202 lines
6.9 KiB
Go
202 lines
6.9 KiB
Go
package httptransport
|
|
|
|
import (
|
|
"net/http"
|
|
"os"
|
|
"path"
|
|
|
|
mr "git.sendico.io/tech/sxchnge/product/app/metrics"
|
|
"git.sendico.io/tech/sxchnge/product/auth/config"
|
|
"git.sendico.io/tech/sxchnge/product/auth/flow"
|
|
httprouter "git.sendico.io/tech/sxchnge/product/auth/http"
|
|
public "git.sendico.io/tech/sxchnge/product/auth/http/public"
|
|
"git.sendico.io/tech/sxchnge/product/auth/response"
|
|
authstorage "git.sendico.io/tech/sxchnge/product/auth/storage"
|
|
accountservice "git.sendico.io/tech/sxchnge/product/customers"
|
|
"git.sendico.io/tech/sxchnge/product/notifications"
|
|
"git.sendico.io/tech/sxchnge/product/sessions/browser"
|
|
"git.sendico.io/tech/sxchnge/product/twofactor"
|
|
delivery "git.sendico.io/tech/sxchnge/product/twofactor/delivery"
|
|
factorhttp "git.sendico.io/tech/sxchnge/product/twofactor/http"
|
|
factorstore "git.sendico.io/tech/sxchnge/product/twofactor/store"
|
|
"git.sendico.io/tech/sxchnge/shared/database"
|
|
"git.sendico.io/tech/sxchnge/shared/errors"
|
|
api "git.sendico.io/tech/sxchnge/shared/http"
|
|
"git.sendico.io/tech/sxchnge/shared/http/response"
|
|
"git.sendico.io/tech/sxchnge/shared/logging"
|
|
"git.sendico.io/tech/sxchnge/shared/service"
|
|
"github.com/go-chi/chi/v5"
|
|
cm "github.com/go-chi/chi/v5/middleware"
|
|
"github.com/go-chi/cors"
|
|
"github.com/go-chi/metrics"
|
|
"go.uber.org/zap"
|
|
"moul.io/chizap"
|
|
)
|
|
|
|
type Middleware struct {
|
|
notifications *notifications.Client
|
|
logger mlogger.Logger
|
|
router *chi.Mux
|
|
apiEndpoint string
|
|
metrics mr.Metrics
|
|
epdispatcher *httprouter.Dispatcher
|
|
}
|
|
|
|
func (mw *Middleware) Handler(service mservice.Type, endpoint string, method api.HTTPMethod, handler sresponse.HandlerFunc) {
|
|
mw.epdispatcher.Handler(service, endpoint, method, handler)
|
|
}
|
|
|
|
func (mw *Middleware) AccountHandler(service mservice.Type, endpoint string, method api.HTTPMethod, handler sresponse.AccountHandlerFunc) {
|
|
mw.epdispatcher.AccountHandler(service, endpoint, method, handler)
|
|
}
|
|
|
|
func (mw *Middleware) PendingAccountHandler(service mservice.Type, endpoint string, method api.HTTPMethod, handler sresponse.PendingAccountHandlerFunc) {
|
|
mw.epdispatcher.PendingAccountHandler(service, endpoint, method, handler)
|
|
}
|
|
|
|
func (mw *Middleware) Finish() {
|
|
mw.metrics.Finish()
|
|
if mw.notifications != nil {
|
|
_ = mw.notifications.Close()
|
|
}
|
|
}
|
|
|
|
func (mw *Middleware) installMiddleware(config *middleware.Config, debug bool) {
|
|
mw.logger.Debug("Installing middleware stack...")
|
|
// Collect metrics for application traffic only. Scrapes and health probes are
|
|
// operational traffic and would otherwise distort request and in-flight SLIs.
