mirror of
https://github.com/moby/moby.git
synced 2026-08-08 17:11:38 +00:00
294 lines
9.6 KiB
Go
294 lines
9.6 KiB
Go
// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package security
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/go-openapi/errors"
|
|
|
|
"github.com/go-openapi/runtime"
|
|
)
|
|
|
|
const (
|
|
query = "query"
|
|
header = "header"
|
|
accessTokenParam = "access_token"
|
|
)
|
|
|
|
// HTTPAuthenticator is a function that authenticates a HTTP request.
|
|
func HTTPAuthenticator(handler func(*http.Request) (bool, any, error)) runtime.Authenticator {
|
|
return runtime.AuthenticatorFunc(func(params any) (bool, any, error) {
|
|
if request, ok := params.(*http.Request); ok {
|
|
return handler(request)
|
|
}
|
|
if scoped, ok := params.(*ScopedAuthRequest); ok {
|
|
return handler(scoped.Request)
|
|
}
|
|
return false, nil, nil
|
|
})
|
|
}
|
|
|
|
// HttpAuthenticator aliases [HTTPAuthenticator] for backward-compatibility.
|
|
//
|
|
// Deprecated: use [HTTPAuthenticator] instead.
|
|
func HttpAuthenticator(handler func(*http.Request) (bool, any, error)) runtime.Authenticator { //nolint:revive
|
|
return HTTPAuthenticator(handler)
|
|
}
|
|
|
|
// ScopedAuthenticator is a function that authenticates an [http.Request] against a list of valid scopes.
|
|
func ScopedAuthenticator(handler func(*ScopedAuthRequest) (bool, any, error)) runtime.Authenticator {
|
|
return runtime.AuthenticatorFunc(func(params any) (bool, any, error) {
|
|
if request, ok := params.(*ScopedAuthRequest); ok {
|
|
return handler(request)
|
|
}
|
|
return false, nil, nil
|
|
})
|
|
}
|
|
|
|
// UserPassAuthentication validates a basic-auth credential.
|
|
//
|
|
// Implementations comparing the password (or any derived secret) against a
|
|
// known value MUST use [crypto/subtle.ConstantTimeCompare]: the runtime
|
|
// extracts the credential from the request and delegates the comparison
|
|
// here, and does not enforce a constant-time posture on the caller's behalf.
|
|
type UserPassAuthentication func(string, string) (any, error)
|
|
|
|
// UserPassAuthenticationCtx is the [context.Context]-aware variant of
|
|
// [UserPassAuthentication]. The same constant-time-comparison guidance
|
|
// applies.
|
|
type UserPassAuthenticationCtx func(context.Context, string, string) (context.Context, any, error)
|
|
|
|
// TokenAuthentication validates an API-key token.
|
|
//
|
|
// Implementations comparing the token against a known value MUST use
|
|
// [crypto/subtle.ConstantTimeCompare]; the runtime delegates the comparison
|
|
// here and does not enforce a constant-time posture on the caller's behalf.
|
|
type TokenAuthentication func(string) (any, error)
|
|
|
|
// TokenAuthenticationCtx is the [context.Context]-aware variant of
|
|
// [TokenAuthentication]. The same constant-time-comparison guidance
|
|
// applies.
|
|
type TokenAuthenticationCtx func(context.Context, string) (context.Context, any, error)
|
|
|
|
// ScopedTokenAuthentication validates a bearer/OAuth2 token along with the
|
|
// scopes required for the operation.
|
|
//
|
|
// Implementations comparing the token against a known value MUST use
|
|
// [crypto/subtle.ConstantTimeCompare]; the runtime delegates the comparison
|
|
// here and does not enforce a constant-time posture on the caller's behalf.
|
|
type ScopedTokenAuthentication func(string, []string) (any, error)
|
|
|
|
// ScopedTokenAuthenticationCtx is the [context.Context]-aware variant of
|
|
// [ScopedTokenAuthentication]. The same constant-time-comparison guidance
|
|
// applies.
