Let graph auth middleware add the roleids to the context

They were also added by the ExtractAccountUUID for the /drives endpoint.
We'll need some on other endpoints as well (for automatic user
provisioning).

extensions/graph/pkg/middleware/auth.go

@@ -8,6 +8,8 @@ import (
 	"github.com/cs3org/reva/v2/pkg/token/manager/jwt"
 	"github.com/owncloud/ocis/v2/extensions/graph/pkg/service/v0/errorcode"
 	"github.com/owncloud/ocis/v2/ocis-pkg/account"
+	opkgm "github.com/owncloud/ocis/v2/ocis-pkg/middleware"
+	gmmetadata "go-micro.dev/v4/metadata"
 	"google.golang.org/grpc/metadata"
 )
 
@@ -25,6 +27,8 @@ func authOptions(opts ...account.Option) account.Options {
 // Auth provides a middleware to authenticate requests using the x-access-token header value
 // and write it to the context. If there is no x-access-token the middleware prevents access and renders a json document.
 func Auth(opts ...account.Option) func(http.Handler) http.Handler {
+	// Note: This largely duplicates was ocis-pkg/middleware/account.go already does (apart from a slightly different error
+	// handling). Ideally we should merge both middlewares.
 	opt := authOptions(opts...)
 	tokenManager, err := jwt.New(map[string]interface{}{
 		"secret":  opt.JWTSecret,
@@ -69,6 +73,12 @@ func Auth(opts ...account.Option) func(http.Handler) http.Handler {
 
 			ctx = revactx.ContextSetToken(ctx, t)
 			ctx = revactx.ContextSetUser(ctx, u)
+			ctx = gmmetadata.Set(ctx, opkgm.AccountID, u.Id.OpaqueId)
+			if u.Opaque != nil {
+				if roles, ok := u.Opaque.Map["roles"]; ok {
+					ctx = gmmetadata.Set(ctx, opkgm.RoleIDs, string(roles.Value))
+				}
+			}
 			ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, t)
 
 			next.ServeHTTP(w, r.WithContext(ctx))

extensions/graph/pkg/service/v0/service.go

@@ -14,8 +14,6 @@ import (
 	"github.com/owncloud/ocis/v2/extensions/graph/pkg/identity"
 	"github.com/owncloud/ocis/v2/extensions/graph/pkg/identity/ldap"
 	graphm "github.com/owncloud/ocis/v2/extensions/graph/pkg/middleware"
-	"github.com/owncloud/ocis/v2/ocis-pkg/account"
-	opkgm "github.com/owncloud/ocis/v2/ocis-pkg/middleware"
 	"github.com/owncloud/ocis/v2/ocis-pkg/roles"
 	"github.com/owncloud/ocis/v2/ocis-pkg/service/grpc"
 	settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
@@ -171,19 +169,13 @@ func NewService(opts ...Option) Service {
 					})
 				})
 			})
-			r.Group(func(r chi.Router) {
+			r.Route("/drives", func(r chi.Router) {
-				r.Use(opkgm.ExtractAccountUUID(
+				r.Get("/", svc.GetAllDrives)
-					account.Logger(options.Logger),
+				r.Post("/", svc.CreateDrive)
-					account.JWTSecret(options.Config.TokenManager.JWTSecret)),
+				r.Route("/{driveID}", func(r chi.Router) {
-				)
+					r.Patch("/", svc.UpdateDrive)
-				r.Route("/drives", func(r chi.Router) {
+					r.Get("/", svc.GetSingleDrive)
-					r.Get("/", svc.GetAllDrives)
+					r.Delete("/", svc.DeleteDrive)
-					r.Post("/", svc.CreateDrive)
-					r.Route("/{driveID}", func(r chi.Router) {
-						r.Patch("/", svc.UpdateDrive)
-						r.Get("/", svc.GetSingleDrive)
-						r.Delete("/", svc.DeleteDrive)
-					})
 				})
 			})
 		})