Marko Tikvić / webutility

Browse Code »

Commit 2d79a4120f3102793bf2694a02c815b33ee308b5

Authored by Marko Tikvić 2017-10-26 09:35:22 +0200

1 parent bc3671b260

Exists in master and in 1 other branch

Responses contain full URI

Showing 3 changed files with 34 additions and 5 deletions Show diff stats

auth_utility.go

Diff comments View file @2d79a41

 package webutility
 import (
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"net/http"
 	"strings"
 	"time"
 	"github.com/dgrijalva/jwt-go"
 )
 const OneDay = time.Hour * 24
 const OneWeek = OneDay * 7
 const saltSize = 32
 const appName = "korisnicki-centar"
 const secret = "korisnicki-centar-api"
 type Role struct {
 	Name string `json:"name"`
 	ID   uint32 `json:"id"`
 }
 // TokenClaims are JWT token claims.
 type TokenClaims struct {
 	Token              string `json:"access_token"`
 	TokenType          string `json:"token_type"`
 	Username           string `json:"username"`
 	Role               string `json:"role"`
 	RoleID             uint32 `json:"role_id"`
 	ExpiresIn          int64  `json:"expires_in"`
 	jwt.StandardClaims        // extending a struct
 }
 // CredentialsStruct is an instace of username/password values.
 type CredentialsStruct struct {
 	Username string `json:"username"`
 	Password string `json:"password"`
 }
 // ValidateCredentials hashes pass and salt and returns comparison result with resultHash
 func ValidateCredentials(pass, salt, resultHash string) bool {
 	hash, _, err := CreateHash(pass, salt)
 	if err != nil {
 		return false
 	}
 	return hash == resultHash
 }
 // CreateHash hashes str using SHA256.
 // If the presalt parameter is not provided CreateHash will generate new salt string.
 // Returns hash and salt strings or an error if it fails.
 func CreateHash(str, presalt string) (hash, salt string, err error) {
 	// chech if message is presalted
 	if presalt == "" {
 		salt, err = randomSalt()
 		if err != nil {
 			return "", "", err
 		}
 	} else {
 		salt = presalt
 	}
 	// convert strings to raw byte slices
 	rawstr := []byte(str)
 	rawsalt, err := hex.DecodeString(salt)
 	if err != nil {
 		return "", "", err
 	}
 	rawdata := make([]byte, len(rawstr)+len(rawsalt))
 	rawdata = append(rawdata, rawstr...)
 	rawdata = append(rawdata, rawsalt...)
 	// hash message + salt
 	hasher := sha256.New()
 	hasher.Write(rawdata)
 	rawhash := hasher.Sum(nil)
 	hash = hex.EncodeToString(rawhash)
 	return hash, salt, nil
 }
 // CreateAuthToken returns JWT token with encoded username, role, expiration date and issuer claims.
 // It returns an error if it fails.
 func CreateAuthToken(username string, role Role) (TokenClaims, error) {
 	t0 := (time.Now()).Unix()
 	t1 := (time.Now().Add(OneWeek)).Unix()
 	claims := TokenClaims{
 		TokenType: "Bearer",
 		Username:  username,
 		Role:      role.Name,
 		RoleID:    role.ID,
 		ExpiresIn: t1 - t0,
 	}
 	// initialize jwt.StandardClaims fields (anonymous struct)
 	claims.IssuedAt = t0
 	claims.ExpiresAt = t1
 	claims.Issuer = appName
 	jwtToken := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	token, err := jwtToken.SignedString([]byte(secret))
 	if err != nil {
 		return TokenClaims{}, err
 	}
 	claims.Token = token
 	return claims, nil
 }
 // RefreshAuthToken prolongs JWT token's expiration date for one week.
 // It returns new JWT token or an error if it fails.
 func RefreshAuthToken(req *http.Request) (TokenClaims, error) {
 	authHead := req.Header.Get("Authorization")
