4f0107f1b2
Add a complete authentication and authorization system to Silo with three pluggable backends (local bcrypt, LDAP/FreeIPA, OIDC/Keycloak), session management, API token support, and role-based access control. Authentication backends: - Local: bcrypt (cost 12) password verification against users table - LDAP: FreeIPA simple bind with group-to-role mapping - OIDC: Keycloak redirect flow with realm role mapping - Backends are tried in order; users upserted to DB on first login Session and token management: - PostgreSQL-backed sessions via alexedwards/scs + pgxstore - Opaque API tokens (silo_ prefix, SHA-256 hashed, shown once) - 24h session lifetime, HttpOnly/SameSite=Lax/Secure cookies Role-based access control (admin > editor > viewer): - RequireAuth middleware: Bearer token -> session -> redirect/401 - RequireRole middleware: per-route-group minimum role enforcement - CSRF protection via justinas/nosurf on web forms, API exempt - CORS locked to configured origins when auth enabled Route restructuring: - Public: /health, /ready, /login, /auth/oidc, /auth/callback - Web (auth + CSRF): /, /projects, /schemas, /settings - API read (viewer): GET /api/** - API write (editor): POST/PUT/PATCH/DELETE /api/** User context wiring: - created_by/updated_by columns on items, projects, relationships - All create/update handlers populate tracking fields from context - CSV and BOM import handlers pass authenticated username - Revision creation tracks user across all code paths Default admin account: - Configurable via auth.local.default_admin_username/password - Env var overrides: SILO_ADMIN_USERNAME, SILO_ADMIN_PASSWORD - Idempotent: created on first startup, skipped if exists CLI and FreeCAD plugin: - silo token create/list/revoke subcommands (HTTP API client) - FreeCAD SiloClient sends Bearer token on all requests - Token read from ApiToken preference or SILO_API_TOKEN env var Web UI: - Login page (Catppuccin Mocha themed, OIDC button conditional) - Settings page with account info and API token management - User display name, role badge, and logout button in header - One-time token display banner with copy-to-clipboard Database (migration 009): - users table with role, auth_source, oidc_subject, password_hash - api_tokens table with SHA-256 hash, prefix, expiry, scopes - sessions table (scs pgxstore schema) - audit_log table (schema ready for future use) - created_by/updated_by ALTER on items, relationships, projects New dependencies: scs/v2, scs/pgxstore, go-oidc/v3, go-ldap/v3, justinas/nosurf, golang.org/x/oauth2
103 lines
2.6 KiB
Go
103 lines
2.6 KiB
Go
package api
|
|
|
|
import (
|
|
"embed"
|
|
"html/template"
|
|
"net/http"
|
|
|
|
"github.com/justinas/nosurf"
|
|
"github.com/kindredsystems/silo/internal/auth"
|
|
"github.com/rs/zerolog"
|
|
)
|
|
|
|
//go:embed templates/*.html
|
|
var templatesFS embed.FS
|
|
|
|
// WebHandler serves HTML pages.
|
|
type WebHandler struct {
|
|
templates *template.Template
|
|
logger zerolog.Logger
|
|
server *Server
|
|
}
|
|
|
|
// NewWebHandler creates a new web handler.
|
|
func NewWebHandler(logger zerolog.Logger, server *Server) (*WebHandler, error) {
|
|
tmpl, err := template.ParseFS(templatesFS, "templates/*.html")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
wh := &WebHandler{
|
|
templates: tmpl,
|
|
logger: logger,
|
|
server: server,
|
|
}
|
|
|
|
// Store reference on server for auth handlers to use templates
|
|
server.webHandler = wh
|
|
|
|
return wh, nil
|
|
}
|
|
|
|
// PageData holds data for page rendering.
|
|
type PageData struct {
|
|
Title string
|
|
Page string
|
|
Data any
|
|
User *auth.User
|
|
CSRFToken string
|
|
}
|
|
|
|
// HandleIndex serves the main items page.
|
|
func (h *WebHandler) HandleIndex(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != "/" {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
|
|
data := PageData{
|
|
Title: "Items",
|
|
Page: "items",
|
|
User: auth.UserFromContext(r.Context()),
|
|
CSRFToken: nosurf.Token(r),
|
|
}
|
|
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
if err := h.templates.ExecuteTemplate(w, "base.html", data); err != nil {
|
|
h.logger.Error().Err(err).Msg("failed to render template")
|
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
|
}
|
|
}
|
|
|
|
// HandleProjectsPage serves the projects page.
|
|
func (h *WebHandler) HandleProjectsPage(w http.ResponseWriter, r *http.Request) {
|
|
data := PageData{
|
|
Title: "Projects",
|
|
Page: "projects",
|
|
User: auth.UserFromContext(r.Context()),
|
|
CSRFToken: nosurf.Token(r),
|
|
}
|
|
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
if err := h.templates.ExecuteTemplate(w, "base.html", data); err != nil {
|
|
h.logger.Error().Err(err).Msg("failed to render template")
|
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
|
}
|
|
}
|
|
|
|
// HandleSchemasPage serves the schemas page.
|
|
func (h *WebHandler) HandleSchemasPage(w http.ResponseWriter, r *http.Request) {
|
|
data := PageData{
|
|
Title: "Schemas",
|
|
Page: "schemas",
|
|
User: auth.UserFromContext(r.Context()),
|
|
CSRFToken: nosurf.Token(r),
|
|
}
|
|
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
if err := h.templates.ExecuteTemplate(w, "base.html", data); err != nil {
|
|
h.logger.Error().Err(err).Msg("failed to render template")
|
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
|
}
|
|
}
|