36 changed files with 442 additions and 408 deletions
-
16cmd/rpdata-graphiql/main.go
-
8graphql/resolver/mutations/addChannel.go
-
12graphql/resolver/mutations/addChapter.go
-
12graphql/resolver/mutations/addCharacter.go
-
10graphql/resolver/mutations/addCharacterNick.go
-
8graphql/resolver/mutations/addLog.go
-
8graphql/resolver/mutations/addPost.go
-
12graphql/resolver/mutations/addStory.go
-
10graphql/resolver/mutations/addStoryTag.go
-
8graphql/resolver/mutations/editChannel.go
-
10graphql/resolver/mutations/editChapter.go
-
10graphql/resolver/mutations/editCharacter.go
-
8graphql/resolver/mutations/editFile.go
-
8graphql/resolver/mutations/editLog.go
-
8graphql/resolver/mutations/editPost.go
-
10graphql/resolver/mutations/editStory.go
-
8graphql/resolver/mutations/movePost.go
-
8graphql/resolver/mutations/removeChannel.go
-
8graphql/resolver/mutations/removeChapter.go
-
10graphql/resolver/mutations/removeCharacter.go
-
10graphql/resolver/mutations/removeCharacterNick.go
-
8graphql/resolver/mutations/removeFile.go
-
8graphql/resolver/mutations/removeLog.go
-
8graphql/resolver/mutations/removePost.go
-
10graphql/resolver/mutations/removeStory.go
-
10graphql/resolver/mutations/removeStoryTag.go
-
8graphql/resolver/queries/files.go
-
11graphql/resolver/queries/stories.go
-
16graphql/resolver/types/session.go
-
16graphql/resolver/types/user.go
-
109internal/auth/key.go
-
198internal/auth/token.go
-
4internal/auth/user.go
-
20internal/session/context.go
-
40internal/session/defaults.go
-
182internal/session/session.go
@ -1,16 +0,0 @@ |
|||
package types |
|||
|
|||
import "git.aiterp.net/rpdata/api/internal/session" |
|||
|
|||
// SessionResolver resolves Session
|
|||
type SessionResolver struct{ S *session.Session } |
|||
|
|||
// User resolves Session.user
|
|||
func (r *SessionResolver) User() *UserResolver { |
|||
user := r.S.User() |
|||
if user == nil { |
|||
return nil |
|||
} |
|||
|
|||
return &UserResolver{U: user} |
|||
} |
|||
@ -1,16 +0,0 @@ |
|||
package types |
|||
|
|||
import "git.aiterp.net/rpdata/api/internal/session" |
|||
|
|||
// UserResolver resulves the user type
|
|||
type UserResolver struct{ U *session.User } |
|||
|
|||
// ID resolves User.id
|
|||
func (r *UserResolver) ID() string { |
|||
return r.U.ID |
|||
} |
|||
|
|||
// Permissions resolves User.permissions
|
|||
func (r *UserResolver) Permissions() []string { |
|||
return r.U.Permissions |
|||
} |
|||
@ -0,0 +1,109 @@ |
|||
package auth |
|||
|
|||
import ( |
|||
"crypto/rand" |
|||
"encoding/binary" |
|||
"errors" |
|||
"strconv" |
|||
|
|||
"git.aiterp.net/rpdata/api/internal/store" |
|||
"github.com/globalsign/mgo" |
|||
) |
|||
|
|||
var keyCollection *mgo.Collection |
|||
|
|||
// A Key contains a JWT secret and the limitations of it. There are two types of
|
|||
// keys, single-user keys and wildcard keys. The former is used to authenticate
|
|||
// a single user (e.g. the logbot) through an API while the latter is only for
|
|||
// services that can be trusted to perform its own authentication (a frontend).
|
|||
type Key struct { |
|||
ID string `bson:"_id"` |
|||
Name string `bson:"name"` |
|||
User string `bson:"user"` |
|||
Secret string `bson:"secret"` |
|||
} |
|||
|
|||
// ValidForUser returns true if the key's user is the same as
|
|||
// the user, or it's a wildcard key.
|
|||
func (key *Key) ValidForUser(user string) bool { |
|||
return key.User == user || key.User == "*" |
|||
} |
|||
|
|||
// FindKey finds a key by kid (key ID)
|
|||
func FindKey(kid string) (Key, error) { |
|||
key := Key{} |
|||
err := keyCollection.FindId(kid).One(&key) |
|||
|
|||
return key, err |
|||
} |
|||
|
|||
// NewKey generates a new key for the user and name. This
|
|||
// does not allow generating wildcard keys, they have to be
|
|||
// manually inserted into the DB.
