`d3a1df9`

middleware/pat: JSON envelope on 401/403, set X-OAuth-Scopes header

Authored by mfwolffe <wolffemf@dukes.jmu.edu> yesterday

SHA: d3a1df9809c4ea7332d72a8501bfea8d80b254ba
Parents: 9191613
Tree: ed77f98

1 changed file

Status	File	+	-
M	`internal/web/middleware/pat.go`	64	6

internal/web/middleware/pat.gomodified

  				}()
+ 			}
 +			// X-OAuth-Scopes echoes the token's scopes on every response —
 +			// even errors emitted further down the chain — so the CLI's
 +			// error path (shithub-cli/internal/api/errors.go) can report
 +			// provided scopes alongside the required scope on 403.
 +			w.Header().Set("X-OAuth-Scopes", strings.Join(row.Scopes, ", "))
++
  			ctx := context.WithValue(r.Context(), patAuthKey, PATAuth{
  				UserID:      row.UserID,
  				Username:    user.Username,
  // RequireScope rejects with 403 if the request was authenticated via PAT
  // and the token's scopes don't include required. Pure-session callers
  // (PATAuth zero) pass through — sessions have implicit full scope.
 +//
 +// The 403 response is the canonical /api/v1 JSON envelope
 +// `{"error": "token lacks required scope: <scope>"}` and carries
 +// X-Accepted-OAuth-Scopes so the CLI can format an actionable error
 +// without parsing the message body.
  func RequireScope(required pat.Scope) func(http.Handler) http.Handler {
  	return func(next http.Handler) http.Handler {
  		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  				return
+ 			}
  			if !pat.HasScope(auth.Scopes, required) {
 -				w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 -				w.WriteHeader(http.StatusForbidden)
 -				_, _ = w.Write([]byte("token lacks required scope: " + string(required) + "\n"))
 +				w.Header().Set("X-Accepted-OAuth-Scopes", string(required))
 +				writeAPIJSONError(w, http.StatusForbidden, "token lacks required scope: "+string(required))
  				return
+ 			}
  			next.ServeHTTP(w, r)
+ 	}
+ }
 +// writeAPIJSONError writes the canonical /api/v1 error envelope. Kept
 +// inline so package middleware doesn't depend on the api handler package
 +// (which would import-cycle).
 +func writeAPIJSONError(w http.ResponseWriter, status int, msg string) {
 +	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 +	w.Header().Set("Cache-Control", "no-store")
 +	w.WriteHeader(status)
 +	// Escape the inner message just enough for embedding in a JSON
 +	// string literal. The reason strings here are package-controlled —
 +	// no user input — but defensive escaping keeps this honest if a
 +	// caller ever passes through external data.
 +	_, _ = w.Write([]byte(`{"error":` + jsonString(msg) + `}` + "\n"))
 +}
++
 +// jsonString returns s wrapped in JSON-string quoting, escaping the
 +// minimum required characters. Avoiding encoding/json here keeps
 +// allocations down on the hot challenge path.
 +func jsonString(s string) string {
 +	var b strings.Builder
 +	b.Grow(len(s) + 2)
 +	b.WriteByte('"')
 +	for _, r := range s {
 +		switch r {
 +		case '"', '\\':
 +			b.WriteByte('\\')
 +			b.WriteRune(r)
 +		case '\n':
 +			b.WriteString(`\n`)
 +		case '\r':
 +			b.WriteString(`\r`)
 +		case '\t':
 +			b.WriteString(`\t`)
 +		default:
 +			if r < 0x20 {
 +				// Control chars: emit as \u00XX.
 +				const hex = "0123456789abcdef"
 +				b.WriteString(`\u00`)
 +				b.WriteByte(hex[byte(r)>>4])
 +				b.WriteByte(hex[byte(r)&0x0f])
 +				continue
 +			}
 +			b.WriteRune(r)
 +		}
 +	}
 +	b.WriteByte('"')
 +	return b.String()
 +}
++
  // errNoCredentials is the sentinel that says "no Authorization header at
  // all" — distinct from "Authorization present but malformed."
  var errNoCredentials = errors.New("middleware: no credentials")
+ }
  // writePATChallenge writes the canonical 401 with a Bearer challenge.
 +// Body is the /api/v1 JSON error envelope so the shithub-cli client and
 +// any other JSON consumer can decode the failure uniformly.
  func writePATChallenge(w http.ResponseWriter, realm, reason string) {
  	w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`", error="invalid_token", error_description="`+reason+`"`)
 -	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 -	w.WriteHeader(http.StatusUnauthorized)
 -	_, _ = w.Write([]byte(reason + "\n"))
 +	writeAPIJSONError(w, http.StatusUnauthorized, reason)
+ }
  // remoteAddrFromRequest pulls the client IP for last_used_ip. Reuses the