|
|
type ScopedTokenAuthenticationCtx func(context.Context, string, []string) (context.Context, any, error)
|
|
|
|
var DefaultRealmName = "API"
|
|
|
|
type secCtxKey uint8
|
|
|
|
const (
|
|
failedBasicAuth secCtxKey = iota
|
|
oauth2SchemeName
|
|
)
|
|
|
|
func FailedBasicAuth(r *http.Request) string {
|
|
return FailedBasicAuthCtx(r.Context())
|
|
}
|
|
|
|
func FailedBasicAuthCtx(ctx context.Context) string {
|
|
v, ok := ctx.Value(failedBasicAuth).(string)
|
|
if !ok {
|
|
return ""
|
|
}
|
|
return v
|
|
}
|
|
|
|
func OAuth2SchemeName(r *http.Request) string {
|
|
return OAuth2SchemeNameCtx(r.Context())
|
|
}
|
|
|
|
func OAuth2SchemeNameCtx(ctx context.Context) string {
|
|
v, ok := ctx.Value(oauth2SchemeName).(string)
|
|
if !ok {
|
|
return ""
|
|
}
|
|
return v
|
|
}
|
|
|
|
// BasicAuth creates a basic auth authenticator with the provided authentication function.
|
|
func BasicAuth(authenticate UserPassAuthentication) runtime.Authenticator {
|
|
return BasicAuthRealm(DefaultRealmName, authenticate)
|
|
}
|
|
|
|
// BasicAuthRealm creates a basic auth authenticator with the provided authentication function and realm name.
|
|
func BasicAuthRealm(realm string, authenticate UserPassAuthentication) runtime.Authenticator {
|
|
if realm == "" {
|
|
realm = DefaultRealmName
|
|
}
|
|
|
|
return HttpAuthenticator(func(r *http.Request) (bool, any, error) {
|
|
if usr, pass, ok := r.BasicAuth(); ok {
|
|
p, err := authenticate(usr, pass)
|
|
if err != nil {
|
|
*r = *r.WithContext(context.WithValue(r.Context(), failedBasicAuth, realm))
|
|
}
|
|
return true, p, err
|
|
}
|
|
*r = *r.WithContext(context.WithValue(r.Context(), failedBasicAuth, realm))
|
|
return false, nil, nil
|
|
})
|
|
}
|
|
|
|
// BasicAuthCtx creates a basic auth authenticator with the provided authentication function with support for [context.Context].
|
|
func BasicAuthCtx(authenticate UserPassAuthenticationCtx) runtime.Authenticator {
|
|
return BasicAuthRealmCtx(DefaultRealmName, authenticate)
|
|
}
|
|
|
|
// BasicAuthRealmCtx creates a basic auth authenticator with the provided authentication function and realm name with support for [context.Context].
|
|
func BasicAuthRealmCtx(realm string, authenticate UserPassAuthenticationCtx) runtime.Authenticator {
|
|
if realm == "" {
|
|
realm = DefaultRealmName
|
|
}
|
|
|
|
return HttpAuthenticator(func(r *http.Request) (bool, any, error) {
|
|
if usr, pass, ok := r.BasicAuth(); ok {
|
|
ctx, p, err := authenticate(r.Context(), usr, pass)
|
|
if err != nil {
|
|
ctx = context.WithValue(ctx, failedBasicAuth, realm)
|
|
}
|
|
*r = *r.WithContext(ctx)
|
|
return true, p, err
|
|
}
|
|
*r = *r.WithContext(context.WithValue(r.Context(), failedBasicAuth, realm))
|
|
return false, nil, nil
|
|
})
|
|
}
|
|
|
|
// APIKeyAuth creates an authenticator that uses a token for authorization.
|
|
// This token can be obtained from either a header or a query string.
|
|
func APIKeyAuth(name, in string, authenticate TokenAuthentication) runtime.Authenticator {
|
|
inl := strings.ToLower(in)
|
|
if inl != query && inl != header {
|
|
// panic because this is most likely a typo
|
|
panic(errors.New(http.StatusInternalServerError, "api key auth: in value needs to be either \"query\" or \"header\""))
|
|
}
|
|
|
|
var getToken func(*http.Request) string
|
|
switch inl {
|
|
case header:
|
|
getToken = func(r *http.Request) string { return r.Header.Get(name) }
|
|
case query:
|
|
getToken = func(r *http.Request) string { return r.URL.Query().Get(name) }
|
|
}
|
|
|
|
return HttpAuthenticator(func(r *http.Request) (bool, any, error) {
|
|
token := getToken(r)
|
|
if token == "" {
|
|
return false, nil, nil
|
|
}
|
|
|
|
p, err := authenticate(token)
|
|
return true, p, err
|
|
})
|
|
}
|
|
|
|
// APIKeyAuthCtx creates an authenticator that uses a token for authorization with support for [context.Context].