|
|||
func NewKey(name, user string) (*Key, error) { |
|||
if user == "*" { |
|||
return nil, errors.New("auth: wildcard keys not allowed") |
|||
} |
|||
|
|||
secret, err := makeKeySecret() |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
key := &Key{ |
|||
ID: makeKeyID(), |
|||
Name: name, |
|||
User: user, |
|||
Secret: secret, |
|||
} |
|||
|
|||
if err := keyCollection.Insert(key); err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return key, nil |
|||
} |
|||
|
|||
func init() { |
|||
store.HandleInit(func(db *mgo.Database) { |
|||
keyCollection = db.C("auth.keys") |
|||
|
|||
keyCollection.EnsureIndexKey("user") |
|||
}) |
|||
} |
|||
|
|||
// makeKeyID makes a random story ID that's 16 characters long
|
|||
func makeKeyID() string { |
|||
result := "K" |
|||
offset := 0 |
|||
data := make([]byte, 32) |
|||
|
|||
rand.Read(data) |
|||
for len(result) < 16 { |
|||
result += strconv.FormatUint(binary.LittleEndian.Uint64(data[offset:]), 36) |
|||
offset += 8 |
|||
|
|||
if offset >= 32 { |
|||
rand.Read(data) |
|||
offset = 0 |
|||
} |
|||
} |
|||
|
|||
return result[:16] |
|||
} |
|||
|
|||
func makeKeySecret() (string, error) { |
|||
data := make([]byte, 64) |
|||
alphabet := "0123456789abcdefghjiklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSUTVWXYZ-_" |
|||
|
|||
_, err := rand.Read(data) |
|||
if err != nil { |
|||
return "", err |
|||
} |
|||
|
|||
for i := range data { |
|||
data[i] = alphabet[data[i]%64] |
|||
} |
|||
|
|||
return string(data), nil |
|||
} |
|||
@ -0,0 +1,198 @@ |
|||
package auth |
|||
|
|||
import ( |
|||
"context" |
|||
"errors" |
|||
"fmt" |
|||
"net/http" |
|||
"strings" |
|||
"time" |
|||
|
|||
jwt "github.com/dgrijalva/jwt-go" |
|||
) |
|||
|
|||
var contextKey = &struct{ data string }{"Token Context Key"} |
|||
|
|||
// ErrNoKid is returned if the key id is missing from the jwt token header,
|
|||
var ErrNoKid = errors.New("Missing \"kid\" field in token") |
|||
|
|||
// ErrKeyNotFound is returned if the key wasn't found.
|
|||
var ErrKeyNotFound = errors.New("Key not found") |
|||
|
|||
// ErrInvalidClaims is returned by parseClaims if the claims cannot be parsed
|
|||
var ErrInvalidClaims = errors.New("Invalid claims in token") |
|||
|
|||
// ErrExpired is returned by parseClaims if the expiry date is in the past
|
|||
var ErrExpired = errors.New("Claims have already expired") |
|||
|
|||
// ErrWrongUser is returned by CheckToken if the key cannot represent this user
|
|||
var ErrWrongUser = errors.New("Key is not valid for this user") |
|||
|
|||
// ErrWrongPermissions is returned by CheckToken if the key cannot claim one or more of its permissions
|
|||
var ErrWrongPermissions = errors.New("Key is not valid for this user") |
|||
|
|||
// ErrDeletedUser is returned by CheckToken if the key can represent this user, but the user doesn't exist.
|
|||
var ErrDeletedUser = errors.New("User was not found") |
|||
|
|||
// A Token contains the parsed results from an bearer token. Its methods are safe to use with a nil receiver, but
|
|||
// the userID should be checked.
