mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
feat: Add authentication and personal user endpoint (#29)
* feat: Add authentication and personal user endpoint This contribution adds a lot of scaffolding for the database fake and testability of coderd. A new endpoint "/user" is added to return the currently authenticated user to the requester. * Use TestMain to catch leak instead * Add userpassword package * Add WIP * Add user auth * Fix test * Add comments * Fix login response * Fix order * Fix generated code * Update httpapi/httpapi.go Co-authored-by: Bryan <bryan@coder.com> Co-authored-by: Bryan <bryan@coder.com>
This commit is contained in:
Kyle Carberry
@@ -0,0 +1,114 @@
|
||||
package httpapi
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"reflect"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/go-playground/validator/v10"
|
||||
)
|
||||
|
||||
var (
|
||||
validate *validator.Validate
|
||||
usernameRegex = regexp.MustCompile("^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$")
|
||||
)
|
||||
|
||||
// This init is used to create a validator and register validation-specific
|
||||
// functionality for the HTTP API.
|
||||
//
|
||||
// A single validator instance is used, because it caches struct parsing.
|
||||
func init() {
|
||||
validate = validator.New()
|
||||
validate.RegisterTagNameFunc(func(fld reflect.StructField) string {
|
||||
name := strings.SplitN(fld.Tag.Get("json"), ",", 2)[0]
|
||||
if name == "-" {
|
||||
return ""
|
||||
}
|
||||
return name
|
||||
})
|
||||
validate.RegisterValidation("username", func(fl validator.FieldLevel) bool {
|
||||
f := fl.Field().Interface()
|
||||
str, ok := f.(string)
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
if len(str) > 32 {
|
||||
return false
|
||||
}
|
||||
if len(str) < 1 {
|
||||
return false
|
||||
}
|
||||
return usernameRegex.MatchString(str)
|
||||
})
|
||||
}
|
||||
|
||||
// Response represents a generic HTTP response.
|
||||
type Response struct {
|
||||
Message string `json:"message" validate:"required"`
|
||||
Errors []Error `json:"errors,omitempty" validate:"required"`
|
||||
}
|
||||
|
||||
// Error represents a scoped error to a user input.
|
||||
type Error struct {
|
||||
Field string `json:"field" validate:"required"`
|
||||
Code string `json:"code" validate:"required"`
|
||||
}
|
||||
|
||||
// Write outputs a standardized format to an HTTP response body.
|
||||
func Write(w http.ResponseWriter, status int, response Response) {
|
||||
buf := &bytes.Buffer{}
|
||||
enc := json.NewEncoder(buf)
|
||||
enc.SetEscapeHTML(true)
|
||||
err := enc.Encode(response)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
||||
w.WriteHeader(status)
|
||||
_, err = w.Write(buf.Bytes())
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Read decodes JSON from the HTTP request into the value provided.
|
||||
// It uses go-validator to validate the incoming request body.
|
||||
func Read(rw http.ResponseWriter, r *http.Request, value interface{}) bool {
|
||||
err := json.NewDecoder(r.Body).Decode(value)
|
||||
if err != nil {
|
||||
Write(rw, http.StatusBadRequest, Response{
|
||||
Message: fmt.Sprintf("read body: %s", err.Error()),
|
||||
})
|
||||
return false
|
||||
}
|
||||
err = validate.Struct(value)
|
||||
var validationErrors validator.ValidationErrors
|
||||
if errors.As(err, &validationErrors) {
|
||||
apiErrors := make([]Error, 0, len(validationErrors))
|
||||
for _, validationError := range validationErrors {
|
||||
apiErrors = append(apiErrors, Error{
|
||||
Field: validationError.Field(),
|
||||
Code: validationError.Tag(),
|
||||
})
|
||||
}
|
||||
Write(rw, http.StatusBadRequest, Response{
|
||||
Message: "Validation failed",
|
||||
Errors: apiErrors,
|
||||
})
|
||||
return false
|
||||
}
|
||||
if err != nil {
|
||||
Write(rw, http.StatusInternalServerError, Response{
|
||||
Message: fmt.Sprintf("validation: %s", err.Error()),
|
||||
})
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -0,0 +1,134 @@
|
||||
package httpapi_test
