H1K0
d357ae3156
The file viewer's preview is now a real link (target=_blank) to the original, instead of fetching it into a blob. A navigation can't send the auth header, so the access token rides in the query — the auth middleware accepts ?access_token= as a fallback, but only for GET, so a crafted link can't drive a mutation. GetContent gains an ?inline=1 toggle (Content-Disposition: inline) so the tab views the original instead of downloading it; download stays the default. Documented in openapi.yaml; TestMediaQueryTokenAuth covers GET-with-query-token (200), missing token (401) and query-token rejected on a non-GET (401). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
67 lines
1.9 KiB
Go
67 lines
1.9 KiB
Go
package handler
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"tanabata/backend/internal/domain"
|
|
"tanabata/backend/internal/service"
|
|
)
|
|
|
|
// AuthMiddleware validates Bearer JWTs and injects user identity into context.
|
|
type AuthMiddleware struct {
|
|
authSvc *service.AuthService
|
|
}
|
|
|
|
// NewAuthMiddleware creates an AuthMiddleware backed by authSvc.
|
|
func NewAuthMiddleware(authSvc *service.AuthService) *AuthMiddleware {
|
|
return &AuthMiddleware{authSvc: authSvc}
|
|
}
|
|
|
|
// Handle returns a Gin handler function that enforces authentication.
|
|
// On success it calls c.Next(); on failure it aborts with 401 JSON.
|
|
func (m *AuthMiddleware) Handle() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
token := bearerToken(c)
|
|
if token == "" {
|
|
c.JSON(http.StatusUnauthorized, errorBody{
|
|
Code: domain.ErrUnauthorized.Code(),
|
|
Message: "authorization header missing or malformed",
|
|
})
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
claims, err := m.authSvc.ValidateAccessToken(c.Request.Context(), token)
|
|
if err != nil {
|
|
c.JSON(http.StatusUnauthorized, errorBody{
|
|
Code: domain.ErrUnauthorized.Code(),
|
|
Message: "invalid or expired token",
|
|
})
|
|
c.Abort()
|
|
return
|
|
}
|
|
|
|
ctx := domain.WithUser(c.Request.Context(), claims.UserID, claims.IsAdmin, claims.SessionID)
|
|
c.Request = c.Request.WithContext(ctx)
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// bearerToken extracts the access token from the Authorization header. As a
|
|
// fallback it accepts an ?access_token= query parameter, but only for GET
|
|
// requests — this lets the browser open media (e.g. /files/{id}/content) via a
|
|
// plain link/new tab, where it can't send the header, without allowing a crafted
|
|
// link to drive a state-changing request.
|
|
func bearerToken(c *gin.Context) string {
|
|
if raw := c.GetHeader("Authorization"); strings.HasPrefix(raw, "Bearer ") {
|
|
return strings.TrimPrefix(raw, "Bearer ")
|
|
}
|
|
if c.Request.Method == http.MethodGet {
|
|
return c.Query("access_token")
|
|
}
|
|
return ""
|
|
}
|