auth.go

package main

import (
	"context"
	"crypto/hmac"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"io"
	"log"
	"net"
	"net/http"
	"net/url"
	"os"
	"path/filepath"
	"strings"
	"sync"
	"time"
)

type AuthConfig struct {
	ClientID      string
	ClientSecret  string
	SessionSecret []byte
	CookieDomain  string
	GitHubOrg     string
	AllowedUsers  map[string]bool
}

type AuthClaims struct {
	Username  string `json:"sub"`
	AvatarURL string `json:"avatar"`
	ExpiresAt int64  `json:"exp"`
}

type User struct {
	Username  string
	AvatarURL string
}

type contextKey string

const userContextKey contextKey = "user"

// contributorCache caches authorized usernames so we don't re-check GitHub every request.
var contributorCache = struct {
	sync.RWMutex
	users map[string]time.Time
}{users: make(map[string]time.Time)}

func userFromContext(r *http.Request) *User {
	u, _ := r.Context().Value(userContextKey).(*User)
	return u
}

func (s *Server) isLocal() bool {
	return strings.HasPrefix(s.config.Domain, "localhost") || strings.HasPrefix(s.config.Domain, "127.0.0.1")
}

func (s *Server) baseURL() string {
	if s.isLocal() {
		return "http://" + s.config.Domain
	}
	return "https://" + s.config.Domain
}

// --- Cookie signing ---

func (s *Server) signCookie(claims AuthClaims) (string, error) {
	payload, err := json.Marshal(claims)
	if err != nil {
		return "", err
	}
	encoded := base64.RawURLEncoding.EncodeToString(payload)
	mac := hmac.New(sha256.New, s.auth.SessionSecret)
	mac.Write([]byte(encoded))
	sig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
	return encoded + "." + sig, nil
}

func (s *Server) verifyCookie(value string) (*AuthClaims, bool) {
	parts := strings.SplitN(value, ".", 2)
	if len(parts) != 2 {
		return nil, false
	}
	mac := hmac.New(sha256.New, s.auth.SessionSecret)
	mac.Write([]byte(parts[0]))
	expectedSig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
	if !hmac.Equal([]byte(parts[1]), []byte(expectedSig)) {
		return nil, false
	}
	payload, err := base64.RawURLEncoding.DecodeString(parts[0])
	if err != nil {
		return nil, false
	}
	var claims AuthClaims
	if err := json.Unmarshal(payload, &claims); err != nil {
		return nil, false
	}
	if time.Now().Unix() > claims.ExpiresAt {
		return nil, false
	}
	return &claims, true
}

// --- Middleware ---

func (s *Server) authMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		host := r.Host
		if h, _, err := net.SplitHostPort(host); err == nil {
			host = h
		}

		// Always allow auth endpoints on the main domain
		// Compare against domain with and without port
		mainDomain := s.config.Domain
		if h, _, err := net.SplitHostPort(mainDomain); err == nil {
			mainDomain = h
		}
		if (host == mainDomain || r.Host == s.config.Domain) && strings.HasPrefix(r.URL.Path, "/auth/") {
			next.ServeHTTP(w, r)
			return
		}
		// Always allow Caddy's domain check (internal)
		if r.URL.Path == "/api/check-domain" {
			next.ServeHTTP(w, r)
			return
		}
		// In local dev, skip auth for PR subdomains — *.localhost cookies
		// are unreliable across browsers. In prod the cookie domain works fine.
		if s.isLocal() && host != mainDomain {
			next.ServeHTTP(w, r)
			return
		}

		// Check session cookie
		cookie, err := r.Cookie("tl_preview")
		if err != nil {
			s.sendUnauth(w, r)
			return
		}
		claims, ok := s.verifyCookie(cookie.Value)
		if !ok {
			s.sendUnauth(w, r)
			return
		}

		user := &User{Username: claims.Username, AvatarURL: claims.AvatarURL}
		ctx := context.WithValue(r.Context(), userContextKey, user)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

func (s *Server) sendUnauth(w http.ResponseWriter, r *http.Request) {
	if strings.HasPrefix(r.URL.Path, "/api/") {
		jsonError(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	http.Redirect(w, r, s.baseURL()+"/auth/login", http.StatusFound)
}

