Method checkPublicAuth

rest/handler.go:917–949

checkPublicAuth verifies that the current request is authenticated for the given database. Returns an HTTPError if authentication fails. NOTE: checkPublicAuth is not used for the admin interface.

(dbCtx *db.DatabaseContext)

// authentication fails.
// NOTE: checkPublicAuth is not used for the admin interface.
func (h *handler) checkPublicAuth(dbCtx *db.DatabaseContext) (err error) {

	h.user = nil
	if dbCtx == nil {
		return nil
	}

	start := time.Now()
	auditFields, err := h.setUserForPublicAuth(dbCtx)
	dbCtx.DbStats.Security().TotalAuthTime.Add(time.Since(start).Nanoseconds())
	if err != nil {
		dbCtx.DbStats.Security().AuthFailedCount.Add(1)
		if errors.Is(err, ErrInvalidLogin) {
			base.Audit(h.ctx(), base.AuditIDPublicUserAuthenticationFailed, auditFields)
		}
		return
	}
	dbCtx.DbStats.Security().AuthSuccessCount.Add(1)

	username := ""
	if h.isGuest() {
		username = base.GuestUsername
	} else if h.user != nil {
		username = h.user.Name()
	}
	roleNames, err := getSGUserRolesForAudit(dbCtx, h.user)
	if err != nil {
		base.InfofCtx(h.ctx(), base.KeyHTTP, "Unable to retrieve user roles for audit logging, will be omitted from audit entry: %v", err)
	}
	h.rqCtx = base.UserLogCtx(h.ctx(), username, base.UserDomainSyncGateway, roleNames)
	base.Audit(h.ctx(), base.AuditIDPublicUserAuthenticated, auditFields)
	return err
}

// setUserForPublicAuth sets h.user based on the authentication information in the request. Returns an error if the user
// can not authenticate successfully, and returns AuditFields even in the case that there is an error in the request.