Function CheckAuth

middleware/check_auth.go:17–135

(c *fiber.Ctx)

)

func CheckAuth(c *fiber.Ctx) error {
	var body map[string]interface{}
	var controlPassword bool = false
	var username string = ""
	var password string = ""
	var err error
	var token string

	_ = c.BodyParser(&body)
	if body == nil {
		body = make(map[string]interface{})
	}

	pathsToCheck := []string{"path", "folder", "itemName", "filepath", "oldFilepath", "newFilepath"}
	for _, p := range pathsToCheck {
		val := c.Query(p)
		if val != "" && !utils.IsSafePath(val) {
			return c.Status(403).JSON(fiber.Map{"err": "forbidden"})
		}
	}

	authHeader := c.Get("Authorization")
	if after, ok := strings.CutPrefix(authHeader, "Bearer "); ok {
		token = after
	} else {
		token = authHeader
	}

	reqUsername, hasUsername := body["username"].(string)
	reqPassword, hasPassword := body["password"].(string)

	if token == "" && (!hasUsername || !hasPassword || reqUsername == "" || reqPassword == "") {
		token = c.Cookies("token")
		if token == "" {
			return c.Status(400).JSON(fiber.Map{"err": "authorization required"})
		}
	}

	if token != "" {
		userIp := c.IP()
		userUserAgent := c.Get("User-Agent")
		tokenData, ok := cache.TokenFingerprint.Get(token)

		if !ok {
			return c.Status(401).JSON(fiber.Map{"err": "invalid token"})
		}

		// TODO: this should be a opt in feature
		if subtle.ConstantTimeCompare([]byte(tokenData.Ip), []byte(userIp)) != 1 || tokenData.UserAgent != userUserAgent {
			cache.TokenFingerprint.Delete(token)
			return c.Status(401).JSON(fiber.Map{"err": "invalid token"})
		}

		username, err = utils.VerifyToken(token, config.Config.SecretJwtKey)
		if err != nil {
			return c.Status(401).JSON(fiber.Map{"err": "invalid token"})
		}
		c.Locals("username", username)