8 |
42 | {{end}}
43 |
--------------------------------------------------------------------------------
/web/templates/admin/list-client-applications.gohtml:
--------------------------------------------------------------------------------
1 | {{- /*gotype: github.com/inklabs/goauth2/web.listClientApplicationsTemplateVars*/ -}}
2 |
3 | {{template "base" .}}
4 | {{define "pageTitle"}}Client Applications{{end}}
5 |
6 | {{define "content"}}
7 |
9 |
41 |
10 |
12 |
13 | Add User
11 |
14 |
39 |
40 |
8 |
34 | {{end}}
35 |
--------------------------------------------------------------------------------
/web/templates/admin/list-users.gohtml:
--------------------------------------------------------------------------------
1 | {{- /*gotype: github.com/inklabs/goauth2/web.listUsersTemplateVars*/ -}}
2 |
3 | {{template "base" .}}
4 | {{define "pageTitle"}}Users{{end}}
5 |
6 | {{define "content"}}
7 |
9 |
33 |
10 |
12 |
13 |
29 |
32 | Client Applications
11 || Client ID | 15 |Client Secret | 16 |Creation Date | 17 |
|---|---|---|
| {{.ClientID}} | 23 |{{.ClientSecret}} | 24 |{{formatDate .CreateTimestamp "Jan 02, 2006 15:04:05 UTC"}} | 25 |
-
30 |
8 |
42 | {{end}}
43 |
--------------------------------------------------------------------------------
/web/templates/admin/login.gohtml:
--------------------------------------------------------------------------------
1 | {{template "base" .}}
2 | {{define "pageTitle"}}Admin Login{{end}}
3 |
4 | {{define "content"}}
5 |
9 |
41 |
10 |
12 | Users
11 |
13 | Add
14 |
15 |
16 |
17 |
18 |
39 |
40 | | User ID | 20 |Username | 21 |Creation Date | 22 |Roles | 23 |
|---|---|---|---|
| {{.UserID}} | 29 |{{.Username}} | 30 |{{formatDate .CreateTimestamp "Jan 02, 2006 15:04:05 UTC"}} | 31 |32 | {{if .IsAdmin}}{{end}} 33 | {{if .CanOnboardAdminApplications}}{{end}} 34 | | 35 |
6 |
38 | {{end}}
39 |
--------------------------------------------------------------------------------
/web/templates/layout/base.gohtml:
--------------------------------------------------------------------------------
1 | {{define "base"}}
2 |
3 |
4 |
5 |
6 |
7 |
7 |
37 |
8 |
10 | Admin Login
9 |
11 |
35 |
36 |
17 |
32 |
33 | {{block "flash" .}}
34 | {{ if index .Errors }}
35 |
18 |
25 |
31 |
19 |
20 | 
21 | GoAuth2
22 |
23 |
24 |
21 | GoAuth2
22 |
23 |
36 | {{ range index .Errors }}
37 |
40 | {{ end }}
41 | {{ if index .Messages }}
42 | {{ . }}
38 | {{ end }} 39 |
43 | {{ range index .Messages }}
44 |
47 | {{ end }}
48 | {{end}}
49 |
50 | {{ . }}
45 | {{ end }} 46 |
51 | {{block "content" .}}{{end}}
52 |
53 |
54 |
64 |
65 | {{block "extraEndBody" .}}{{end}}
66 |
67 |
68 |
69 | {{end}}
70 |
--------------------------------------------------------------------------------
/web/templates/login.gohtml:
--------------------------------------------------------------------------------
1 | {{template "base" .}}
2 | {{define "pageTitle"}}Login{{end}}
3 |
4 | {{define "content"}}
5 |
6 |
43 | {{end}}
44 |
--------------------------------------------------------------------------------
/web/web_app.go:
