edited custom admin middleware to only handle admin signed requests

Author: Hubtrick-Git

middlewares/access_control_middlewares.go

@@ -23,20 +23,23 @@ import (
 	"github.com/google/uuid"
 	"github.com/l3montree-dev/devguard/accesscontrol"
 	"github.com/l3montree-dev/devguard/database/models"
+	"github.com/l3montree-dev/devguard/dtos"
 	"github.com/l3montree-dev/devguard/shared"
 	"github.com/l3montree-dev/devguard/utils"
 	"github.com/labstack/echo/v4"
 )
 
-func InstanceAdminMiddleware() echo.MiddlewareFunc {
+func InstanceAdminMiddleware(pat shared.PersonalAccessTokenService) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(ctx echo.Context) error {
-			session := shared.GetSession(ctx)
-			if !session.IsInstanceAdmin() {
-				slog.Error("access denied in InstanceAdminMiddleware - user is not an instance admin", "user", session.GetUserID())
-				return echo.NewHTTPError(403, "you do not have access to this resource")
+			isAdmin, err := pat.VerifyAdminRequest(ctx.Request())
+			if err == nil {
+				if isAdmin {
+					ctx.Set("session", accesscontrol.NewSession("admin", dtos.AllowedScopes, true))
+					return next(ctx)
+				}
 			}
-			return next(ctx)
+			return fmt.Errorf("could not verify admin request: %v", err)
 		}
 	}
 }

mocks/mock_AdminService.go

@@ -16,18 +16,20 @@
 package router
 
 import (
+	"github.com/l3montree-dev/devguard/cmd/devguard/api"
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
 type AdminRouter struct {
 	*echo.Group
 }
 
-func NewAdminRouter(sessionRouter SessionRouter, adminController *controllers.AdminController) AdminRouter {
-	adminRouter := sessionRouter.Group.Group("/admin",
-		middlewares.InstanceAdminMiddleware(),
+func NewAdminRouter(server api.Server, adminController *controllers.AdminController, patService shared.PersonalAccessTokenService) AdminRouter {
+	adminRouter := server.Echo.Group("/admin",
+		middlewares.InstanceAdminMiddleware(patService),
 	)
 
 	adminRouter.GET("/", func(ctx echo.Context) error {

mocks/mock_PersonalAccessTokenService.go

@@ -232,7 +232,7 @@ func (p *PatService) markAsLastUsedNow(ctx context.Context, fingerprint string)
 	return p.patRepository.MarkAsLastUsedNow(ctx, nil, fingerprint)
 }
 
-func (p *PatService) verifyAdminRequest(req *http.Request) (bool, error) {
+func (p *PatService) VerifyAdminRequest(req *http.Request) (bool, error) {
 	verifier, _ := httpsign.NewP256Verifier(p.adminPubKey, nil,
 		httpsign.Headers("@method", "content-digest"))
 
@@ -262,7 +262,7 @@ func (p *PatService) VerifyRequestSignature(ctx context.Context, req *http.Reque
 	fingerprint := req.Header.Get("X-Fingerprint")
 	if fingerprint == "" {
 		// check if it's an admin request
-		isAdmin, err := p.verifyAdminRequest(req)
+		isAdmin, err := p.VerifyAdminRequest(req)
 		if err != nil {
 			return nil, fmt.Errorf("could not verify admin request: %v", err)
 		}

router/admin_router.go

@@ -70,6 +70,7 @@ type ReleaseService interface {
 
 type PersonalAccessTokenService interface {
 	VerifyRequestSignature(ctx context.Context, req *http.Request) (AuthSession, error)
+	VerifyAdminRequest(req *http.Request) (bool, error)
 	RevokeByPrivateKey(ctx context.Context, privKey string) error
 	ToModel(ctx context.Context, request dtos.PatCreateRequest, userID string) models.PAT
 }