cacert-boardvoting/cmd/boardvoting/middleware.go

216 lines
4.9 KiB
Go
Raw Normal View History

2022-05-22 09:02:37 +00:00
/*
Copyright 2022 CAcert Inc.
SPDX-License-Identifier: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package main
2022-05-22 10:19:25 +00:00
import (
"context"
2022-05-27 15:39:54 +00:00
"crypto/x509"
"errors"
"fmt"
2022-05-22 10:19:25 +00:00
"net/http"
"strings"
"github.com/justinas/nosurf"
"git.cacert.org/cacert-boardvoting/internal/models"
)
type contextKey int
const (
ctxUser contextKey = iota
2022-05-27 15:39:54 +00:00
ctxAuthenticatedCert
2022-05-22 10:19:25 +00:00
)
2022-05-22 09:02:37 +00:00
func secureHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Security-Policy", "default-src 'self'; font-src 'self' data:")
w.Header().Set("Referrer-Policy", "origin-when-cross-origin")
w.Header().Set("X-Content-Type-Options", "nosniff")
w.Header().Set("X-Frame-Options", "deny")
w.Header().Set("X-XSS-Protection", "0")
w.Header().Set("Strict-Transport-Security", "max-age=63072000")
next.ServeHTTP(w, r)
})
}
2022-05-22 10:06:23 +00:00
func (app *application) logRequest(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
app.infoLog.Printf("%s - %s %s %s", r.RemoteAddr, r.Proto, r.Method, r.URL.RequestURI())
next.ServeHTTP(w, r)
})
}
2022-05-27 15:39:54 +00:00
func (app *application) authenticateRequest(r *http.Request) (*models.User, *x509.Certificate, error) {
if r.TLS == nil {
2022-05-27 15:39:54 +00:00
return nil, nil, nil
}
if len(r.TLS.PeerCertificates) < 1 {
2022-05-27 15:39:54 +00:00
return nil, nil, nil
}
2022-05-27 15:39:54 +00:00
clientCert := r.TLS.PeerCertificates[0]
allowClientAuth := false
2022-05-29 13:43:45 +00:00
for _, eku := range clientCert.ExtKeyUsage {
if eku == x509.ExtKeyUsageClientAuth {
allowClientAuth = true
break
}
}
if !allowClientAuth {
// presented certificate is not valid for client authentication
return nil, nil, nil
}
2022-05-27 15:39:54 +00:00
emails := clientCert.EmailAddresses
user, err := app.users.ByEmails(r.Context(), emails)
if err != nil {
2022-05-27 15:39:54 +00:00
return nil, nil, fmt.Errorf("could not get user information from database: %w", err)
}
2022-05-27 15:39:54 +00:00
return user, clientCert, nil
}
func (app *application) tryAuthenticate(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
2022-05-27 15:39:54 +00:00
user, cert, err := app.authenticateRequest(r)
if err != nil {
app.serverError(w, err)
return
}
if user == nil {
next.ServeHTTP(w, r)
return
}
w.Header().Add("Cache-Control", "no-store")
2022-05-27 15:39:54 +00:00
certContext := context.WithValue(r.Context(), ctxAuthenticatedCert, cert)
userContext := context.WithValue(certContext, ctxUser, user)
next.ServeHTTP(w, r.WithContext(userContext))
})
}
func (app *application) GetUser(r *http.Request) (*models.User, error) {
user := r.Context().Value(ctxUser)
if user == nil {
return nil, errors.New("no user in context")
}
result, ok := user.(*models.User)
if !ok {
return nil, fmt.Errorf("%v is not a user", user)
}
return result, nil
}
func (app *application) HasRole(r *http.Request, roles ...models.RoleName) (bool, bool, error) {
user, err := app.GetUser(r)
if err != nil {
return false, false, err
}
if user == nil {
return false, false, nil
}
roleMatched, err := user.HasRole(roles...)
if err != nil {
return false, true, fmt.Errorf("could not determin user role assignment: %w", err)
}
if !roleMatched {
roleNames := make([]string, len(roles))
for idx := range roles {
roleNames[idx] = string(roles[idx])
}
app.errorLog.Printf(
"user %s does not have any of the required role(s) %s assigned",
user.Name,
strings.Join(roleNames, ", "),
)
return false, true, nil
}
return true, true, nil
}
func (app *application) requireRole(next http.Handler, roles ...models.RoleName) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
hasRole, hasUser, err := app.HasRole(r, roles...)
if err != nil {
app.serverError(w, err)
return
}
if !hasUser {
app.clientError(w, http.StatusUnauthorized)
return
}
if !hasRole {
app.clientError(w, http.StatusForbidden)
return
}
next.ServeHTTP(w, r)
})
}
func (app *application) userCanVote(next http.Handler) http.Handler {
return app.requireRole(next, models.RoleVoter)
}
func (app *application) userCanEditVote(next http.Handler) http.Handler {
return app.requireRole(next, models.RoleVoter)
}
func (app *application) userCanChangeVoters(next http.Handler) http.Handler {
return app.requireRole(next, models.RoleSecretary, models.RoleAdmin)
}
func noSurf(next http.Handler) http.Handler {
csrfHandler := nosurf.New(next)
csrfHandler.SetBaseCookie(http.Cookie{
HttpOnly: true,
Path: "/",
Secure: true,
SameSite: http.SameSiteStrictMode,
})
return csrfHandler
}