Add signed-url handling to thumbnail service

Co-authored-by: André Duffeck <a.duffeck@opencloud.eu>

Signed-off-by: Christian Richter <c.richter@opencloud.eu>

services/thumbnails/pkg/service/http/v0/service.go

@@ -3,7 +3,9 @@ package svc
 import (
 	"context"
 	"fmt"
+	"github.com/opencloud-eu/reva/v2/pkg/signedurl"
 	"net/http"
+	"net/url"
 	"strconv"
 
 	"github.com/go-chi/chi/v5"
@@ -65,6 +67,7 @@ func NewService(opts ...Option) Service {
 
 	m.Route(options.Config.HTTP.Root, func(r chi.Router) {
 		r.Use(svc.TransferTokenValidator)
+		r.Use(svc.SignedUrlValidator)
 		r.Get("/data", svc.GetThumbnail)
 	})
 
@@ -114,11 +117,47 @@ func (s Thumbnails) GetThumbnail(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func (s Thumbnails) SignedUrlValidator(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		u, err := url.Parse(r.URL.String())
+		if err != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		signer, err := signedurl.NewJWTSignedURL(signedurl.WithSecret("abcde"))
+		if err != nil {
+			panic("failed to create signer")
+		}
+
+		sig := u.Query().Get("oc-jwt-sig")
+		if sig == "" {
+			next.ServeHTTP(w, r)
+		}
+
+		_, err = signer.Verify(u.String())
+		if err == nil {
+			// the signature is valid
+			next.ServeHTTP(w, r)
+		} else {
+			w.WriteHeader(http.StatusUnauthorized)
+		}
+
+		// TODO: make sure that one of the validator validated
+		// TODO: log errors
+	})
+}
+
 // TransferTokenValidator validates a transfer token
 func (s Thumbnails) TransferTokenValidator(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		logger := s.logger.SubloggerWithRequestID(r.Context())
 		tokenString := r.Header.Get("Transfer-Token")
+		if tokenString == "" {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		logger := s.logger.SubloggerWithRequestID(r.Context())
 		token, err := jwt.ParseWithClaims(tokenString, &tjwt.ThumbnailClaims{}, func(token *jwt.Token) (interface{}, error) {
 			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 				return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])