wip

internal/auth/middleware.go

@@ -0,0 +1,102 @@
+package auth
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/yourusername/caldav-server/internal/config"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type contextKey string
+
+const userContextKey contextKey = "authenticated_user"
+
+// Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
+type Middleware struct {
+	cfg    *config.Config
+	logger *slog.Logger
+}
+
+func NewMiddleware(cfg *config.Config, logger *slog.Logger) *Middleware {
+	return &Middleware{cfg: cfg, logger: logger}
+}
+
+// Wrap returns an http.Handler that requires valid Basic Auth credentials
+// before delegating to next.
+func (m *Middleware) Wrap(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		username, password, ok := r.BasicAuth()
+		if !ok {
+			m.challenge(w)
+			return
+		}
+
+		user, err := m.authenticate(username, password)
+		if err != nil {
+			m.logger.Warn("authentication failed",
+				"username", username,
+				"remote_addr", r.RemoteAddr,
+				"error", err)
+			m.challenge(w)
+			return
+		}
+
+		m.logger.Debug("authenticated request",
+			"username", username,
+			"method", r.Method,
+			"path", r.URL.Path)
+
+		ctx := context.WithValue(r.Context(), userContextKey, &Principal{
+			Username:    username,
+			DisplayName: user.DisplayName,
+			Email:       user.Email,
+		})
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// challenge sends a 401 response requesting Basic Auth.
+func (m *Middleware) challenge(w http.ResponseWriter) {
+	w.Header().Set("WWW-Authenticate", `Basic realm="`+m.cfg.Auth.Realm+`"`)
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(http.StatusUnauthorized)
+	_, _ = w.Write([]byte("Unauthorized"))
+}
+
+// authenticate validates username/password against config.
+func (m *Middleware) authenticate(username, password string) (*config.UserConfig, error) {
+	user, ok := m.cfg.Users[username]
+	if !ok {
+		// constant-time comparison to avoid timing attacks
+		_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalid"), []byte(password))
+		return nil, errUnauthorized
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
+		return nil, errUnauthorized
+	}
+
+	return &user, nil
+}
+
+// Principal holds the authenticated user's identity.
+type Principal struct {
+	Username    string
+	DisplayName string
+	Email       string
+}
+
+// FromContext extracts the Principal from a request context.
+// Returns nil if the request was not authenticated.
+func FromContext(ctx context.Context) *Principal {
+	p, _ := ctx.Value(userContextKey).(*Principal)
+	return p
+}
+
+var errUnauthorized = &authError{msg: "invalid credentials"}
+
+type authError struct{ msg string }
+
+func (e *authError) Error() string { return e.msg }