oidc-idp/internal/handlers/error.go

/*
Copyright CAcert Inc.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package handlers

import (
	"bytes"
	"context"
	"fmt"
	"html/template"
	"log/slog"
	"net/http"

	"code.cacert.org/cacert/oidc-idp/internal/services"
	"code.cacert.org/cacert/oidc-idp/ui"
)

type errorKey int

const (
	errorBucketKey errorKey = iota
)

type ErrorDetails struct {
	ErrorMessage string
	ErrorDetails []string
	ErrorCode    string
	Error        error
}

type ErrorBucket struct {
	logger       *slog.Logger
	trans        *services.I18NService
	errorDetails *ErrorDetails
	templates    TemplateCache
}

func (b *ErrorBucket) serveHTTP(w http.ResponseWriter, r *http.Request) {
	if b.errorDetails != nil {
		localizer := getLocalizer(b.trans, r)

		b.templates.render(b.logger, w, Error, map[string]interface{}{
			"Title": b.trans.LookupMessage(
				"ErrorTitle",
				nil,
				localizer,
			),
			"details": b.errorDetails,
		})
	}
}

func GetErrorBucket(r *http.Request) *ErrorBucket {
	if bucket, ok := r.Context().Value(errorBucketKey).(*ErrorBucket); ok {
		return bucket
	}

	return nil
}

// AddError can be called to add error details from your application's handler.
func (b *ErrorBucket) AddError(details *ErrorDetails) {
	b.errorDetails = details
}

type errorResponseWriter struct {
	http.ResponseWriter
	errorBucket *ErrorBucket
	statusCode  int
}

func (w *errorResponseWriter) WriteHeader(code int) {
	w.statusCode = code

	if code >= http.StatusBadRequest {
		w.Header().Set("Content-Type", "text/html; charset=utf-8")

		w.errorBucket.AddError(&ErrorDetails{ErrorCode: "HTTP error"})
	}

	w.ResponseWriter.WriteHeader(code)
}

func (w *errorResponseWriter) Write(content []byte) (int, error) {
	if w.statusCode >= http.StatusBadRequest {
		if w.errorBucket.errorDetails.ErrorDetails == nil {
			w.errorBucket.errorDetails.ErrorDetails = make([]string, 0)
		}

		w.errorBucket.errorDetails.ErrorDetails = append(
			w.errorBucket.errorDetails.ErrorDetails, string(content),
		)

		return len(content), nil
	}

	code, err := w.ResponseWriter.Write(content)
	if err != nil {
		return code, fmt.Errorf("error writing response: %w", err)
	}

	return code, nil
}

func ErrorHandling(
	logger *slog.Logger, templateCache TemplateCache, trans *services.I18NService,
) (func(http.Handler) http.Handler, error) {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			errorBucket := &ErrorBucket{
				logger:    logger,
				trans:     trans,
				templates: templateCache,
			}
			next.ServeHTTP(
				&errorResponseWriter{w, errorBucket, http.StatusOK},
				r.WithContext(context.WithValue(r.Context(), errorBucketKey, errorBucket)),
			)
			errorBucket.serveHTTP(w, r)
		})
	}, nil
}

type ErrorHandler struct {
	logger   *slog.Logger
	trans    *services.I18NService
	template *template.Template
}

func (h *ErrorHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodGet {
		http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)

		return
	}

	localizer := getLocalizer(h.trans, r)

	errorName := r.URL.Query().Get("error")
	errorDescription := r.URL.Query().Get("error_description")

	h.logger.Debug(
		"error from Hydra",
		"error_name", errorName, "error_description", errorDescription,
	)

	rendered := bytes.NewBuffer(make([]byte, 0))

	msg := h.trans.LookupMessage
	msgMarkdown := h.trans.LookupMarkdownMessage

	err := h.template.Lookup("base").Execute(rendered, map[string]interface{}{
		"Title": msg("AuthServerErrorTitle", nil, localizer),
		"Explanation": template.HTML( //nolint:gosec
			msgMarkdown("AuthServerErrorExplanation", nil, localizer),
		),
		"ErrorMessage": errorDescription,
	})
	if err != nil {
		h.logger.Error("template rendering failed", "error", err)
		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)

		return
	}

	w.Header().Add("Pragma", "no-cache")
	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")

	_, _ = w.Write(rendered.Bytes())
}

func NewErrorHandler(logger *slog.Logger, trans *services.I18NService) *ErrorHandler {
	return &ErrorHandler{
		logger: logger,
		trans:  trans,
		template: template.Must(template.ParseFS(
			ui.Templates,
			"templates/base.gohtml",
			"templates/hydra_error.gohtml"),
		),
	}
}