cacert-boardvoting/internal/handlers/middleware.go

/*
Copyright CAcert Inc.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package handlers

import (
	"bytes"
	"context"
	"crypto/x509"
	"encoding/pem"
	"errors"
	"fmt"
	"log"
	"net/http"
	"strings"

	"github.com/justinas/nosurf"

	"git.cacert.org/cacert-boardvoting/internal/models"
)

type contextKey int

const (
	ctxUser contextKey = iota
	ctxAuthenticatedCert
)

func SecureHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Security-Policy", "default-src 'self'; font-src 'self' data:")
		w.Header().Set("Referrer-Policy", "origin-when-cross-origin")
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("X-Frame-Options", "deny")
		w.Header().Set("X-XSS-Protection", "0")
		w.Header().Set("Strict-Transport-Security", "max-age=63072000")

		next.ServeHTTP(w, r)
	})
}

type UserMiddleware struct {
	users    *models.UserModel
	errorLog *log.Logger
}

func NewUserMiddleware(users *models.UserModel, errorLog *log.Logger) *UserMiddleware {
	return &UserMiddleware{users: users, errorLog: errorLog}
}

func (m *UserMiddleware) AuthenticateRequest(
	ctx context.Context,
	r *http.Request,
) (*models.User, *x509.Certificate, error) {
	if r.TLS == nil {
		return nil, nil, nil
	}

	if len(r.TLS.PeerCertificates) < 1 {
		return nil, nil, nil
	}

	clientCert := r.TLS.PeerCertificates[0]

	allowClientAuth := false

	for _, eku := range clientCert.ExtKeyUsage {
		if eku == x509.ExtKeyUsageClientAuth {
			allowClientAuth = true

			break
		}
	}

	if !allowClientAuth {
		// presented certificate is not valid for client authentication
		return nil, nil, nil
	}

	emails := clientCert.EmailAddresses

	user, err := m.users.ByEmails(ctx, emails)
	if err != nil {
		return nil, nil, fmt.Errorf("could not get user information from database: %w", err)
	}

	return user, clientCert, nil
}

func (m *UserMiddleware) TryAuthenticate(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		user, cert, err := m.AuthenticateRequest(r.Context(), r)
		if err != nil {
			panic(err)
		}

		if user == nil {
			next.ServeHTTP(w, r)

			return
		}

		w.Header().Add("Cache-Control", "no-store")

		certContext := context.WithValue(r.Context(), ctxAuthenticatedCert, cert)
		userContext := context.WithValue(certContext, ctxUser, user)

		next.ServeHTTP(w, r.WithContext(userContext))
	})
}

func (m *UserMiddleware) HasRole(r *http.Request, roles ...models.RoleName) (bool, bool, error) {
	user, err := getUser(r)
	if err != nil {
		return false, false, err
	}

	if user == nil {
		return false, false, nil
	}

	roleMatched, err := user.HasRole(roles...)
	if err != nil {
		return false, true, fmt.Errorf("could not determin user role assignment: %w", err)
	}

	if !roleMatched {
		roleNames := make([]string, len(roles))
		for idx := range roles {
			roleNames[idx] = string(roles[idx])
		}

		m.errorLog.Printf(
			"user %s does not have any of the required role(s) %s assigned",
			user.Name,
			strings.Join(roleNames, ", "),
		)

		return false, true, nil
	}

	return true, true, nil
}

func (m *UserMiddleware) requireRole(next http.Handler, roles ...models.RoleName) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		hasRole, hasUser, err := m.HasRole(r, roles...)
		if err != nil {
			panic(err)
		}

		if !hasUser {
			ClientError(w, http.StatusUnauthorized)

			return
		}

		if !hasRole {
			ClientError(w, http.StatusForbidden)

			return
		}

		next.ServeHTTP(w, r)
	})
}

func (m *UserMiddleware) UserCanVote(next http.Handler) http.Handler {
	return m.requireRole(next, models.RoleVoter)
}

func (m *UserMiddleware) UserCanEditVote(next http.Handler) http.Handler {
	return m.requireRole(next, models.RoleVoter)
}

func (m *UserMiddleware) CanManageUsers(next http.Handler) http.Handler {
	return m.requireRole(next, models.RoleSecretary, models.RoleAdmin)
}

func NoSurf(next http.Handler) http.Handler {
	csrfHandler := nosurf.New(next)
	csrfHandler.SetBaseCookie(http.Cookie{
		HttpOnly: true,
		Path:     "/",
		Secure:   true,
		SameSite: http.SameSiteStrictMode,
	})

	return csrfHandler
}

func getUser(r *http.Request) (*models.User, error) {
	user := r.Context().Value(ctxUser)
	if user == nil {
		return nil, errors.New("no user in context")
	}

	result, ok := user.(*models.User)
	if !ok {
		return nil, fmt.Errorf("%v is not a user", user)
	}

	return result, nil
}

func getPEMClientCert(r *http.Request) (string, error) {
	cert := r.Context().Value(ctxAuthenticatedCert)

	authenticatedCertificate, ok := cert.(*x509.Certificate)
	if !ok {
		return "", errors.New("could not handle certificate as x509.Certificate")
	}

	clientCertPEM := bytes.NewBuffer(make([]byte, 0))

	err := pem.Encode(clientCertPEM, &pem.Block{Type: "CERTIFICATE", Bytes: authenticatedCertificate.Raw})
	if err != nil {
		return "", fmt.Errorf("error encoding client certificate: %w", err)
	}

	return clientCertPEM.String(), nil
}