bookhoard/internal/middleware/device_auth.go

package middleware

import (
	"bookmann/internal/database"
	"net/http"
	"strings"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5/pgtype"
	"github.com/labstack/echo/v4"
)

type DeviceContext struct {
	ID               uuid.UUID
	UserID           uuid.UUID
	DeviceName       string
	DeviceType       string
	DeviceIdentifier string
	SyncEnabled      bool
	AutoSync         bool
}

type DeviceAuthMiddleware struct {
	db *database.Queries
}

func NewDeviceAuthMiddleware(db *database.Queries) *DeviceAuthMiddleware {
	return &DeviceAuthMiddleware{
		db: db,
	}
}

func (m *DeviceAuthMiddleware) Authenticate(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		authHeader := c.Request().Header.Get("Authorization")
		if authHeader == "" {
			return c.JSON(http.StatusUnauthorized, map[string]string{
				"error": "missing authorization header",
			})
		}

		if !strings.HasPrefix(authHeader, "Bearer ") {
			return c.JSON(http.StatusUnauthorized, map[string]string{
				"error": "invalid authorization header format",
			})
		}

		token := strings.TrimPrefix(authHeader, "Bearer ")

		device, err := m.db.GetDeviceByAuthToken(c.Request().Context(), token)
		if err != nil {
			return c.JSON(http.StatusUnauthorized, map[string]string{
				"error": "invalid device token",
			})
		}

		if !device.SyncEnabled.Bool || !device.SyncEnabled.Valid {
			return c.JSON(http.StatusForbidden, map[string]string{
				"error": "device sync is disabled",
			})
		}

		ctx := DeviceContext{
			ID:               device.ID.Bytes,
			UserID:           device.UserID.Bytes,
			DeviceName:       device.DeviceName,
			DeviceType:       device.DeviceType,
			DeviceIdentifier: device.DeviceIdentifier,
			SyncEnabled:      device.SyncEnabled.Bool && device.SyncEnabled.Valid,
			AutoSync:         device.AutoSync.Bool && device.AutoSync.Valid,
		}

		c.Set("device", ctx)
		c.Set("device_id", device.ID.Bytes)
		c.Set("user_id", device.UserID.Bytes)

		return next(c)
	}
}

func (m *DeviceAuthMiddleware) RequirePermission(permission string) echo.MiddlewareFunc {
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			device, ok := c.Get("device").(DeviceContext)
			if !ok {
				return c.JSON(http.StatusUnauthorized, map[string]string{
					"error": "device not authenticated",
				})
			}

			if !m.hasPermission(device.DeviceType, permission) {
				return c.JSON(http.StatusForbidden, map[string]string{
					"error": "insufficient permissions",
				})
			}

			return next(c)
		}
	}
}

func (m *DeviceAuthMiddleware) hasPermission(deviceType string, permission string) bool {
	permissions := map[string][]string{
		"koreader": {"sync:progress", "sync:annotations", "sync:metadata"},
		"kobo":     {"sync:progress", "sync:annotations", "sync:metadata"},
		"web":      {"sync:progress", "sync:annotations", "sync:metadata", "device:manage"},
		"mobile":   {"sync:progress", "sync:annotations", "sync:metadata"},
	}

	devicePerms, exists := permissions[deviceType]
	if !exists {
		return false
	}

	for _, p := range devicePerms {
		if p == permission {
			return true
		}
	}

	return false
}

func (m *DeviceAuthMiddleware) UpdateLastSeen(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		err := next(c)

		deviceID, ok := c.Get("device_id").(uuid.UUID)
		if ok {
			pgDeviceID := pgtype.UUID{Bytes: [16]byte(deviceID), Valid: true}
			m.db.UpdateDeviceLastSeen(c.Request().Context(), pgDeviceID)
		}

		return err
	}
}