frostfs-s3-gw/api/middleware/auth.go

package middleware

import (
	stderrors "errors"
	"net/http"
	"time"

	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/api/errors"
	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/creds/accessbox"
	"git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/logs"
	"go.uber.org/zap"
)

type (
	// Box contains access box and additional info.
	Box struct {
		AccessBox   *accessbox.Box
		ClientTime  time.Time
		AuthHeaders *AuthHeader
	}

	// Center is a user authentication interface.
	Center interface {
		// Authenticate validate and authenticate request.
		// Must return ErrNoAuthorizationHeader if auth header is missed.
		Authenticate(request *http.Request) (*Box, error)
	}

	//nolint:revive
	AuthHeader struct {
		AccessKeyID string
		Region      string
		SignatureV4 string
	}
)

// ErrNoAuthorizationHeader is returned for unauthenticated requests.
var ErrNoAuthorizationHeader = stderrors.New("no authorization header")

func Auth(center Center, log *zap.Logger) Func {
	return func(h http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			ctx := r.Context()
			box, err := center.Authenticate(r)
			if err != nil {
				if err == ErrNoAuthorizationHeader {
					reqLogOrDefault(ctx, log).Debug(logs.CouldntReceiveAccessBoxForGateKeyRandomKeyWillBeUsed)
				} else {
					reqLogOrDefault(ctx, log).Error(logs.FailedToPassAuthentication, zap.Error(err))
					if _, ok := err.(errors.Error); !ok {
						err = errors.GetAPIError(errors.ErrAccessDenied)
					}
					WriteErrorResponse(w, GetReqInfo(r.Context()), err)
					return
				}
			} else {
				ctx = SetBoxData(ctx, box.AccessBox)
				if !box.ClientTime.IsZero() {
					ctx = SetClientTime(ctx, box.ClientTime)
				}
				ctx = SetAuthHeaders(ctx, box.AuthHeaders)
			}

			h.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}