--------------------------------------------------------------------------------
1 | package web
2 |
3 | import (
4 | "embed"
5 | "encoding/gob"
6 | "encoding/json"
7 | "fmt"
8 | "html/template"
9 | "io/fs"
10 | "log"
11 | "net/http"
12 | "net/url"
13 | "path"
14 | "strconv"
15 | "time"
16 |
17 | "github.com/gorilla/mux"
18 | "github.com/gorilla/sessions"
19 | "github.com/inklabs/rangedb/pkg/shortuuid"
20 |
21 | "github.com/inklabs/goauth2"
22 | "github.com/inklabs/goauth2/projection"
23 | )
24 |
25 | const (
26 | accessTokenTODO = "f5bb89d486ee458085e476871b177ff4"
27 | ClientIDTODO = "8895e1e5f06644ebb41c26ea5740b246"
28 | ClientSecretTODO = "c1e847aef925467290b4302e64f3de4e"
29 | expiresAtTODO = 1574371565
30 | )
31 |
32 | //go:embed static
33 | var staticAssets embed.FS
34 |
35 | //go:embed templates
36 | var templates embed.FS
37 |
38 | const defaultHost = "0.0.0.0:8080"
39 |
40 | // SessionKeyPair holds the keys for a secure cookie session.
41 | type SessionKeyPair struct {
42 | AuthenticationKey []byte
43 | EncryptionKey []byte
44 | }
45 |
46 | type webApp struct {
47 | router http.Handler
48 | templateFS fs.FS
49 | goAuth2App *goauth2.App
50 | uuidGenerator shortuuid.Generator
51 | sessionStore sessions.Store
52 | sessionKeyPairs []SessionKeyPair
53 | csrfAuthKey []byte
54 | host string
55 | projections struct {
56 | emailToUserID *projection.EmailToUserID
57 | clientApplications *projection.ClientApplications
58 | users *projection.Users
59 | }
60 | }
61 |
62 | // Option defines functional option parameters for webApp.
63 | type Option func(*webApp)
64 |
65 | // WithTemplateFS is a functional option to inject a fs.FS
66 | func WithTemplateFS(f fs.FS) Option {
67 | return func(webApp *webApp) {
68 | webApp.templateFS = f
69 | }
70 | }
71 |
72 | // WithGoAuth2App is a functional option to inject a goauth2.App.
73 | func WithGoAuth2App(goAuth2App *goauth2.App) Option {
74 | return func(app *webApp) {
75 | app.goAuth2App = goAuth2App
76 | }
77 | }
78 |
79 | // WithHost is a functional option to inject a tcp4 host.
80 | func WithHost(host string) Option {
81 | return func(app *webApp) {
82 | app.host = host
83 | }
84 | }
85 |
86 | // WithUUIDGenerator is a functional option to inject a shortuuid.Generator.
87 | func WithUUIDGenerator(generator shortuuid.Generator) Option {
88 | return func(app *webApp) {
89 | app.uuidGenerator = generator
90 | }
91 | }
92 |
93 | // WithCSRFAuthKey is a functional option to inject a CSRF authentication key
94 | func WithCSRFAuthKey(csrfAuthKey []byte) Option {
95 | return func(app *webApp) {
96 | app.csrfAuthKey = csrfAuthKey
97 | }
98 | }
99 |
100 | // WithSessionKeyPair is a functional option to inject a session key pair.
101 | // Useful for rotating session authentication and encryption keys. Old sessions can still
102 | // be read because the first pair will fail, and the second will be tested.
103 | func WithSessionKeyPair(sessionKeyPairs ...SessionKeyPair) Option {
104 | return func(app *webApp) {
105 | app.sessionKeyPairs = sessionKeyPairs
106 | }
107 | }
108 |
109 | // New constructs an webApp.
