mirror of
https://github.com/bitechdev/ResolveSpec.git
synced 2026-10-02 11:31:57 +00:00
Hein
c9fa8c60f2
pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).
- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
parameter, JSON null arrays, expires_at timezone casts, passkey list
GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps
73 lines
2.3 KiB
Go
73 lines
2.3 KiB
Go
package security
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
)
|
|
|
|
// ChainAuthenticator tries each authenticator in order, returning the first success.
|
|
// Login and Logout are delegated to the primary authenticator.
|
|
type ChainAuthenticator struct {
|
|
authenticators []Authenticator
|
|
authenticateCallback func(r *http.Request) (*UserContext, error)
|
|
}
|
|
|
|
// NewChainAuthenticator creates a ChainAuthenticator from the given authenticators.
|
|
// At least one authenticator is required; the first is treated as primary for Login/Logout.
|
|
func NewChainAuthenticator(primary Authenticator, rest ...Authenticator) *ChainAuthenticator {
|
|
return &ChainAuthenticator{
|
|
authenticators: append([]Authenticator{primary}, rest...),
|
|
}
|
|
}
|
|
|
|
func (c *ChainAuthenticator) Authenticate(r *http.Request) (*UserContext, error) {
|
|
var lastErr error
|
|
for _, a := range c.authenticators {
|
|
if uc, err := a.Authenticate(r); err == nil {
|
|
return uc, nil
|
|
} else {
|
|
lastErr = err
|
|
}
|
|
}
|
|
if c.authenticateCallback != nil {
|
|
return c.authenticateCallback(r)
|
|
}
|
|
return nil, fmt.Errorf("all authenticators failed; last error: %w", lastErr)
|
|
}
|
|
|
|
func (c *ChainAuthenticator) SetAuthenticateCallback(fn func(r *http.Request) (*UserContext, error)) {
|
|
c.authenticateCallback = fn
|
|
}
|
|
|
|
func (c *ChainAuthenticator) Login(ctx context.Context, req LoginRequest) (*LoginResponse, error) {
|
|
return c.authenticators[0].Login(ctx, req)
|
|
}
|
|
|
|
func (c *ChainAuthenticator) LoginWithCookie(ctx context.Context, req LoginRequest, w http.ResponseWriter) (*LoginResponse, error) {
|
|
return c.authenticators[0].LoginWithCookie(ctx, req, w)
|
|
}
|
|
|
|
func (c *ChainAuthenticator) Logout(ctx context.Context, req LogoutRequest) error {
|
|
return c.authenticators[0].Logout(ctx, req)
|
|
}
|
|
|
|
func (c *ChainAuthenticator) LogoutWithCookie(ctx context.Context, req LogoutRequest, w http.ResponseWriter) error {
|
|
return c.authenticators[0].LogoutWithCookie(ctx, req, w)
|
|
}
|
|
|
|
// LoginWithAPIKey tries each authenticator that supports API key login and
|
|
// returns the first success. Failures collapse to one generic error.
|
|
func (c *ChainAuthenticator) LoginWithAPIKey(ctx context.Context, rawKey string, claims map[string]any) (*LoginResponse, error) {
|
|
for _, a := range c.authenticators {
|
|
l, ok := a.(APIKeyLoginable)
|
|
if !ok {
|
|
continue
|
|
}
|
|
if resp, err := l.LoginWithAPIKey(ctx, rawKey, claims); err == nil {
|
|
return resp, nil
|
|
}
|
|
}
|
|
return nil, errInvalidAPIKey
|
|
}
|