serve whomst data from .well-known

Author: 1lann

handler.go

@@ -61,7 +61,7 @@ type StatusResponse struct {
 	UserDescriptor json.RawMessage `json:"loggedInUser,omitempty"`
 }
 
-func (t *Tmpauth) serveStatus(w http.ResponseWriter, r *http.Request, token *CachedToken) (int, error) {
+func (t *Tmpauth) serveStatus(w http.ResponseWriter, token *CachedToken) (int, error) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
 
@@ -126,6 +126,7 @@ func (t *Tmpauth) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
 	}
 
 	statusRequested := false
+	whomstRequested := false
 
 	if t.Matches(r.URL.Path, "/.well-known/tmpauth/") {
 		if t.miniServerHost != "" {
@@ -170,6 +171,9 @@ func (t *Tmpauth) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
 		case "status":
 			statusRequested = true
 			break
+		case "whomst":
+			whomstRequested = true
+			break
 		default:
 			return http.StatusBadRequest, fmt.Errorf("tmpauth: no such path")
 		}
@@ -225,10 +229,14 @@ func (t *Tmpauth) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
 			})
 		}
 
+		// Not authed, return an empty status or whomst response if requested
 		if statusRequested {
-			return t.serveStatus(w, r, nil)
+			return t.serveStatus(w, nil)
+		} else if whomstRequested {
+			return t.serveWhomst(w, nil)
 		}
 
+		// Begin auth flow
 		if authRequired {
 			return t.StartAuth(w, r)
 		}
@@ -240,8 +248,9 @@ func (t *Tmpauth) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
 		}
 	}
 
+	// Token is available (authenticated, but not necessarily allowed), serve the status response if requested
 	if statusRequested {
-		return t.serveStatus(w, r, cachedToken)
+		return t.serveStatus(w, cachedToken)
 	}
 
 	userAuthorized := false
@@ -267,6 +276,11 @@ func (t *Tmpauth) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error)
 		return http.StatusForbidden, fmt.Errorf("tmpauth: user not in allowed list")
 	}
 
+	// Now serve the whomst response if requested (authenticated and authorized)
+	if whomstRequested {
+		return t.serveWhomst(w, cachedToken)
+	}
+
 	return t.Next(w, r)
 }
 
@@ -374,6 +388,8 @@ func (t *Tmpauth) StartAuth(w http.ResponseWriter, r *http.Request) (int, error)
 	return 0, nil
 }
 
+// authFromCookie attempts to get the auth token from the cookie or the X-Tmpauth-Token header, and returns the
+// cachedToken (if it was successfully parsed), and any error.
 func (t *Tmpauth) authFromCookie(r *http.Request) (*CachedToken, error) {
 	token := r.Header.Get("X-Tmpauth-Token")
 	if token != "" {
@@ -388,6 +404,25 @@ func (t *Tmpauth) authFromCookie(r *http.Request) (*CachedToken, error) {
 	return t.ParseWrappedAuthJWT(cookie.Value)
 }
 
+// serveWhomst returns the entire whomst database if the user is logged in.
+func (t *Tmpauth) serveWhomst(w http.ResponseWriter, token *CachedToken) (int, error) {
+	// If the user is not logged in, return an error
+	if token == nil {
+		return http.StatusUnauthorized, fmt.Errorf("tmpauth: must be logged in to retrieve whomst database")
+	}
+
+	whomstData, err := t.Whomst()
+	if err != nil {
+		return http.StatusInternalServerError, fmt.Errorf("tmpauth: failed to retrieve whomst data: %w", err)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(whomstData)
+
+	return 0, nil
+}
+
 func (t *Tmpauth) Whomst() (map[string]json.RawMessage, error) {
 	var resp *http.Response
 	var respErr error