110 | func New(options ...Option) (*webApp, error) {
111 | goAuth2App, err := goauth2.New()
112 | if err != nil {
113 | return nil, err
114 | }
115 |
116 | app := &webApp{
117 | templateFS: templates,
118 | goAuth2App: goAuth2App,
119 | uuidGenerator: shortuuid.NewUUIDGenerator(),
120 | host: defaultHost,
121 | }
122 |
123 | for _, option := range options {
124 | option(app)
125 | }
126 |
127 | err = app.validateCSRFAuthKey()
128 | if err != nil {
129 | return nil, err
130 | }
131 |
132 | err = app.initSessionStore()
133 | if err != nil {
134 | return nil, err
135 | }
136 |
137 | app.initRoutes()
138 | err = app.initProjections()
139 | if err != nil {
140 | return nil, err
141 | }
142 |
143 | return app, nil
144 | }
145 |
146 | func (a *webApp) validateCSRFAuthKey() error {
147 | if a.csrfAuthKey == nil {
148 | return fmt.Errorf("missing CSRF authentication key")
149 | }
150 |
151 | if len(a.csrfAuthKey) != 32 {
152 | return fmt.Errorf("invalid CSRF authentication key length")
153 | }
154 |
155 | return nil
156 | }
157 |
158 | func (a *webApp) initSessionStore() error {
159 | var keyPairs [][]byte
160 |
161 | for _, sessionKeyPair := range a.sessionKeyPairs {
162 | if len(sessionKeyPair.AuthenticationKey) != 64 {
163 | return fmt.Errorf("invalid session authentication key length")
164 | }
165 |
166 | if len(sessionKeyPair.EncryptionKey) != 32 {
167 | return fmt.Errorf("invalid session encryption key length")
168 | }
169 |
170 | keyPairs = append(keyPairs,
171 | sessionKeyPair.AuthenticationKey,
172 | sessionKeyPair.EncryptionKey,
173 | )
174 | }
175 |
176 | gob.Register(AuthenticatedUser{})
177 | a.sessionStore = sessions.NewCookieStore(keyPairs...)
178 | return nil
179 | }
180 |
181 | func (a *webApp) initRoutes() {
182 | r := mux.NewRouter().StrictSlash(true)
183 | r.HandleFunc("/authorize", a.authorize)
184 | r.HandleFunc("/login", a.login)
185 | r.HandleFunc("/token", a.token)
186 | r.PathPrefix("/static/").Handler(cache30Days(http.FileServer(http.FS(staticAssets))))
187 |
188 | a.addAdminRoutes(r)
189 |
190 | a.router = r
191 | }
192 |
193 | func (a *webApp) initProjections() error {
194 | a.projections.emailToUserID = projection.NewEmailToUserID()
195 | a.projections.clientApplications = projection.NewClientApplications()
196 | a.projections.users = projection.NewUsers()
197 |
198 | return a.goAuth2App.SubscribeAndReplay(
199 | a.projections.emailToUserID,
200 | a.projections.clientApplications,
201 | a.projections.users,
202 | )
203 | }
204 |
205 | func (a *webApp) ServeHTTP(w http.ResponseWriter, r *http.Request) {
206 | a.router.ServeHTTP(w, r)
207 | }
208 |
209 | func (a *webApp) login(w http.ResponseWriter, r *http.Request) {
210 | params := r.URL.Query()
211 | clientID := params.Get("client_id")
212 | redirectURI := params.Get("redirect_uri")
213 | responseType := params.Get("response_type")
214 | state := params.Get("state")
215 | scope := params.Get("scope")
216 |
217 | a.renderTemplate(w, "login.gohtml", struct {
218 | flashMessageVars
219 | ClientID string
220 | RedirectURI string
221 | ResponseType string
222 | Scope string
223 | State string
224 | }{
225 | ClientID: clientID,
