coder · deansheather · Apr 6, 2022 · Apr 6, 2022 · Apr 7, 2022 · Apr 7, 2022
diff --git a/coderd/access/session/actor.go b/coderd/access/session/actor.go
@@ -0,0 +1,42 @@
+package session
+
+import (
+	"github.com/coder/coder/coderd/database"
+)
+
+// ActorType is an enum of all types of Actors.
+type ActorType string
+
+// ActorTypes.
+const (
+	ActorTypeAnonymous ActorType = "anonymous"
+	ActorTypeUser      ActorType = "user"
+)
+
+// Actor represents an unauthenticated or authenticated client accessing the
+// API. To check authorization, callers should call pass the Actor into the
+// authz package to assert access.
+type Actor interface {
+	Type() ActorType
+	// ID is the unique ID of the actor for logging purposes.
+	ID() string
+	// Name is a friendly, but consistent, name for the actor for logging
+	// purposes. E.g. "deansheather"
+	Name() string
+
+	// TODO: Steven - RBAC methods
+}
+
+// AnonymousActor represents an unauthenticated API client.
+type AnonymousActor interface {
+	Actor
+	Anonymous()
+}
+
+// UserActor represents an authenticated user actor. Any consumers that wish to
+// check if the actor is a user (and access user fields such as User.ID) can
+// do a checked type cast from Actor to UserActor.
+type UserActor interface {
+	Actor
+	User() *database.User
+}
diff --git a/coderd/access/session/anonymous.go b/coderd/access/session/anonymous.go
@@ -0,0 +1,22 @@
+package session
+
+const AnonymousUserID = "anonymous"
+
+type anonymousActor struct{}
+
+// Anon is a static AnonymousActor implementation.
+var Anon AnonymousActor = anonymousActor{}
+
+func (anonymousActor) Type() ActorType {
+	return ActorTypeAnonymous
+}
+
+func (anonymousActor) ID() string {
+	return AnonymousUserID
+}
+
+func (anonymousActor) Name() string {
+	return AnonymousUserID
+}
+
+func (anonymousActor) Anonymous() {}
diff --git a/coderd/access/session/anonymous_test.go b/coderd/access/session/anonymous_test.go
@@ -0,0 +1,18 @@
+package session_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/access/session"
+)
+
+func TestAnonymousActor(t *testing.T) {
+	t.Parallel()
+
+	require.Equal(t, session.ActorTypeAnonymous, session.Anon.Type())
+	require.Equal(t, session.AnonymousUserID, session.Anon.ID())
+	require.Equal(t, session.AnonymousUserID, session.Anon.Name())
+	session.Anon.Anonymous()
+}
diff --git a/coderd/access/session/doc.go b/coderd/access/session/doc.go
@@ -0,0 +1,4 @@
+// Package session provides session authentication via middleware for the Coder
+// HTTP API. It also exposes the Actor type, which is the intermediary layer
+// between identity and RBAC authorization.
+package session
diff --git a/coderd/access/session/mw.go b/coderd/access/session/mw.go
@@ -0,0 +1,51 @@
+package session
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/coder/coder/coderd/database"
+)
+
+type actorContextKey struct{}
+
+// APIKey returns the API key from the ExtractAPIKey handler.
+func RequestActor(r *http.Request) Actor {
+	actor, ok := r.Context().Value(actorContextKey{}).(Actor)
+	if !ok {
+		panic("developer error: ExtractActor middleware not provided")
+	}
+	return actor
+}
+
+// ExtractActor determines the Actor from the request. It will try to get the
+// following actors in order:
+//   1. UserActor
+//   2. AnonymousActor
+func ExtractActor(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			var (
+				ctx = r.Context()
+				act Actor
+			)
+
+			// Try to get a UserActor.
+			act, ok := UserActorFromRequest(ctx, db, rw, r)
+			if !ok {
+				return
+			}
+
+			// TODO: Dean - WorkspaceActor, SatelliteActor etc.
