coder · deansheather · Apr 6, 2022 · Apr 6, 2022 · Apr 7, 2022 · Apr 7, 2022
diff --git a/coderd/access/session/actor.go b/coderd/access/session/actor.go
@@ -0,0 +1,41 @@
+package session
+
+import (
+	"github.com/coder/coder/coderd/database"
+)
+
+// ActorType is an enum of all types of Actors.
+type ActorType string
+
+// ActorTypes.
+const (
+	ActorTypeUser ActorType = "user"
+	// TODO: Dean - WorkspaceActor and SatelliteActor
+)
+
+// Actor represents an unauthenticated or authenticated client accessing the
+// API. To check authorization, callers should call pass the Actor into the
+// authz package to assert access.
+type Actor interface {
+	// Type is the type of actor as an enum. This method exists rather than
+	// switching on `actor.(type)` because doing a type switch is ~63% slower
+	// according to a benchmark that Dean made. This performance difference adds
+	// up over time because we will call this method on most requests.
+	Type() ActorType
+	// ID is the unique ID of the actor for logging purposes.
+	ID() string
+	// Name is a friendly, but consistent, name for the actor for logging
+	// purposes. E.g. "deansheather"
+	Name() string
+
+	// TODO: Steven - RBAC methods
+}
+
+// UserActor represents an authenticated user actor. Any consumers that wish to
+// check if the actor is a user (and access user fields such as User.ID) can
+// do a checked type cast from Actor to UserActor.
+type UserActor interface {
+	Actor
+	User() *database.User
+	APIKey() *database.APIKey
+}
diff --git a/coderd/access/session/doc.go b/coderd/access/session/doc.go
@@ -0,0 +1,7 @@
+// Package session provides session authentication via middleware for the Coder
+// HTTP API. It also exposes the Actor type, which is the intermediary layer
+// between identity and RBAC authorization.
+//
+// The Actor types exposed by this package are consumed by the authz packages to
+// determine if a request is authorized to perform an API action.
+package session
diff --git a/coderd/access/session/mw.go b/coderd/access/session/mw.go
@@ -0,0 +1,49 @@
+package session
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/coder/coder/coderd/database"
+)
+
+type actorContextKey struct{}
+
+// APIKey returns the API key from the ExtractAPIKey handler. The returned Actor
+// may be nil if the request was unauthenticated.
+//
+// Depends on ExtractActor middleware.
+func RequestActor(r *http.Request) Actor {
+	actor, ok := r.Context().Value(actorContextKey{}).(Actor)
+	if !ok {
+		return nil
+	}
+	return actor
+}
+
+// ExtractActor determines the Actor from the request. It will try to get the
+// following actors in order:
+//   1. UserActor
+//   2. AnonymousActor
+func ExtractActor(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			var (
+				ctx = r.Context()
+				act Actor
+			)
+
+			// Try to get a UserActor.
+			act, ok := UserActorFromRequest(ctx, db, rw, r)
+			if !ok {
+				return
+			}
+
+			// TODO: Dean - WorkspaceActor, SatelliteActor etc.
+
+			ctx = context.WithValue(ctx, actorContextKey{}, act)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+			return
+		})
+	}
+}
diff --git a/coderd/access/session/mw_internal_test.go b/coderd/access/session/mw_internal_test.go
@@ -0,0 +1,124 @@
+package session
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+func TestMiddleware(t *testing.T) {
+	t.Parallel()
+
+	successHandler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		// Only called if the API key passes through the handler.
+		httpapi.Write(rw, http.StatusOK, httpapi.Response{
+			Message: "it worked!",
+		})
+	})
+
+	t.Run("UserActor", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("Error", func(t *testing.T) {
+			t.Parallel()
+			var (
+				db = databasefake.New()
+				r  = httptest.NewRequest("GET", "/", nil)
+				rw = httptest.NewRecorder()
+			)
+			r.AddCookie(&http.Cookie{
+				Name:  AuthCookie,
+				Value: "invalid-api-key",
+			})
+
+			ExtractActor(db)(successHandler).ServeHTTP(rw, r)
+			res := rw.Result()
+			defer res.Body.Close()
+			require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+		})
+
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			var (
+				db       = databasefake.New()
+				u        = newUser(t, db)
+				_, token = newAPIKey(t, db, u, time.Time{}, time.Time{})
+				r        = httptest.NewRequest("GET", "/", nil)
+				rw       = httptest.NewRecorder()
+			)
+			r.AddCookie(&http.Cookie{
+				Name:  AuthCookie,
+				Value: token,
+			})
+
+			var (
+				called  int64
+				handler = http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+					atomic.AddInt64(&called, 1)
+
+					// Double check the UserActor.
+					act := RequestActor(r)
+					require.NotNil(t, act)
+					require.Equal(t, ActorTypeUser, act.Type())
+					require.Equal(t, u.ID.String(), act.ID())
+					require.Equal(t, u.Username, act.Name())
+
+					userActor, ok := act.(UserActor)
+					require.True(t, ok)
+					require.Equal(t, u, *userActor.User())
+
+					httpapi.Write(rw, http.StatusOK, httpapi.Response{
+						Message: "success",
+					})
+				})
+			)
+
+			ExtractActor(db)(handler).ServeHTTP(rw, r)
+			res := rw.Result()
+			defer res.Body.Close()
+			require.Equal(t, http.StatusOK, res.StatusCode)
+
+			require.EqualValues(t, 1, called)
+		})
+	})
+
+	t.Run("Fallthrough", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			db = databasefake.New()
+			r  = httptest.NewRequest("GET", "/", nil)
+			rw = httptest.NewRecorder()
+		)
+
+		var (
+			called  int64
+			handler = http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+				atomic.AddInt64(&called, 1)
+
+				// Actor should be nil.