226 | RedirectURI: redirectURI,
227 | ResponseType: responseType,
228 | Scope: scope,
229 | State: state,
230 | flashMessageVars: a.getFlashMessageVars(w, r),
231 | })
232 | }
233 |
234 | func (a *webApp) authorize(w http.ResponseWriter, r *http.Request) {
235 | err := r.ParseForm()
236 | if err != nil {
237 | writeInvalidRequestResponse(w)
238 | return
239 | }
240 |
241 | redirectURI := r.Form.Get("redirect_uri")
242 | responseType := r.Form.Get("response_type")
243 | state := r.Form.Get("state")
244 |
245 | switch responseType {
246 | case "code":
247 | a.handleAuthorizationCodeGrant(w, r)
248 |
249 | case "token":
250 | a.handleImplicitGrant(w, r)
251 |
252 | default:
253 | errorRedirect(w, r, redirectURI, "unsupported_response_type", state)
254 |
255 | }
256 | }
257 |
258 | func (a *webApp) handleAuthorizationCodeGrant(w http.ResponseWriter, r *http.Request) {
259 | username := r.Form.Get("username")
260 | password := r.Form.Get("password")
261 | clientID := r.Form.Get("client_id")
262 | redirectURI := r.Form.Get("redirect_uri")
263 | state := r.Form.Get("state")
264 | scope := r.Form.Get("scope")
265 |
266 | userID, err := a.projections.emailToUserID.GetUserID(username)
267 | if err != nil {
268 | errorRedirect(w, r, redirectURI, "access_denied", state)
269 | return
270 | }
271 |
272 | // TODO: Change signature for Dispatch from []rangedb.Event to SavedEvents
273 | events := SavedEvents(a.goAuth2App.Dispatch(goauth2.RequestAuthorizationCodeViaAuthorizationCodeGrant{
274 | UserID: userID,
275 | ClientID: clientID,
276 | RedirectURI: redirectURI,
277 | Username: username,
278 | Password: password,
279 | Scope: scope,
280 | }))
281 | var issuedEvent goauth2.AuthorizationCodeWasIssuedToUserViaAuthorizationCodeGrant
282 | if !events.Get(&issuedEvent) {
283 | if events.ContainsAny(
284 | &goauth2.RequestAuthorizationCodeViaAuthorizationCodeGrantWasRejectedDueToInvalidClientApplicationID{},
285 | &goauth2.RequestAuthorizationCodeViaAuthorizationCodeGrantWasRejectedDueToInvalidClientApplicationRedirectURI{},
286 | ) {
287 | writeInvalidRequestResponse(w)
288 | return
289 | }
290 |
291 | errorRedirect(w, r, redirectURI, "access_denied", state)
292 | return
293 | }
294 |
295 | newParams := url.Values{}
296 | if state != "" {
297 | newParams.Set("state", state)
298 | }
299 |
300 | newParams.Set("code", issuedEvent.AuthorizationCode)
301 |
302 | uri := fmt.Sprintf("%s?%s", redirectURI, newParams.Encode())
303 | http.Redirect(w, r, uri, http.StatusFound)
304 | }
305 |
306 | func (a *webApp) handleImplicitGrant(w http.ResponseWriter, r *http.Request) {
307 | username := r.Form.Get("username")
308 | password := r.Form.Get("password")
309 | clientID := r.Form.Get("client_id")
310 | redirectURI := r.Form.Get("redirect_uri")
311 | state := r.Form.Get("state")
312 | scope := r.Form.Get("scope")
313 |
314 | userID, err := a.projections.emailToUserID.GetUserID(username)
315 | if err != nil {
316 | errorRedirect(w, r, redirectURI, "access_denied", state)
317 | return
318 | }
319 |
320 | events := SavedEvents(a.goAuth2App.Dispatch(goauth2.RequestAccessTokenViaImplicitGrant{
321 | UserID: userID,
322 | ClientID: clientID,
