feat: initial commit - kratos admin service

pkg/auth/middleware.go

@@ -0,0 +1,100 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/go-kratos/kratos/v3/errors"
+	"github.com/go-kratos/kratos/v3/transport"
+	httpm "github.com/go-kratos/kratos/v3/transport/http"
+)
+
+// Error reasons reported by this middleware. They mirror the wire-visible names
+// in api/<domain>/<version>/error_reason.proto, but are declared here so `pkg`
+// does not depend on a domain's generated proto. TestReasonsMatchAPIEnum pins
+// the two together so they cannot drift.
+const (
+	reasonUnauthenticated  = "UNAUTHENTICATED"
+	reasonPermissionDenied = "PERMISSION_DENIED"
+)
+
+var (
+	// noAuthPaths defines the paths that do not require authentication.
+	noAuthPaths = map[string]struct{}{
+		"/v1/admins/login": {},
+	}
+	// authSecretKey is the secret key used for signing JWT tokens.
+	authSecretKey = authSecretFromEnv("KRATOS_AUTH_SECRET")
+	// cookieName is the name of the cookie that stores the authorization token.
+	cookieName = cookieNameFromEnv("KRATOS_AUTH_COOKIE")
+	// ErrUnauthenticated indicates that the request carried no usable credential.
+	ErrUnauthenticated = errors.Unauthorized(reasonUnauthenticated, "Token is invalid")
+	// ErrPermissionDenied indicates that the caller lacks the required access.
+	ErrPermissionDenied = errors.Forbidden(reasonPermissionDenied, "Access denied")
+)
+
+// Middleware is an authentication middleware for HTTP servers.
+func Middleware() httpm.FilterFunc {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if _, ok := noAuthPaths[r.URL.Path]; ok {
+				next.ServeHTTP(w, r)
+				return
+			}
+			// This filter runs outside the kratos handler chain, so the error
+			// encoder has to be invoked explicitly. Writing plain text here
+			// instead would leave clients unable to read code / reason.
+			cookie, err := r.Cookie(cookieName)
+			if err != nil {
+				httpm.DefaultErrorEncoder(w, r, ErrUnauthenticated)
+				return
+			}
+			auth, err := ParseToken(cookie.Value, authSecretKey)
+			if err != nil {
+				httpm.DefaultErrorEncoder(w, r, err)
+				return
+			}
+			ctx := NewContext(r.Context(), auth)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+// SetCookie sets the login cookie in the HTTP response.
+func SetCookie(ctx context.Context, userID int64, access string, expiresAt time.Time) error {
+	tr, ok := transport.FromServerContext(ctx)
+	if !ok {
+		return fmt.Errorf("failed to get transport from context")
+	}
+	token, err := GenerateToken(userID, access, authSecretKey, expiresAt)
+	if err != nil {
+		return err
+	}
+	cookie := &http.Cookie{
+		Name:    cookieName,
+		Value:   token,
+		Path:    "/",
+		Expires: expiresAt,
+	}
+	tr.ReplyHeader().Add("Set-Cookie", cookie.String())
+	return nil
+}
+
+// DeleteCookie clears the login cookie in the HTTP response.
+func DeleteCookie(ctx context.Context) error {
+	tr, ok := transport.FromServerContext(ctx)
+	if !ok {
+		return fmt.Errorf("failed to get transport from context")
+	}
+	expires := time.Now().AddDate(0, 0, -1)
+	cookie := &http.Cookie{
+		Name:    cookieName,
+		Value:   "",
+		Path:    "/",
+		Expires: expires,
+	}
+	tr.ReplyHeader().Add("Set-Cookie", cookie.String())
+	return nil
+}