snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/auth/handlers/routes.go

@@ -0,0 +1,148 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/cortezaproject/corteza/server/pkg/actionlog"
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/locale"
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/httprate"
+	"github.com/gorilla/csrf"
+)
+
+func (h *AuthHandlers) MountHttpRoutes(r chi.Router) {
+	var (
+		l = GetLinks()
+	)
+
+	if h.Opt.DevelopmentMode {
+		r.Get("/auth/dev", h.handle(h.devView))
+		r.Get("/auth/dev/scenarios", h.devSceneView)
+	}
+
+	r.Handle("/auth/", http.RedirectHandler("/auth", http.StatusSeeOther))
+	r.Group(func(r chi.Router) {
+		r.Use(locale.DetectLanguage(locale.Global()))
+
+		r.Use(func(next http.Handler) http.Handler {
+			return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				ctx := actionlog.RequestOriginToContext(r.Context(), actionlog.RequestOrigin_Auth)
+				next.ServeHTTP(w, r.WithContext(ctx))
+			})
+		})
+
+		if h.Opt.RequestRateLimit > 0 {
+			r.Use(httprate.LimitByIP(h.Opt.RequestRateLimit, h.Opt.RequestRateWindowLength))
+		}
+
+		r.Use(auth.ExtraReqInfoMiddleware)
+
+		r.Group(func(r chi.Router) {
+			// all routes protected with CSRF:
+			if h.Opt.CsrfEnabled {
+				r.Use(csrf.Protect(
+					[]byte(h.Opt.CsrfSecret),
+					csrf.SameSite(csrf.SameSiteStrictMode),
+					csrf.Secure(h.Opt.SessionCookieSecure),
+					csrf.FieldName(h.Opt.CsrfFieldName),
+					csrf.CookieName(h.Opt.CsrfCookieName),
+				))
+			}
+
+			r.Get(tbp(l.Profile), h.handle(authOnly(h.profileForm)))
+			r.Post(tbp(l.Profile), h.handle(authOnly(h.profileProc)))
+
+			r.HandleFunc(tbp(l.Logout), h.handle(h.logoutProc))
+
+			r.Get(tbp(l.Sessions), h.handle(authOnly(h.sessionsView)))
+			r.Post(tbp(l.Sessions), h.handle(authOnly(h.sessionsProc)))
+
+			r.Get(tbp(l.AuthorizedClients), h.handle(authOnly(h.clientsView)))
+			r.Post(tbp(l.AuthorizedClients), h.handle(authOnly(h.clientsProc)))
+
+			r.Get(tbp(l.Signup), h.handle(h.onlyIfSignupEnabled(anonyOnly(h.signupForm))))
+			r.Post(tbp(l.Signup), h.handle(h.onlyIfSignupEnabled(anonyOnly(h.signupProc))))
+			r.Get(tbp(l.PendingEmailConfirmation), h.handle(h.pendingEmailConfirmation))
+			r.Get(tbp(l.ConfirmEmail), h.handle(h.confirmEmail))
+
+			r.Get(tbp(l.Login), h.handle(anonyOnly(h.loginForm)))
+			r.Post(tbp(l.Login), h.handle(h.onlyIfLocalEnabled(anonyOnly(h.loginProc))))
+
+			r.Get(tbp(l.Mfa), h.handle(h.mfaForm))
+			r.Post(tbp(l.Mfa), h.handle(h.mfaProc))
+
+			r.Get(tbp(l.RequestPasswordReset), h.handle(h.onlyIfPasswordResetEnabled(anonyOnly(h.requestPasswordResetForm))))
+			r.Post(tbp(l.RequestPasswordReset), h.handle(h.onlyIfPasswordResetEnabled(anonyOnly(h.requestPasswordResetProc))))
+			r.Get(tbp(l.PasswordResetRequested), h.handle(h.onlyIfPasswordResetEnabled(anonyOnly(h.passwordResetRequested))))
+			r.Get(tbp(l.ResetPassword), h.handle(h.onlyIfPasswordResetEnabled(h.resetPasswordForm)))
+			r.Post(tbp(l.ResetPassword), h.handle(h.onlyIfPasswordResetEnabled(authOnly(h.resetPasswordProc))))