323 | RedirectURI: redirectURI,
324 | Username: username,
325 | Password: password,
326 | }))
327 | var issuedEvent goauth2.AccessTokenWasIssuedToUserViaImplicitGrant
328 | if !events.Get(&issuedEvent) {
329 | if events.ContainsAny(
330 | &goauth2.RequestAccessTokenViaImplicitGrantWasRejectedDueToInvalidClientApplicationID{},
331 | &goauth2.RequestAccessTokenViaImplicitGrantWasRejectedDueToInvalidClientApplicationRedirectURI{},
332 | ) {
333 | writeInvalidRequestResponse(w)
334 | return
335 | }
336 |
337 | errorRedirect(w, r, redirectURI, "access_denied", state)
338 | return
339 | }
340 |
341 | newParams := url.Values{}
342 | if state != "" {
343 | newParams.Set("state", state)
344 | }
345 |
346 | newParams.Set("access_token", accessTokenTODO)
347 | newParams.Set("expires_at", strconv.Itoa(expiresAtTODO))
348 | newParams.Set("scope", scope)
349 | newParams.Set("token_type", "Bearer")
350 |
351 | uri := fmt.Sprintf("%s#%s", redirectURI, newParams.Encode())
352 | http.Redirect(w, r, uri, http.StatusFound)
353 | }
354 |
355 | // AccessTokenResponse holds the JSON response for an access token.
356 | type AccessTokenResponse struct {
357 | AccessToken string `json:"access_token"`
358 | ExpiresAt int64 `json:"expires_at"`
359 | TokenType string `json:"token_type"`
360 | RefreshToken string `json:"refresh_token,omitempty"`
361 | Scope string `json:"scope,omitempty"`
362 | }
363 |
364 | func (a *webApp) token(w http.ResponseWriter, r *http.Request) {
365 | clientID, clientSecret, ok := r.BasicAuth()
366 | if !ok {
367 | writeInvalidClientResponse(w)
368 | return
369 | }
370 |
371 | err := r.ParseForm()
372 | if err != nil {
373 | writeInvalidRequestResponse(w)
374 | return
375 | }
376 |
377 | grantType := r.Form.Get("grant_type")
378 | scope := r.Form.Get("scope")
379 |
380 | switch grantType {
381 | case "client_credentials":
382 | a.handleClientCredentialsGrant(w, clientID, clientSecret, scope)
383 |
384 | case "password":
385 | a.handleROPCGrant(w, r, clientID, clientSecret, scope)
386 |
387 | case "refresh_token":
388 | a.handleRefreshTokenGrant(w, r, clientID, clientSecret, scope)
389 |
390 | case "authorization_code":
391 | a.handleAuthorizationCodeTokenGrant(w, r, clientID, clientSecret)
392 |
393 | default:
394 | writeUnsupportedGrantTypeResponse(w)
395 | }
396 | }
397 |
398 | func (a *webApp) handleRefreshTokenGrant(w http.ResponseWriter, r *http.Request, clientID, clientSecret, scope string) {
399 | refreshToken := r.Form.Get("refresh_token")
400 |
401 | events := SavedEvents(a.goAuth2App.Dispatch(goauth2.RequestAccessTokenViaRefreshTokenGrant{
402 | RefreshToken: refreshToken,
403 | ClientID: clientID,
404 | ClientSecret: clientSecret,
405 | Scope: scope,
406 | }))
407 |
408 | var accessTokenEvent goauth2.AccessTokenWasIssuedToUserViaRefreshTokenGrant
409 | if !events.Get(&accessTokenEvent) {
410 | writeInvalidGrantResponse(w)
411 | return
412 | }
413 |
414 | var nextRefreshToken string
415 | var refreshTokenEvent goauth2.RefreshTokenWasIssuedToUserViaRefreshTokenGrant
416 | if events.Get(&refreshTokenEvent) {
417 | nextRefreshToken = refreshTokenEvent.NextRefreshToken
418 | }
419 |
420 | writeJSONResponse(w, AccessTokenResponse{
