arnefandCopilot
b4644bc590
- Root handler now only serves the welcome page for GET/HEAD; all other methods (e.g. OPTIONS, PROPFIND) return 405 with an Allow header instead of always returning 200, fixing client capability probes and PROPFIND misbehavior. - Mount /files/ properly and cache one xwebdav.Handler per authenticated user so its LockSystem persists across requests instead of being recreated per-request (which broke LOCK/UNLOCK). - Remove the username segment from all DAV URLs (/cal/, /card/, /files/ are now identical for every account; the acting user is always resolved via Basic Auth, never the path). - Reintroduce a fixed literal "home" path segment (/cal/home/, /card/home/) to preserve the URL segment depth that go-webdav's caldav/carddav server relies on to classify resources (principal vs. home-set vs. collection vs. object). Removing the username had collapsed this depth, silently misclassifying requests and returning empty <multistatus> responses (DAVx5 "no resources found"). - Replace the store's single global mutex with per-user sharded locks so different users' requests no longer serialize against each other. - Add auth.NewContext test helper, WebDAV handler tests (per-user isolation, lock persistence across requests), and a concurrent multi-user store test. - Update README and copilot-instructions to document the new URL scheme and the go-webdav path-depth classification quirk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
110 lines
3.0 KiB
Go
110 lines
3.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"net/http"
|
|
|
|
"github.com/yourusername/caldav-server/internal/config"
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
type contextKey string
|
|
|
|
const userContextKey contextKey = "authenticated_user"
|
|
|
|
// Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
|
|
type Middleware struct {
|
|
cfg *config.Config
|
|
logger *slog.Logger
|
|
}
|
|
|
|
func NewMiddleware(cfg *config.Config, logger *slog.Logger) *Middleware {
|
|
return &Middleware{cfg: cfg, logger: logger}
|
|
}
|
|
|
|
// Wrap returns an http.Handler that requires valid Basic Auth credentials
|
|
// before delegating to next.
|
|
func (m *Middleware) Wrap(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
username, password, ok := r.BasicAuth()
|
|
if !ok {
|
|
m.challenge(w)
|
|
return
|
|
}
|
|
|
|
user, err := m.authenticate(username, password)
|
|
if err != nil {
|
|
m.logger.Warn("authentication failed",
|
|
"username", username,
|
|
"remote_addr", r.RemoteAddr,
|
|
"error", err)
|
|
m.challenge(w)
|
|
return
|
|
}
|
|
|
|
m.logger.Debug("authenticated request",
|
|
"username", username,
|
|
"method", r.Method,
|
|
"path", r.URL.Path)
|
|
|
|
ctx := context.WithValue(r.Context(), userContextKey, &Principal{
|
|
Username: username,
|
|
DisplayName: user.DisplayName,
|
|
Email: user.Email,
|
|
})
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
|
|
// challenge sends a 401 response requesting Basic Auth.
|
|
func (m *Middleware) challenge(w http.ResponseWriter) {
|
|
w.Header().Set("WWW-Authenticate", `Basic realm="`+m.cfg.Auth.Realm+`"`)
|
|
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
_, _ = w.Write([]byte("Unauthorized"))
|
|
}
|
|
|
|
// authenticate validates username/password against config.
|
|
func (m *Middleware) authenticate(username, password string) (*config.UserConfig, error) {
|
|
user, ok := m.cfg.Users[username]
|
|
if !ok {
|
|
// constant-time comparison to avoid timing attacks
|
|
_ = bcrypt.CompareHashAndPassword([]byte("$2b$12$invalid"), []byte(password))
|
|
return nil, errUnauthorized
|
|
}
|
|
|
|
if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
|
|
return nil, errUnauthorized
|
|
}
|
|
|
|
return &user, nil
|
|
}
|
|
|
|
// Principal holds the authenticated user's identity.
|
|
type Principal struct {
|
|
Username string
|
|
DisplayName string
|
|
Email string
|
|
}
|
|
|
|
// FromContext extracts the Principal from a request context.
|
|
// Returns nil if the request was not authenticated.
|
|
func FromContext(ctx context.Context) *Principal {
|
|
p, _ := ctx.Value(userContextKey).(*Principal)
|
|
return p
|
|
}
|
|
|
|
// NewContext returns a copy of ctx carrying p, retrievable via FromContext.
|
|
// This is primarily useful for tests of downstream packages that need an
|
|
// authenticated context without going through the Basic Auth handshake.
|
|
func NewContext(ctx context.Context, p *Principal) context.Context {
|
|
return context.WithValue(ctx, userContextKey, p)
|
|
}
|
|
|
|
var errUnauthorized = &authError{msg: "invalid credentials"}
|
|
|
|
type authError struct{ msg string }
|
|
|
|
func (e *authError) Error() string { return e.msg }
|