137 lines
3.4 KiB
Go
137 lines
3.4 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/sha1"
|
|
"encoding/gob"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io/ioutil"
|
|
"log"
|
|
"net/http"
|
|
|
|
"github.com/go-chi/render"
|
|
"github.com/gorilla/sessions"
|
|
"golang.org/x/oauth2"
|
|
|
|
"github.com/umputun/remark/app/store"
|
|
)
|
|
|
|
type Provider struct {
|
|
Name string
|
|
RedirectURL string
|
|
InfoURL string
|
|
Endpoint oauth2.Endpoint
|
|
Scopes []string
|
|
MapUser func(map[string]interface{}) store.User
|
|
|
|
*sessions.FilesystemStore
|
|
conf *oauth2.Config
|
|
}
|
|
|
|
type Params struct {
|
|
Cid string
|
|
Csecret string
|
|
SessionStore *sessions.FilesystemStore
|
|
Admins []string
|
|
}
|
|
|
|
// newProvider makes auth for given provider
|
|
func initProvider(p Params, provider Provider) *Provider {
|
|
log.Printf("[INFO] create %s auth, id=%s", provider.Name, p.Cid)
|
|
|
|
conf := oauth2.Config{
|
|
ClientID: p.Cid,
|
|
ClientSecret: p.Csecret,
|
|
RedirectURL: provider.RedirectURL,
|
|
Scopes: provider.Scopes,
|
|
Endpoint: provider.Endpoint,
|
|
}
|
|
|
|
provider.conf = &conf
|
|
provider.FilesystemStore = p.SessionStore
|
|
return &provider
|
|
}
|
|
|
|
// LoginHandler - GET /login/github
|
|
func (p Provider) LoginHandler(w http.ResponseWriter, r *http.Request) {
|
|
|
|
// make state (random) and store in session
|
|
state := randToken()
|
|
session, err := p.Get(r, "remark")
|
|
if err != nil {
|
|
log.Printf("[WARN] %s", err)
|
|
}
|
|
session.Values["state-"+p.Name] = state
|
|
session.Save(r, w)
|
|
|
|
// return login url
|
|
log.Printf("[DEBUG] login url %s", p.conf.AuthCodeURL(state))
|
|
http.Redirect(w, r, p.conf.AuthCodeURL(state), http.StatusTemporaryRedirect)
|
|
}
|
|
|
|
// AuthHandler is redirect url. Should check state to prevent CSRF.
|
|
func (p Provider) AuthHandler(w http.ResponseWriter, r *http.Request) {
|
|
session, err := p.Get(r, "remark")
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("failed to get session, %s", err.Error()), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
// compare saved state to the one from redirect url
|
|
retrievedState, ok := session.Values["state-"+p.Name]
|
|
if !ok || retrievedState != r.URL.Query().Get("state") {
|
|
http.Error(w, fmt.Sprintf("unexpected state %s", retrievedState.(string)), http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
tok, err := p.conf.Exchange(context.Background(), r.URL.Query().Get("code"))
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("exchange failed, %s", err), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
client := p.conf.Client(context.Background(), tok)
|
|
uinfo, err := client.Get(p.InfoURL)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("failed to get client info via %s, %s", p.InfoURL, err), http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
defer uinfo.Body.Close()
|
|
data, err := ioutil.ReadAll(uinfo.Body)
|
|
if err != nil {
|
|
http.Error(w, fmt.Sprintf("failed to read user info, %s", err), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
jData := map[string]interface{}{}
|
|
if e := json.Unmarshal(data, &jData); e != nil {
|
|
http.Error(w, fmt.Sprintf("failed to unmarshal user info, %s", err), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
log.Printf("[DEBUG] got raw user info %+v", jData)
|
|
|
|
session.Values["uinfo"] = p.MapUser(jData)
|
|
if err = session.Save(r, w); err != nil {
|
|
http.Error(w, fmt.Sprintf("failed to save user info, %s", err), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
log.Printf("[DEBUG] %+v", jData)
|
|
render.JSON(w, r, jData)
|
|
}
|
|
|
|
func randToken() string {
|
|
b := make([]byte, 32)
|
|
rand.Read(b)
|
|
s := sha1.New()
|
|
s.Write(b)
|
|
return fmt.Sprintf("%x", s.Sum(nil))
|
|
}
|
|
|
|
func init() {
|
|
gob.Register(store.User{})
|
|
}
|