fix oidc partial auth

Daedaluz · Mar 21, 2024 · dc7f137 · dc7f137
1 parent ed2872b
commit dc7f137
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/internal/api/application/user.go b/internal/api/application/user.go
@@ -48,6 +48,36 @@ func UserMiddleware() gin.HandlerFunc {
 	}
 }
 
+func JWTMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		authorization := c.GetHeader("Authorization")
+		fields := strings.Fields(authorization)
+		if len(fields) != 2 {
+			c.Next()
+			return
+		}
+		if !strings.EqualFold(fields[0], "bearer") {
+			c.Next()
+			return
+		}
+		set, err := trust.GetJWKSet()
+		if err != nil {
+			c.Next()
+			return
+		}
+		token, err := jwt.Parse([]byte(fields[1]),
+			jwt.WithValidate(true),
+			jwt.WithKeySet(set),
+			jwt.WithIssuer(viper.GetString("userApi.trustedIssuer")),
+			jwt.WithAcceptableSkew(time.Minute))
+		if err != nil {
+			c.Next()
+			return
+		}
+		c.Set("jwt", token)
+	}
+}
+
 func GetCurrentJWT(c *gin.Context) jwt.Token {
 	token, exists := c.Get("jwt")
 	if !exists {

diff --git a/internal/api/v1/routes.go b/internal/api/v1/routes.go
@@ -55,6 +55,7 @@ func AddRoutes(g *gin.RouterGroup) {
 	issuerGroup := g.Group("/oidc")
 	issuerGroup.Use(
 		cors.New(clientCorsConfig),
+		application.JWTMiddleware(),
 	)
 
 	public.AddRoutes(publicGroup)