66 lines
1.7 KiB
Go
66 lines
1.7 KiB
Go
package middlewares
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"abuse_registration_poc/internal/handlers"
|
|
"abuse_registration_poc/internal/models"
|
|
)
|
|
|
|
var routePermissions = map[string]map[string][]string{
|
|
"GET": {
|
|
"/api/v1/categories": {models.RoleReader, models.RoleAdmin},
|
|
"/api/v1/locations": {models.RoleReader, models.RoleAdmin},
|
|
"/api/v1/registrations": {models.RoleReader, models.RoleAdmin},
|
|
"/api/v1/registrations/:id": {models.RoleReader, models.RoleAdmin},
|
|
},
|
|
"POST": {
|
|
"/api/v1/registrations": {models.RoleAdmin},
|
|
"/api/v1/reset": {models.RoleAdmin},
|
|
},
|
|
"PUT": {
|
|
"/api/v1/registrations/:id": {models.RoleAdmin},
|
|
},
|
|
"DELETE": {
|
|
"/api/v1/registrations/:id": {models.RoleAdmin},
|
|
},
|
|
}
|
|
|
|
func DynamicAuthorize(routePattern string, next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
|
|
role, exists := RoleFromContext(request.Context())
|
|
if !exists {
|
|
handlers.WriteJSON(writer, http.StatusForbidden, map[string]string{"message": "Access denied."})
|
|
return
|
|
}
|
|
|
|
if !hasPermission(role, request.Method, routePattern) {
|
|
handlers.WriteJSON(writer, http.StatusForbidden, map[string]string{"message": "Access denied to this resource."})
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(writer, request)
|
|
})
|
|
}
|
|
|
|
func Protected(routePattern string, next http.Handler) http.Handler {
|
|
return Authenticate(DynamicAuthorize(routePattern, next))
|
|
}
|
|
|
|
func hasPermission(role string, method string, path string) bool {
|
|
methodPermissions, ok := routePermissions[method]
|
|
if !ok {
|
|
return false
|
|
}
|
|
roles, ok := methodPermissions[path]
|
|
if !ok {
|
|
return false
|
|
}
|
|
for _, allowed := range roles {
|
|
if allowed == role {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|