HTTP middleware for admin auth and inter-service auth

atproto/auth/http.go

···
+package auth
+
+import (
+	"context"
+	"crypto/subtle"
+	"net/http"
+	"strings"
+
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+// HTTP Middleware for atproto admin auth, which is HTTP Basic auth with the username "admin".
+//
+// This supports multiple admin passwords, which makes it easier to rotate service secrets.
+//
+// This can be used with `echo.WrapMiddleware` (part of the echo web framework)
+func AdminAuthMiddleware(handler http.HandlerFunc, adminPasswords []string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		username, password, ok := r.BasicAuth()
+		if ok && username == "admin" {
+			for _, pw := range adminPasswords {
+				if subtle.ConstantTimeCompare([]byte(pw), []byte(password)) == 1 {
+					handler(w, r)
+					return
+				}
+			}
+		}
+		w.Header().Set("WWW-Authenticate", `Basic realm="admin", charset="UTF-8"`)
+		// TODO: XRPC error body?
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+	}
+}
+
+// HTTP Middleware for inter-service auth, which is HTTP Bearer with JWT.
+//
+// 'mandatory' indicates whether valid inter-service auth must be present, or just optional.
+func (v *ServiceAuthValidator) Middleware(handler http.HandlerFunc, mandatory bool) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+
+		if hdr := r.Header.Get("Authorization"); hdr != "" {
+			parts := strings.Split(hdr, " ")
+			if parts[0] != "Bearer" || len(parts) != 2 {
+				// TODO: XRPC error body?
+				w.Header().Set("WWW-Authenticate", "Bearer")
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				return
+			}
+
+			var lxm *syntax.NSID
+			uparts := strings.Split(r.URL.Path, "/")
+			// TODO: should this "fail closed"? eg, reject if not a valid XRPC endpoint
+			if len(uparts) >= 3 && uparts[1] == "xrpc" {
+				nsid, err := syntax.ParseNSID(uparts[2])
+				if nil == err {
+					lxm = &nsid
+				}
+			}
+
+			did, err := v.Validate(r.Context(), parts[1], lxm)
+			if err != nil {
+				w.Header().Set("WWW-Authenticate", "Bearer")
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				// TODO: XRPC error body?
+				return
+			}
+			ctx := context.WithValue(r.Context(), "did", did)
+			handler(w, r.WithContext(ctx))
+			return
+		}
+
+		if mandatory {
+			// TODO: XRPC error body?
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+		handler(w, r)
+	}
+}

atproto/auth/http_test.go

···
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/identity"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func webHome(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	w.WriteHeader(http.StatusOK)
+	did, ok := ctx.Value("did").(syntax.DID)
+	if ok {
+		w.Write([]byte(did.String()))
+	} else {
+		w.Write([]byte("hello world"))
+	}
+}
+
+func TestAdminAuthMiddleware(t *testing.T) {
+	assert := assert.New(t)
+
+	pw1 := "secret123"
+	pw2 := "secret789"
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	middle := AdminAuthMiddleware(webHome, []string{pw1, pw2})
+
+	{
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("admin", pw1)
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("admin", pw2)
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("wrong", pw2)
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		resp := httptest.NewRecorder()
+		req.SetBasicAuth("admin", "wrong")
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+}
+
+func TestServiceAuthMiddleware(t *testing.T) {
+	assert := assert.New(t)
+
+	iss := syntax.DID("did:example:iss")
+	aud := "did:example:aud#svc"
+	lxm := syntax.NSID("com.example.api")
+
+	priv, err := crypto.GeneratePrivateKeyP256()
+	if err != nil {
+		t.Fatal(err)
+	}
+	pub, err := priv.PublicKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	dir := identity.NewMockDirectory()
+	dir.Insert(identity.Identity{
+		DID: iss,
+		Keys: map[string]identity.Key{
+			"atproto": identity.Key{
+				Type:               "Multikey",
+				PublicKeyMultibase: pub.Multibase(),
+			},
+		},
+	})
+
+	v := ServiceAuthValidator{
+		Audience: aud,
+		Dir:      &dir,
+	}
+
+	{
+		// optional middleware, no auth
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		middle := v.Middleware(webHome, false)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+		assert.Equal("hello world", string(resp.Body.Bytes()))
+	}
+
+	{
+		// mandatory middleware, no auth
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		middle := v.Middleware(webHome, true)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		// mandatory middleware, valid auth
+		tok, err := SignServiceAuth(iss, aud, time.Minute, &lxm, priv)
+		if err != nil {
+			t.Fatal(err)
+		}
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		req.Header.Set("Authorization", "Bearer "+tok)
+		middle := v.Middleware(webHome, true)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusOK, resp.Code)
+		assert.Equal(iss.String(), string(resp.Body.Bytes()))
+	}
+
+	{
+		// mangled header
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.api", nil)
+		req.Header.Set("Authorization", "Bearer dummy")
+		middle := v.Middleware(webHome, false)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+
+	{
+		// wrong path
+		tok, err := SignServiceAuth(iss, aud, time.Minute, &lxm, priv)
+		if err != nil {
+			t.Fatal(err)
+		}
+		req := httptest.NewRequest(http.MethodGet, "/xrpc/com.example.other.api", nil)
+		req.Header.Set("Authorization", "Bearer "+tok)
+		middle := v.Middleware(webHome, true)
+		resp := httptest.NewRecorder()
+		middle(resp, req)
+		assert.Equal(http.StatusUnauthorized, resp.Code)
+	}
+}