|
|||
type Token struct { |
|||
UserID string |
|||
Permissions []string |
|||
} |
|||
|
|||
// Authenticated returns true if the token is non-nil and parsed
|
|||
func (token *Token) Authenticated() bool { |
|||
return token != nil && token.UserID != "" |
|||
} |
|||
|
|||
// Permitted returns true if the token is non-nil and has the given permission or the "admin" permission
|
|||
func (token *Token) Permitted(permissions ...string) bool { |
|||
if token == nil { |
|||
return false |
|||
} |
|||
|
|||
for _, tokenPermission := range token.Permissions { |
|||
if tokenPermission == "admin" { |
|||
return true |
|||
} |
|||
|
|||
for _, permission := range permissions { |
|||
if permission == tokenPermission { |
|||
return true |
|||
} |
|||
} |
|||
} |
|||
|
|||
return false |
|||
} |
|||
|
|||
// PermittedUser checks the first permission if the user matches, the second otherwise. This is a common
|
|||
// pattern.
|
|||
func (token *Token) PermittedUser(userID, permissionIfUser, permissionOtherwise string) bool { |
|||
if token == nil { |
|||
return false |
|||
} |
|||
|
|||
if token.UserID == userID { |
|||
return token.Permitted(permissionIfUser) |
|||
} |
|||
|
|||
return token.Permitted(permissionOtherwise) |
|||
} |
|||
|
|||
// TokenFromContext gets the token from context.
|
|||
func TokenFromContext(ctx context.Context) *Token { |
|||
token, ok := ctx.Value(contextKey).(*Token) |
|||
if !ok { |
|||
return nil |
|||
} |
|||
|
|||
return token |
|||
} |
|||
|
|||
// RequestWithToken either returns the request, or the request with a new context that
|
|||
// has the token.
|
|||
func RequestWithToken(r *http.Request) *http.Request { |
|||
header := r.Header.Get("Authorization") |
|||
if header == "" { |
|||
return r |
|||
} |
|||
|
|||
if !strings.HasPrefix(header, "Bearer ") { |
|||
return r |
|||
} |
|||
|
|||
token, err := CheckToken(header[7:]) |
|||
if err != nil { |
|||
return r |
|||
} |
|||
|
|||
return r.WithContext(context.WithValue(r.Context(), contextKey, &token)) |
|||
} |
|||
|
|||
// CheckToken reads the token string and returns a token if everything is kosher.
|
|||
func CheckToken(tokenString string) (token Token, err error) { |
|||
var key Key |
|||
|
|||
jwtToken, err := jwt.Parse(tokenString, func(jwtToken *jwt.Token) (interface{}, error) { |
|||
if _, ok := jwtToken.Method.(*jwt.SigningMethodHMAC); !ok { |
|||
return nil, fmt.Errorf("Unexpected signing method: %v", jwtToken.Header["alg"]) |
|||
} |
|||
|
|||
kid, ok := jwtToken.Header["kid"].(string) |
|||
if !ok { |
|||
return nil, ErrNoKid |
|||
} |
|||
|
|||
key, err = FindKey(kid) |
|||
if err != nil || key.ID == "" { |
|||
return nil, ErrKeyNotFound |
|||
} |
|||
|
|||
return []byte(key.Secret), nil |
|||
}) |
|||
if err != nil { |
|||
return Token{}, err |
|||
} |
|||
|
|||
userid, permissions, err := parseClaims(jwtToken.Claims) |
|||
if err != nil { |
|||
return Token{}, err |
|||
} |
|||
|
|||
if !key.ValidForUser(userid) { |
|||
return Token{}, ErrWrongUser |
|||
} |
|||
|
|||
user, err := FindUser(userid) |
|||
if err != nil { |
|||
return Token{}, ErrDeletedUser |
|||
} |
|||
|
|||
for _, permission := range permissions { |
|||
found := false |
|||
|
|||
for _, userPermission := range user.Permissions { |
|||
if permission == userPermission { |
|||
found = true |
|||
break |
|||
} |
|||
} |
|||
|
|||
if !found { |
|||
return Token{}, ErrWrongPermissions |
|||
} |
|||
} |
|||
|
|||
return Token{UserID: token.UserID, Permissions: permissions}, nil |
|||
} |
|||
|
|||
func parseClaims(jwtClaims jwt.Claims) (userid string, permissions []string, err error) { |
|||
mapClaims, ok := jwtClaims.(jwt.MapClaims) |
|||
if !ok { |
|||
return "", nil, ErrInvalidClaims |
|||
} |
|||
|
|||
if !mapClaims.VerifyExpiresAt(time.Now().Unix(), true) { |
|||
return "", nil, ErrExpired |
|||
} |
|||
|
|||
if userid, ok = mapClaims["user"].(string); !ok { |
|||
return "", nil, ErrInvalidClaims |
|||
} |
|||
|
|||
if claimedPermissions, ok := mapClaims["permissions"].([]interface{}); ok { |
|||
for _, permission := range claimedPermissions { |
|||
if permission, ok := permission.(string); ok { |
|||
permissions = append(permissions, permission) |
|||
} |
|||
} |
|||
} |
|||
|
|||
if len(permissions) == 0 { |
|||
return "", nil, ErrInvalidClaims |
|||
} |
|||
|
|||
return |
|||
} |
|||
@ -1,20 +0,0 @@ |
|||
package session |
|||
|
|||
import "context" |
|||
|
|||
type contextKeyType struct{ name string } |
|||
|
|||
func (ck *contextKeyType) String() string { |
|||
return ck.name |
|||
} |
|||
|
|||
var contextKey = &contextKeyType{name: "session context key"} |
|||
|
|||
// FromContext gets a session fron the context.