421 | AccessToken: "61272356284f4340b2b1f3f1400ad4d9",
422 | ExpiresAt: accessTokenEvent.ExpiresAt,
423 | TokenType: "Bearer",
424 | RefreshToken: nextRefreshToken,
425 | Scope: accessTokenEvent.Scope,
426 | })
427 | return
428 | }
429 |
430 | func (a *webApp) handleROPCGrant(w http.ResponseWriter, r *http.Request, clientID, clientSecret, scope string) {
431 | username := r.Form.Get("username")
432 | password := r.Form.Get("password")
433 | userID, err := a.projections.emailToUserID.GetUserID(username)
434 | if err != nil {
435 | writeInvalidGrantResponse(w)
436 | return
437 | }
438 |
439 | events := SavedEvents(a.goAuth2App.Dispatch(goauth2.RequestAccessTokenViaROPCGrant{
440 | UserID: userID,
441 | ClientID: clientID,
442 | ClientSecret: clientSecret,
443 | Username: username,
444 | Password: password,
445 | Scope: scope,
446 | }))
447 | var accessTokenEvent goauth2.AccessTokenWasIssuedToUserViaROPCGrant
448 | if !events.Get(&accessTokenEvent) {
449 | if events.Contains(&goauth2.RequestAccessTokenViaROPCGrantWasRejectedDueToInvalidClientApplicationCredentials{}) {
450 | writeInvalidClientResponse(w)
451 | return
452 | }
453 |
454 | writeInvalidGrantResponse(w)
455 | return
456 | }
457 |
458 | var refreshToken string
459 | var refreshTokenEvent goauth2.RefreshTokenWasIssuedToUserViaROPCGrant
460 | if events.Get(&refreshTokenEvent) {
461 | refreshToken = refreshTokenEvent.RefreshToken
462 | }
463 |
464 | writeJSONResponse(w, AccessTokenResponse{
465 | AccessToken: accessTokenTODO,
466 | ExpiresAt: accessTokenEvent.ExpiresAt,
467 | TokenType: "Bearer",
468 | RefreshToken: refreshToken,
469 | Scope: accessTokenEvent.Scope,
470 | })
471 | return
472 | }
473 |
474 | func (a *webApp) handleClientCredentialsGrant(w http.ResponseWriter, clientID, clientSecret, scope string) {
475 | events := SavedEvents(a.goAuth2App.Dispatch(goauth2.RequestAccessTokenViaClientCredentialsGrant{
476 | ClientID: clientID,
477 | ClientSecret: clientSecret,
478 | Scope: scope,
479 | }))
480 | var accessTokenIssuedEvent goauth2.AccessTokenWasIssuedToClientApplicationViaClientCredentialsGrant
481 | if !events.Get(&accessTokenIssuedEvent) {
482 | writeInvalidClientResponse(w)
483 | return
484 | }
485 |
486 | writeJSONResponse(w, AccessTokenResponse{
487 | AccessToken: accessTokenTODO,
488 | ExpiresAt: accessTokenIssuedEvent.ExpiresAt,
489 | TokenType: "Bearer",
490 | Scope: accessTokenIssuedEvent.Scope,
491 | })
492 | return
493 | }
494 |
495 | func (a *webApp) handleAuthorizationCodeTokenGrant(w http.ResponseWriter, r *http.Request, clientID, clientSecret string) {
496 | authorizationCode := r.Form.Get("code")
497 | redirectURI := r.Form.Get("redirect_uri")
498 |
499 | events := SavedEvents(a.goAuth2App.Dispatch(goauth2.RequestAccessTokenViaAuthorizationCodeGrant{
500 | AuthorizationCode: authorizationCode,
501 | ClientID: clientID,
502 | ClientSecret: clientSecret,
503 | RedirectURI: redirectURI,
504 | }))
505 |
506 | var accessTokenIssuedEvent goauth2.AccessTokenWasIssuedToUserViaAuthorizationCodeGrant
507 | if !events.Get(&accessTokenIssuedEvent) {
508 | if events.ContainsAny(
