mirror of
https://git.vectorsigma.ru/public/photoview.git
synced 2026-08-03 19:29:15 +00:00
Use cookies for authentication instead of header
This replaces the current implementation where a bearer header holds the auth-token. Now the same token is being sent using a cookie instead. This greatly simplifies fetching resources (images and video), since the header is sent along implicitly with each request.
This commit is contained in:
viktorstrate
79
api/routes/authenticate_media.go
Normal file
79
api/routes/authenticate_media.go
Normal file
@@ -0,0 +1,79 @@
|
||||
package routes
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"net/http"
|
||||
|
||||
"github.com/viktorstrate/photoview/api/graphql/auth"
|
||||
"github.com/viktorstrate/photoview/api/graphql/models"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
func authenticateMedia(media *models.Media, db *sql.DB, r *http.Request) (success bool, responseMessage string, responseStatus int, errorMessage error) {
|
||||
user := auth.UserFromContext(r.Context())
|
||||
|
||||
if user != nil {
|
||||
row := db.QueryRow("SELECT owner_id FROM album WHERE album.album_id = ?", media.AlbumId)
|
||||
var owner_id int
|
||||
|
||||
if err := row.Scan(&owner_id); err != nil {
|
||||
return false, "internal server error", http.StatusInternalServerError, err
|
||||
}
|
||||
|
||||
if owner_id != user.UserID {
|
||||
return false, "invalid credentials", http.StatusForbidden, nil
|
||||
}
|
||||
} else {
|
||||
// Check if photo is authorized with a share token
|
||||
token := r.URL.Query().Get("token")
|
||||
if token == "" {
|
||||
return false, "unauthorized", http.StatusForbidden, nil
|
||||
}
|
||||
|
||||
row := db.QueryRow("SELECT * FROM share_token WHERE value = ?", token)
|
||||
|
||||
shareToken, err := models.NewShareTokenFromRow(row)
|
||||
if err != nil {
|
||||
return false, "internal server error", http.StatusInternalServerError, err
|
||||
}
|
||||
|
||||
// Validate share token password, if set
|
||||
if shareToken.Password != nil {
|
||||
tokenPassword := r.Header.Get("TokenPassword")
|
||||
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(*shareToken.Password), []byte(tokenPassword)); err != nil {
|
||||
if err == bcrypt.ErrMismatchedHashAndPassword {
|
||||
return false, "unauthorized", http.StatusForbidden, nil
|
||||
} else {
|
||||
return false, "internal server error", http.StatusInternalServerError, err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if shareToken.AlbumID != nil && media.AlbumId != *shareToken.AlbumID {
|
||||
// Check child albums
|
||||
row := db.QueryRow(`
|
||||
WITH recursive child_albums AS (
|
||||
SELECT * FROM album WHERE parent_album = ?
|
||||
UNION ALL
|
||||
SELECT child.* FROM album child JOIN child_albums parent ON parent.album_id = child.parent_album
|
||||
)
|
||||
SELECT * FROM child_albums WHERE album_id = ?
|
||||
`, *shareToken.AlbumID, media.AlbumId)
|
||||
|
||||
_, err := models.NewAlbumFromRow(row)
|
||||
if err != nil {
|
||||
if err == sql.ErrNoRows {
|
||||
return false, "unauthorized", http.StatusForbidden, nil
|
||||
}
|
||||
return false, "internal server error", http.StatusInternalServerError, err
|
||||
}
|
||||
}
|
||||
|
||||
if shareToken.MediaID != nil && media.MediaID != *shareToken.MediaID {
|
||||
return false, "unauthorized", http.StatusForbidden, nil
|
||||
}
|
||||
}
|
||||
|
||||
return true, "success", http.StatusAccepted, nil
|
||||
}
|
||||
@@ -11,9 +11,7 @@ import (
|
||||
"strconv"
|
||||
|
||||
"github.com/gorilla/mux"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
|
||||
"github.com/viktorstrate/photoview/api/graphql/auth"
|
||||
"github.com/viktorstrate/photoview/api/graphql/models"
|
||||
"github.com/viktorstrate/photoview/api/scanner"
|
||||
)
