feat: template feature

Signed-off-by: Michael Barz <mbarz@owncloud.com>
2024-10-17 08:47:02 +02:00
parent 392a3de103
commit e40b7240bf
9 changed files with 417 additions and 11 deletions
@@ -26,10 +26,11 @@ const (

 // WopiContext wraps all the information we need for WOPI
 type WopiContext struct {
-	AccessToken   string
-	ViewOnlyToken string
-	FileReference *providerv1beta1.Reference
-	ViewMode      appproviderv1beta1.ViewMode
+	AccessToken       string
+	ViewOnlyToken     string
+	FileReference     *providerv1beta1.Reference
+	TemplateReference *providerv1beta1.Reference
+	ViewMode          appproviderv1beta1.ViewMode
 }

 // WopiContextAuthMiddleware will prepare an HTTP handler to be used as
@@ -120,10 +121,21 @@ func WopiContextAuthMiddleware(cfg *config.Config, next http.Handler) http.Handl

 		hashedRef := helpers.HashResourceId(claims.WopiContext.FileReference.GetResourceId())
 		fileID := parseWopiFileID(cfg, r.URL.Path)
-		if fileID != hashedRef {
-			wopiLogger.Error().Msg("file reference in the URL doesn't match the one inside the access token")
-			http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
-			return
+		if claims.WopiContext.TemplateReference != nil {
+			hashedTemplateRef := helpers.HashResourceId(claims.WopiContext.TemplateReference.GetResourceId())
+			// the fileID could be one of the references within the access token if both are set
+			// because we can use the access token to get the contents of the template file
+			if fileID != hashedTemplateRef && fileID != hashedRef {
+				wopiLogger.Error().Msg("file reference in the URL doesn't match the one inside the access token")
+				http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+				return
+			}
+		} else {
+			if fileID != hashedRef {
+				wopiLogger.Error().Msg("file reference in the URL doesn't match the one inside the access token")
+				http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+				return
+			}
 		}

 		next.ServeHTTP(w, r.WithContext(ctx))
@@ -165,6 +165,70 @@ var _ = Describe("Wopi Context Middleware", func() {
 		mw.ServeHTTP(resp, req)
 		Expect(resp.Code).To(Equal(http.StatusOK))
 	})
+	It("Should authorize successful with template reference", func() {
+		req := httptest.NewRequest("GET", src.String(), nil).WithContext(ctx)
+		token, err := tknMngr.MintToken(ctx, user, nil)
+		Expect(err).ToNot(HaveOccurred())
+
+		wopiContext := middleware.WopiContext{
+			AccessToken: token,
+			ViewMode:    appprovider.ViewMode_VIEW_MODE_READ_WRITE,
+			TemplateReference: &providerv1beta1.Reference{
+				ResourceId: rid,
+				Path:       ".",
+			},
+			FileReference: &providerv1beta1.Reference{
+				ResourceId: &providerv1beta1.ResourceId{
+					StorageId: "storageID",
+					OpaqueId:  "opaqueID2",
+					SpaceId:   "spaceID",
+				},
+			},
+		}
+		wopiToken, ttl, err := middleware.GenerateWopiToken(wopiContext, cfg)
+		q := req.URL.Query()
+		q.Add("access_token", wopiToken)
+		q.Add("access_token_ttl", strconv.FormatInt(ttl, 10))
+		req.URL.RawQuery = q.Encode()
+		resp := httptest.NewRecorder()
+
+		mw.ServeHTTP(resp, req)
+		Expect(resp.Code).To(Equal(http.StatusOK))
+	})
+	It("Should not authorize when no reference matches", func() {
+		req := httptest.NewRequest("GET", src.String(), nil).WithContext(ctx)
+		token, err := tknMngr.MintToken(ctx, user, nil)
+		Expect(err).ToNot(HaveOccurred())
+
+		wopiContext := middleware.WopiContext{
+			AccessToken: token,
+			ViewMode:    appprovider.ViewMode_VIEW_MODE_READ_WRITE,
+			TemplateReference: &providerv1beta1.Reference{
+				ResourceId: &providerv1beta1.ResourceId{
+					StorageId: "storageID",
+					OpaqueId:  "opaqueID3",
+					SpaceId:   "spaceID",
+				},
+				Path: ".",
+			},
+			FileReference: &providerv1beta1.Reference{
+				ResourceId: &providerv1beta1.ResourceId{
+					StorageId: "storageID",
+					OpaqueId:  "opaqueID2",
+					SpaceId:   "spaceID",
+				},
+			},
+		}
+		wopiToken, ttl, err := middleware.GenerateWopiToken(wopiContext, cfg)
+		q := req.URL.Query()
+		q.Add("access_token", wopiToken)
+		q.Add("access_token_ttl", strconv.FormatInt(ttl, 10))
+		req.URL.RawQuery = q.Encode()
+		resp := httptest.NewRecorder()
+
+		mw.ServeHTTP(resp, req)
+		Expect(resp.Code).To(Equal(http.StatusUnauthorized))
+	})
 	It("Should not authorize with proxy when fileID mismatches", func() {
 		cfg.Wopi.ProxySecret = "proxySecret"
 		cfg.Wopi.ProxyURL = "https://proxy"