 	tokenstr := strings.TrimPrefix(authHead, "Bearer ")
 	token, err := jwt.ParseWithClaims(tokenstr, &TokenClaims{}, secretFunc)
 	if err != nil {
 		return TokenClaims{}, err
 	}
 	// type assertion
 	claims, ok := token.Claims.(*TokenClaims)
 	if !ok || !token.Valid {
 		return TokenClaims{}, errors.New("token is not valid")
 	}
 	// extend token expiration date
 	return CreateAuthToken(claims.Username, Role{claims.Role, claims.RoleID})
 }
 // RbacCheck returns true if role that made HTTP request is authorized to
 // access the resource it is targeting.
 // It exctracts user's role from the JWT token located in Authorization header of
 // http.Request and then compares it with the list of supplied roles and returns
 // true if there's a match, if "*" is provided or if the authRoles is nil.
 // Otherwise it returns false.
-func RbacCheck(req *http.Request, authRoles []string) (*TokenClaims, error) {
+func RbacCheck(req *http.Request, authRoles []string) bool {
+	if authRoles == nil {
+		return true
+	}
+	// validate token and check expiration date
+	claims, err := GetTokenClaims(req)
+	if err != nil {
+		return false
+	}
+	// check if token has expired
+	if claims.ExpiresAt < (time.Now()).Unix() {
+		return false
+	}
+	// check if role extracted from token matches
+	// any of the provided (allowed) ones
+	for _, r := range authRoles {
+		if claims.Role == r || r == "*" {
+			return true
+		}
+	}
+	return false
+}
+// TODO
+func AuthCheck(req *http.Request, authRoles []string) (*TokenClaims, error) {
 	if authRoles == nil {
 		return &TokenClaims{}, nil
 	}
 	// validate token and check expiration date
 	claims, err := GetTokenClaims(req)
 	if err != nil {
 		return &TokenClaims{}, err
 	}
 	// check if token has expired
 	if claims.ExpiresAt < (time.Now()).Unix() {
 		return &TokenClaims{}, errors.New("token has expired")
 	}
 	// check if role extracted from token matches
 	// any of the provided (allowed) ones
 	for _, r := range authRoles {
 		if claims.Role == r || r == "*" {
 			return claims, nil
 		}
 	}
-	return &TokenClaims{}, errors.New("role is not authorized")
+	return claims, errors.New("role is not authorized")
 }
 // GetTokenClaims extracts JWT claims from Authorization header of the request.
 // Returns token claims or an error.
 func GetTokenClaims(req *http.Request) (*TokenClaims, error) {
 	// check for and strip 'Bearer' prefix
 	var tokstr string
 	authHead := req.Header.Get("Authorization")
 	if ok := strings.HasPrefix(authHead, "Bearer "); ok {
-		tokstr = strings.TrimPrefix(tokstr, "Bearer ")
+		tokstr = strings.TrimPrefix(authHead, "Bearer ")
 	} else {
 		return &TokenClaims{}, errors.New("authorization header in incomplete")
 	}
 	token, err := jwt.ParseWithClaims(tokstr, &TokenClaims{}, secretFunc)
 	if err != nil {
 		return &TokenClaims{}, err
 	}
 	// type assertion
 	claims, ok := token.Claims.(*TokenClaims)
 	if !ok || !token.Valid {
 		return &TokenClaims{}, errors.New("token is not valid")
 	}
 	return claims, nil
 }
 // randomSalt returns a string of random characters of 'saltSize' length.
 func randomSalt() (s string, err error) {
 	rawsalt := make([]byte, saltSize)
 	_, err = rand.Read(rawsalt)
 	if err != nil {
 		return "", err
 	}
 	s = hex.EncodeToString(rawsalt)
 	return s, nil
 }
 // secretFunc returns byte slice of API secret keyword.
 func secretFunc(token *jwt.Token) (interface{}, error) {
 	return []byte(secret), nil
 }