|
|||
func FromContext(ctx context.Context) *Session { |
|||
return ctx.Value(contextKey).(*Session) |
|||
} |
|||
|
|||
func contextWithSession(parent context.Context, session *Session) context.Context { |
|||
return context.WithValue(parent, contextKey, session) |
|||
} |
|||
@ -1,40 +0,0 @@ |
|||
package session |
|||
|
|||
// DefaultPermissions gets the default permissions
|
|||
func DefaultPermissions() []string { |
|||
return []string{ |
|||
"member", |
|||
"log.edit", |
|||
"log.reorder", |
|||
"post.edit", |
|||
"post.move", |
|||
"file.upload", |
|||
} |
|||
} |
|||
|
|||
// AllPermissions gets all permissions and their purpose
|
|||
func AllPermissions() map[string]string { |
|||
return map[string]string{ |
|||
"member": "Can add/edit/remove own content", |
|||
"user.edit": "Can edit non-owned users", |
|||
"character.add": "Can add non-owned characters", |
|||
"character.edit": "Can edit non-owned characters", |
|||
"character.remove": "Can remove non-owned characters", |
|||
"channel.add": "Can add channels", |
|||
"channel.edit": "Can edit channels", |
|||
"channel.remove": "Can remove channels", |
|||
"log.add": "Can add logs", |
|||
"log.edit": "Can edit logs", |
|||
"log.remove": "Can remove logs", |
|||
"post.add": "Can add posts", |
|||
"post.edit": "Can edit posts", |
|||
"post.move": "Can move posts", |
|||
"post.remove": "Can remove posts", |
|||
"story.edit": "Can edit non-owned stories", |
|||
"story.remove": "Can remove non-owned stories", |
|||
"story.unlisted": "Can view unlisted stories by other users", |
|||
"file.upload": "Can upload files", |
|||
"file.edit": "Can edit non-owned files", |
|||
"file.remove": "Can remove non-owned files", |
|||
} |
|||
} |
|||
@ -1,182 +0,0 @@ |
|||
package session |
|||
|
|||
import ( |
|||
"crypto/rand" |
|||
"encoding/hex" |
|||
"log" |
|||
"net/http" |
|||
"strings" |
|||
"sync" |
|||
"time" |
|||
|
|||
"git.aiterp.net/aiterp/wikiauth" |
|||
|
|||
"git.aiterp.net/rpdata/api/internal/config" |
|||
"git.aiterp.net/rpdata/api/internal/store" |
|||
"github.com/globalsign/mgo" |
|||
"github.com/globalsign/mgo/bson" |
|||
) |
|||
|
|||
var sessionCollection *mgo.Collection |
|||
|
|||
// A Session represents a login session.
|
|||
type Session struct { |
|||
mutex sync.Mutex |
|||
|
|||
ID string `bson:"_id"` |
|||
Time time.Time `bson:"time"` |
|||
UserID string `bson:"userId"` |
|||
|
|||
user *User |
|||
w http.ResponseWriter |
|||
} |
|||
|
|||
// Load loads a session from a cookie, returning either `r` or a request
|
|||
// with the session context.
