Refactoring of auth middleware, and starting work on account admin

pkg/middleware/auth.go

@@ -12,27 +12,44 @@ import (
 	"github.com/torkelo/grafana-pro/pkg/setting"
 )
 
-func authGetRequestAccountId(c *Context) (int64, error) {
+type AuthOptions struct {
+	ReqAdmin    bool
+	ReqSignedIn bool
+}
+
+func getRequestAccountId(c *Context) (int64, error) {
 	accountId := c.Session.Get("accountId")
 
-	urlQuery := c.Req.URL.Query()
+	if accountId != nil {
+		return accountId.(int64), nil
+	}
 
-	// TODO: check that this is a localhost request
+	// localhost render query
+	urlQuery := c.Req.URL.Query()
 	if len(urlQuery["render"]) > 0 {
 		accId, _ := strconv.ParseInt(urlQuery["accountId"][0], 10, 64)
 		c.Session.Set("accountId", accId)
 		accountId = accId
 	}
 
-	if accountId == nil {
-		if setting.Anonymous {
-			return setting.AnonymousAccountId, nil
+	// check api token
+	header := c.Req.Header.Get("Authorization")
+	parts := strings.SplitN(header, " ", 2)
+	if len(parts) == 2 || parts[0] == "Bearer" {
+		token := parts[1]
+		userQuery := m.GetAccountByTokenQuery{Token: token}
+		if err := bus.Dispatch(&userQuery); err != nil {
+			return -1, err
 		}
-
-		return -1, errors.New("Auth: session account id not found")
+		return userQuery.Result.Id, nil
 	}
 
-	return accountId.(int64), nil
+	// anonymous gues user
+	if setting.Anonymous {
+		return setting.AnonymousAccountId, nil
+	}
+
+	return -1, errors.New("Auth: session account id not found")
 }
 
 func authDenied(c *Context) {
@@ -43,57 +60,17 @@ func authDenied(c *Context) {
 	c.Redirect(setting.AppSubUrl + "/login")
 }
 
-func authByToken(c *Context) {
-	header := c.Req.Header.Get("Authorization")
-	parts := strings.SplitN(header, " ", 2)
-	if len(parts) != 2 || parts[0] != "Bearer" {
-		return
-	}
-	token := parts[1]
-	userQuery := m.GetAccountByTokenQuery{Token: token}
-
-	if err := bus.Dispatch(&userQuery); err != nil {
-		return
-	}
-
-	usingQuery := m.GetAccountByIdQuery{Id: userQuery.Result.UsingAccountId}
-	if err := bus.Dispatch(&usingQuery); err != nil {
-		return
-	}
-
-	c.UserAccount = userQuery.Result
-	c.Account = usingQuery.Result
-}
-
-func authBySession(c *Context) {
-	accountId, err := authGetRequestAccountId(c)
-
-	if err != nil && c.Req.URL.Path != "/login" {
-		authDenied(c)
-		return
-	}
-
-	userQuery := m.GetAccountByIdQuery{Id: accountId}
-	if err := bus.Dispatch(&userQuery); err != nil {
-		authDenied(c)
-		return
-	}
-
-	usingQuery := m.GetAccountByIdQuery{Id: userQuery.Result.UsingAccountId}
-	if err := bus.Dispatch(&usingQuery); err != nil {
-		authDenied(c)
-		return
-	}
-
-	c.UserAccount = userQuery.Result
-	c.Account = usingQuery.Result
-}
-
-func Auth() macaron.Handler {
+func Auth(options *AuthOptions) macaron.Handler {
 	return func(c *Context) {
-		authByToken(c)
-		if c.UserAccount == nil {
-			authBySession(c)
+
+		if !c.IsSignedIn && options.ReqSignedIn {
+			authDenied(c)
+			return
+		}
+
+		if !c.IsAdmin && options.ReqAdmin {
+			authDenied(c)
+			return
 		}
 	}
 }