pass_auth.go

package gig

type (
	// PassAuthCertCheck defines a function to validate certificate fingerprint.
	// Must return path on unsuccessful login.
	PassAuthCertCheck func(string, Context) (string, error)
	// PassAuthLogin defines a function to login user.
	// It may pin certificate to user if login is successful.
	// Must return path to redirect to after login.
	PassAuthLogin func(username, password, sig string, c Context) (string, error)
)

// PassAuth is a middleware that implements username/password authentication
// by first requiring a certificate, checking username/password using PassAuthValidator,
// and then pinning certificate to it.
//
// For valid credentials it calls the next handler.
func PassAuth(check PassAuthCertCheck) MiddlewareFunc {
	return func(next HandlerFunc) HandlerFunc {
		return func(c Context) error {
			// If no client certificate is sent, request it
			var sig = c.CertHash()
			if sig == "" {
				return c.NoContent(StatusClientCertificateRequired, "Please create a certificate")
			}

			to, err := check(sig, c)
			if err != nil {
				debugPrintf("gemini: could not check certificate: %s", err)
				return c.NoContent(StatusBadRequest, "Try again later")
			}

			if to != "" {
				return c.NoContent(StatusRedirectTemporary, to)
			}

			return next(c)
		}
	}
}

// PassAuthLoginHandle sets up handlers to check username/password using PassAuthLogin.
func (g *Gig) PassAuthLoginHandle(path string, fn PassAuthLogin) {
	g.Handle(path, func(c Context) error {
		cert := c.Certificate()
		if cert == nil {
			return c.NoContent(StatusClientCertificateRequired, "Please create a certificate")
		}
		username, err := c.QueryString()
		if err != nil {
			debugPrintf("gemini: could not extract username from URL: %s", err)
			return c.NoContent(StatusBadRequest, "Invalid username received")
		}

		if username == "" {
			return c.NoContent(StatusInput, "Enter username")
		}

		return c.NoContent(StatusRedirectTemporary, "%s/%s", path, username)
	})

	g.Handle(path+"/:username", func(c Context) error {
		var (
			username = c.Param("username")
			sig      = c.CertHash()
		)

		if sig == "" {
			return c.NoContent(StatusClientCertificateRequired, "Please create a certificate")
		}

		if username == "" {
			return c.NoContent(StatusRedirectTemporary, path)
		}

		password, err := c.QueryString()

		if err != nil {
			debugPrintf("gemini: could not extract password from URL: %s", err)
			return c.NoContent(StatusBadRequest, "Invalid password received")
		}

		if password == "" {
			return c.NoContent(StatusSensitiveInput, "Enter password")
		}

		to, err := fn(username, password, sig, c)

		if err != nil {
			return err
		}

		return c.NoContent(StatusRedirectTemporary, to)
	})
}