http_utility.go

Diff comments View file @2d79a41

 package webutility
 import (
 	"encoding/json"
 	"net/http"
 )
 const (
 	templateHttpErr500_EN = "An internal server error has occurred."
 	templateHttpErr500_RS = "Došlo je do greške na serveru."
 	templateHttpErr400_EN = "Bad request: invalid request body."
 	templateHttpErr400_RS = "Neispravan zahtev."
 	templateHttpErr401_EN = "Unauthorized request."
 	templateHttpErr401_RS = "Neautorizovan zahtev."
 )
 type httpError struct {
 	Error   []HttpErrorDesc `json:"error"`
 	Request string          `json:"request"`
 }
 type HttpErrorDesc struct {
 	Lang string `json:"lang"`
 	Desc string `json:"description"`
 }
 // ErrorResponse writes HTTP error to w.
 func ErrorResponse(w http.ResponseWriter, r *http.Request, code int, desc []HttpErrorDesc) {
-	err := httpError{desc, r.Method + " " + r.URL.Path}
+	//err := httpError{desc, r.Method + " " + r.URL.Path}
+	err := httpError{desc, r.Method + " " + r.RequestURI}
 	w.WriteHeader(code)
 	json.NewEncoder(w).Encode(err)
 }
 // BadRequestResponse writes HTTP error 400 to w.
 func BadRequestResponse(w http.ResponseWriter, req *http.Request) {
 	ErrorResponse(w, req, http.StatusBadRequest, []HttpErrorDesc{
 		{"en", templateHttpErr400_EN},
 		{"rs", templateHttpErr400_RS},
 	})
 }
 // InternalSeverErrorResponse writes HTTP error 500 to w.
 func InternalServerErrorResponse(w http.ResponseWriter, req *http.Request) {
 	ErrorResponse(w, req, http.StatusInternalServerError, []HttpErrorDesc{
 		{"en", templateHttpErr500_EN},
 		{"rs", templateHttpErr500_RS},
 	})
 }
 // UnauthorizedError writes HTTP error 401 to w.
 func UnauthorizedResponse(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("WWW-Authenticate", "Bearer")
 	ErrorResponse(w, req, http.StatusUnauthorized, []HttpErrorDesc{
 		{"en", templateHttpErr401_EN},
 		{"rs", templateHttpErr401_RS},
 	})
 }
 // NotFoundHandler writes HTTP error 404 to w.
 func NotFoundHandler(w http.ResponseWriter, req *http.Request) {
 	SetDefaultHeaders(w)
 	if req.Method == "OPTIONS" {
 		return
 	}
 	ErrorResponse(w, req, http.StatusNotFound, []HttpErrorDesc{
 		{"en", "Not found."},
 		{"rs", "Traženi resurs ne postoji."},
 	})
 }
 // SetDefaultHeaders set's default headers for an HTTP response.
 func SetDefaultHeaders(w http.ResponseWriter) {
 	w.Header().Set("Access-Control-Allow-Origin", "*")
 	w.Header().Set("Access-Control-Allow-Methods", "POST, GET, PUT, DELETE, OPTIONS")
 	w.Header().Set("Access-Control-Allow-Headers", `Accept, Content-Type,
 		Content-Length, Accept-Encoding, X-CSRF-Token, Authorization`)
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 }

