| 195 | } |
| 196 | |
| 197 | func (t *tokenAuth) VerifyAndRetrieveUser(c *gin.Context) (bool, error) { |
| 198 | headerVal := c.GetHeader(AuthorizationHeader) |
| 199 | if strings.HasPrefix(headerVal, TokenHeaderPrefixCr) { |
| 200 | // This is an HMAC auth header, skip JWT verification |
| 201 | return false, nil |
| 202 | } |
| 203 | |
| 204 | tokenString := strings.TrimPrefix(headerVal, TokenHeaderPrefix) |
| 205 | if tokenString == "" { |
| 206 | return true, nil |
| 207 | } |
| 208 | |
| 209 | token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) { |
| 210 | return t.secret, nil |
| 211 | }) |
| 212 | |
| 213 | if err != nil { |
| 214 | t.l.Warning("Failed to parse jwt token: %s", err) |
| 215 | return false, nil |
| 216 | } |
| 217 | |
| 218 | claims, ok := token.Claims.(*Claims) |
| 219 | if !ok || claims.TokenType != TokenTypeAccess { |
| 220 | return false, serializer.NewError(serializer.CodeCredentialInvalid, "Invalid token type", nil) |
| 221 | } |
| 222 | |
| 223 | uid, err := t.idEncoder.Decode(claims.Subject, hashid.UserID) |
| 224 | if err != nil { |
| 225 | return false, serializer.NewError(serializer.CodeNotFound, "User not found", err) |
| 226 | } |
| 227 | |
| 228 | util.WithValue(c, inventory.UserIDCtx{}, uid) |
| 229 | |
| 230 | if claims.ClientID != "" { |
| 231 | util.WithValue(c, ScopeContextKey{}, claims.Scopes) |
| 232 | } |
| 233 | return false, nil |
| 234 | } |
| 235 | |
| 236 | func (t *tokenAuth) Issue(ctx context.Context, args *IssueTokenArgs) (*Token, error) { |
| 237 | u := args.User |