509 | &goauth2.RequestAccessTokenViaAuthorizationCodeGrantWasRejectedDueToInvalidClientApplicationID{},
510 | &goauth2.RequestAccessTokenViaAuthorizationCodeGrantWasRejectedDueToInvalidClientApplicationSecret{},
511 | ) {
512 | writeInvalidClientResponse(w)
513 | return
514 | }
515 |
516 | writeInvalidGrantResponse(w)
517 | return
518 | }
519 |
520 | var refreshToken string
521 | var refreshTokenIssuedEvent goauth2.RefreshTokenWasIssuedToUserViaAuthorizationCodeGrant
522 | if events.Get(&refreshTokenIssuedEvent) {
523 | refreshToken = refreshTokenIssuedEvent.RefreshToken
524 | }
525 |
526 | writeJSONResponse(w, AccessTokenResponse{
527 | AccessToken: accessTokenTODO,
528 | ExpiresAt: accessTokenIssuedEvent.ExpiresAt,
529 | TokenType: "Bearer",
530 | Scope: accessTokenIssuedEvent.Scope,
531 | RefreshToken: refreshToken,
532 | })
533 | return
534 | }
535 |
536 | func (a *webApp) renderTemplate(w http.ResponseWriter, templateName string, data interface{}) {
537 | baseTemplateName := path.Base(templateName)
538 | tmpl, err := template.New(baseTemplateName).Funcs(funcMap).ParseFS(a.templateFS, "templates/layout/*.gohtml", "templates/"+templateName)
539 | if err != nil {
540 | log.Printf("unable to parse template %s: %v", templateName, err)
541 | http.Error(w, "internal error", http.StatusInternalServerError)
542 | return
543 | }
544 |
545 | err = tmpl.Execute(w, data)
546 | if err != nil {
547 | log.Printf("unable to render template %s: %v", templateName, err)
548 | http.Error(w, "500 Internal Server Error", http.StatusInternalServerError)
549 | return
550 | }
551 | }
552 |
553 | type errorResponse struct {
554 | Error string `json:"error"`
555 | }
556 |
557 | func writeInvalidRequestResponse(w http.ResponseWriter) {
558 | http.Error(w, "invalid request", http.StatusBadRequest)
559 | }
560 |
561 | func writeInternalServerErrorResponse(w http.ResponseWriter) {
562 | http.Error(w, "invalid request", http.StatusInternalServerError)
563 | }
564 |
565 | func writeInvalidClientResponse(w http.ResponseWriter) {
566 | w.WriteHeader(http.StatusUnauthorized)
567 | writeJSONResponse(w, errorResponse{Error: "invalid_client"})
568 | }
569 |
570 | func writeInvalidGrantResponse(w http.ResponseWriter) {
571 | w.WriteHeader(http.StatusUnauthorized)
572 | writeJSONResponse(w, errorResponse{Error: "invalid_grant"})
573 | }
574 |
575 | func writeUnsupportedGrantTypeResponse(w http.ResponseWriter) {
576 | w.WriteHeader(http.StatusBadRequest)
577 | writeJSONResponse(w, errorResponse{Error: "unsupported_grant_type"})
578 | }
579 |
580 | func writeJSONResponse(w http.ResponseWriter, jsonBody interface{}) {
581 | bytes, err := json.Marshal(jsonBody)
582 | if err != nil {
583 | http.Error(w, "internal error", http.StatusInternalServerError)
584 | return
585 | }
586 | w.Header().Set("Content-Type", "application/json;charset=UTF-8")
587 | w.Header().Set("Cache-Control", "no-store")
588 | w.Header().Set("Pragma", "no-cache")
589 | _, _ = w.Write(bytes)
590 | }
591 |
592 | func errorRedirect(w http.ResponseWriter, r *http.Request, redirectURI, errorMessage, state string) {
593 | query := url.Values{}
594 | query.Set("error", errorMessage)
595 |
596 | if state != "" {
