|
| 1 | +package code.api.util |
| 2 | + |
| 3 | +import net.liftweb.common.{Box, Empty, Full} |
| 4 | + |
| 5 | +/** |
| 6 | + * Transport-independent parsing of the HTTP `Authorization` header value |
| 7 | + * into the subset of CallContext fields used by the authentication chain. |
| 8 | + * |
| 9 | + * The auth chain in [[APIUtil.getUserAndSessionContextFuture]] identifies which |
| 10 | + * scheme to use (OAuth 2, OAuth 1.0a, DirectLogin, Gateway Login, DAuth) by |
| 11 | + * reading CallContext.authReqHeaderField / directLoginParams / oAuthParams — |
| 12 | + * *not* requestHeaders. Every transport that supports authentication (REST |
| 13 | + * via http4s, gRPC, etc.) must populate these three fields identically, |
| 14 | + * otherwise schemes will silently fail to match and the chain will fall through |
| 15 | + * to "OBP-20080 Authorization Header format is not supported". |
| 16 | + * |
| 17 | + * This helper is the single source of truth for that parsing so that all |
| 18 | + * transports stay in sync. |
| 19 | + */ |
| 20 | +object AuthHeaderParser { |
| 21 | + |
| 22 | + /** Result of parsing an Authorization header value. */ |
| 23 | + final case class ParsedAuthHeader( |
| 24 | + authReqHeaderField: Box[String], |
| 25 | + directLoginParams: Map[String, String], |
| 26 | + oAuthParams: Map[String, String] |
| 27 | + ) |
| 28 | + |
| 29 | + private val EmptyParsed: ParsedAuthHeader = |
| 30 | + ParsedAuthHeader(Empty, Map.empty, Map.empty) |
| 31 | + |
| 32 | + private val DirectLoginAllowedParameters: List[String] = |
| 33 | + List("consumer_key", "token", "username", "password") |
| 34 | + |
| 35 | + /** |
| 36 | + * Parse an Authorization header value (e.g. "Bearer eyJ...", "DirectLogin token=...", |
| 37 | + * 'OAuth oauth_consumer_key="..."') into the auth-related CallContext fields. |
| 38 | + * |
| 39 | + * Returns empty fields when no header value is present. |
| 40 | + */ |
| 41 | + def parseAuthorizationHeader(authHeaderValue: Option[String]): ParsedAuthHeader = |
| 42 | + authHeaderValue match { |
| 43 | + case None => EmptyParsed |
| 44 | + case Some(value) => |
| 45 | + ParsedAuthHeader( |
| 46 | + authReqHeaderField = Full(value), |
| 47 | + directLoginParams = if (value.contains("DirectLogin")) parseDirectLoginHeader(value) else Map.empty, |
| 48 | + oAuthParams = if (value.startsWith("OAuth ")) parseOAuthHeader(value) else Map.empty |
| 49 | + ) |
| 50 | + } |
| 51 | + |
| 52 | + /** |
| 53 | + * Parse a DirectLogin header value into its named parameters. |
| 54 | + * Accepts both: |
| 55 | + * - `DirectLogin token="xxx", username="yyy"` (old Authorization header format, with prefix) |
| 56 | + * - `token="xxx", username="yyy"` (new dedicated `DirectLogin:` header, no prefix) |
| 57 | + * |
| 58 | + * Only the whitelisted parameters (`consumer_key`, `token`, `username`, `password`) |
| 59 | + * are kept. Mirrors Lift's getAllParameters in directlogin.scala. |
| 60 | + */ |
| 61 | + def parseDirectLoginHeader(headerValue: String): Map[String, String] = { |
| 62 | + val cleanedParameterList = headerValue.stripPrefix("DirectLogin").split(",").map(_.trim).toList |
| 63 | + cleanedParameterList.flatMap { input => |
| 64 | + if (input.contains("=")) { |
| 65 | + val split = input.split("=", 2) |
| 66 | + val paramName = split(0).trim |
| 67 | + val paramValue = split(1).replaceAll("^\"|\"$", "").trim |
| 68 | + if (DirectLoginAllowedParameters.contains(paramName) && paramValue.nonEmpty) |
| 69 | + Some(paramName -> paramValue) |
| 70 | + else |
| 71 | + None |
| 72 | + } else { |
| 73 | + None |
| 74 | + } |
| 75 | + }.toMap |
| 76 | + } |
| 77 | + |
| 78 | + /** |
| 79 | + * Parse an OAuth 1.0a Authorization header value into its named parameters. |
| 80 | + * Format: `OAuth oauth_consumer_key="xxx", oauth_token="yyy", ...` |
| 81 | + */ |
| 82 | + def parseOAuthHeader(headerValue: String): Map[String, String] = { |
| 83 | + val oauthPart = headerValue.stripPrefix("OAuth ").trim |
| 84 | + val pattern = """(\w+)="([^"]*)"""".r |
| 85 | + pattern.findAllMatchIn(oauthPart).map(m => m.group(1) -> m.group(2)).toMap |
| 86 | + } |
| 87 | +} |
0 commit comments