master -> develop (#20)

* Squash merge develop into master

* feat: add automated production release workflow

* feat: add Gitflow workflow for syncing branches

* ci: update workflow runner to latest ubuntu version

* feat: enable buf.build publishing on master and develop branches

---------

Co-authored-by: Prad Nukala <prad@sonr.io>

internal/mdw/authz.go

@@ -0,0 +1,95 @@
+package mdw
+
+import (
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/labstack/echo/v4"
+	"gopkg.in/macaroon.v2"
+)
+
+const (
+	OriginMacroonCaveat  MacroonCaveat = "origin"
+	ScopesMacroonCaveat  MacroonCaveat = "scopes"
+	SubjectMacroonCaveat MacroonCaveat = "subject"
+	ExpMacroonCaveat     MacroonCaveat = "exp"
+	TokenMacroonCaveat   MacroonCaveat = "token"
+)
+
+type MacroonCaveat string
+
+func (c MacroonCaveat) Equal(other string) bool {
+	return string(c) == other
+}
+
+func (c MacroonCaveat) String() string {
+	return string(c)
+}
+
+func (c MacroonCaveat) Verify(value string) error {
+	switch c {
+	case OriginMacroonCaveat:
+		return nil
+	case ScopesMacroonCaveat:
+		return nil
+	case SubjectMacroonCaveat:
+		return nil
+	case ExpMacroonCaveat:
+		// Check if the expiration time is still valid
+		exp, err := time.Parse(time.RFC3339, value)
+		if err != nil {
+			return err
+		}
+		if time.Now().After(exp) {
+			return fmt.Errorf("expired")
+		}
+		return nil
+	case TokenMacroonCaveat:
+		return nil
+	default:
+		return fmt.Errorf("unknown caveat: %s", c)
+	}
+}
+
+var MacroonCaveats = []MacroonCaveat{OriginMacroonCaveat, ScopesMacroonCaveat, SubjectMacroonCaveat, ExpMacroonCaveat, TokenMacroonCaveat}
+
+func MacaroonMiddleware(secretKeyStr string, location string) echo.MiddlewareFunc {
+	secretKey := []byte(secretKeyStr)
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			// Extract the macaroon from the Authorization header
+			auth := c.Request().Header.Get("Authorization")
+			if auth == "" {
+				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Missing Authorization header"})
+			}
+
+			// Decode the macaroon
+			mac, err := macaroon.Base64Decode([]byte(auth))
+			if err != nil {
+				return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid macaroon encoding"})
+			}
+
+			token, err := macaroon.New(secretKey, mac, location, macaroon.LatestVersion)
+			if err != nil {
+				return c.JSON(http.StatusBadRequest, map[string]string{"error": "Invalid macaroon"})
+			}
+
+			// Verify the macaroon
+			err = token.Verify(secretKey, func(caveat string) error {
+				for _, c := range MacroonCaveats {
+					if c.String() == caveat {
+						return nil
+					}
+				}
+				return nil // Return nil if the caveat is valid
+			}, nil)
+			if err != nil {
+				return c.JSON(http.StatusUnauthorized, map[string]string{"error": "Invalid macaroon"})
+			}
+
+			// Macaroon is valid, proceed to the next handler
+			return next(c)
+		}
+	}
+}

