Function SessionOrAPIKey

internal/api/middleware/auth.go:84–125

SessionOrAPIKey authenticates a request via the console session cookie first, then falls back to a Bearer API key. Both resolve to a *domain.APIKeyAuth in the request context, so all /v1 handlers work for the browser console and for programmatic clients without any per-handler changes.

(apiKeyStore domain.APIKeyStore, resolver SessionResolver, allowedOrigins []string)

// the request context, so all /v1 handlers work for the browser console and for
// programmatic clients without any per-handler changes.
func SessionOrAPIKey(apiKeyStore domain.APIKeyStore, resolver SessionResolver, allowedOrigins []string) func(http.Handler) http.Handler {
	allowAll := len(allowedOrigins) == 1 && allowedOrigins[0] == "*"
	allowed := make(map[string]bool, len(allowedOrigins))
	for _, o := range allowedOrigins {
		allowed[o] = true
	}

	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if resolver != nil {
				if c, err := r.Cookie(SessionCookieName); err == nil && c.Value != "" {
					if auth, err := resolver.ResolveSessionAuth(r.Context(), c.Value); err == nil && auth != nil {
						if isStateChanging(r.Method) && !originAllowed(r, allowed, allowAll) {
							writeError(w, http.StatusForbidden, "cross-origin request blocked")
							return
						}
						next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), authContextKey, auth)))
						return
					}
				}
			}

			authHeader := r.Header.Get("Authorization")
			if authHeader == "" {
				writeError(w, http.StatusUnauthorized, "missing authorization")
				return
			}
			parts := strings.SplitN(authHeader, " ", 2)
			if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
				writeError(w, http.StatusUnauthorized, "invalid authorization header format")
				return
			}
			auth, err := apiKeyStore.GetAuthByHash(r.Context(), HashAPIKey(parts[1]))
			if err != nil {
				writeError(w, http.StatusUnauthorized, "invalid API key")
				return
			}
			go func() { _ = apiKeyStore.UpdateLastUsed(context.Background(), auth.KeyID) }()
			next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), authContextKey, auth)))
		})
	}
}

// RequireScope returns middleware that rejects requests whose API key lacks the given scope.
// Keys with the "admin" scope pass all scope checks.