597 | query.Set("state", state)
598 | }
599 | uri := fmt.Sprintf("%s?%s", redirectURI, query.Encode())
600 | http.Redirect(w, r, uri, http.StatusFound)
601 | }
602 |
603 | func cache30Days(s http.Handler) http.Handler {
604 | return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
605 | thirtyDays := time.Hour * 24 * 30
606 | w.Header().Set("Cache-Control", fmt.Sprintf("max-age=%d", thirtyDays))
607 | s.ServeHTTP(w, r)
608 | })
609 | }
610 |
--------------------------------------------------------------------------------
/web/web_app_private_test.go:
--------------------------------------------------------------------------------
1 | package web
2 |
3 | import (
4 | "math"
5 | "net/http"
6 | "net/http/httptest"
7 | "testing"
8 |
9 | "github.com/stretchr/testify/assert"
10 | "github.com/stretchr/testify/require"
11 | )
12 |
13 | func Test_writeJsonResponse_FailsFromInvalidJson(t *testing.T) {
14 | // Given
15 | w := httptest.NewRecorder()
16 | invalidJSON := map[string]float64{
17 | "foo": math.Inf(1),
18 | }
19 |
20 | // When
21 | writeJSONResponse(w, invalidJSON)
22 |
23 | // Then
24 | body := w.Body.String()
25 | require.Equal(t, http.StatusInternalServerError, w.Result().StatusCode)
26 | assert.Equal(t, "HTTP/1.1", w.Result().Proto)
27 | assert.Contains(t, body, "internal error")
28 | }
29 |
--------------------------------------------------------------------------------
/web/web_app_session.go:
--------------------------------------------------------------------------------
1 | package web
2 |
3 | import (
4 | "fmt"
5 | "net/http"
6 | )
7 |
8 | const (
9 | sessionName = "goa2"
10 | flashMessageKey = "flash.message"
11 | flashErrorKey = "flash.error"
12 | )
13 |
14 | func (a *webApp) FlashError(w http.ResponseWriter, r *http.Request, format string, vars ...interface{}) {
15 | a.flashMessage(w, r, flashErrorKey, fmt.Sprintf(format, vars...))
16 | }
17 |
18 | func (a *webApp) FlashMessage(w http.ResponseWriter, r *http.Request, format string, vars ...interface{}) {
19 | a.flashMessage(w, r, flashMessageKey, fmt.Sprintf(format, vars...))
20 | }
21 |
22 | func (a *webApp) flashMessage(w http.ResponseWriter, r *http.Request, key, message string) {
23 | session, _ := a.sessionStore.Get(r, sessionName)
24 | session.AddFlash(message, key)
25 | _ = session.Save(r, w)
26 | }
27 |
28 | func (a *webApp) getFlashMessageVars(w http.ResponseWriter, r *http.Request) flashMessageVars {
29 | session, _ := a.sessionStore.Get(r, sessionName)
30 | fErrors := session.Flashes(flashErrorKey)
31 | fMessages := session.Flashes(flashMessageKey)
32 |
33 | var flashErrors, flashMessages []string
34 | for _, flash := range fErrors {
35 | flashErrors = append(flashErrors, flash.(string))
36 | }
37 | for _, flash := range fMessages {
38 | flashMessages = append(flashMessages, flash.(string))
39 | }
40 |
41 | if len(fErrors) > 0 || len(fMessages) > 0 {
42 | _ = session.Save(r, w)
43 | }
44 |
45 | return flashMessageVars{
46 | Errors: flashErrors,
47 | Messages: flashMessages,
48 | }
49 | }
50 |
--------------------------------------------------------------------------------
7 |
42 |
8 |
10 | Log In To Your Account
9 |
11 |
40 |
41 |