// --- OAuth handlers ---

func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
	// Generate CSRF state
	stateBytes := make([]byte, 16)
	rand.Read(stateBytes)
	state := hex.EncodeToString(stateBytes)

	http.SetCookie(w, &http.Cookie{
		Name:     "tl_oauth_state",
		Value:    state,
		Path:     "/auth/",
		MaxAge:   600,
		HttpOnly: true,
		Secure:   !s.isLocal(),
		SameSite: http.SameSiteLaxMode,
	})

	params := url.Values{
		"client_id":    {s.auth.ClientID},
		"redirect_uri": {s.baseURL() + "/auth/callback"},
		"scope":        {"read:org read:user"},
		"state":        {state},
	}

	http.Redirect(w, r, "https://github.com/login/oauth/authorize?"+params.Encode(), http.StatusFound)
}

func (s *Server) handleOAuthCallback(w http.ResponseWriter, r *http.Request) {
	// Verify state
	stateCookie, err := r.Cookie("tl_oauth_state")
	if err != nil || stateCookie.Value != r.URL.Query().Get("state") {
		http.Error(w, "Invalid OAuth state", http.StatusBadRequest)
		return
	}

	code := r.URL.Query().Get("code")
	if code == "" {
		http.Error(w, "Missing code", http.StatusBadRequest)
		return
	}

	// Exchange code for access token
	token, err := s.exchangeCode(code)
	if err != nil {
		log.Printf("OAuth token exchange failed: %v", err)
		http.Error(w, "Authentication failed", http.StatusInternalServerError)
		return
	}

	// Get user info
	username, avatarURL, err := s.getGitHubUser(token)
	if err != nil {
		log.Printf("Failed to get GitHub user: %v", err)
		http.Error(w, "Failed to get user info", http.StatusInternalServerError)
		return
	}

	// Check if authorized
	if !s.isAuthorized(username, token) {
		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		w.WriteHeader(http.StatusForbidden)
		fmt.Fprintf(w, `<!DOCTYPE html>
<html><head><meta charset="utf-8"><title>Access Denied</title>
<style>
body { background: #0e0e16; color: #e0e0ef; font-family: -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; }
.card { background: #171723; border: 1px solid #2a2a3d; border-radius: 10px; padding: 2rem; max-width: 440px; text-align: center; }
h2 { font-size: 1.1rem; margin-bottom: 0.5rem; }
p { color: #8888a0; font-size: 0.85rem; line-height: 1.6; }
a { color: #9b7fff; }
</style></head><body>
<div class="card">
<h2>Access Denied</h2>
<p>Sorry <strong>%s</strong>, this preview service is available to TheLounge contributors.</p>
<p>You need to be a <a href="https://github.com/thelounge">thelounge</a> org member or have a merged PR to <a href="https://github.com/thelounge/thelounge">thelounge/thelounge</a>.</p>
</div></body></html>`, username)
		return
	}

	log.Printf("User %s authenticated successfully", username)

	// Set session cookie
	claims := AuthClaims{
		Username:  username,
		AvatarURL: avatarURL,
		ExpiresAt: time.Now().Add(7 * 24 * time.Hour).Unix(),
	}
	cookieValue, err := s.signCookie(claims)
	if err != nil {
		http.Error(w, "Failed to create session", http.StatusInternalServerError)
		return
	}

	http.SetCookie(w, &http.Cookie{
		Name:     "tl_preview",
		Value:    cookieValue,
		Path:     "/",
		Domain:   s.auth.CookieDomain,
		MaxAge:   7 * 24 * 60 * 60,
		HttpOnly: true,
		Secure:   !s.isLocal(),
		SameSite: http.SameSiteLaxMode,
	})

	// Clear state cookie
	http.SetCookie(w, &http.Cookie{
		Name:   "tl_oauth_state",
		Path:   "/auth/",
		MaxAge: -1,
	})

	http.Redirect(w, r, s.baseURL()+"/", http.StatusFound)
}

func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
	http.SetCookie(w, &http.Cookie{
		Name:   "tl_preview",
		Path:   "/",
		Domain: s.auth.CookieDomain,
		MaxAge: -1,
	})
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	fmt.Fprintf(w, `<!DOCTYPE html>
<html><head><meta charset="utf-8"><title>Logged out</title>
<style>
body { background: #0e0e16; color: #e0e0ef; font-family: -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; }
.card { background: #171723; border: 1px solid #2a2a3d; border-radius: 10px; padding: 2rem; max-width: 440px; text-align: center; }
a { color: #9b7fff; text-decoration: none; border: 1px solid #2a2a3d; padding: 0.5rem 1rem; border-radius: 6px; display: inline-block; margin-top: 1rem; }
a:hover { border-color: #7c5cff; }
</style></head><body>
<div class="card">
<p>You've been logged out.</p>
<a href="/auth/login">Sign in again</a>
</div></body></html>`)
}