+			r.Get(tbp(l.AcceptInvite), h.handle(h.acceptInviteForm))
+			r.Post(tbp(l.AcceptInvite), h.handle(h.acceptInviteProc))
+
+			r.Get(tbp(l.Security), h.handle(authOnly(h.securityForm)))
+			r.Post(tbp(l.Security), h.handle(authOnly(h.securityProc)))
+			r.Get(tbp(l.ChangePassword), h.handle(h.onlyIfLocalEnabled(authOnly(h.changePasswordForm))))
+			r.Post(tbp(l.ChangePassword), h.handle(h.onlyIfLocalEnabled(authOnly(h.changePasswordProc))))
+			r.Get(tbp(l.CreatePassword), h.handle(h.onlyIfPasswordCreateEnabled(h.createPasswordForm)))
+			r.Post(tbp(l.CreatePassword), h.handle(h.onlyIfPasswordCreateEnabled(h.createPasswordProc)))
+
+			r.Get(tbp(l.MfaTotpNewSecret), h.handle(partAuthOnly(h.mfaTotpConfigForm)))
+			r.Post(tbp(l.MfaTotpNewSecret), h.handle(partAuthOnly(h.mfaTotpConfigProc)))
+			r.Get(tbp(l.MfaTotpQRImage), h.handle(partAuthOnly(h.mfaTotpConfigQR)))
+			r.Get(tbp(l.MfaTotpDisable), h.handle(authOnly(h.mfaTotpDisableForm)))
+			r.Post(tbp(l.MfaTotpDisable), h.handle(authOnly(h.mfaTotpDisableProc)))
+
+		})
+
+		r.Group(func(r chi.Router) {
+			// OAuth2 routes
+			r.HandleFunc(tbp(l.OAuth2Authorize), h.handle(h.oauth2Authorize))
+			r.Get(tbp(l.OAuth2AuthorizeClient), h.handle(authOnly(h.oauth2AuthorizeClient)))
+			r.Post(tbp(l.OAuth2AuthorizeClient), h.handle(authOnly(h.oauth2AuthorizeClientProc)))
+			r.Get(tbp(l.OAuth2DefaultClient), h.handle(h.oauth2authorizeDefaultClient))
+			r.Post(tbp(l.OAuth2DefaultClient), h.handle(h.oauth2authorizeDefaultClientProc))
+		})
+
+		// userinfo is authorized with an access token, not with a session; CSRF does not apply
+		r.Get(tbp(l.OAuth2UserInfo), h.oauth2Userinfo)
+		r.Post(tbp(l.OAuth2UserInfo), h.oauth2Userinfo)
+
+		// Wrapping SAML structs so we assure that fresh ones are always used in case
+		// of settings changes.
+		//
+		// @todo refactor this with a wrapping struct to handle serve HTTPS and pass
+		// calls to internal SAML service.
+		r.Group(func(r chi.Router) {
+			r.HandleFunc(tbp(l.SamlMetadata), func(rw http.ResponseWriter, r *http.Request) {
+				if h.SamlSPService == nil || !h.SamlSPService.Enabled {
+					rw.WriteHeader(http.StatusServiceUnavailable)
+					return
+				}
+
+				h.SamlSPService.ServeHTTP(rw, r)
+			})
+			r.HandleFunc(tbp(l.SamlCallback), func(rw http.ResponseWriter, r *http.Request) {
+				if h.SamlSPService == nil || !h.SamlSPService.Enabled {
+					rw.WriteHeader(http.StatusServiceUnavailable)
+					return
+				}
+
+				h.SamlSPService.ServeHTTP(rw, r)
+			})
+			r.HandleFunc(tbp(l.SamlInit), func(rw http.ResponseWriter, r *http.Request) {
+				h.samlInit(rw, r)
+			})
+		})
+
+		r.Route(tbp(l.External)+"/{provider}", func(r chi.Router) {
+			// External provider
+			r.Get("/", h.externalInit)
+			r.Get("/callback", h.externalCallback)
+		})
+
+		r.HandleFunc("/auth/oauth2/token", h.handle(h.oauth2Token))
+		r.HandleFunc("/auth/oauth2/info", h.oauth2Info)
+		r.HandleFunc("/auth/oauth2/public-keys", h.oauth2PublicKeys)
+	})
+}