api/services/auth.go

package services

import (
	"context"
	"crypto/rand"
	"encoding/base64"
	"errors"
	"fmt"
	"git.aiterp.net/rpdata/api/models"
	"git.aiterp.net/rpdata/api/repositories"
	"github.com/dgrijalva/jwt-go"
	"log"
	"net/http"
	"reflect"
	"strings"
	"time"
)

var contextKey = &struct{ data string }{"Token Context Key"}

// ErrNoKid is returned if the key id is missing from the jwt token header,
var ErrNoKid = errors.New("missing \"kid\" field in token")

// ErrKeyNotFound is returned if the key wasn't found.
var ErrKeyNotFound = errors.New("key not found")

// ErrInvalidClaims is returned by parseClaims if the claims cannot be parsed
var ErrInvalidClaims = errors.New("invalid claims in token")

// ErrExpired is returned by parseClaims if the expiry date is in the past
var ErrExpired = errors.New("claims have already expired")

// ErrWrongUser is returned by CheckToken if the key cannot represent this user
var ErrWrongUser = errors.New("key is not valid for this user")

// ErrDeletedUser is returned by CheckToken if the key can represent this user, but the user doesn't exist.
var ErrDeletedUser = errors.New("user was not found")

// ErrUnauthenticated is returned when the user is not authenticated
var ErrUnauthenticated = errors.New("you are not authenticated")

// ErrUnauthorized is returned when the user doesn't have access to this resource
var ErrUnauthorized = errors.New("you are not authorized to perform this action")

// ErrInvalidOperation is returned for operations that should never be allowed
var ErrInvalidOperation = errors.New("no permission exists for this operation")

// AuthService is a service for handling the 'orizations and 'entications.
type AuthService struct {
	keys  repositories.KeyRepository
	users repositories.UserRepository
}

// FindKey finds a key by id.
func (s *AuthService) FindKey(ctx context.Context, id string) (*models.Key, error) {
	return s.keys.Find(ctx, id)
}

// FindUser finds a user by id.
func (s *AuthService) FindUser(ctx context.Context, id string) (*models.User, error) {
	return s.users.Find(ctx, id)
}

// CreateKey generates a new key for the user and name. This
// does not allow generating wildcard keys, they have to be
// manually inserted into the DB.
func (s *AuthService) CreateKey(ctx context.Context, name, user string) (*models.Key, error) {
	if user == "*" {
		return nil, errors.New("auth: wildcard keys not allowed")
	}

	secret, err := s.generateSecret()
	if err != nil {
		return nil, err
	}

	key := &models.Key{
		Name:   name,
		User:   user,
		Secret: secret,
	}

	key, err = s.keys.Insert(ctx, *key)
	if err != nil {
		return nil, err
	}

	return key, nil
}

// CheckPermission does some magic.
func (s *AuthService) CheckPermission(ctx context.Context, op string, obj interface{}) error {
	token := s.TokenFromContext(ctx)
	if token == nil {
		return ErrUnauthenticated
	}

	if v := reflect.ValueOf(obj); v.Kind() == reflect.Struct {
		ptr := reflect.PtrTo(v.Type())
		ptrValue := reflect.New(ptr.Elem())
		ptrValue.Elem().Set(v)

		obj = ptrValue.Interface()
	}

	var authorized = false

	switch v := obj.(type) {
	case *models.Channel:
		authorized = token.Permitted("channel." + op)
	case *models.Character:
		authorized = token.PermittedUser(v.Author, "member", "character."+op)
	case *models.Chapter:
		authorized = token.PermittedUser(v.Author, "member", "chapter."+op)
	case *models.Comment:
		if op == "add" && v.Author != token.UserID {
			return ErrInvalidOperation
		}

		authorized = token.PermittedUser(v.Author, "member", "comment."+op)
	case *models.File:
		authorized = token.PermittedUser(v.Author, "member", "file."+op)
	case *models.Log:
		authorized = token.Permitted("log." + op)
	case *models.Post:
		authorized = token.Permitted("post." + op)
	case *models.Story:
		if op == "tag" && v.Open {
			authorized = true
			break
		}

		authorized = token.PermittedUser(v.Author, "member", "story."+op)
	case *models.User:
		authorized = token.Permitted("user." + op)
	default:
		log.Panicf("Invalid model %T: %#+v", v, v)
	}

	if !authorized {
		return ErrUnauthorized
	}

	return nil
}

// TokenFromContext gets the token from context.
func (s *AuthService) TokenFromContext(ctx context.Context) *models.Token {
	token, ok := ctx.Value(contextKey).(*models.Token)
	if !ok {
		return nil
	}

	return token
}

// SpinOffContext adds the auth token to a background context.
func (s *AuthService) SpinOffContext(ctx context.Context) context.Context {
	token := s.TokenFromContext(ctx)

	return context.WithValue(context.Background(), contextKey, token)
}

// RequestWithToken either returns the request, or the request with a new context that
// has the token.
func (s *AuthService) RequestWithToken(r *http.Request) *http.Request {
	header := r.Header.Get("Authorization")
	if header == "" {
		return r
	}

