feat: dashboard auth

Author: wuriyanto

dashboard/handler/api.go

@@ -3,13 +3,16 @@ package handler
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"regexp"
 	"strings"
+	"time"
 
 	"github.com/telkomdev/tob/config"
 	"github.com/telkomdev/tob/dashboard/shared"
+	"github.com/telkomdev/tob/dashboard/utils"
 )
 
 var (
@@ -21,12 +24,20 @@ type WebhookMessage struct {
 	Message string `json:"message"`
 }
 
+// LoginPayload type
+type LoginPayload struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
 // DashboardHTTPHandler type
 type DashboardHTTPHandler struct {
-	serviceData      map[string]map[string]interface{}
-	logger           *log.Logger
-	webhookTobTokens []string
-	dashboardTitle   string
+	serviceData       map[string]map[string]interface{}
+	logger            *log.Logger
+	webhookTobTokens  []string
+	dashboardTitle    string
+	dashboardUsername string
+	dashboardPassword string
 }
 
 // Data type
@@ -35,6 +46,12 @@ type Data struct {
 	DashboardTitle string                            `json:"dashboardTitle"`
 }
 
+// LoginResponse type
+type LoginResponse struct {
+	Username  string `json:"username"`
+	JWTString string `json:"jwtString"`
+}
+
 // NewDashboardHTTPHandler DashboardHTTPHandler's constructor
 func NewDashboardHTTPHandler(tobConfig config.Config, logger *log.Logger) (*DashboardHTTPHandler, error) {
 	if dashboardTitle, ok := tobConfig["dashboardTitle"].(string); ok {
@@ -102,14 +119,104 @@ func NewDashboardHTTPHandler(tobConfig config.Config, logger *log.Logger) (*Dash
 		serviceData[name] = services
 	}
 
+	dashboardUsername, ok := tobConfig["dashboardUsername"].(string)
+	if !ok {
+		return nil, errors.New("cannot parse dashboardUsername from configs")
+	}
+
+	dashboardPassword, ok := tobConfig["dashboardPassword"].(string)
+	if !ok {
+		return nil, errors.New("cannot parse dashboardPassword from configs")
+	}
+
 	return &DashboardHTTPHandler{
-		dashboardTitle:   defaultDashboardTitle,
-		serviceData:      serviceData,
-		logger:           logger,
-		webhookTobTokens: webhookTobTokens,
+		dashboardTitle:    defaultDashboardTitle,
+		serviceData:       serviceData,
+		logger:            logger,
+		webhookTobTokens:  webhookTobTokens,
+		dashboardUsername: dashboardUsername,
+		dashboardPassword: dashboardPassword,
 	}, nil
 }
 
+// Login will handle user login
+func (h *DashboardHTTPHandler) Login(jwtService utils.JwtService) http.HandlerFunc {
+	return func(resp http.ResponseWriter, req *http.Request) {
+
+		if req.Method != http.MethodPost {
+			shared.BuildJSONResponse(resp, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    405,
+				Message: "http method not valid",
+				Data:    shared.EmptyJSON{},
+			}, 405)
+			return
+		}
+
+		var loginPayload LoginPayload
+
+		err := json.NewDecoder(req.Body).Decode(&loginPayload)
+		if err != nil {
+			shared.BuildJSONResponse(resp, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    400,
+				Message: "login payload is not valid",
+				Data:    shared.EmptyJSON{},
+			}, 400)
+			return
+		}
+
+		hashedPassword, err := utils.Sha256Hex([]byte(loginPayload.Password))
+		if err != nil {
+			shared.BuildJSONResponse(resp, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    400,
+				Message: "login payload is not valid",
+				Data:    shared.EmptyJSON{},
+			}, 400)
+			return
+		}
+
+		if h.dashboardUsername != loginPayload.Username || h.dashboardPassword != hashedPassword {
+			shared.BuildJSONResponse(resp, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    401,
+				Message: "username or password is not valid",
+				Data:    shared.EmptyJSON{},
+			}, 401)
+			return
+		}
+
+		var claim utils.Claim
+		claim.Alg = utils.HS256
+		claim.Subject = h.dashboardUsername
+		claim.User.ID = h.dashboardUsername
+		claim.User.FullName = h.dashboardUsername
+		claim.User.Email = h.dashboardUsername
+
+		jwtString, err := jwtService.Generate(&claim, time.Hour*8766)
+		if err != nil {
+			shared.BuildJSONResponse(resp, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    401,
+				Message: "error generating jwt",
+				Data:    shared.EmptyJSON{},
+			}, 401)
+			return
+		}
+
+		shared.BuildJSONResponse(resp, shared.Response[LoginResponse]{
+			Success: true,
+			Code:    200,
+			Message: "login succeed",
+			Data: LoginResponse{
+				Username:  h.dashboardUsername,
+				JWTString: fmt.Sprintf("Bearer %s", jwtString),
+			},
+		}, 200)
+	}
+}
+
 // GetServices will return tob services
 func (h *DashboardHTTPHandler) GetServices() http.HandlerFunc {
 	return func(resp http.ResponseWriter, req *http.Request) {

