41 lines
1.4 KiB
Go
41 lines
1.4 KiB
Go
package middleware
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"crypto/subtle"
|
|
"errors"
|
|
apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
|
|
"git.yuntuo.hk/k2safe/go-omni/httpx"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// Auth is the fail-closed registry default. Startup replaces it with configured
|
|
// authentication. This administrative example uses one environment-only key;
|
|
// production applications can inject JWT/OIDC through the same middleware slot.
|
|
func Auth(next httpx.Handler) httpx.Handler {
|
|
return func(c *httpx.Context) error {
|
|
return apierrors.Unauthorized("UNAUTHENTICATED", "authentication required")
|
|
}
|
|
}
|
|
func NewAuthFromEnv() (httpx.Middleware, error) {
|
|
token := os.Getenv("USER_SERVICE_API_TOKEN")
|
|
if len(token) < 32 || strings.ContainsAny(token, " \t\r\n") {
|
|
return nil, errors.New("USER_SERVICE_API_TOKEN requires at least 32 bytes without whitespace")
|
|
}
|
|
expected := sha256.Sum256([]byte(token))
|
|
return func(next httpx.Handler) httpx.Handler {
|
|
return func(c *httpx.Context) error {
|
|
parts := strings.Fields(c.Header("Authorization"))
|
|
if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
|
|
return apierrors.Unauthorized("UNAUTHENTICATED", "authentication required")
|
|
}
|
|
actual := sha256.Sum256([]byte(parts[1]))
|
|
if subtle.ConstantTimeCompare(expected[:], actual[:]) != 1 {
|
|
return apierrors.Unauthorized("UNAUTHENTICATED", "authentication required")
|
|
}
|
|
return next(c)
|
|
}
|
|
}, nil
|
|
}
|