	if !strings.HasPrefix(header, "Bearer ") {
		return r
	}

	token, err := s.CheckToken(r.Context(), header[7:])
	if err != nil {
		return r
	}

	return r.WithContext(context.WithValue(r.Context(), contextKey, &token))
}

// CheckToken reads the token string and returns a token if everything is kosher.
func (s *AuthService) CheckToken(ctx context.Context, tokenString string) (token models.Token, err error) {
	var key *models.Key

	jwtToken, err := jwt.Parse(tokenString, func(jwtToken *jwt.Token) (interface{}, error) {
		if _, ok := jwtToken.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, fmt.Errorf("unexpected signing method: %v", jwtToken.Header["alg"])
		}

		kid, ok := jwtToken.Header["kid"].(string)
		if !ok {
			return nil, ErrNoKid
		}

		key, err = s.FindKey(ctx, kid)
		if err != nil || key.ID == "" {
			return nil, ErrKeyNotFound
		}

		return []byte(key.Secret), nil
	})
	if err != nil {
		return models.Token{}, err
	}

	userid, permissions, err := s.parseClaims(jwtToken.Claims)
	if err != nil {
		return models.Token{}, err
	}

	if !key.ValidForUser(userid) {
		return models.Token{}, ErrWrongUser
	}

	user, err := s.ensureUser(ctx, userid)
	if err != nil {
		return models.Token{}, ErrDeletedUser
	}

	acceptedPermissions := make([]string, 0, len(user.Permissions))
	if len(permissions) > 0 {
		for _, permission := range permissions {
			found := false

			for _, userPermission := range user.Permissions {
				if permission == userPermission {
					found = true
					break
				}
			}

			if found {
				acceptedPermissions = append(acceptedPermissions, permission)
			}
		}
	} else {
		acceptedPermissions = append(acceptedPermissions, user.Permissions...)
	}

	return models.Token{UserID: user.ID, Permissions: acceptedPermissions}, nil
}

// AllPermissions gets all permissions and their purpose
func (s *AuthService) AllPermissions() map[string]string {
	return map[string]string{
		"member":           "Can add/edit/remove own content",
		"user.edit":        "Can edit non-owned users",
		"character.add":    "Can add non-owned characters",
		"character.edit":   "Can edit non-owned characters",
		"character.remove": "Can remove non-owned characters",
		"channel.add":      "Can add channels",
		"channel.edit":     "Can edit channels",
		"channel.remove":   "Can remove channels",
		"comment.edit":     "Can edit non-owned comments",
		"comment.remove":   "Can remove non-owned comments",
		"log.add":          "Can add logs",
		"log.edit":         "Can edit logs",
		"log.remove":       "Can remove logs",
		"post.add":         "Can add posts",
		"post.edit":        "Can edit posts",
		"post.move":        "Can move posts",
		"post.remove":      "Can remove posts",
		"story.add":        "Can add non-owned stories",
		"story.edit":       "Can edit non-owned stories",
		"story.remove":     "Can remove non-owned stories",
		"story.unlisted":   "Can view non-owned unlisted stories",
		"file.upload":      "Can upload files",
		"file.list":        "Can list non-owned files",
		"file.view":        "Can view non-owned files",
		"file.edit":        "Can edit non-owned files",
		"file.remove":      "Can remove non-owned files",
	}
}

func (s *AuthService) parseClaims(jwtClaims jwt.Claims) (userid string, permissions []string, err error) {
	mapClaims, ok := jwtClaims.(jwt.MapClaims)
	if !ok {
		return "", nil, ErrInvalidClaims
	}

	if !mapClaims.VerifyExpiresAt(time.Now().Unix(), true) {
		return "", nil, ErrExpired
	}

	if userid, ok = mapClaims["user"].(string); !ok {
		return "", nil, ErrInvalidClaims
	}

	if claimedPermissions, ok := mapClaims["permissions"].([]interface{}); ok {
		for _, permission := range claimedPermissions {
			if permission, ok := permission.(string); ok {
				permissions = append(permissions, permission)
			}
		}

		if len(permissions) == 0 {
			return "", nil, ErrInvalidClaims
		}
	}

	return
}

func (s *AuthService) generateSecret() (string, error) {
	var data [64]byte

	_, err := rand.Read(data[:])
	if err != nil {
		return "", err
	}

	return base64.RawURLEncoding.EncodeToString(data[:]), nil
}

func (s *AuthService) ensureUser(ctx context.Context, id string) (*models.User, error) {
	user, err := s.users.Find(ctx, id)
	if err == repositories.ErrNotFound {
		user = &models.User{
			ID:   id,
			Nick: "",
			Permissions: []string{
				"member",
				"log.edit",
				"post.edit",
				"post.move",
				"post.remove",
				"file.upload",
			},
		}

		user, err = s.users.Insert(ctx, *user)
		if err != nil {
			return nil, err
		}
	} else if err != nil {
		return nil, err
	}

	return user, err
}