add public share auth middleware

proxy/pkg/middleware/public_share_auth.go

@@ -0,0 +1,58 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+)
+
+const (
+	headerRevaAccessToken   = "x-access-token"
+	headerShareToken        = "public-token"
+	appProviderPathPrefix   = "/app/open"
+	basicAuthPasswordPrefix = "basic|"
+	authenticationType      = "publicshares"
+)
+
+// PublicShareAuth ...
+func PublicShareAuth(opts ...Option) func(next http.Handler) http.Handler {
+	options := newOptions(opts...)
+	logger := options.Logger
+
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Currently we only want to authenticate app open request coming from public shares.
+			shareToken := r.Header.Get(headerShareToken)
+			if shareToken == "" || !strings.HasPrefix(appProviderPathPrefix, r.URL.Path) {
+				// Don't authenticate
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// We can ignore the username since it is always set to "public" in public shares.
+			_, password, ok := r.BasicAuth()
+
+			sharePassword := basicAuthPasswordPrefix
+			if ok {
+				sharePassword += password
+			}
+
+			authResp, err := options.RevaGatewayClient.Authenticate(r.Context(), &gateway.AuthenticateRequest{
+				Type:         authenticationType,
+				ClientId:     shareToken,
+				ClientSecret: sharePassword,
+			})
+
+			if err != nil {
+				logger.Debug().Err(err).Str("public_share_token", shareToken).Msg("could not authenticate public share")
+				// try another middleware
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			r.Header.Add(headerRevaAccessToken, authResp.Token)
+			next.ServeHTTP(w, r)
+		})
+	}
+}