mirror of
https://github.com/DarkflameUniverse/DarkflameServer.git
synced 2026-10-02 10:53:44 +00:00
3f2a9cc5b0
Bearer keys (dlk_...) are checked per request against their owner's current account (ban, lock, demotion, sign out everywhere stop or narrow them at once) and their scope: permission routes need the permission in scope, read-only keys only read, level-only routes need an all-permission key, and session-only paths (sign-in, password, 2FA, key management) are never reachable with a key. Per-key rate limit and daily quota with 429 and X-RateLimit/X-Quota/Retry-After headers; usage is written in batches every minute. WebSocket subscriptions honour the scope too. Routes to list, make, rotate and revoke keys; staff with api_keys_manage can see and revoke others' keys under the rank rules. POST /api/auth/token now makes an all-permission key. Audit entries for create/rotate/revoke/denied, and actions done with a key are attributed to "user (key name)". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
79 lines
2.3 KiB
C++
79 lines
2.3 KiB
C++
#pragma once
|
|
|
|
#include <string>
|
|
#include <map>
|
|
#include <memory>
|
|
#include <algorithm>
|
|
#include "eHTTPStatusCode.h"
|
|
#include "json.hpp"
|
|
#include "ApiKeyScope.h"
|
|
|
|
/**
|
|
* HTTP Request Context
|
|
*
|
|
* Carries all request metadata through the middleware chain.
|
|
* Populated by the Web framework before middleware/handlers are called.
|
|
*/
|
|
struct HTTPContext {
|
|
// Request metadata
|
|
std::string method{};
|
|
std::string path{}; // lowercased: routes match without regard to case
|
|
std::string originalPath{}; // as sent, for parameters whose case matters (file names)
|
|
std::string queryString{};
|
|
std::string body{};
|
|
|
|
// Request headers (header name -> value)
|
|
// Header names are lowercase for case-insensitive lookup
|
|
std::map<std::string, std::string> headers{};
|
|
|
|
// Client information
|
|
std::string clientIP{};
|
|
unsigned long connectionId = 0; // the web server's id of the connection (for Web::Defer)
|
|
|
|
// Authentication information (populated by auth middleware)
|
|
bool isAuthenticated = false;
|
|
std::string authenticatedUser{};
|
|
uint32_t accountId = 0;
|
|
uint8_t gmLevel = 0;
|
|
// Set when an API key authenticated the request: the key's scope, on top of what the account may do (gmLevel).
|
|
// Every permission check must honour it (RouteUtils::Can and friends do).
|
|
std::shared_ptr<const ApiKeys::Scope> apiKey{};
|
|
|
|
// Custom data for middleware to communicate
|
|
std::map<std::string, std::string> userData{};
|
|
|
|
/**
|
|
* Get header value (case-insensitive)
|
|
*/
|
|
const std::string& GetHeader(const std::string& headerName) const {
|
|
static const std::string empty{};
|
|
|
|
// Convert to lowercase for comparison
|
|
std::string lowerName = headerName;
|
|
std::transform(lowerName.begin(), lowerName.end(), lowerName.begin(), ::tolower);
|
|
|
|
const auto it = headers.find(lowerName);
|
|
return it != headers.end() ? it->second : empty;
|
|
}
|
|
|
|
/**
|
|
* Set header value (automatically lowercased)
|
|
*/
|
|
void SetHeader(const std::string& headerName, const std::string& value) {
|
|
std::string lowerName = headerName;
|
|
std::transform(lowerName.begin(), lowerName.end(), lowerName.begin(), ::tolower);
|
|
headers[lowerName] = value;
|
|
}
|
|
|
|
/**
|
|
* Get user data as JSON for template rendering
|
|
*/
|
|
nlohmann::json GetUserDataJson() const {
|
|
nlohmann::json userData;
|
|
userData["username"] = authenticatedUser;
|
|
userData["gmLevel"] = gmLevel;
|
|
userData["accountId"] = accountId;
|
|
return userData;
|
|
}
|
|
};
|