Restructured authmiddleware fn and added tests (#2410)

* Created separate file for authmiddleware fn
* Optimize auth login and middleware
* Added unittests for authmiddleware
* Fixed authURL
* Removed featureConfig as global variable
* Fix integration test according to examples repo changes
* Fix integration test path for go module-example

Co-authored-by: Sanket Sudake <sanketsudake@gmail.com>

pkg/router/auth.go

@@ -0,0 +1,170 @@
+package router
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/gorilla/mux"
+
+	fv1 "github.com/fission/fission/pkg/apis/core/v1"
+	config "github.com/fission/fission/pkg/featureconfig"
+)
+
+var (
+	malformedToken = errors.New("Unauthorized: malformed token")
+	expiredToken   = errors.New("Unauthorized: token is either expired or not active yet")
+	invalidCreds   = errors.New("Unauthorized: invalid username or password")
+)
+
+func checkAuthToken(r *http.Request) error {
+	authHeader := strings.Split(r.Header.Get("Authorization"), "Bearer ")
+	if len(authHeader) != 2 || len(authHeader[1]) == 0 {
+		// malformed token
+		return malformedToken
+	}
+
+	jwtToken := authHeader[1]
+	token, err := jwt.Parse(jwtToken, func(token *jwt.Token) (interface{}, error) {
+		return []byte(os.Getenv("JWT_SIGNING_KEY")), nil
+	})
+
+	if token != nil && token.Valid {
+		// valid token
+		return nil
+	}
+
+	if ve, ok := err.(*jwt.ValidationError); ok {
+		if ve.Errors&jwt.ValidationErrorMalformed != 0 {
+			// malformed token
+			err = malformedToken
+		} else if ve.Errors&(jwt.ValidationErrorExpired|jwt.ValidationErrorNotValidYet) != 0 {
+			// token is either expired or not active yet
+			err = expiredToken
+		} else {
+			err = fmt.Errorf("Unauthorized: %w", err)
+		}
+	}
+
+	if err == nil {
+		err = errors.New("Unauthorized: invalid token")
+	}
+
+	return err
+}
+
+func authMiddleware(featureConfig *config.FeatureConfig) mux.MiddlewareFunc {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path != featureConfig.AuthConfig.AuthUriPath && r.URL.Path != "/router-healthz" {
+				err := checkAuthToken(r)
+				if err != nil {
+					http.Error(w, err.Error(), http.StatusUnauthorized)
+					return
+				}
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+type AuthConf struct {
+	username      string
+	password      string
+	jwtSigningKey string
+}
+
+func parseAuthConf(auth *AuthConf) error {
+	username, ok := os.LookupEnv("AUTH_USERNAME")
+	if !ok || len(username) == 0 {
+		return fmt.Errorf("Username not configured  or invalid")
+	}
+
+	password, ok := os.LookupEnv("AUTH_PASSWORD")
+	if !ok || len(password) == 0 {
+		return fmt.Errorf("Password not configured or invalid")
+	}
+
+	signingKey, ok := os.LookupEnv("JWT_SIGNING_KEY")
+	if !ok || len(signingKey) == 0 {
+		return fmt.Errorf("Signing key not configured or invalid")
+	}
+
+	auth.username = username
+	auth.password = password
+	auth.jwtSigningKey = signingKey
+	return nil
+}
+
+func authLoginHandler(featureConfig *config.FeatureConfig) func(w http.ResponseWriter, r *http.Request) {
+	var (
+		err       error
+		validConf bool
+	)
+
+	validConf = true
+
+	auth := &AuthConf{}
+	if err = parseAuthConf(auth); err != nil {
+		validConf = false
+	}
+
+	return func(w http.ResponseWriter, r *http.Request) {
+		if !validConf {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		var t fv1.AuthLogin
+
+		err = json.Unmarshal(body, &t)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		rat := &fv1.RouterAuthToken{}
+
+		if t.Username != auth.username || t.Password != auth.password {
+			http.Error(w, invalidCreds.Error(), http.StatusUnauthorized)
+			return
+		}
+
+		claims := &jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(jwt.TimeFunc().Add(featureConfig.AuthConfig.JWTExpiryTime * time.Second)),
+			Issuer:    featureConfig.AuthConfig.JWTIssuer,
+			NotBefore: jwt.NewNumericDate(jwt.TimeFunc()),
+		}
+
+		token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+		ss, err := token.SignedString([]byte(auth.jwtSigningKey))
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		rat.AccessToken = ss
+		rat.TokenType = "Bearer"
+
+		resp, err := json.Marshal(rat)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		w.WriteHeader(http.StatusCreated)
+		_, _ = w.Write(resp)
+	}
+
+}