// --- GitHub API helpers ---

func (s *Server) exchangeCode(code string) (string, error) {
	data := url.Values{
		"client_id":     {s.auth.ClientID},
		"client_secret": {s.auth.ClientSecret},
		"code":          {code},
	}
	req, _ := http.NewRequest("POST", "https://github.com/login/oauth/access_token", strings.NewReader(data.Encode()))
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	var result struct {
		AccessToken string `json:"access_token"`
		Error       string `json:"error"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return "", err
	}
	if result.Error != "" {
		return "", fmt.Errorf("oauth error: %s", result.Error)
	}
	return result.AccessToken, nil
}

func (s *Server) getGitHubUser(token string) (username, avatarURL string, err error) {
	req, _ := http.NewRequest("GET", "https://api.github.com/user", nil)
	req.Header.Set("Authorization", "token "+token)
	req.Header.Set("Accept", "application/vnd.github.v3+json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return "", "", err
	}
	defer resp.Body.Close()

	var user struct {
		Login     string `json:"login"`
		AvatarURL string `json:"avatar_url"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
		return "", "", err
	}
	return user.Login, user.AvatarURL, nil
}

func (s *Server) isAuthorized(username, token string) bool {
	// Manual allowlist
	if s.auth.AllowedUsers[strings.ToLower(username)] {
		log.Printf("User %s authorized via allowlist", username)
		return true
	}

	// Check contributor cache
	contributorCache.RLock()
	if t, ok := contributorCache.users[username]; ok && time.Since(t) < 24*time.Hour {
		contributorCache.RUnlock()
		return true
	}
	contributorCache.RUnlock()

	authorized := s.checkOrgMember(username, token) || s.checkMergedPRs(username, token)

	if authorized {
		contributorCache.Lock()
		contributorCache.users[username] = time.Now()
		contributorCache.Unlock()
	}

	return authorized
}

func (s *Server) checkOrgMember(username, token string) bool {
	url := fmt.Sprintf("https://api.github.com/user/memberships/orgs/%s", s.auth.GitHubOrg)
	req, _ := http.NewRequest("GET", url, nil)
	req.Header.Set("Authorization", "token "+token)
	req.Header.Set("Accept", "application/vnd.github.v3+json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Printf("Org membership check failed: %v", err)
		return false
	}
	defer resp.Body.Close()
	io.Copy(io.Discard, resp.Body)

	if resp.StatusCode == 200 {
		log.Printf("User %s is a %s org member", username, s.auth.GitHubOrg)
		return true
	}
	return false
}

func (s *Server) checkMergedPRs(username, token string) bool {
	q := fmt.Sprintf("repo:%s type:pr author:%s is:merged", s.config.GitHubRepo, username)
	searchURL := fmt.Sprintf("https://api.github.com/search/issues?q=%s&per_page=1", url.QueryEscape(q))
	req, _ := http.NewRequest("GET", searchURL, nil)
	req.Header.Set("Authorization", "token "+token)
	req.Header.Set("Accept", "application/vnd.github.v3+json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Printf("Merged PR check failed: %v", err)
		return false
	}
	defer resp.Body.Close()

	var result struct {
		TotalCount int `json:"total_count"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return false
	}

	if result.TotalCount > 0 {
		log.Printf("User %s has %d merged PRs in %s", username, result.TotalCount, s.config.GitHubRepo)
		return true
	}
	return false
}

// --- Session secret management ---

func loadOrCreateSecret(dataDir string) []byte {
	path := filepath.Join(dataDir, ".session_secret")
	if data, err := os.ReadFile(path); err == nil && len(data) == 32 {
		return data
	}
	secret := make([]byte, 32)
	rand.Read(secret)
	os.WriteFile(path, secret, 0o600)
	log.Printf("Generated new session secret")
	return secret
}