Merge pull request #13 from bat-bs/reporting

Feat: Add Admin Panel

Author: hofq

api/apiserver.go

@@ -12,6 +12,9 @@ import (
 
 func ApiInit(mux *http.ServeMux, a *auth.Auth) {
 	api := ApiHandler{db.NewDB(), a}
+	mux.HandleFunc("/api2/user/widget", api.GetUserWidget)
+	mux.HandleFunc("/api2/user/logout", api.LogoutUser)
+	mux.HandleFunc("/api2/admin/table/get", api.GetAdminTable)
 	mux.HandleFunc("/api2/table/get", api.GetTable)
 	mux.HandleFunc("/api2/table/entry/save", api.CreateEntry)
 	mux.HandleFunc("/api2/table/entry/delete/", api.DeleteEntry)
@@ -23,6 +26,61 @@ type ApiHandler struct {
 	auth *auth.Auth
 }
 
+func (a *ApiHandler) GetAdminTable(w http.ResponseWriter, r *http.Request) {
+	ok, err := a.auth.ValidateAdminSession(w, r)
+	if err == nil && ok {
+		keys, err := a.db.LookupApiKeyUserOverview()
+		if err != nil {
+			log.Fatal(err)
+		}
+		templ := template.Must(template.New("adminTable.html.templ").Funcs(sprig.FuncMap()).ParseFiles("templates/adminTable.html.templ"))
+
+		if err != nil {
+			panic(err)
+		}
+
+		err = templ.Execute(w, keys)
+		if err != nil {
+			panic(err)
+		}
+	} else {
+		http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+	}
+}
+
+func (a *ApiHandler) LogoutUser(w http.ResponseWriter, r *http.Request) {
+	a.auth.LogoutHandler(w, r)
+
+}
+
+func (a *ApiHandler) GetUserWidget(w http.ResponseWriter, r *http.Request) {
+
+	claims, err := a.auth.GetClaims(r)
+	if err != nil {
+		http.Error(w, "Not Authenticated", http.StatusForbidden)
+		return
+	}
+	claimsDB, err := a.db.GetUser(claims.Sub)
+	if err != nil {
+		log.Println("Could not get Claims from DB")
+		return
+	}
+	userWidgetContent := `
+	<p class="text-xl">{{if .IsAdmin }}<a class="text-sky-400" href="/admin">Admin-Panel</a> - <a class="text-sky-400" href="">Homepage</a>{{ end }} </p><p>Hallo, {{.Name}} <u><a class="text-sky-400" href="/api2/user/logout">logout</a></u></p>
+
+	`
+	userWidget, err := template.New(userWidgetContent).Parse(userWidgetContent)
+	if err != nil {
+		log.Println("Error while templating the pop up")
+		return
+	}
+
+	err = userWidget.Execute(w, claimsDB)
+	if err != nil {
+		log.Println("Error while filling out the Template or writing Response")
+	}
+}
+
 func (a *ApiHandler) GetTable(w http.ResponseWriter, r *http.Request) {
 	// Check if Request is Authenticated
 	if !a.auth.ValidateSessionToken(w, r) {
@@ -34,6 +92,21 @@ func (a *ApiHandler) GetTable(w http.ResponseWriter, r *http.Request) {
 		// If Claims Extraction Failed, user will be Redirected to Update his Token.
 		a.Unauthenticated(w, r)
 	}
+	admin := false
+	log.Println(claims.Roles)
+	for _, group := range claims.Roles {
+		if group == "admin" {
+			admin = true
+		}
+	}
+	// Check/Create user as its the first authenticated action ran
+	u := db.User{
+		Name:    claims.Name,
+		Sub:     claims.Sub,
+		IsAdmin: admin,
+	}
+	a.db.WriteUser(&u)
+
 	keys, err := a.db.LookupApiKeyInfos(claims.Sub)
 	if err != nil {
 		log.Fatal(err)

api/entry.go

@@ -49,7 +49,6 @@ func (a *ApiHandler) CreateEntry(w http.ResponseWriter, r *http.Request) {
 		UUID:        uuid,
 		ApiKey:      a.hashToken(apikey),
 		Owner:       claims.Sub,
-		Groups:      claims.Groups,
 		AiApi:       r.Form.Get("apitype"),
 		Description: r.Form.Get("beschreibung"),
 	}

apiproxy/response.go

@@ -33,11 +33,13 @@ func NewResponse(in *http.Response) error {
 		rs: in,
 		db: db.NewDB(),
 	}
+
 	err := r.ReadValues()
 	if err != nil {
 		return err
 	}
 	go r.ProcessValues()
+	defer r.db.Close()
 	return nil
 }
 

apiproxy/validateToken.go

@@ -36,6 +36,7 @@ func ValidateToken(w http.ResponseWriter, r *http.Request) string {
 	}
 
 	db := db.NewDB()
+	defer db.Close()
 
 	hashes, err := db.LookupApiKeys("*")
 	if err != nil || len(hashes) == 0 {

auth/auth.go

@@ -4,11 +4,15 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/base64"
+	"fmt"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"time"
 
+	db "openai-api-proxy/db"
+
 	"github.com/coreos/go-oidc/v3/oidc"
 	"golang.org/x/oauth2"
 )
@@ -25,6 +29,11 @@ func Init(mux *http.ServeMux) (a *Auth) {
 		// handle error
 		log.Println("Cannot Initiate Provider: ", err)
 	}
+	var claims *ProviderClaims
+	err = provider.Claims(&claims)
+	if err != nil {
+		log.Println("Cannot extract provider Claims for LogoutURL", err)
+	}
 
 	clientId, ok := os.LookupEnv("CLIENT_ID")
 	if !ok {
@@ -50,33 +59,65 @@ func Init(mux *http.ServeMux) (a *Auth) {
 		Endpoint: provider.Endpoint(),
 
 		// "openid" is a required scope for OpenID Connect flows.
-		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+		Scopes: []string{oidc.ScopeOpenID, "profile", "email", "roles"},
 	}
 
 	var verifier = provider.Verifier(&oidc.Config{ClientID: clientId})
 	a = &Auth{
 		oauth2Config: oauth2Config,
 		ctx:          context.Background(),
 		verifier:     verifier,
+		provider:     provider,
+		claims:       claims,
 	}
 	mux.HandleFunc("/callback/", a.CallbackHandler)
 	mux.HandleFunc("/login/", a.LoginHandler)
 	return a
 }
 
+type ProviderClaims struct {
+	EndSessionURL string `json:"end_session_endpoint"`
+}
+
 type Claims struct {
 	Email    string   `json:"email"`
+	Name     string   `json:"name"`
 	Verified bool     `json:"email_verified"`
 	Sub      string   `json:"sub"`
-	Groups   []string `json:"groups"`
+	Roles    []string `json:"roles"`
 }
 
 type Auth struct {
 	oauth2Config *oauth2.Config
 	ctx          context.Context
 	verifier     *oidc.IDTokenVerifier
+	provider     *oidc.Provider
+	claims       *ProviderClaims
 }
 
+func (a *Auth) LogoutHandler(w http.ResponseWriter, r *http.Request) {
+	state, _ := r.Cookie("oauthstate")
+	http.SetCookie(w, &http.Cookie{
+		Name:    "session_token",
+		Path:    "/",
+		Value:   "",
+		Expires: time.Unix(0, 0),
+	})
+	if a.claims.EndSessionURL == "" {
+		http.Error(w, "Logout not implemented by Identity Provider", http.StatusNotImplemented)
+		return
+	}
+	logoutURL, err := url.Parse(a.claims.EndSessionURL)
+	if err != nil {
+		log.Println("Error parsing URL: ", err)
+	}
+	query := logoutURL.Query()
+	query.Set("state", state.Value)
+	query.Set("post_logout_redirect_uri", a.oauth2Config.RedirectURL) // Not implemented by our IDP of Testing https://github.com/zitadel/zitadel/issues/6615
+	logoutURL.RawQuery = query.Encode()
+
+	http.Redirect(w, r, logoutURL.String(), http.StatusTemporaryRedirect)
+}
 func (a *Auth) LoginHandler(w http.ResponseWriter, r *http.Request) {
 
 	// Create oauthState cookie
@@ -127,16 +168,55 @@ func (a *Auth) GetClaims(r *http.Request) (*Claims, error) {
 	var err error
 	// Parse and verify ID Token payload.
 	rawIDToken, err := r.Cookie("session_token")
+	if err != nil {
+		return nil, err
+	}
 	idToken, err := a.verifier.Verify(a.ctx, rawIDToken.Value)
+	if err != nil {
+		return nil, err
+	}
 	claims := &Claims{}
 	// Extract custom claims
-	if err = idToken.Claims(claims); err != nil {
+
+	if err = idToken.Claims(&claims); err != nil {
 		log.Println("Error Extracting User-Claim", err)
 		return nil, err
 		// handle error
 	}
 	return claims, nil
 }
+
+type NotAdmin struct {
+	uid string
+}
+
+func (n *NotAdmin) Error() string {
+	return fmt.Sprintf("User %s has no Admin Role", n.uid)
+}
+
+func (a *Auth) ValidateAdminSession(w http.ResponseWriter, r *http.Request) (bool, error) {
+	authenticated := a.ValidateSessionToken(w, r)
+	if !authenticated {
+		log.Println("Not Authenticated")
+		return false, nil
+	}
+	claims, err := a.GetClaims(r)
+	if err != nil {
+		log.Println("Claims not found")
+		return false, err
+	}
+	db := db.NewDB()
+	defer db.Close()
+	user, err := db.GetUser(claims.Sub)
+	if err != nil {
+		return false, err
+	}
+	if user.IsAdmin {
+		return true, nil
+	}
+	return false, &NotAdmin{uid: claims.Sub}
+}
+
 func (a *Auth) ValidateSessionToken(w http.ResponseWriter, r *http.Request) bool {
 	// Parse and verify ID Token payload.
 	rawIDToken, err := r.Cookie("session_token")