Improve the Header Authentication Method

[obelisk]

This adds more of the code needed to properly authenticate a user based on headers present added by a reverse proxy.

I'm wary of the CSRF token line that's commented out but I must just be missing something there. Also updating users always fails and I assume that's because the login flow never runs with header authentication.

The way this is designed to work is to be put behind a proxy that handles the authentication for you that then passes the request along with newly added trusted headers from the proxy.

Admin vs User level permissions are handled by checking for the presence of specified groups passed along from the proxy.

[javuto]

In other authentication methods I have used a redirect instead of writing the header:

http.Redirect(w, r, forbiddenPath, http.StatusFound)

Do you think we should use WriteHeader instead?

[javuto]

Ditto

[javuto]

Since this authentication method does not require to pre-create users, better follow these steps:
1 - Check if user already exists
2 - If not, create user
3 - Update metadata
I would replace this block (135-138) with the following code:

if !adminUsers.Exists(username) {
  log.Printf("user not found, creating new user: %s", username)
  email := r.Header.Get(headersConfig.TrustedPrefix + headersConfig.Email)
  fullname := r.Header.Get(headersConfig.TrustedPrefix + headersConfig.DisplayName)
  newUser, err := adminUsers.New(username, "", email, fullname, (s["level"] == adminLevel))
  if err != nil {
    log.Printf("error creating user %s: %v", username, err)
    http.Redirect(w, r, forbiddenPath, http.StatusFound)
    return
  }
} else {
  if err := adminUsers.UpdateMetadata(r.RemoteAddr, r.Header.Get("User-Agent"), username); err != nil {
    log.Printf("error updating metadata for user %s: %v", username, err)
  }
}

[javuto]

Added some comments, great job!

[javuto]

There is one string parameter missing, also my bad since I forgot that .New() just creates the AdminUser structure, and in order to complete the creation of the user, it needs a subsequent call to .Create(), for example:

email := r.Header.Get(headersConfig.TrustedPrefix + headersConfig.Email)
newUser, err := adminUsers.New(username, "", email, fullname, (s["level"] == adminLevel))
if err != nil {
  log.Printf("Error with new user %s: %v", username, err)
  http.Redirect(w, r, forbiddenPath, http.StatusFound)
  return
}
if err := adminUsers.Create(newUser); err != nil {
  log.Printf("Error creating user %s: %v", username, err)
  http.Redirect(w, r, forbiddenPath, http.StatusFound)
  return
}

[obelisk]

Troubleshooting this build error

[javuto]

LGTM 🎉