git.iko.soy/typeable/oauth2-proxy
on remove-gap-headers help sign in
typeable/oauth2-proxy/validator.go
111 lines 2.9 kB history raw
1package main
3import (
4 "encoding/csv"
5 "fmt"
6 "io"
7 "os"
8 "strings"
9 "sync/atomic"
10 "unsafe"
12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
15// UserMap holds information from the authenticated emails file
16type UserMap struct {
17 usersFile string
18 m unsafe.Pointer
21// NewUserMap parses the authenticated emails file into a new UserMap
22//
23// TODO (@NickMeves): Audit usage of `unsafe.Pointer` and potentially refactor
24func NewUserMap(usersFile string, done <-chan bool, onUpdate func()) *UserMap {
25 um := &UserMap{usersFile: usersFile}
26 m := make(map[string]bool)
27 atomic.StorePointer(&um.m, unsafe.Pointer(&m)) // #nosec G103
28 if usersFile != "" {
29 logger.Printf("using authenticated emails file %s", usersFile)
30 WatchForUpdates(usersFile, done, func() {
31 um.LoadAuthenticatedEmailsFile()
32 onUpdate()
33 })
34 um.LoadAuthenticatedEmailsFile()
35 }
36 return um
39// IsValid checks if an email is allowed
40func (um *UserMap) IsValid(email string) (result bool) {
41 m := *(*map[string]bool)(atomic.LoadPointer(&um.m))
42 _, result = m[email]
43 return
46// LoadAuthenticatedEmailsFile loads the authenticated emails file from disk
47// and parses the contents as CSV
48func (um *UserMap) LoadAuthenticatedEmailsFile() {
49 r, err := os.Open(um.usersFile)
50 if err != nil {
51 logger.Fatalf("failed opening authenticated-emails-file=%q, %s", um.usersFile, err)
52 }
53 defer func(c io.Closer) {
54 cerr := c.Close()
55 if cerr != nil {
56 logger.Fatalf("Error closing authenticated emails file: %s", cerr)
57 }
58 }(r)
59 csvReader := csv.NewReader(r)
60 csvReader.Comma = ','
61 csvReader.Comment = '#'
62 csvReader.TrimLeadingSpace = true
63 records, err := csvReader.ReadAll()
64 if err != nil {
65 logger.Errorf("error reading authenticated-emails-file=%q, %s", um.usersFile, err)
66 return
67 }
68 updated := make(map[string]bool)
69 for _, r := range records {
70 address := strings.ToLower(strings.TrimSpace(r[0]))
71 updated[address] = true
72 }
73 atomic.StorePointer(&um.m, unsafe.Pointer(&updated)) // #nosec G103
76func newValidatorImpl(domains []string, usersFile string,
77 done <-chan bool, onUpdate func()) func(string) bool {
78 validUsers := NewUserMap(usersFile, done, onUpdate)
80 var allowAll bool
81 for i, domain := range domains {
82 if domain == "*" {
83 allowAll = true
84 continue
85 }
86 domains[i] = fmt.Sprintf("@%s", strings.ToLower(domain))
87 }
89 validator := func(email string) (valid bool) {
90 if email == "" {
91 return
92 }
93 email = strings.ToLower(email)
94 for _, domain := range domains {
95 valid = valid || strings.HasSuffix(email, domain)
96 }
97 if !valid {
98 valid = validUsers.IsValid(email)
99 }
100 if allowAll {
101 valid = true
102 }
103 return valid
104 }
105 return validator
108// NewValidator constructs a function to validate email addresses
109func NewValidator(domains []string, usersFile string) func(string) bool {
110 return newValidatorImpl(domains, usersFile, nil, func() {})