Make client use our auth(n/z) scheme.
Our auth(n/z) scheme can be loosely defined as "encrypted tokens that nginx
transforms into headers" and "scopes for bypassing ACL". Our Go client, which is
what we'll be using to have services communicate with each other, follows this
paradigm now by auto-injecting the headers we'll need to identify ourselves.
This will work behind our firewall, but will be useless for the rest of the
world, which will need to go through the nginx bastion that can strip the
headers and replace them with the headers appropriate to the token attached to
the request.
This did involve setting a static client ID as the client for our
email_verification listener. Ideally, this would cause Client registration
(using that ID) when the listener starts up, ignoring ErrClientAlreadyExists. I
don't want to have to write the code that will allow us to bypass the Client ACL
properly right now, though, so we're just going to have to remember to manually
create that Client. Or not. I don't think it will do any harm (outside the OAuth
flow) to be using a Client ID that doesn't actually point to a Client. I just
think it'd be good for record-keeping purposes.
8 "bitbucket.org/ww/goautoneg"
12 RequestErrAccessDenied = "access_denied"
13 RequestErrInsufficient = "insufficient"
14 RequestErrOverflow = "overflow"
15 RequestErrInvalidValue = "invalid_value"
16 RequestErrInvalidFormat = "invalid_format"
17 RequestErrMissing = "missing"
18 RequestErrNotFound = "not_found"
19 RequestErrConflict = "conflict"
20 RequestErrActOfGod = "act_of_god"
24 actOfGodResponse = Response{Errors: []RequestError{RequestError{Slug: RequestErrActOfGod}}}
25 invalidFormatResponse = Response{Errors: []RequestError{RequestError{Slug: RequestErrInvalidFormat, Field: "/"}}}
27 encoders = []string{"application/json"}
30 type Response struct {
31 Errors []RequestError `json:"errors,omitempty"`
32 Logins []Login `json:"logins,omitempty"`
33 Profiles []Profile `json:"profiles,omitempty"`
34 Clients []Client `json:"clients,omitempty"`
35 Endpoints []Endpoint `json:"endpoints,omitempty"`
36 Sessions []Session `json:"sessions,omitempty"`
39 type RequestError struct {
40 Slug string `json:"error,omitempty"`
41 Field string `json:"field,omitempty"`
42 Param string `json:"param,omitempty"`
43 Header string `json:"header,omitempty"`
46 func negotiate(h http.Handler) http.Handler {
47 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
48 if r.Header.Get("Accept") != "" {
49 contentType := goautoneg.Negotiate(r.Header.Get("Accept"), encoders)
50 if contentType == "" {
51 w.WriteHeader(http.StatusNotAcceptable)
52 w.Write([]byte("Unsupported content type requested: " + r.Header.Get("Accept")))
60 func encode(w http.ResponseWriter, r *http.Request, status int, resp Response) {
61 contentType := goautoneg.Negotiate(r.Header.Get("Accept"), encoders)
62 w.Header().Set("content-type", contentType)
66 case "application/json":
67 enc := json.NewEncoder(w)
68 err = enc.Encode(resp)
70 enc := json.NewEncoder(w)
71 err = enc.Encode(resp)
78 func decode(r *http.Request, target interface{}) error {
80 switch r.Header.Get("Content-Type") {
81 case "application/json":
82 dec := json.NewDecoder(r.Body)
83 return dec.Decode(target)
85 dec := json.NewDecoder(r.Body)
86 return dec.Decode(target)
90 func wrap(context Context, f func(w http.ResponseWriter, r *http.Request, context Context)) http.Handler {
91 return negotiate(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
92 w.Header().Set("Access-Control-Allow-Origin", "*")
93 w.Header().Set("Access-Control-Allow-Headers", r.Header.Get("Access-Control-Request-Headers"))
94 w.Header().Set("Access-Control-Allow-Credentials", "true")
95 if r.Method == "OPTIONS" {
96 w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS")
97 w.Header().Set("Allow", "GET, POST, PUT, DELETE, PATCH, OPTIONS")
98 w.WriteHeader(http.StatusOK)