+				act := RequestActor(r)
+				require.Nil(t, act)
+
+				httpapi.Write(rw, http.StatusOK, httpapi.Response{
+					Message: "success",
+				})
+			})
+		)
+
+		// No auth provided.
+		ExtractActor(db)(handler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		require.EqualValues(t, 1, called)
+	})
+}
diff --git a/coderd/access/session/user.go b/coderd/access/session/user.go
@@ -0,0 +1,174 @@
+package session
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"database/sql"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+const (
+	// AuthCookie represents the name of the cookie the API key is stored in.
+	AuthCookie = "session_token"
+
+	// nolint:gosec // this is not a credential
+	apiKeyInvalidMessage = "API key is invalid"
+	apiKeyLifetime       = 24 * time.Hour
+)
+
+type userActor struct {
+	user   database.User
+	apiKey database.APIKey
+}
+
+var _ UserActor = &userActor{}
+
+func NewUserActor(u database.User, apiKey database.APIKey) UserActor {
+	return &userActor{
+		user:   u,
+		apiKey: apiKey,
+	}
+}
+
+func (*userActor) Type() ActorType {
+	return ActorTypeUser
+}
+
+func (ua *userActor) ID() string {
+	return ua.user.ID.String()
+}
+
+func (ua *userActor) Name() string {
+	return ua.user.Username
+}
+
+func (ua *userActor) User() *database.User {
+	return &ua.user
+}
+
+func (ua *userActor) APIKey() *database.APIKey {
+	return &ua.apiKey
+}
+
+// UserActorFromRequest tries to get a UserActor from the API key supplied in
+// the request cookies. If the cookie doesn't exist, nil is returned. If there
+// was an error that was responded to, false is returned.
+//
+// You should probably be calling session.ExtractActor as a middleware, or
+// session.RequestActor instead.
+func UserActorFromRequest(ctx context.Context, db database.Store, rw http.ResponseWriter, r *http.Request) (UserActor, bool) {
+	cookie, err := r.Cookie(AuthCookie)
+	if err != nil || cookie.Value == "" {
+		// No cookie provided, return true so any actor handlers further down
+		// the chain can make their attempt.
+		return nil, true
+	}
+
+	// TODO: Dean - workspace agent token auth should not share the same cookie
+	// name as regular auth
+	if strings.Count(cookie.Value, "-") == 4 {
+		// Skip anything that looks like a UUID for now.
+		return nil, true
+	}
+
+	keyID, _, hashedSecret, err := parseAPIKey(cookie.Value)
+	if err != nil {
+		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+			Message: fmt.Sprintf("invalid API key cookie %q: %v", AuthCookie, err),
+		})
+		return nil, false
+	}
+
+	// Get the API key from the database.
+	key, err := db.GetAPIKeyByID(ctx, keyID)
+	if xerrors.Is(err, sql.ErrNoRows) {
+		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+			Message: apiKeyInvalidMessage,
+		})
+		return nil, false
+	}
+	if err != nil {
+		httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+			Message: fmt.Sprintf("get API key by id: %s", err.Error()),
+		})
+		return nil, false
+	}
+
+	// Checking to see if the secret is valid.
+	if subtle.ConstantTimeCompare(key.HashedSecret, hashedSecret[:]) != 1 {
+		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+			Message: apiKeyInvalidMessage,
+		})
+		return nil, false
+	}
+
+	// Check if the key has expired.
+	now := database.Now()
+	if key.ExpiresAt.Before(now) {
+		httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+			Message: apiKeyInvalidMessage,
+		})
+		return nil, false
+	}
+
+	// TODO: Dean - check if the corresponding OIDC or OAuth token has expired
+	// once OIDC is implemented
+
+	// Only update LastUsed and key expiry once an hour to prevent database
+	// spam.
+	if now.Sub(key.LastUsed) > time.Hour || key.ExpiresAt.Sub(now) <= apiKeyLifetime-time.Hour {
+		err := db.UpdateAPIKeyByID(ctx, database.UpdateAPIKeyByIDParams{
+			ID:               key.ID,
+			ExpiresAt:        now.Add(apiKeyLifetime),
+			LastUsed:         now,
+			OIDCAccessToken:  key.OIDCAccessToken,
+			OIDCRefreshToken: key.OIDCRefreshToken,
+			OIDCExpiry:       key.OIDCExpiry,
+		})
+		if err != nil {
+			httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+				Message: fmt.Sprintf("could not refresh API key: %s", err.Error()),
+			})
+			return nil, false
+		}
+	}
+
+	// Get the associated user.
+	u, err := db.GetUserByID(ctx, key.UserID)
+	if err != nil {
+		httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+			Message: fmt.Sprintf("could not fetch current user: %s", err.Error()),
+		})
+		return nil, false
+	}
+
+	return NewUserActor(u, key), true
+}
+
+func parseAPIKey(apiKey string) (id, secret string, hashed []byte, err error) {
+	// APIKeys are formatted: ${id}-${secret}. The ID is 10 characters and the
+	// secret is 22.
+	parts := strings.Split(apiKey, "-")
+	if len(parts) != 2 || len(parts[0]) != 10 || len(parts[1]) != 22 {
+		return "", "", nil, xerrors.New("invalid API key format")
+	}
+
+	// We hash the secret before getting the key from the database to ensure we
+	// keep this function fixed time.
+	var (
+		keyID        = parts[0]
+		keySecret    = parts[1]
+		hashedSecret = sha256.Sum256([]byte(keySecret))
+	)
+
+	return keyID, keySecret, hashedSecret[:], nil
+}