memos/server/acl.go

119 lines
3.0 KiB
Go
Raw Normal View History

2022-02-03 10:32:03 +03:00
package server
import (
"fmt"
"net/http"
"strconv"
2022-06-27 17:09:06 +03:00
"github.com/usememos/memos/api"
"github.com/usememos/memos/common"
2022-02-03 10:32:03 +03:00
"github.com/gorilla/sessions"
"github.com/labstack/echo-contrib/session"
"github.com/labstack/echo/v4"
)
var (
2022-05-02 21:05:43 +03:00
userIDContextKey = "user-id"
2022-02-03 10:32:03 +03:00
)
2022-05-02 21:05:43 +03:00
func getUserIDContextKey() string {
return userIDContextKey
2022-02-03 10:32:03 +03:00
}
func setUserSession(ctx echo.Context, user *api.User) error {
sess, _ := session.Get("session", ctx)
2022-02-03 10:32:03 +03:00
sess.Options = &sessions.Options{
Path: "/",
MaxAge: 1000 * 3600 * 24 * 30,
HttpOnly: true,
}
2022-05-02 21:05:43 +03:00
sess.Values[userIDContextKey] = user.ID
err := sess.Save(ctx.Request(), ctx.Response())
2022-02-03 19:56:44 +03:00
if err != nil {
2022-02-04 13:54:24 +03:00
return fmt.Errorf("failed to set session, err: %w", err)
2022-02-03 19:56:44 +03:00
}
return nil
2022-02-03 10:32:03 +03:00
}
func removeUserSession(ctx echo.Context) error {
sess, _ := session.Get("session", ctx)
2022-02-03 10:32:03 +03:00
sess.Options = &sessions.Options{
Path: "/",
MaxAge: 0,
HttpOnly: true,
}
2022-05-02 21:05:43 +03:00
sess.Values[userIDContextKey] = nil
err := sess.Save(ctx.Request(), ctx.Response())
2022-02-03 19:56:44 +03:00
if err != nil {
2022-02-04 13:54:24 +03:00
return fmt.Errorf("failed to set session, err: %w", err)
2022-02-03 19:56:44 +03:00
}
return nil
2022-02-03 10:32:03 +03:00
}
2022-07-27 14:45:37 +03:00
func aclMiddleware(s *Server, next echo.HandlerFunc) echo.HandlerFunc {
2022-08-07 04:23:46 +03:00
return func(c echo.Context) error {
ctx := c.Request().Context()
path := c.Path()
2022-07-28 15:09:25 +03:00
// Skip auth.
2022-08-07 04:23:46 +03:00
if common.HasPrefixes(path, "/api/auth") {
return next(c)
2022-07-28 15:09:25 +03:00
}
2022-08-07 04:23:46 +03:00
if common.HasPrefixes(path, "/api/ping", "/api/status", "/api/user/:id") && c.Request().Method == http.MethodGet {
return next(c)
2022-02-03 10:32:03 +03:00
}
// If there is openId in query string and related user is found, then skip auth.
2022-08-07 04:23:46 +03:00
openID := c.QueryParam("openId")
if openID != "" {
userFind := &api.UserFind{
OpenID: &openID,
}
2022-08-07 04:23:46 +03:00
user, err := s.Store.FindUser(ctx, userFind)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user by open_id").SetInternal(err)
}
if user != nil {
// Stores userID into context.
2022-08-07 04:23:46 +03:00
c.Set(getUserIDContextKey(), user.ID)
return next(c)
}
}
{
2022-08-07 04:23:46 +03:00
sess, _ := session.Get("session", c)
userIDValue := sess.Values[userIDContextKey]
2022-07-27 14:45:37 +03:00
if userIDValue != nil {
userID, _ := strconv.Atoi(fmt.Sprintf("%v", userIDValue))
userFind := &api.UserFind{
ID: &userID,
}
2022-08-07 04:23:46 +03:00
user, err := s.Store.FindUser(ctx, userFind)
2022-07-27 14:45:37 +03:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to find user by ID: %d", userID)).SetInternal(err)
}
if user != nil {
if user.RowStatus == api.Archived {
return echo.NewHTTPError(http.StatusForbidden, fmt.Sprintf("User has been archived with email %s", user.Email))
}
2022-08-07 04:23:46 +03:00
c.Set(getUserIDContextKey(), userID)
2022-07-27 14:45:37 +03:00
}
}
2022-07-27 14:45:37 +03:00
}
2022-02-03 19:56:44 +03:00
2022-08-07 04:23:46 +03:00
if common.HasPrefixes(path, "/api/memo", "/api/tag", "/api/shortcut") && c.Request().Method == http.MethodGet {
if _, err := strconv.Atoi(c.QueryParam("creatorId")); err == nil {
return next(c)
}
2022-07-27 14:45:37 +03:00
}
2022-02-03 10:32:03 +03:00
2022-08-07 04:23:46 +03:00
userID := c.Get(getUserIDContextKey())
2022-07-27 14:45:37 +03:00
if userID == nil {
2022-07-28 15:09:25 +03:00
return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
2022-02-03 10:32:03 +03:00
}
2022-02-05 19:25:41 +03:00
2022-08-07 04:23:46 +03:00
return next(c)
2022-02-03 10:32:03 +03:00
}
}