internal/mdw/client.go

@@ -0,0 +1,3 @@
+package mdw
+
+type AuthClient struct{}

internal/mdw/headers.go

@@ -0,0 +1,55 @@
+package mdw
+
+type RequestHeaders struct {
+	Authorization      *string `header:"Authorization"`
+	CacheControl       *string `header:"Cache-Control"`
+	DeviceMemory       *string `header:"Device-Memory"`
+	Forwarded          *string `header:"Forwarded"`
+	From               *string `header:"From"`
+	Host               *string `header:"Host"`
+	Link               *string `header:"Link"`
+	PermissionsPolicy  *string `header:"Permissions-Policy"`
+	ProxyAuthorization *string `header:"Proxy-Authorization"`
+	Referer            *string `header:"Referer"`
+	UserAgent          *string `header:"User-Agent"`
+	ViewportWidth      *string `header:"Viewport-Width"`
+	Width              *string `header:"Width"`
+	WWWAuthenticate    *string `header:"WWW-Authenticate"`
+
+	// HTMX Specific
+	HXBoosted               *string `header:"HX-Boosted"`
+	HXCurrentURL            *string `header:"HX-Current-URL"`
+	HXHistoryRestoreRequest *string `header:"HX-History-Restore-Request"`
+	HXPrompt                *string `header:"HX-Prompt"`
+	HXRequest               *string `header:"HX-Request"`
+	HXTarget                *string `header:"HX-Target"`
+	HXTriggerName           *string `header:"HX-Trigger-Name"`
+	HXTrigger               *string `header:"HX-Trigger"`
+}
+
+type ResponseHeaders struct {
+	AcceptCH                      *string `header:"Accept-CH"`
+	AccessControlAllowCredentials *string `header:"Access-Control-Allow-Credentials"`
+	AccessControlAllowHeaders     *string `header:"Access-Control-Allow-Headers"`
+	AccessControlAllowMethods     *string `header:"Access-Control-Allow-Methods"`
+	AccessControlExposeHeaders    *string `header:"Access-Control-Expose-Headers"`
+	AccessControlRequestHeaders   *string `header:"Access-Control-Request-Headers"`
+	ContentSecurityPolicy         *string `header:"Content-Security-Policy"`
+	CrossOriginEmbedderPolicy     *string `header:"Cross-Origin-Embedder-Policy"`
+	PermissionsPolicy             *string `header:"Permissions-Policy"`
+	ProxyAuthorization            *string `header:"Proxy-Authorization"`
+	WWWAuthenticate               *string `header:"WWW-Authenticate"`
+
+	// HTMX Specific
+	HXLocation           *string `header:"HX-Location"`
+	HXPushURL            *string `header:"HX-Push-Url"`
+	HXRedirect           *string `header:"HX-Redirect"`
+	HXRefresh            *string `header:"HX-Refresh"`
+	HXReplaceURL         *string `header:"HX-Replace-Url"`
+	HXReswap             *string `header:"HX-Reswap"`
+	HXRetarget           *string `header:"HX-Retarget"`
+	HXReselect           *string `header:"HX-Reselect"`
+	HXTrigger            *string `header:"HX-Trigger"`
+	HXTriggerAfterSettle *string `header:"HX-Trigger-After-Settle"`
+	HXTriggerAfterSwap   *string `header:"HX-Trigger-After-Swap"`
+}

internal/mdw/session.go

@@ -0,0 +1,72 @@
+package mdw
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/donseba/go-htmx"
+	"github.com/labstack/echo/v4"
+	"github.com/onsonr/sonr/internal/db"
+	"github.com/segmentio/ksuid"
+)
+
+type Session struct {
+	echo.Context
+	htmx *htmx.HTMX
+	dB   *db.DB
+}
+
+// GetSession returns the current Session
+func GetSession(c echo.Context) *Session {
+	return c.(*Session)
+}
+
+// UseSession establishes a Session Cookie.
+func UseSession(next echo.HandlerFunc) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		sc := initSession(c)
+		headers := new(RequestHeaders)
+		sc.Bind(headers)
+		return next(sc)
+	}
+}
+
+func (c *Session) DB() *db.DB {
+	return c.dB
+}
+
+func (c *Session) Htmx() *htmx.HTMX {
+	return c.htmx
+}
+
+func (c *Session) ID() string {
+	return readCookie(c, "session")
+}
+
+func initSession(c echo.Context) *Session {
+	s := &Session{Context: c}
+	if val := readCookie(c, "session"); val == "" {
+		id := ksuid.New().String()
+		writeCookie(c, "session", id)
+	}
+	return s
+}
+
+func readCookie(c echo.Context, key string) string {
+	cookie, err := c.Cookie(key)
+	if err != nil {
+		return ""
+	}
+	if cookie == nil {
+		return ""
+	}
+	return cookie.Value
+}
+
+func writeCookie(c echo.Context, key string, value string) {
+	cookie := new(http.Cookie)
+	cookie.Name = key
+	cookie.Value = value
+	cookie.Expires = time.Now().Add(24 * time.Hour)
+	c.SetCookie(cookie)
+}