dashboard/middleware/jwt.go

@@ -0,0 +1,61 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/telkomdev/tob/dashboard/shared"
+	"github.com/telkomdev/tob/dashboard/utils"
+)
+
+// JWTMiddleware this middleware function for verifying accessToken from Authorization Header
+func JWTMiddleware(jwtService utils.JwtService, next http.Handler) http.Handler {
+
+	return http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		accessToken := req.Header.Get("Authorization")
+		if accessToken == "" {
+			shared.BuildJSONResponse(res, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    401,
+				Message: "no token provided",
+				Data:    shared.EmptyJSON{},
+			}, 401)
+			return
+		}
+		tokenSlice := strings.Split(accessToken, " ")
+		if len(tokenSlice) < 2 {
+			shared.BuildJSONResponse(res, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    401,
+				Message: "token is not valid",
+				Data:    shared.EmptyJSON{},
+			}, 401)
+			return
+		}
+
+		if tokenSlice[0] != "Bearer" {
+			shared.BuildJSONResponse(res, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    401,
+				Message: "token is not valid",
+				Data:    shared.EmptyJSON{},
+			}, 401)
+			return
+		}
+		tokenString := tokenSlice[1]
+		claim, err := jwtService.Validate(utils.HS256, tokenString)
+		if err != nil {
+			shared.BuildJSONResponse(res, shared.Response[shared.EmptyJSON]{
+				Success: false,
+				Code:    401,
+				Message: err.Error(),
+				Data:    shared.EmptyJSON{},
+			}, 401)
+			return
+		}
+
+		userID := claim.Subject
+		req.Header.Add("userId", userID)
+		next.ServeHTTP(res, req)
+	})
+}

dashboard/server/http_server.go

@@ -1,14 +1,20 @@
 package server
 
 import (
+	"errors"
 	"fmt"
 	"io/fs"
 	"log"
 	"net/http"
+	"os"
+	"path"
+	"strings"
 
 	"github.com/telkomdev/tob/config"
 	"github.com/telkomdev/tob/dashboard/handler"
+	"github.com/telkomdev/tob/dashboard/middleware"
 	"github.com/telkomdev/tob/dashboard/ui"
+	"github.com/telkomdev/tob/dashboard/utils"
 )
 
 var (
@@ -21,6 +27,8 @@ type HTTPServer struct {
 	logger  *log.Logger
 	configs config.Config
 
+	jwtService utils.JwtService
+
 	dashboardStaticAssets fs.FS
 	dashboardHTTPHandler  *handler.DashboardHTTPHandler
 }
@@ -31,6 +39,13 @@ func NewHTTPServer(configs config.Config, logger *log.Logger) (*HTTPServer, erro
 		defaultDashboardHTTPPort = int(parsedDashboardHTTPPort)
 	}
 
+	dashboardJwtKey, ok := configs["dashboardJwtKey"].(string)
+	if !ok {
+		return nil, errors.New("cannot parse dashboardJwtKey from configs")
+	}
+
+	jwtService := utils.NewJWT(dashboardJwtKey)
+
 	dashboardStaticAssets, err := ui.Assets()
 	if err != nil {
 		return nil, err
@@ -47,6 +62,7 @@ func NewHTTPServer(configs config.Config, logger *log.Logger) (*HTTPServer, erro
 		logger:                logger,
 		dashboardStaticAssets: dashboardStaticAssets,
 		dashboardHTTPHandler:  dashboardHTTPHandler,
+		jwtService:            jwtService,
 	}, nil
 }
 
@@ -55,9 +71,31 @@ func (s *HTTPServer) Run() {
 	mux := http.NewServeMux()
 
 	dashboardFs := http.FileServer(http.FS(s.dashboardStaticAssets))
-	mux.Handle("/", http.StripPrefix("/", dashboardFs))
 
-	mux.HandleFunc("/api/services", s.dashboardHTTPHandler.GetServices())
+	var index = func() http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path == "/" {
+				dashboardFs.ServeHTTP(w, r)
+				return
+			}
+
+			f, err := s.dashboardStaticAssets.Open(strings.TrimPrefix(path.Clean(r.URL.Path), "/"))
+			if err == nil {
+				defer f.Close()
+			}
+			if os.IsNotExist(err) {
+				r.URL.Path = "/"
+			}
+
+			dashboardFs.ServeHTTP(w, r)
+		})
+	}
+
+	// mux.Handle("/", http.StripPrefix("/", dashboardFs))
+	mux.Handle("/", index())
+
+	mux.HandleFunc("/api/login", s.dashboardHTTPHandler.Login(s.jwtService))
+	mux.Handle("/api/services", middleware.JWTMiddleware(s.jwtService, s.dashboardHTTPHandler.GetServices()))
 	mux.HandleFunc("/api/tob/webhook", s.dashboardHTTPHandler.HandleTobWebhook())
 
 	log.Printf("Dashboard HTTP server running on port %d\n", s.port)