|
|
mw.router.Use(metrics.Collector(metrics.CollectorOpts{
|
|
Host: false, // avoid high-cardinality "host" label
|
|
Proto: true, // include HTTP protocol label
|
|
Skip: func(r *http.Request) bool {
|
|
return isObservabilityRequest(mw.apiEndpoint, r.URL.Path)
|
|
},
|
|
}))
|
|
mw.router.Use(cm.RequestID)
|
|
if debug {
|
|
mw.router.Use(chizap.New(mw.logger.Named("http_trace"), &chizap.Opts{
|
|
WithReferer: true,
|
|
WithUserAgent: true,
|
|
}))
|
|
}
|
|
mw.router.Use(cors.Handler(cors.Options{
|
|
AllowedOrigins: config.CORS.AllowedOrigins,
|
|
AllowedMethods: config.CORS.AllowedMethods,
|
|
AllowedHeaders: config.CORS.AllowedHeaders,
|
|
ExposedHeaders: config.CORS.ExposedHeaders,
|
|
AllowCredentials: config.CORS.AllowCredentials,
|
|
MaxAge: config.CORS.MaxAge,
|
|
OptionsPassthrough: false,
|
|
Debug: debug,
|
|
}))
|
|
mw.router.Use(func(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if err := browser.ValidateCSRF(r, config.CORS.AllowedOrigins); err != nil {
|
|
mw.logger.Info("Rejected browser request with invalid CSRF context",
|
|
zap.String("method", r.Method), zap.String("path", r.URL.Path))
|
|
response.Forbidden(mw.logger, mservice.Accounts, "csrf_rejected", "browser request failed CSRF validation").ServeHTTP(w, r)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
})
|
|
mw.router.Use(cm.Recoverer)
|
|
mw.router.Handle("/metrics", metrics.Handler())
|
|
mw.logger.Info("Middleware stack installation complete")
|
|
}
|
|
|
|
func isObservabilityRequest(apiEndpoint, requestPath string) bool {
|
|
healthPath := path.Join("/", apiEndpoint, "health")
|
|
metricsPath := path.Join("/", apiEndpoint, "metrics")
|
|
|
|
return requestPath == healthPath || requestPath == metricsPath || requestPath == "/metrics"
|
|
}
|
|
|
|
func CreateMiddleware(
|
|
logger mlogger.Logger,
|
|
db db.Factory,
|
|
apiRouter *chi.Mux,
|
|
config *middleware.Config,
|
|
authStorage *middleware.AuthStorageConfig,
|
|
debug bool,
|
|
notificationConfig ...*notifications.Config,
|
|
) (*Middleware, error) {
|
|
if config == nil {
|
|
return nil, merrors.InvalidArgument("middleware configuration is required", "middleware")
|
|
}
|
|
if err := config.Token.Validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := config.CORS.Validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
loginRateLimits, err := config.ResolveLoginRateLimits()
|
|
if err != nil {
|
|
logger.Error("Invalid login rate limit configuration", zap.Error(err))
|
|
return nil, err
|
|
}
|
|
p := &Middleware{
|
|
logger: logger.Named("middleware"),
|
|
router: apiRouter,
|
|
apiEndpoint: os.Getenv(config.EndPointEnv),
|
|
}
|
|
p.logger.Info("Set endpoint", zap.String("endpoint", p.apiEndpoint))
|
|
p.installMiddleware(config, debug)
|
|
if p.metrics, err = mr.NewMetricsRouter(p.logger, p.router, p.apiEndpoint); err != nil {
|
|
p.logger.Error("Failed to create metrics router", zap.Error(err), zap.String("api_endpoint", p.apiEndpoint))
|
|
return nil, err
|
|
}
|
|
|
|
stores, err := authstorage.OpenStores(p.logger, db, authStorage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var authFlow *flow.Service
|
|
var factors *twofactor.Service
|
|
if len(notificationConfig) > 0 && notificationConfig[0] != nil {
|
|
c := notificationConfig[0]
|
|
customers, err := accountservice.NewAccountService(p.logger, db, &config.Password, authStorage)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
authFlow = &flow.Service{Accounts: stores.Accounts, Customers: customers, Tokens: stores.Verification, Transactions: db.TransactionFactory(), Attempts: stores.LoginAttempts, Secret: middleware.SignatureConf(config).PrivateKey, ActivationURL: c.ActivationURL}
|
|
if err = authFlow.Validate(); err != nil {
|
|
return nil, err
|
|
}
|
|
p.notifications, err = notifications.Open(*c)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
authFlow.Sender = p.notifications
|
|
records, err := factorstore.Open(p.logger, db)
|
|
if err != nil {
|
|
_ = p.notifications.Close()
|
|
return nil, err
|
|
}
|
|
factors, err = twofactor.New(stores.Accounts, stores.Verification, records, db.TransactionFactory(), middleware.SignatureConf(config).PrivateKey, p.logger, delivery.Email{Sender: p.notifications})
|
|
if err != nil {
|
|
_ = p.notifications.Close()
|
|
return nil, err
|
|
}
|
|
}
|
|
flows := public.Flows{Onboarding: authFlow}
|
|
if factors != nil {
|
|
flows.Factors = factors
|
|
}
|
|
p.epdispatcher = httprouter.NewDispatcher(
|
|
p.logger,
|
|
p.router,
|
|
stores.Accounts,
|
|
stores.RefreshTokens,
|
|
stores.LoginAttempts,
|
|
config,
|
|
loginRateLimits,
|
|
flows,
|
|
)
|
|
if factors != nil {
|
|
factorhttp.Install(p.epdispatcher, factors, p.logger)
|
|
}
|
|
return p, nil
|
|
}
|