <scheme> <token>
|
|
// AuthorizationSchemes must be non-empty to check the Authorization header;
|
|
// nil or empty skips it entirely.
|
|
if len(ra.AuthorizationSchemes) > 0 {
|
|
if authHeader := r.Header.Get("Authorization"); authHeader != "" {
|
|
parts := strings.SplitN(authHeader, " ", 2)
|
|
if len(parts) == 2 {
|
|
scheme, token := parts[0], strings.TrimSpace(parts[1])
|
|
if ra.AuthorizationSchemes[0] == "*" ||
|
|
slices.Contains(ra.AuthorizationSchemes, scheme) {
|
|
return a.Authenticate("", token)
|
|
}
|
|
}
|
|
return nil, ErrNoCredentials
|
|
}
|
|
}
|
|
|
|
// 3. Token headers
|
|
for _, h := range ra.TokenHeaders {
|
|
if token := r.Header.Get(h); token != "" {
|
|
return a.Authenticate("", token)
|
|
}
|
|
}
|
|
|
|
// 4. Query parameters
|
|
for _, p := range ra.TokenQueryParams {
|
|
if token := r.URL.Query().Get(p); token != "" {
|
|
return a.Authenticate("", token)
|
|
}
|
|
}
|
|
|
|
return nil, ErrNoCredentials
|
|
}
|