79 lines
2.6 KiB
Go
79 lines
2.6 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"browser.local/platform/domain"
|
|
"browser.local/platform/service"
|
|
)
|
|
|
|
func (h *coreHandlers) requireAuthorizedAPI(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if !strings.HasPrefix(r.URL.Path, "/api/v1/") || publicAPIRequest(r) || runServiceRequest(r) {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
user, err := h.core.GetCurrentUser(bearerToken(r))
|
|
if err != nil {
|
|
writeServiceError(w, err)
|
|
return
|
|
}
|
|
if platformAdminRequest(r) && !apiPlatformAdmin(user) {
|
|
writeServiceError(w, service.ErrForbidden)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func publicAPIRequest(r *http.Request) bool {
|
|
path := r.URL.Path
|
|
if path == "/api/v1/auth/login" || path == "/api/v1/auth/register" || path == "/api/v1/client-managers/register" || path == "/api/v1/client-managers/heartbeat" {
|
|
return true
|
|
}
|
|
if strings.HasPrefix(path, "/api/v1/game-client-bridge/companion/") {
|
|
return true
|
|
}
|
|
if r.Method != http.MethodGet {
|
|
return false
|
|
}
|
|
return path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") ||
|
|
path == "/api/v1/plugin-marketplace/plugins" || strings.HasPrefix(path, "/api/v1/plugin-marketplace/plugins/")
|
|
}
|
|
|
|
func runServiceRequest(r *http.Request) bool {
|
|
return strings.HasPrefix(r.URL.Path, "/api/v1/run/control/") ||
|
|
strings.HasPrefix(r.URL.Path, "/api/v1/run/lifecycle/") ||
|
|
strings.HasPrefix(r.URL.Path, "/api/v1/run/jobs/") ||
|
|
strings.HasPrefix(r.URL.Path, "/api/v1/run/logs/") ||
|
|
strings.HasPrefix(r.URL.Path, "/api/v1/run/artifacts/") ||
|
|
strings.HasPrefix(r.URL.Path, "/api/v1/run/metrics/")
|
|
}
|
|
|
|
func platformAdminRequest(r *http.Request) bool {
|
|
path := r.URL.Path
|
|
if path == "/api/v1/users/current" || strings.HasPrefix(path, "/api/v1/users/current/") {
|
|
return false
|
|
}
|
|
if path == "/api/v1/users" || strings.HasPrefix(path, "/api/v1/users/") ||
|
|
path == "/api/v1/ai-providers" || strings.HasPrefix(path, "/api/v1/ai-providers/") ||
|
|
path == "/api/v1/metrics/platform" ||
|
|
path == "/api/v1/run/endpoints" || strings.HasPrefix(path, "/api/v1/run/endpoints/") {
|
|
return true
|
|
}
|
|
if r.Method != http.MethodGet && (path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") || strings.Contains(path, "/plugin-marketplace/plugins/")) {
|
|
return true
|
|
}
|
|
return r.Method == http.MethodPost && (path == "/api/v1/jobs" || path == "/api/v1/artifacts" || path == "/api/v1/log-streams")
|
|
}
|
|
|
|
func apiPlatformAdmin(user domain.User) bool {
|
|
for _, role := range user.Roles {
|
|
if role == "platform-admin" || role == "admin" || role == "platformadmin" {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|