|
|
// This token can be obtained from either a header or a query string.
|
|
func APIKeyAuthCtx(name, in string, authenticate TokenAuthenticationCtx) runtime.Authenticator {
|
|
inl := strings.ToLower(in)
|
|
if inl != query && inl != header {
|
|
// panic because this is most likely a typo
|
|
panic(errors.New(http.StatusInternalServerError, "api key auth: in value needs to be either \"query\" or \"header\""))
|
|
}
|
|
|
|
var getToken func(*http.Request) string
|
|
switch inl {
|
|
case header:
|
|
getToken = func(r *http.Request) string { return r.Header.Get(name) }
|
|
case query:
|
|
getToken = func(r *http.Request) string { return r.URL.Query().Get(name) }
|
|
}
|
|
|
|
return HttpAuthenticator(func(r *http.Request) (bool, any, error) {
|
|
token := getToken(r)
|
|
if token == "" {
|
|
return false, nil, nil
|
|
}
|
|
|
|
ctx, p, err := authenticate(r.Context(), token)
|
|
*r = *r.WithContext(ctx)
|
|
return true, p, err
|
|
})
|
|
}
|
|
|
|
// ScopedAuthRequest contains both the [http.Request] and the required scopes for a particular operation.
|
|
type ScopedAuthRequest struct {
|
|
Request *http.Request
|
|
RequiredScopes []string
|
|
}
|
|
|
|
// BearerAuth for use with oauth2 flows.
|
|
func BearerAuth(name string, authenticate ScopedTokenAuthentication) runtime.Authenticator {
|
|
const prefix = "Bearer "
|
|
return ScopedAuthenticator(func(r *ScopedAuthRequest) (bool, any, error) {
|
|
var token string
|
|
hdr := r.Request.Header.Get(runtime.HeaderAuthorization)
|
|
if after, ok := strings.CutPrefix(hdr, prefix); ok {
|
|
token = after
|
|
}
|
|
if token == "" {
|
|
qs := r.Request.URL.Query()
|
|
token = qs.Get(accessTokenParam)
|
|
}
|
|
//#nosec
|
|
ct, _, _ := runtime.ContentType(r.Request.Header)
|
|
if token == "" && (ct == "application/x-www-form-urlencoded" || ct == "multipart/form-data") {
|
|
token = r.Request.FormValue(accessTokenParam)
|
|
}
|
|
|
|
if token == "" {
|
|
return false, nil, nil
|
|
}
|
|
|
|
rctx := context.WithValue(r.Request.Context(), oauth2SchemeName, name)
|
|
*r.Request = *r.Request.WithContext(rctx)
|
|
p, err := authenticate(token, r.RequiredScopes)
|
|
return true, p, err
|
|
})
|
|
}
|
|
|
|
// BearerAuthCtx for use with oauth2 flows with support for [context.Context].
|
|
func BearerAuthCtx(name string, authenticate ScopedTokenAuthenticationCtx) runtime.Authenticator {
|
|
const prefix = "Bearer "
|
|
return ScopedAuthenticator(func(r *ScopedAuthRequest) (bool, any, error) {
|
|
var token string
|
|
hdr := r.Request.Header.Get(runtime.HeaderAuthorization)
|
|
if after, ok := strings.CutPrefix(hdr, prefix); ok {
|
|
token = after
|
|
}
|
|
if token == "" {
|
|
qs := r.Request.URL.Query()
|
|
token = qs.Get(accessTokenParam)
|
|
}
|
|
//#nosec
|
|
ct, _, _ := runtime.ContentType(r.Request.Header)
|
|
if token == "" && (ct == "application/x-www-form-urlencoded" || ct == "multipart/form-data") {
|
|
token = r.Request.FormValue(accessTokenParam)
|
|
}
|
|
|
|
if token == "" {
|
|
return false, nil, nil
|
|
}
|
|
|
|
rctx := context.WithValue(r.Request.Context(), oauth2SchemeName, name)
|
|
ctx, p, err := authenticate(rctx, token, r.RequiredScopes)
|
|
*r.Request = *r.Request.WithContext(ctx)
|
|
return true, p, err
|
|
})
|
|
}
|