mirror of
https://github.com/plausible/analytics.git
synced 2024-12-28 12:01:39 +03:00
6035618213
* Add `GET /capabilities` to Plugins API It aims to: - help the client verify the data-domain the token is associated with - list all the features available for the site's owner (and therefore determine availability of the subset of those for the current Plugins API caller) The endpoint does not require authentication, in the sense that it'll always respond with 200 OK. However when the token is provided, a verification lookup is made. * Remove IO.inspect() call * Credo * Aesthetics * s/send_resp/send_error/ * Call preload just once
54 lines
1.3 KiB
Elixir
54 lines
1.3 KiB
Elixir
defmodule PlausibleWeb.Plugs.AuthorizePluginsAPI do
|
|
@moduledoc """
|
|
Plug for Basic HTTP Authentication using
|
|
Plugins API Tokens lookup.
|
|
"""
|
|
|
|
alias PlausibleWeb.Plugins.API.Errors
|
|
alias Plausible.Plugins.API.Tokens
|
|
import Plug.Conn
|
|
|
|
def init(opts), do: opts
|
|
|
|
def call(conn, opts \\ []) do
|
|
send_error? =
|
|
Keyword.get(opts, :send_error?, true)
|
|
|
|
with {:ok, token} <- extract_token(conn),
|
|
{:ok, conn} <- authorize(conn, token) do
|
|
conn
|
|
else
|
|
{:unauthorized, conn} ->
|
|
if send_error? do
|
|
Errors.unauthorized(conn)
|
|
else
|
|
conn
|
|
end
|
|
end
|
|
end
|
|
|
|
defp authorize(conn, token_value) do
|
|
case Tokens.find(token_value) do
|
|
{:ok, token} ->
|
|
{:ok, token} = Tokens.update_last_seen(token)
|
|
{:ok, Plug.Conn.assign(conn, :authorized_site, token.site)}
|
|
|
|
{:error, :not_found} ->
|
|
{:unauthorized, conn}
|
|
end
|
|
end
|
|
|
|
defp extract_token(conn) do
|
|
with ["Basic " <> encoded_user_and_pass] <- get_req_header(conn, "authorization"),
|
|
{:ok, decoded_user_and_pass} <- Base.decode64(encoded_user_and_pass) do
|
|
case :binary.split(decoded_user_and_pass, ":") do
|
|
[_user, token_value] -> {:ok, token_value}
|
|
[token_value] -> {:ok, token_value}
|
|
end
|
|
else
|
|
_ ->
|
|
{:unauthorized, conn}
|
|
end
|
|
end
|
|
end
|