jordi fita mas
e128680e9a
I need to check that the user is an employee (or admin) in administration handlers, but i do not want to do it for each handler, because i am bound to forget it. Thus, i added the /admin sub-path for these resources. The public-facing web is the rest of the resources outside /admin, but for now there is only home, to test whether it works as expected or not. The public-facing web can not relay on the user’s language settings, as the guest user has no way to set that. I would be happy to just use the Accept-Language header for that, but apparently Google does not use that header[0], and they give four alternatives: a country-specific domain, a subdomain with a generic top-level domain (gTLD), subdirectories with a gTLD, or URL parameters (e.g., site.com?loc=de). Of the four, Google does not recommend URL parameters, and the customer is already using subdirectories with the current site, therefor that’s what i have chosen. Google also tells me that it is a very good idea to have links between localized version of the same resources, either with <link> elements, Link HTTP response headers, or a sitemap file[1]; they are all equivalent in the eyes of Google. I have choosen the Link response headers way, because for that i can simply “augment” ResponseHeader to automatically add these headers when the response status is 2xx, otherwise i would need to pass down the original URL path until it reaches the template. Even though Camper is supposed to be a “generic”, multi-company application, i think i will stick to the easiest route and write the templates for just the “first” customer. [0]: https://developers.google.com/search/docs/specialty/international/managing-multi-regional-sites [1]: https://developers.google.com/search/docs/specialty/international/localized-versions
47 lines
859 B
Go
47 lines
859 B
Go
/*
|
|
* SPDX-FileCopyrightText: 2023 jordi fita mas <jfita@peritasoft.com>
|
|
* SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"golang.org/x/text/language"
|
|
|
|
"dev.tandem.ws/tandem/camper/pkg/locale"
|
|
)
|
|
|
|
const (
|
|
CSRFTokenField = "csrf_token"
|
|
CSRFTokenHeader = "X-CSRFToken"
|
|
)
|
|
|
|
type User struct {
|
|
ID int
|
|
Email string
|
|
LoggedIn bool
|
|
Role string
|
|
Language language.Tag
|
|
CSRFToken string
|
|
Locale *locale.Locale
|
|
}
|
|
|
|
func (user *User) VerifyCSRFToken(r *http.Request) error {
|
|
token := r.Header.Get(CSRFTokenHeader)
|
|
if token == "" {
|
|
token = r.FormValue(CSRFTokenField)
|
|
}
|
|
if user.CSRFToken == token {
|
|
return nil
|
|
}
|
|
return errors.New(user.Locale.Gettext("Cross-site request forgery detected."))
|
|
}
|
|
|
|
func (user *User) IsEmployee() bool {
|
|
role := user.Role[0]
|
|
return role == 'e' || role == 'a'
|
|
}
|