From 9ea4c305e2655b65a06685e1e09506617a1467f5 Mon Sep 17 00:00:00 2001
From: Eugene <eugene@umputun.com>
Date: Thu, 21 Dec 2017 20:58:33 -0600
Subject: [PATCH] auth to middleware

---
 app/main.go            |  5 +++--
 app/rest/auth/auth.go  | 14 +-----------
 app/rest/middleware.go | 49 ++++++++++++++++++++++++++++++++++++++++++
 app/rest/server.go     | 22 ++++++++-----------
 4 files changed, 62 insertions(+), 28 deletions(-)

diff --git a/app/main.go b/app/main.go
index 0c8561b1..04f72d5b 100644
--- a/app/main.go
+++ b/app/main.go
@@ -46,8 +46,9 @@ func main() {
 
 	sessionStore := sessions.NewFilesystemStore(opts.SessionStore, []byte(opts.StoreKey))
 	srv := rest.Server{
-		Version: revision,
-		Store:   dataStore,
+		Version:      revision,
+		Store:        dataStore,
+		SessionStore: sessionStore,
 		AuthGoogle: auth.NewGoogle(auth.Params{
 			Cid:          opts.GoogleCID,
 			Csecret:      opts.GoogleCSEC,
diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go
index b50c409f..78531192 100644
--- a/app/rest/auth/auth.go
+++ b/app/rest/auth/auth.go
@@ -5,9 +5,9 @@ import (
 	"crypto/sha1"
 	"encoding/gob"
 	"fmt"
-	"sync"
 
 	"github.com/gorilla/sessions"
+
 	"github.com/umputun/remark/app/store"
 )
 
@@ -18,18 +18,6 @@ type Params struct {
 	Admins       []string
 }
 
-type SessionStore struct {
-	StorePath string
-	StoreKey  string
-
-	store *sessions.FilesystemStore
-	once  sync.Once
-}
-
-func (s *SessionStore) GetSession(name string) {
-
-}
-
 func randToken() string {
 	b := make([]byte, 32)
 	rand.Read(b)
diff --git a/app/rest/middleware.go b/app/rest/middleware.go
index a26634ef..630fcc7e 100644
--- a/app/rest/middleware.go
+++ b/app/rest/middleware.go
@@ -1,6 +1,7 @@
 package rest
 
 import (
+	"context"
 	"log"
 	"net/http"
 	"os"
@@ -9,6 +10,9 @@ import (
 
 	"github.com/didip/tollbooth"
 	"github.com/go-chi/render"
+	"github.com/go-errors/errors"
+	"github.com/gorilla/sessions"
+	"github.com/umputun/remark/app/store"
 )
 
 var org = "Umputun"
@@ -102,3 +106,48 @@ func Recoverer(next http.Handler) http.Handler {
 
 	return http.HandlerFunc(fn)
 }
+
+type contextKey string
+
+// Auth adds auth from session and populate user info
+func Auth(sessionStore *sessions.FilesystemStore) func(http.Handler) http.Handler {
+	f := func(h http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+
+			session, err := sessionStore.Get(r, "remark")
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+				return
+			}
+
+			uinfoData, ok := session.Values["uinfo"]
+			if !ok {
+				http.Error(w, "login required", http.StatusUnauthorized)
+				return
+			}
+
+			ctx := r.Context()
+			ctx = context.WithValue(ctx, contextKey("user"), uinfoData.(store.User))
+			r = r.WithContext(ctx)
+
+			h.ServeHTTP(w, r)
+		}
+		return http.HandlerFunc(fn)
+	}
+	return f
+}
+
+// GetUserInfo extracts user, or and token from request's context
+func GetUserInfo(r *http.Request) (user store.User, err error) {
+
+	ctx := r.Context()
+	if ctx == nil {
+		return store.User{}, errors.New("user not defined")
+	}
+
+	if u, ok := ctx.Value(contextKey("user")).(store.User); ok {
+		return u, nil
+	}
+
+	return store.User{}, errors.New("user can't be parsed")
+}
diff --git a/app/rest/server.go b/app/rest/server.go
index cc90920a..f26ef866 100644
--- a/app/rest/server.go
+++ b/app/rest/server.go
@@ -11,16 +11,18 @@ import (
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/render"
+	"github.com/gorilla/sessions"
 	"github.com/umputun/remark/app/rest/auth"
 	"github.com/umputun/remark/app/store"
 )
 
 // Server is a rest access server
 type Server struct {
-	Version    string
-	Store      store.Interface
-	AuthGoogle *auth.Google
-	AuthGithub *auth.Github
+	Version      string
+	Store        store.Interface
+	AuthGoogle   *auth.Google
+	AuthGithub   *auth.Github
+	SessionStore *sessions.FilesystemStore
 }
 
 // Run the lister and request's router, activate rest server
@@ -40,7 +42,7 @@ func (s *Server) Run() {
 	router.Post("/comment", s.createCommentCtrl)
 	router.Delete("/comment/{id}", s.deleteCommentCtrl)
 	router.Get("/find", s.getURLComments)
-	router.Get("/last/{max}", s.getLastComments)
+	router.With(Auth(s.SessionStore)).Get("/last/{max}", s.getLastComments)
 	router.Get("/id/{id}", s.getByID)
 
 	log.Fatal(http.ListenAndServe(":8080", router))
@@ -119,18 +121,12 @@ func (s *Server) getLastComments(w http.ResponseWriter, r *http.Request) {
 		max = 0
 	}
 
-	session, err := s.AuthGoogle.Get(r, "remark")
+	uinfoData, err := GetUserInfo(r)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-
-	uinfoData, ok := session.Values["uinfo"]
-	if !ok {
 		http.Error(w, "login required", http.StatusUnauthorized)
 		return
 	}
-	log.Printf("[DEBUG] user: %+v", uinfoData.(store.User))
+	log.Printf("[DEBUG] user: %+v", uinfoData)
 
 	comments, err := s.Store.Last(store.Locator{}, max)
 	if err != nil {