103 lines
2.7 KiB
Go
103 lines
2.7 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"net/http"
|
|
|
|
"github.com/yourusername/caldav-server/internal/config"
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
type contextKey string
|
|
|
|
const userContextKey contextKey = "authenticated_user"
|
|
|
|
// Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
|
|
type Middleware struct {
|
|
cfg *config.Config
|
|
logger *slog.Logger
|
|
}
|
|
|
|
func NewMiddleware(cfg *config.Config, logger *slog.Logger) *Middleware {
|
|
return &Middleware{cfg: cfg, logger: logger}
|
|
}
|
|
|
|
// Wrap returns an http.Handler that requires valid Basic Auth credentials
|
|
// before delegating to next.
|
|
func (m *Middleware) Wrap(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
username, password, ok := r.BasicAuth()
|
|
if !ok {
|
|
m.challenge(w)
|
|
return
|
|
}
|
|
|
|
user, err := m.authenticate(username, password)
|
|
if err != nil {
|
|
m.logger.Warn("authentication failed",
|
|
"username", username,
|
|
"remote_addr", r.RemoteAddr,
|
|
"error", err)
|
|
m.challenge(w)
|
|
return
|
|
}
|
|
|
|
m.logger.Debug("authenticated request",
|
|
"username", username,
|
|
"method", r.Method,
|
|
"path", r.URL.Path)
|
|
|
|
ctx := context.WithValue(r.Context(), userContextKey, &Principal{
|
|
Username: username,
|
|
DisplayName: user.DisplayName,
|
|
Email: user.Email,
|
|
})
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
|
|
// challenge sends a 401 response requesting Basic Auth.
|
|
func (m *Middleware) challenge(w http.ResponseWriter) {
|
|
w.Header().Set("WWW-Authenticate", `Basic realm="`+m.cfg.Auth.Realm+`"`)
|
|
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
_, _ = w.Write([]byte("Unauthorized"))
|
|
}
|
|
|
|
// authenticate validates username/password against config.
|
|
func (m *Middleware) authenticate(username, password string) (*config.UserConfig, error) {
|
|
user, ok := m.cfg.Users[username]
|
|
if !ok {
|
|
// constant-time comparison to avoid timing attacks
|
|
_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalid"), []byte(password))
|
|
return nil, errUnauthorized
|
|
}
|
|
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
|
|
return nil, errUnauthorized
|
|
}
|
|
|
|
return &user, nil
|
|
}
|
|
|
|
// Principal holds the authenticated user's identity.
|
|
type Principal struct {
|
|
Username string
|
|
DisplayName string
|
|
Email string
|
|
}
|
|
|
|
// FromContext extracts the Principal from a request context.
|
|
// Returns nil if the request was not authenticated.
|
|
func FromContext(ctx context.Context) *Principal {
|
|
p, _ := ctx.Value(userContextKey).(*Principal)
|
|
return p
|
|
}
|
|
|
|
var errUnauthorized = &authError{msg: "invalid credentials"}
|
|
|
|
type authError struct{ msg string }
|
|
|
|
func (e *authError) Error() string { return e.msg }
|