+
+			// Fallback to an AnonymousActor.
+			if act == nil {
+				act = Anon
+			}
+
+			ctx = context.WithValue(ctx, actorContextKey{}, act)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+			return
+		})
+	}
+}
diff --git a/coderd/access/session/mw_test.go b/coderd/access/session/mw_test.go
@@ -0,0 +1,141 @@
+package session_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/access/session"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+func TestMiddleware(t *testing.T) {
+	t.Parallel()
+
+	successHandler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		// Only called if the API key passes through the handler.
+		httpapi.Write(rw, http.StatusOK, httpapi.Response{
+			Message: "it worked!",
+		})
+	})
+
+	t.Run("NoMiddleware", func(t *testing.T) {
+		t.Parallel()
+
+		require.Panics(t, func() {
+			r := httptest.NewRequest("GET", "/", nil)
+			_ = session.RequestActor(r)
+		})
+	})
+
+	t.Run("UserActor", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("Error", func(t *testing.T) {
+			t.Parallel()
+			var (
+				db = databasefake.New()
+				r  = httptest.NewRequest("GET", "/", nil)
+				rw = httptest.NewRecorder()
+			)
+			r.AddCookie(&http.Cookie{
+				Name:  session.AuthCookie,
+				Value: "invalid-api-key",
+			})
+
+			session.ExtractActor(db)(successHandler).ServeHTTP(rw, r)
+			res := rw.Result()
+			defer res.Body.Close()
+			require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+		})
+
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			var (
+				db       = databasefake.New()
+				u        = newUser(t, db)
+				_, token = newAPIKey(t, db, u, time.Time{}, time.Time{})
+				r        = httptest.NewRequest("GET", "/", nil)
+				rw       = httptest.NewRecorder()
+			)
+			r.AddCookie(&http.Cookie{
+				Name:  session.AuthCookie,
+				Value: token,
+			})
+
+			var (
+				called  int64
+				handler = http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+					atomic.AddInt64(&called, 1)
+
+					// Double check the UserActor.
+					act := session.RequestActor(r)
+					require.NotNil(t, act)
+					require.Equal(t, session.ActorTypeUser, act.Type())
+					require.Equal(t, u.ID.String(), act.ID())
+					require.Equal(t, u.Username, act.Name())
+
+					userActor, ok := act.(session.UserActor)
+					require.True(t, ok)
+					require.Equal(t, u, *userActor.User())
+
+					httpapi.Write(rw, http.StatusOK, httpapi.Response{
+						Message: "success",
+					})
+				})
+			)
+
+			session.ExtractActor(db)(handler).ServeHTTP(rw, r)
+			res := rw.Result()
+			defer res.Body.Close()
+			require.Equal(t, http.StatusOK, res.StatusCode)
+
+			require.EqualValues(t, 1, called)
+		})
+	})
+
+	t.Run("Fallthrough", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			db = databasefake.New()
+			r  = httptest.NewRequest("GET", "/", nil)
+			rw = httptest.NewRecorder()
+		)
+
+		var (
+			called  int64
+			handler = http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+				atomic.AddInt64(&called, 1)
+
+				// Double check the UserActor.
+				act := session.RequestActor(r)
+				require.NotNil(t, act)
+				require.Equal(t, session.ActorTypeAnonymous, act.Type())
+				require.Equal(t, session.AnonymousUserID, act.ID())
+				require.Equal(t, session.AnonymousUserID, act.Name())
+
+				anonActor, ok := act.(session.AnonymousActor)
+				require.True(t, ok)
+				anonActor.Anonymous()
+
+				httpapi.Write(rw, http.StatusOK, httpapi.Response{
+					Message: "success",
+				})
+			})
+		)
+
+		// No auth provided.
+		session.ExtractActor(db)(handler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		require.EqualValues(t, 1, called)
+	})
+}