feat: add shared backend authorization seams

backend/internal/publicapi/auth.go

@@ -0,0 +1,162 @@
+// Package publicapi authenticates public API clients and internal workers.
+// Runtime configuration is parsed once and injected into an Authenticator;
+// this package deliberately does not read process environment variables.
+package publicapi
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+)
+
+const ownerPartLimit = 96
+
+type PublicClient struct {
+	ID  string
+	Key string
+}
+
+type Config struct {
+	APIKeys             string
+	InternalWorkerToken string
+	Production          bool
+}
+
+type AuthError struct {
+	Status  int
+	Message string
+}
+
+func (e *AuthError) Error() string {
+	return e.Message
+}
+
+type Authenticator struct {
+	clients             []PublicClient
+	internalWorkerToken string
+	production          bool
+}
+
+func NewAuthenticator(config Config) *Authenticator {
+	return &Authenticator{
+		clients:             ParseClients(config.APIKeys),
+		internalWorkerToken: strings.TrimSpace(config.InternalWorkerToken),
+		production:          config.Production,
+	}
+}
+
+func ParseClients(configured string) []PublicClient {
+	entries := strings.FieldsFunc(configured, func(character rune) bool {
+		return character == ',' || character == '\n'
+	})
+	clients := make([]PublicClient, 0, len(entries))
+	for _, rawEntry := range entries {
+		entry := strings.TrimSpace(rawEntry)
+		if entry == "" {
+			continue
+		}
+
+		id := "default"
+		key := entry
+		if separator := strings.IndexByte(entry, ':'); separator >= 0 {
+			id = strings.TrimSpace(entry[:separator])
+			key = strings.TrimSpace(entry[separator+1:])
+		}
+		if id == "" || key == "" {
+			continue
+		}
+		clients = append(clients, PublicClient{ID: id, Key: key})
+	}
+	return clients
+}
+
+func (a *Authenticator) Authenticate(request *http.Request) (PublicClient, string, error) {
+	presented := publicCredential(request)
+	if presented == "" {
+		return PublicClient{}, "", &AuthError{Status: http.StatusUnauthorized, Message: "Missing API key."}
+	}
+	for _, client := range a.clients {
+		if secureEqual(client.Key, presented) {
+			return client, OwnerID(client.ID), nil
+		}
+	}
+	return PublicClient{}, "", &AuthError{Status: http.StatusUnauthorized, Message: "Invalid API key."}
+}
+
+func (a *Authenticator) AssertInternalWorker(request *http.Request) error {
+	if a.internalWorkerToken == "" && !a.production {
+		return nil
+	}
+	if a.internalWorkerToken == "" {
+		return &AuthError{Status: http.StatusInternalServerError, Message: "Worker token is not configured."}
+	}
+
+	presented := request.Header.Get("x-zhinian-worker-token")
+	if presented == "" {
+		presented = bearerToken(request)
+	}
+	if presented == "" || !secureEqual(a.internalWorkerToken, presented) {
+		return &AuthError{Status: http.StatusUnauthorized, Message: "Invalid worker token."}
+	}
+	return nil
+}
+
+func OwnerID(id string) string {
+	part := sanitizeOwnerPart(id)
+	if part == "" {
+		part = "unknown"
+	}
+	return "api:" + part
+}
+
+func publicCredential(request *http.Request) string {
+	if token := bearerToken(request); token != "" {
+		return token
+	}
+	return request.Header.Get("x-zhinian-api-key")
+}
+
+func bearerToken(request *http.Request) string {
+	authorization := request.Header.Get("authorization")
+	separator := strings.IndexAny(authorization, " \t\r\n\v\f")
+	if separator <= 0 || !strings.EqualFold(authorization[:separator], "Bearer") {
+		return ""
+	}
+	if strings.TrimLeft(authorization[separator:], " \t\r\n\v\f") == authorization[separator:] {
+		return ""
+	}
+	return strings.TrimSpace(authorization[separator:])
+}
+
+func secureEqual(expected, presented string) bool {
+	if len(expected) != len(presented) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(expected), []byte(presented)) == 1
+}
+
+func sanitizeOwnerPart(value string) string {
+	part := make([]byte, 0, min(len(value), ownerPartLimit))
+	invalidRun := false
+	for _, character := range value {
+		if isOwnerCharacter(character) {
+			invalidRun = false
+			if len(part) < ownerPartLimit {
+				part = append(part, byte(character))
+			}
+			continue
+		}
+		if !invalidRun && len(part) < ownerPartLimit {
+			part = append(part, '_')
+		}
+		invalidRun = true
+	}
+	return string(part)
+}
+
+func isOwnerCharacter(character rune) bool {
+	return character >= 'A' && character <= 'Z' ||
+		character >= 'a' && character <= 'z' ||
+		character >= '0' && character <= '9' ||
+		strings.ContainsRune("_.:@-", character)
+}