json_utility.go

Diff comments View file @2d79a41

 package webutility
 import (
 	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
 	"sync"
 	"gopkg.in/rana/ora.v4"
 )
 var mu = &sync.Mutex{}
 var payloads []payloadBuff
 type LangMap map[string]map[string]string
 type Field struct {
 	Parameter string `json:"param"`
 	Type      string `json:"type"`
 	Visible   bool   `json:"visible"`
 	Editable  bool   `json:"editable"`
 }
 type CorrelationField struct {
 	Result   string   `json:"result"`
 	Elements []string `json:"elements"`
 	Type     string   `json:"type"`
 }
 type Translation struct {
 	Language     string            `json:"language"`
 	FieldsLabels map[string]string `json:"fieldsLabels"`
 }
 type payloadBuff struct {
 	Type         string             `json:"tableType"`
 	Method       string             `json:"method"`
 	Params       map[string]string  `json:"params"`
 	Lang         []Translation      `json:"lang"`
 	Fields       []Field            `json:"fields"`
 	Correlations []CorrelationField `json:"correlationFields"`
 	IdField      string             `json:"idField"`
 	// Data can only hold slices of any type. It can't be used for itteration
 	Data interface{} `json:"data"`
 }
 type Payload struct {
 	Method       string             `json:"method"`
 	Params       map[string]string  `json:"params"`
 	Lang         []Translation      `json:"lang"`
 	Fields       []Field            `json:"fields"`
 	Correlations []CorrelationField `json:"correlationFields"`
 	IdField      string             `json:"idField"`
 	// Data contains JSON payload.
 	// It can't be used for itteration
 	Data interface{} `json:"data"`
 }
 // InitTables loads all payloads in the payloads variable.
 // Returns an error if it fails.
 func InitTables(db *ora.Ses, project string) error {
 	jsonbuf, err := fetchJSON(db, project)
 	if err != nil {
 		return err
 	}
 	mu.Lock()
 	defer mu.Unlock()
 	json.Unmarshal(jsonbuf, &payloads)
 	if len(payloads) == 0 {
 		return errors.New("tables config is corrupt")
 	}
 	return nil
 }
 // DecodeJSON decodes JSON data from r to v.
 // Returns an error if it fails.
 func DecodeJSON(r io.Reader, v interface{}) error {
 	return json.NewDecoder(r).Decode(v)
 }
 // NewPayload returs a payload sceleton for provided table.
 func NewPayload(r *http.Request, table string) Payload {
 	var pload Payload
-	pload.Method = r.Method + " " + r.URL.Path
+	//pload.Method = r.Method + " " + r.URL.Path
+	pload.Method = r.Method + " " + r.RequestURI
 	if table != "" {
 		pload.Params = make(map[string]string, 0)
 		pload.Lang = translations(table)
 		pload.Fields = fields(table)
 		pload.IdField = id(table)
 		pload.Correlations = correlations(table)
 	}
 	return pload
 }
 // DeliverPayload encodes payload to w.
 func DeliverPayload(w http.ResponseWriter, payload Payload) {
 	json.NewEncoder(w).Encode(payload)
 	payload.Data = nil
 }
 // translations returns a slice of translations for a payload/table of ptype type.
 func translations(ptype string) []Translation {
 	var translations []Translation
 	for _, pload := range payloads {
 		if pload.Type == ptype {
 			for _, t := range pload.Lang {
 				translations = append(translations, Translation{
 					Language:     t.Language,
 					FieldsLabels: t.FieldsLabels,
 				})
 			}
 		}
 	}
 	return translations
 }
 // fields returns a slice of fields for a payload/table of ptype type.
 func fields(ptype string) []Field {
 	var fields []Field
 	for _, pload := range payloads {
 		if pload.Type == ptype {
 			for _, f := range pload.Fields {
 				fields = append(fields, f)
 			}
 		}
 	}
 	return fields
 }
 // id returns the name of ID field of a payload/table of ptype type.
 func id(ptype string) string {
 	for _, pload := range payloads {
 		if pload.Type == ptype {
 			return pload.IdField
 		}
 	}
 	return ""
 }
 // correlations returns a slice of correlation fields for a payload/table of ptype type.
 func correlations(ptype string) []CorrelationField {
 	var corr []CorrelationField
 	for _, pload := range payloads {
 		if pload.Type == ptype {
 			for _, c := range pload.Correlations {
 				corr = append(corr, c)
 			}
 		}
 	}
 	return corr
 }
 // fetchJSON returns a byte slice of JSON configuration file from TABLES_CONFIG table.
 // Returns an error if it fails.
 func fetchJSON(db *ora.Ses, project string) ([]byte, error) {
 	db.SetCfg(db.Cfg().SetClob(ora.S))
 	stmt, err := db.Prep(`SELECT JSON_NCLOB FROM TABLES_CONFIG WHERE PROJEKAT`+EqualQuotes(project), ora.S)
 	defer stmt.Close()
 	if err != nil {
 		return nil, err
 	}
 	rset, err := stmt.Qry()
 	if err != nil {
 		return nil, err
 	}
 	var data string
 	if rset.Next() {
 		data = rset.Row[0].(string)
 	}
 	//fmt.Println(data)
 	return []byte(data), nil
 }