samples/postgres_auth/auth_bearer.cpp

 
#include "auth_bearer.hpp"
#include "user_info_cache.hpp"
 
#include <algorithm>
 
#include <userver/http/common_headers.hpp>
 
namespace samples::pg {
 
class AuthCheckerBearer final : public server::handlers::auth::AuthCheckerBase {
 public:
  using AuthCheckResult = server::handlers::auth::AuthCheckResult;
 
  AuthCheckerBearer(const AuthCache& auth_cache,
                    std::vector<server::auth::UserScope> required_scopes)
      : auth_cache_(auth_cache), required_scopes_(std::move(required_scopes)) {}
 
  [[nodiscard]] AuthCheckResult CheckAuth(
      const server::http::HttpRequest& request,
      server::request::RequestContext& request_context) const override;
 
  [[nodiscard]] bool SupportsUserAuth() const noexcept override { return true; }
 
 private:
  const AuthCache& auth_cache_;
  const std::vector<server::auth::UserScope> required_scopes_;
};
 
AuthCheckerBearer::AuthCheckResult AuthCheckerBearer::CheckAuth(
    const server::http::HttpRequest& request,
    server::request::RequestContext& request_context) const {
  const auto& auth_value = request.GetHeader(http::headers::kAuthorization);
  if (auth_value.empty()) {
    return AuthCheckResult{AuthCheckResult::Status::kTokenNotFound,
                           {},
                           "Empty 'Authorization' header",
                           server::handlers::HandlerErrorCode::kUnauthorized};
  }
 
  const auto bearer_sep_pos = auth_value.find(' ');
  if (bearer_sep_pos == std::string::npos ||
      std::string_view{auth_value.data(), bearer_sep_pos} != "Bearer") {
    return AuthCheckResult{
        AuthCheckResult::Status::kTokenNotFound,
        {},
        "'Authorization' header should have 'Bearer some-token' format",
        server::handlers::HandlerErrorCode::kUnauthorized};
  }
 
  const server::auth::UserAuthInfo::Ticket token{auth_value.data() +
                                                 bearer_sep_pos + 1};
  const auto cache_snapshot = auth_cache_.Get();
 
  auto it = cache_snapshot->find(token);
  if (it == cache_snapshot->end()) {
    return AuthCheckResult{AuthCheckResult::Status::kForbidden};
  }
 
  const UserDbInfo& info = it->second;
  for (const auto& scope : required_scopes_) {
    if (std::find(info.scopes.begin(), info.scopes.end(), scope.GetValue()) ==
        info.scopes.end()) {
      return AuthCheckResult{AuthCheckResult::Status::kForbidden,
                             {},
                             "No '" + scope.GetValue() + "' permission"};
    }
  }
 
  request_context.SetData("name", info.name);
  return {};
}
 
server::handlers::auth::AuthCheckerBasePtr CheckerFactory::operator()(
    const ::components::ComponentContext& context,
    const server::handlers::auth::HandlerAuthConfig& auth_config,
    const server::handlers::auth::AuthCheckerSettings&) const {
  auto scopes = auth_config["scopes"].As<server::auth::UserScopes>({});
  const auto& auth_cache = context.FindComponent<AuthCache>();
  return std::make_shared<AuthCheckerBearer>(auth_cache, std::move(scopes));
}
 
}  // namespace samples::pg