|
||||
@@ -43,90 +41,13 @@ func RegisterPhotoRoutes(db *sql.DB, router *mux.Router) {
|
||||
w.Write([]byte("internal server error"))
|
||||
}
|
||||
|
||||
user := auth.UserFromContext(r.Context())
|
||||
if user != nil {
|
||||
row := db.QueryRow("SELECT owner_id FROM album WHERE album.album_id = ?", media.AlbumId)
|
||||
var owner_id int
|
||||
|
||||
if err := row.Scan(&owner_id); err != nil {
|
||||
log.Printf("WARN: %s", err)
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
w.Write([]byte("internal server error"))
|
||||
return
|
||||
}
|
||||
|
||||
if owner_id != user.UserID {
|
||||
w.WriteHeader(http.StatusForbidden)
|
||||
w.Write([]byte("invalid credentials"))
|
||||
return
|
||||
}
|
||||
} else {
|
||||
// Check if photo is authorized with a share token
|
||||
token := r.URL.Query().Get("token")
|
||||
if token == "" {
|
||||
w.WriteHeader(http.StatusForbidden)
|
||||
w.Write([]byte("unauthorized"))
|
||||
return
|
||||
}
|
||||
|
||||
row := db.QueryRow("SELECT * FROM share_token WHERE value = ?", token)
|
||||
|
||||
shareToken, err := models.NewShareTokenFromRow(row)
|
||||
if success, response, status, err := authenticateMedia(media, db, r); !success {
|
||||
if err != nil {
|
||||
log.Printf("WARN: %s", err)
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
w.Write([]byte("internal server error"))
|
||||
return
|
||||
log.Printf("WARN: error authenticating photo: %s\n", err)
|
||||
}
|
||||
|
||||
// Validate share token password, if set
|
||||
if shareToken.Password != nil {
|
||||
tokenPassword := r.Header.Get("TokenPassword")
|
||||
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(*shareToken.Password), []byte(tokenPassword)); err != nil {
|
||||
if err == bcrypt.ErrMismatchedHashAndPassword {
|
||||
w.WriteHeader(http.StatusForbidden)
|
||||
w.Write([]byte("unauthorized"))
|
||||
return
|
||||
} else {
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
w.Write([]byte("internal server error"))
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if shareToken.AlbumID != nil && media.AlbumId != *shareToken.AlbumID {
|
||||
// Check child albums
|
||||
row := db.QueryRow(`
|
||||
WITH recursive child_albums AS (
|
||||
SELECT * FROM album WHERE parent_album = ?
|
||||
UNION ALL
|
||||
SELECT child.* FROM album child JOIN child_albums parent ON parent.album_id = child.parent_album
|
||||
)
|
||||
SELECT * FROM child_albums WHERE album_id = ?
|
||||
`, *shareToken.AlbumID, media.AlbumId)
|
||||
|
||||
_, err := models.NewAlbumFromRow(row)
|
||||
if err != nil {
|
||||
if err == sql.ErrNoRows {
|
||||
w.WriteHeader(http.StatusForbidden)
|
||||
w.Write([]byte("unauthorized"))
|
||||
return
|
||||
}
|
||||
log.Printf("WARN: %s", err)
|
||||
w.WriteHeader(http.StatusInternalServerError)
|
||||
w.Write([]byte("internal server error"))
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
if shareToken.MediaID != nil && media_id != *shareToken.MediaID {
|
||||
w.WriteHeader(http.StatusForbidden)
|
||||
w.Write([]byte("unauthorized"))
|
||||
return
|
||||
}
|
||||
|
||||
w.WriteHeader(status)
|
||||
w.Write([]byte(response))
|
||||
return
|
||||
}
|
||||
|
||||
var cachedPath string
|
||||
|
||||
@@ -38,6 +38,16 @@ func RegisterVideoRoutes(db *sql.DB, router *mux.Router) {
|
||||
}
|
||||
|
||||
// TODO: Make sure user is authorized to access video
|
||||
if success, response, status, err := authenticateMedia(media, db, r); !success {
|
||||
if err != nil {
|
||||
log.Printf("WARN: error authenticating video: %s\n", err)
|
||||
}
|
||||
w.WriteHeader(status)
|
||||
w.Write([]byte(response))
|
||||
return
|
||||
}
|
||||
|
||||
log.Printf("Video cookies: %d", len(r.Cookies()))
|
||||
|
||||
var cachedPath string
|
||||
|
||||
|
||||
Reference in New Issue
Block a user