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/coder/coder/httpapi"
|
||||
)
|
||||
|
||||
func TestWrite(t *testing.T) {
|
||||
t.Run("NoErrors", func(t *testing.T) {
|
||||
rw := httptest.NewRecorder()
|
||||
httpapi.Write(rw, http.StatusOK, httpapi.Response{
|
||||
Message: "wow",
|
||||
})
|
||||
var m map[string]interface{}
|
||||
err := json.NewDecoder(rw.Body).Decode(&m)
|
||||
require.NoError(t, err)
|
||||
_, ok := m["errors"]
|
||||
require.False(t, ok)
|
||||
})
|
||||
}
|
||||
|
||||
func TestRead(t *testing.T) {
|
||||
t.Run("EmptyStruct", func(t *testing.T) {
|
||||
rw := httptest.NewRecorder()
|
||||
r := httptest.NewRequest("POST", "/", bytes.NewBufferString("{}"))
|
||||
v := struct{}{}
|
||||
require.True(t, httpapi.Read(rw, r, &v))
|
||||
})
|
||||
|
||||
t.Run("NoBody", func(t *testing.T) {
|
||||
rw := httptest.NewRecorder()
|
||||
r := httptest.NewRequest("POST", "/", nil)
|
||||
var v json.RawMessage
|
||||
require.False(t, httpapi.Read(rw, r, v))
|
||||
})
|
||||
|
||||
t.Run("Validate", func(t *testing.T) {
|
||||
type toValidate struct {
|
||||
Value string `json:"value" validate:"required"`
|
||||
}
|
||||
rw := httptest.NewRecorder()
|
||||
r := httptest.NewRequest("POST", "/", bytes.NewBufferString(`{"value":"hi"}`))
|
||||
|
||||
var validate toValidate
|
||||
require.True(t, httpapi.Read(rw, r, &validate))
|
||||
require.Equal(t, validate.Value, "hi")
|
||||
})
|
||||
|
||||
t.Run("ValidateFailure", func(t *testing.T) {
|
||||
type toValidate struct {
|
||||
Value string `json:"value" validate:"required"`
|
||||
}
|
||||
rw := httptest.NewRecorder()
|
||||
r := httptest.NewRequest("POST", "/", bytes.NewBufferString("{}"))
|
||||
|
||||
var validate toValidate
|
||||
require.False(t, httpapi.Read(rw, r, &validate))
|
||||
var v httpapi.Response
|
||||
err := json.NewDecoder(rw.Body).Decode(&v)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, v.Errors, 1)
|
||||
require.Equal(t, v.Errors[0].Field, "value")
|
||||
require.Equal(t, v.Errors[0].Code, "required")
|
||||
})
|
||||
}
|
||||
|
||||
func TestReadUsername(t *testing.T) {
|
||||
// Tests whether usernames are valid or not.
|
||||
testCases := []struct {
|
||||
Username string
|
||||
Valid bool
|
||||
}{
|
||||
{"1", true},
|
||||
{"12", true},
|
||||
{"123", true},
|
||||
{"12345678901234567890", true},
|
||||
{"123456789012345678901", true},
|
||||
{"a", true},
|
||||
{"a1", true},
|
||||
{"a1b2", true},
|
||||
{"a1b2c3d4e5f6g7h8i9j0", true},
|
||||
{"a1b2c3d4e5f6g7h8i9j0k", true},
|
||||
{"aa", true},
|
||||
{"abc", true},
|
||||
{"abcdefghijklmnopqrst", true},
|
||||
{"abcdefghijklmnopqrstu", true},
|
||||
{"wow-test", true},
|
||||
|
||||
{"", false},
|
||||
{" ", false},
|
||||
{" a", false},
|
||||
{" a ", false},
|
||||
{" 1", false},
|
||||
{"1 ", false},
|
||||
{" aa", false},
|
||||
{"aa ", false},
|
||||
{" 12", false},
|
||||
{"12 ", false},
|
||||
{" a1", false},
|
||||
{"a1 ", false},
|
||||
{" abcdefghijklmnopqrstu", false},
|
||||
{"abcdefghijklmnopqrstu ", false},
|
||||
{" 123456789012345678901", false},
|
||||
{" a1b2c3d4e5f6g7h8i9j0k", false},
|
||||
{"a1b2c3d4e5f6g7h8i9j0k ", false},
|
||||
{"bananas_wow", false},
|
||||
{"test--now", false},
|
||||
|
||||
{"123456789012345678901234567890123", false},
|
||||
{"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", false},
|
||||
{"123456789012345678901234567890123123456789012345678901234567890123", false},
|
||||
}
|
||||
type toValidate struct {
|
||||
Username string `json:"username" validate:"username"`
|
||||
}
|
||||
for _, testCase := range testCases {
|
||||
t.Run(testCase.Username, func(t *testing.T) {
|
||||
rw := httptest.NewRecorder()
|
||||
data, err := json.Marshal(toValidate{testCase.Username})
|
||||
require.NoError(t, err)
|
||||
r := httptest.NewRequest("POST", "/", bytes.NewBuffer(data))
|
||||
|
||||
var validate toValidate
|
||||
require.Equal(t, httpapi.Read(rw, r, &validate), testCase.Valid)
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user