mirror of
https://github.com/openziti/ziti.git
synced 2026-09-11 13:29:03 +00:00
Andrew Martinez
fb2034245d
* fixes openziti/ziti#3356 adds www-authenticate headers - www-authenticate headers are returned on 401s from API requests - www-authenticate headers are returned during authentication to signal addtional JWT bearer tokens needed (secondary ext jwt) - adds support for additional headers on API errors - adds SecurityTokenCtx for centralized security header processing (legacy, jwt, etc.) - adds SecurityCtx for centralized identity, auth policy, MFA handling - refactors existing JWT authentication methods (oidc, legacy) to use centralized processing where possible
78 lines
2.8 KiB
Go
78 lines
2.8 KiB
Go
package env
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
openApiErrors "github.com/go-openapi/errors"
|
|
"github.com/michaelquigley/pfxlog"
|
|
"github.com/openziti/foundation/v2/errorz"
|
|
"github.com/openziti/ziti/v2/controller/apierror"
|
|
)
|
|
|
|
// ServeError is a wrapper for the OpenAPI REST server to allow the Edge API Error message responses to be used
|
|
// when errors are raised from the OpenAPI internal runtimes. This includes input validation methods,
|
|
// unsupported media types, etc.
|
|
func ServeError(rw http.ResponseWriter, r *http.Request, inErr error) {
|
|
if openApiError, ok := inErr.(openApiErrors.Error); ok {
|
|
//openApiErrors from the Open API framework mean that we never hit any of the Edge logic and thus
|
|
//do not have any context established (i.e. no request id)
|
|
var apiError *errorz.ApiError
|
|
if openApiError.Code() == http.StatusUnprocessableEntity {
|
|
// triggered by validation failures and consumer errors
|
|
var newApiError *errorz.ApiError
|
|
|
|
if compositeError, ok := openApiError.(*openApiErrors.CompositeError); ok {
|
|
if len(compositeError.Errors) > 0 {
|
|
//validation errors
|
|
if validationError, ok := compositeError.Errors[0].(*openApiErrors.Validation); ok {
|
|
newApiError = errorz.NewCouldNotValidate(validationError)
|
|
newApiError.Status = int(validationError.Code())
|
|
}
|
|
}
|
|
}
|
|
|
|
// only other option is could not parse
|
|
if newApiError == nil {
|
|
newApiError = apierror.NewCouldNotParseBody(openApiError)
|
|
}
|
|
|
|
apiError = newApiError
|
|
|
|
} else if openApiError.Code() == http.StatusNotFound {
|
|
// handle open API openApiErrors we have existing ApiErrors for
|
|
apiError = errorz.NewNotFound()
|
|
} else if openApiError.Code() == http.StatusMethodNotAllowed {
|
|
apiError = apierror.NewMethodNotAllowed()
|
|
} else if openApiError.Code() == http.StatusUnauthorized {
|
|
requestContext, _ := GetRequestContextFromHttpContext(r)
|
|
if requestContext != nil && requestContext.SecurityCtx != nil {
|
|
if securityCtxErr := requestContext.SecurityCtx.GetError(); securityCtxErr != nil {
|
|
requestContext.RespondWithError(securityCtxErr)
|
|
return
|
|
}
|
|
}
|
|
apiError = errorz.NewUnauthorizedTokensMissing()
|
|
} else if openApiError.Code() == http.StatusForbidden {
|
|
apiError = errorz.NewUnauthorized()
|
|
} else if openApiError.Code() >= 600 && openApiError.Code() < 700 {
|
|
//openapi defines error codes 601+ for validation errors
|
|
apiError = errorz.NewCouldNotValidate(inErr)
|
|
|
|
} else {
|
|
apiError = errorz.NewUnhandled(openApiError)
|
|
}
|
|
apiError.Cause = openApiError
|
|
|
|
NewRequestContext(rw, r).RespondWithApiError(apiError)
|
|
return
|
|
}
|
|
|
|
requestContext, err := GetRequestContextFromHttpContext(r)
|
|
if requestContext == nil || err != nil {
|
|
pfxlog.Logger().WithError(err).Error("failed to retrieve request context")
|
|
requestContext = NewRequestContext(rw, r)
|
|
}
|
|
|
|
requestContext.RespondWithError(inErr)
|
|
}
|