@@ -26,6 +26,14 @@ func (s *Service) jwtMiddleware(ctx context.Context, w http.ResponseWriter, req
2626 return service .JWTMiddleware (ctx , w , req , rc , v .VerifyJWT )
2727}
2828
29+ func (s * Service ) validJWTMiddleware (ctx context.Context , w http.ResponseWriter , req * http.Request , rc * service.HandlerConfig ) (context.Context , error ) {
30+ // Check for valid session based on jwt from context
31+ if _ , ok := ctx .Value (service .ContextJWT ).(* jwt.Token ); ! ok {
32+ return ctx , sdk .WithStack (sdk .ErrUnauthorized )
33+ }
34+ return ctx , nil
35+ }
36+
2937func (s * Service ) itemAccessMiddleware (ctx context.Context , w http.ResponseWriter , req * http.Request , rc * service.HandlerConfig ) (context.Context , error ) {
3038 ctx , end := telemetry .Span (ctx , "router.itemAccessMiddleware" )
3139 defer end ()
@@ -44,13 +52,6 @@ func (s *Service) itemAccessMiddleware(ctx context.Context, w http.ResponseWrite
4452 return ctx , sdk .WithStack (sdk .ErrUnauthorized )
4553 }
4654
47- return s .itemAccessCheck (ctx , itemType , apiRef )
48- }
49-
50- func (s * Service ) itemAccessCheck (ctx context.Context , itemType sdk.CDNItemType , apiRef string ) (context.Context , error ) {
51- ctx , end := telemetry .Span (ctx , "router.itemAccessCheck" )
52- defer end ()
53-
5455 // Check for session based on jwt from context
5556 jwt , ok := ctx .Value (service .ContextJWT ).(* jwt.Token )
5657 if ! ok {
@@ -59,28 +60,32 @@ func (s *Service) itemAccessCheck(ctx context.Context, itemType sdk.CDNItemType,
5960 claims := jwt .Claims .(* sdk.AuthSessionJWTClaims )
6061 sessionID := claims .StandardClaims .Id
6162
62- keyWorkflowPermissionForSession := cache .Key (keyPermission , apiRef , sessionID )
63+ item , err := item .LoadByAPIRefHashAndType (ctx , s .Mapper , s .mustDBWithCtx (ctx ), apiRef , itemType )
64+ if err != nil {
65+ return ctx , sdk .NewErrorWithStack (err , sdk .ErrNotFound )
66+ }
67+
68+ return ctx , s .itemAccessCheck (ctx , * item , sessionID )
69+ }
70+
71+ func (s * Service ) itemAccessCheck (ctx context.Context , item sdk.CDNItem , sessionID string ) error {
72+ keyWorkflowPermissionForSession := cache .Key (keyPermission , string (item .Type ), item .APIRefHash , sessionID )
6373
6474 exists , err := s .Cache .Exist (keyWorkflowPermissionForSession )
6575 if err != nil {
66- return ctx , sdk .NewErrorWithStack (sdk .WrapError (err , "unable to check if permission %s exists" , keyWorkflowPermissionForSession ), sdk .ErrUnauthorized )
76+ return sdk .NewErrorWithStack (sdk .WrapError (err , "unable to check if permission %s exists" , keyWorkflowPermissionForSession ), sdk .ErrUnauthorized )
6777 }
6878 if exists {
69- return ctx , nil
70- }
71-
72- item , err := item .LoadByAPIRefHashAndType (ctx , s .Mapper , s .mustDBWithCtx (ctx ), apiRef , itemType )
73- if err != nil {
74- return ctx , sdk .NewErrorWithStack (err , sdk .ErrNotFound )
79+ return nil
7580 }
7681
7782 if err := s .Client .WorkflowLogAccess (ctx , item .APIRef .ProjectKey , item .APIRef .WorkflowName , sessionID ); err != nil {
78- return ctx , sdk .NewErrorWithStack (err , sdk .ErrNotFound )
83+ return sdk .NewErrorWithStack (err , sdk .ErrNotFound )
7984 }
8085
8186 if err := s .Cache .SetWithTTL (keyWorkflowPermissionForSession , true , 3600 ); err != nil {
82- return ctx , sdk .NewErrorWithStack (sdk .WrapError (err , "unable to store permission %s" , keyWorkflowPermissionForSession ), sdk .ErrUnauthorized )
87+ return sdk .NewErrorWithStack (sdk .WrapError (err , "unable to store permission %s" , keyWorkflowPermissionForSession ), sdk .ErrUnauthorized )
8388 }
8489
85- return ctx , nil
90+ return nil
8691}
0 commit comments