Merge pull request #958 from owncloud/basic-auth-cache

implement basic auth cache

proxy/pkg/cache/cache.go

@@ -1,78 +0,0 @@
-package cache
-
-import (
-	"sync"
-	"time"
-)
-
-// Entry represents an entry on the cache. You can type assert on V.
-type Entry struct {
-	V          interface{}
-	expiration time.Time
-}
-
-// Cache is a barebones cache implementation.
-type Cache struct {
-	entries map[string]*Entry
-	size    int
-	m       sync.Mutex
-}
-
-// NewCache returns a new instance of Cache.
-func NewCache(o ...Option) Cache {
-	opts := newOptions(o...)
-
-	return Cache{
-		size:    opts.size,
-		entries: map[string]*Entry{},
-	}
-}
-
-// Get gets a role-bundle by a given `roleID`.
-func (c *Cache) Get(k string) *Entry {
-	c.m.Lock()
-	defer c.m.Unlock()
-
-	if _, ok := c.entries[k]; ok {
-		if c.expired(c.entries[k]) {
-			delete(c.entries, k)
-			return nil
-		}
-		return c.entries[k]
-	}
-	return nil
-}
-
-// Set sets a roleID / role-bundle.
-func (c *Cache) Set(k string, val interface{}, expiration time.Time) {
-	c.m.Lock()
-	defer c.m.Unlock()
-
-	if !c.fits() {
-		c.evict()
-	}
-
-	c.entries[k] = &Entry{
-		val,
-		expiration,
-	}
-}
-
-// evict frees memory from the cache by removing entries that exceeded the cache TTL.
-func (c *Cache) evict() {
-	for i := range c.entries {
-		if c.expired(c.entries[i]) {
-			delete(c.entries, i)
-		}
-	}
-}
-
-// expired checks if an entry is expired
-func (c *Cache) expired(e *Entry) bool {
-	return e.expiration.Before(time.Now())
-}
-
-// fits returns whether the cache fits more entries.
-func (c *Cache) fits() bool {
-	return c.size > len(c.entries)
-}

proxy/pkg/cache/option.go

@@ -1,36 +0,0 @@
-package cache
-
-import "time"
-
-// Options are all the possible options.
-type Options struct {
-	size int
-	ttl  time.Duration
-}
-
-// Option mutates option
-type Option func(*Options)
-
-// Size configures the size of the cache in items.
-func Size(s int) Option {
-	return func(o *Options) {
-		o.size = s
-	}
-}
-
-// TTL rebuilds the cache after the configured duration.
-func TTL(ttl time.Duration) Option {
-	return func(o *Options) {
-		o.ttl = ttl
-	}
-}
-
-func newOptions(opts ...Option) Options {
-	o := Options{}
-
-	for _, v := range opts {
-		v(&o)
-	}
-
-	return o
-}

proxy/pkg/middleware/basic_auth.go

@@ -2,12 +2,11 @@ package middleware
 
 import (
 	"fmt"
-	"net/http"
-	"strings"
-
 	accounts "github.com/owncloud/ocis/accounts/pkg/proto/v0"
 	"github.com/owncloud/ocis/ocis-pkg/log"
 	"github.com/owncloud/ocis/ocis-pkg/oidc"
+	"net/http"
+	"strings"
 )
 
 const publicFilesEndpoint = "/remote.php/dav/public-files/"
@@ -15,50 +14,49 @@ const publicFilesEndpoint = "/remote.php/dav/public-files/"
 // BasicAuth provides a middleware to check if BasicAuth is provided
 func BasicAuth(optionSetters ...Option) func(next http.Handler) http.Handler {
 	options := newOptions(optionSetters...)
+	logger := options.Logger
+	oidcIss := options.OIDCIss
+
 	if options.EnableBasicAuth {
 		options.Logger.Warn().Msg("basic auth enabled, use only for testing or development")
 	}
 
+	h := basicAuth{
+		logger:         logger,
+		enabled:        options.EnableBasicAuth,
+		accountsClient: options.AccountsClient,
+	}
+
 	return func(next http.Handler) http.Handler {
-		return &basicAuth{
-			next:           next,
-			logger:         options.Logger,
-			enabled:        options.EnableBasicAuth,
-			accountsClient: options.AccountsClient,
-			oidcIss:        options.OIDCIss,
-		}
+		return http.HandlerFunc(
+			func(w http.ResponseWriter, req *http.Request) {
+				if h.isPublicLink(req) || !h.isBasicAuth(req) {
+					next.ServeHTTP(w, req)
+					return
+				}
+
+				account, ok := h.getAccount(req)
+
+				if !ok {
+					w.WriteHeader(http.StatusUnauthorized)
+					return
+				}
+
+				claims := &oidc.StandardClaims{
+					OcisID: account.Id,
+					Iss:    oidcIss,
+				}
+
+				next.ServeHTTP(w, req.WithContext(oidc.NewContext(req.Context(), claims)))
+			},
+		)
 	}
 }
 
 type basicAuth struct {
-	next           http.Handler
 	logger         log.Logger
 	enabled        bool
 	accountsClient accounts.AccountsService
-	oidcIss        string
-}
-
-func (m basicAuth) ServeHTTP(w http.ResponseWriter, req *http.Request) {
-	if m.isPublicLink(req) || !m.isBasicAuth(req) {
-		m.next.ServeHTTP(w, req)
-		return
-	}
-
-	login, password, _ := req.BasicAuth()
-
-	account, status := getAccount(m.logger, m.accountsClient, fmt.Sprintf("login eq '%s' and password eq '%s'", strings.ReplaceAll(login, "'", "''"), strings.ReplaceAll(password, "'", "''")))
-
-	if status != 0 {
-		w.WriteHeader(http.StatusUnauthorized)
-		return
-	}
-
-	claims := &oidc.StandardClaims{
-		OcisID: account.Id,
-		Iss:    m.oidcIss,
-	}
-
-	m.next.ServeHTTP(w, req.WithContext(oidc.NewContext(req.Context(), claims)))
 }
 
 func (m basicAuth) isPublicLink(req *http.Request) bool {
@@ -72,3 +70,19 @@ func (m basicAuth) isBasicAuth(req *http.Request) bool {
 
 	return m.enabled && ok && login != "" && password != ""
 }
+
+func (m basicAuth) getAccount(req *http.Request) (*accounts.Account, bool) {
+	login, password, _ := req.BasicAuth()
+
+	account, status := getAccount(
+		m.logger,
+		m.accountsClient,
+		fmt.Sprintf(
+			"login eq '%s' and password eq '%s'",
+			strings.ReplaceAll(login, "'", "''"),
+			strings.ReplaceAll(password, "'", "''"),
+		),
+	)
+
+	return account, status == 0
+}

proxy/pkg/middleware/oidc_auth.go

@@ -10,9 +10,9 @@ import (
 	"github.com/dgrijalva/jwt-go"
 
 	gOidc "github.com/coreos/go-oidc"
+	"github.com/owncloud/ocis/ocis-pkg/cache"
 	"github.com/owncloud/ocis/ocis-pkg/log"
 	"github.com/owncloud/ocis/ocis-pkg/oidc"
-	"github.com/owncloud/ocis/proxy/pkg/cache"
 	"golang.org/x/oauth2"
 )