|
|||
func Load(w http.ResponseWriter, r *http.Request) *http.Request { |
|||
cookie, err := r.Cookie("aiterp_session") |
|||
if err != nil { |
|||
return r.WithContext(contextWithSession(r.Context(), &Session{w: w})) |
|||
} |
|||
|
|||
id := cookie.Value |
|||
|
|||
session := Session{} |
|||
err = sessionCollection.FindId(id).One(&session) |
|||
if err != nil || time.Since(session.Time) > time.Hour*168 { |
|||
return r.WithContext(contextWithSession(r.Context(), &Session{w: w})) |
|||
} |
|||
|
|||
if session.ID != "" && time.Since(session.Time) > time.Second*30 { |
|||
session.Time = time.Now() |
|||
go sessionCollection.UpdateId(id, bson.M{"$set": bson.M{"time": session.Time}}) |
|||
} |
|||
|
|||
cookie.Expires = time.Now().Add(time.Hour * 168) |
|||
http.SetCookie(w, cookie) |
|||
|
|||
session.w = w |
|||
|
|||
return r.WithContext(contextWithSession(r.Context(), &session)) |
|||
} |
|||
|
|||
// Login logs a user in.
|
|||
func (session *Session) Login(username, password string) error { |
|||
auth := wikiauth.New(config.Global().Wiki.URL) |
|||
|
|||
err := auth.Login(username, password) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
|
|||
// Allow bot passwords
|
|||
username = strings.SplitN(username, "@", 2)[0] |
|||
|
|||
data := make([]byte, 32) |
|||
_, err = rand.Read(data) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
|
|||
session.ID = hex.EncodeToString(data) |
|||
session.UserID = username |
|||
session.Time = time.Now() |
|||
|
|||
err = sessionCollection.Insert(&session) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
|
|||
http.SetCookie(session.w, &http.Cookie{ |
|||
Name: "aiterp_session", |
|||
Value: session.ID, |
|||
Expires: time.Now().Add(time.Hour * 2160), // 90 days
|
|||
HttpOnly: true, |
|||
}) |
|||
|
|||
user, err := FindUser(session.UserID) |
|||
if err == mgo.ErrNotFound { |
|||
user = User{ID: username, Nick: "", Permissions: DefaultPermissions()} |
|||
|
|||
err := userCollection.Insert(user) |
|||
if err != nil { |
|||
return err |
|||
} |
|||
} else if err != nil { |
|||
return err |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// Logout logs out the session
|
|||
func (session *Session) Logout() { |
|||
http.SetCookie(session.w, &http.Cookie{ |
|||
Name: "aiterp_session", |
|||
Value: "", |
|||
Expires: time.Unix(0, 0), |
|||
HttpOnly: true, |
|||
}) |
|||
|
|||
session.mutex.Lock() |
|||
session.user = nil |
|||
session.UserID = "" |
|||
session.ID = "" |
|||
session.mutex.Unlock() |
|||
|
|||
sessionCollection.RemoveId(session.ID) |
|||
} |
|||
|
|||
// User gets the user information for the session.
|
|||
func (session *Session) User() *User { |
|||
session.mutex.Lock() |
|||
defer session.mutex.Unlock() |
|||
|
|||
if session.user != nil { |
|||
return session.user |
|||
} |
|||
|
|||
if session.UserID == "" { |
|||
return nil |
|||
} |
|||
|
|||
user, err := FindUser(session.UserID) |
|||
if err != nil { |
|||
return nil |
|||
} |
|||
|
|||
return &user |
|||
} |
|||
|
|||
// NameOrPermitted is a shorthand for checking the username OR permissions, e.g. to check
|
|||
// if a logged in user can edit a certain post.
|
|||
func (session *Session) NameOrPermitted(userid string, permissions ...string) bool { |
|||
if session.UserID == userid { |
|||
return true |
|||
} |
|||
|
|||
user := session.User() |
|||
if user == nil { |
|||
return false |
|||
} |
|||
|
|||
return user.Permitted() |
|||
} |
|||
|
|||
func init() { |
|||
store.HandleInit(func(db *mgo.Database) { |
|||
sessionCollection = db.C("core.sessions") |
|||
|
|||
sessionCollection.EnsureIndexKey("nick") |
|||
sessionCollection.EnsureIndexKey("userId") |
|||
|
|||
err := sessionCollection.EnsureIndex(mgo.Index{ |
|||
Name: "time", |
|||
Key: []string{"time"}, |
|||
ExpireAfter: time.Hour * 168, |
|||
}) |
|||
if err != nil { |
|||
log.Fatalln(err) |
|||
} |
|||
}) |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue