headscale/gen/api/v1/oas_security_gen.go

// Code generated by ogen, DO NOT EDIT.

package apiv1

import (
	"context"
	"net/http"
	"strings"

	"github.com/go-faster/errors"
	"github.com/ogen-go/ogen/ogenerrors"
)

// SecurityHandler is handler for security parameters.
type SecurityHandler interface {
	// HandleBearerAuth handles bearerAuth security.
	HandleBearerAuth(ctx context.Context, operationName OperationName, t BearerAuth) (context.Context, error)
}

func findAuthorization(h http.Header, prefix string) (string, bool) {
	v, ok := h["Authorization"]
	if !ok {
		return "", false
	}
	for _, vv := range v {
		scheme, value, ok := strings.Cut(vv, " ")
		if !ok || !strings.EqualFold(scheme, prefix) {
			continue
		}
		return value, true
	}
	return "", false
}

// operationRolesBearerAuth is a private map storing roles per operation.
var operationRolesBearerAuth = map[string][]string{
	AuthApproveOperation:       []string{},
	AuthRegisterOperation:      []string{},
	AuthRejectOperation:        []string{},
	BackfillNodeIPsOperation:   []string{},
	CheckPolicyOperation:       []string{},
	CreateApiKeyOperation:      []string{},
	CreatePreAuthKeyOperation:  []string{},
	CreateUserOperation:        []string{},
	DebugCreateNodeOperation:   []string{},
	DeleteApiKeyOperation:      []string{},
	DeleteNodeOperation:        []string{},
	DeletePreAuthKeyOperation:  []string{},
	DeleteUserOperation:        []string{},
	ExpireApiKeyOperation:      []string{},
	ExpireNodeOperation:        []string{},
	ExpirePreAuthKeyOperation:  []string{},
	GetNodeOperation:           []string{},
	GetPolicyOperation:         []string{},
	HealthOperation:            []string{},
	ListApiKeysOperation:       []string{},
	ListNodesOperation:         []string{},
	ListPreAuthKeysOperation:   []string{},
	ListUsersOperation:         []string{},
	RegisterNodeOperation:      []string{},
	RenameNodeOperation:        []string{},
	RenameUserOperation:        []string{},
	SetApprovedRoutesOperation: []string{},
	SetPolicyOperation:         []string{},
	SetTagsOperation:           []string{},
}

// GetRolesForBearerAuth returns the required roles for the given operation.
//
// This is useful for authorization scenarios where you need to know which roles
// are required for an operation.
//
// Example:
//
//	requiredRoles := GetRolesForBearerAuth(AddPetOperation)
//
// Returns nil if the operation has no role requirements or if the operation is unknown.
func GetRolesForBearerAuth(operation string) []string {
	roles, ok := operationRolesBearerAuth[operation]
	if !ok {
		return nil
	}
	// Return a copy to prevent external modification
	result := make([]string, len(roles))
	copy(result, roles)
	return result
}

func (s *Server) securityBearerAuth(ctx context.Context, operationName OperationName, req *http.Request) (context.Context, bool, error) {
	var t BearerAuth
	token, ok := findAuthorization(req.Header, "Bearer")
	if !ok {
		return ctx, false, nil
	}
	t.Token = token
	t.Roles = operationRolesBearerAuth[operationName]
	rctx, err := s.sec.HandleBearerAuth(ctx, operationName, t)
	if errors.Is(err, ogenerrors.ErrSkipServerSecurity) {
		return nil, false, nil
	} else if err != nil {
		return nil, false, err
	}
	return rctx, true, err
}

// SecuritySource is provider of security values (tokens, passwords, etc.).
type SecuritySource interface {
	// BearerAuth provides bearerAuth security value.
	BearerAuth(ctx context.Context, operationName OperationName) (BearerAuth, error)
}

func (s *Client) securityBearerAuth(ctx context.Context, operationName OperationName, req *http.Request) error {
	t, err := s.sec.BearerAuth(ctx, operationName)
	if err != nil {
		return errors.Wrap(err, "security source \"BearerAuth\"")
	}
	req.Header.Set("Authorization", "Bearer "+t.Token)
	return nil
}