github.com/vnforks/kid/v5@v5.22.1-0.20200408055009-b89d99c65676/api4/handlers.go (about)

     1  // Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
     2  // See LICENSE.txt for license information.
     3  
     4  package api4
     5  
     6  import (
     7  	"net/http"
     8  
     9  	"github.com/NYTimes/gziphandler"
    10  	"github.com/vnforks/kid/v5/web"
    11  )
    12  
    13  type Context = web.Context
    14  
    15  // ApiHandler provides a handler for API endpoints which do not require the user to be logged in order for access to be
    16  // granted.
    17  func (api *API) ApiHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
    18  	handler := &web.Handler{
    19  		GetGlobalAppOptions: api.GetGlobalAppOptions,
    20  		HandleFunc:          h,
    21  		HandlerName:         web.GetHandlerName(h),
    22  		RequireSession:      false,
    23  		TrustRequester:      false,
    24  		RequireMfa:          false,
    25  		IsStatic:            false,
    26  	}
    27  	if *api.ConfigService.Config().ServiceSettings.WebserverMode == "gzip" {
    28  		return gziphandler.GzipHandler(handler)
    29  	}
    30  	return handler
    31  }
    32  
    33  // ApiSessionRequired provides a handler for API endpoints which require the user to be logged in in order for access to
    34  // be granted.
    35  func (api *API) ApiSessionRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
    36  	handler := &web.Handler{
    37  		GetGlobalAppOptions: api.GetGlobalAppOptions,
    38  		HandleFunc:          h,
    39  		HandlerName:         web.GetHandlerName(h),
    40  		RequireSession:      true,
    41  		TrustRequester:      false,
    42  		RequireMfa:          true,
    43  		IsStatic:            false,
    44  	}
    45  	if *api.ConfigService.Config().ServiceSettings.WebserverMode == "gzip" {
    46  		return gziphandler.GzipHandler(handler)
    47  	}
    48  	return handler
    49  
    50  }
    51  
    52  // ApiSessionRequiredMfa provides a handler for API endpoints which require a logged-in user session  but when accessed,
    53  // if MFA is enabled, the MFA process is not yet complete, and therefore the requirement to have completed the MFA
    54  // authentication must be waived.
    55  func (api *API) ApiSessionRequiredMfa(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
    56  	handler := &web.Handler{
    57  		GetGlobalAppOptions: api.GetGlobalAppOptions,
    58  		HandleFunc:          h,
    59  		HandlerName:         web.GetHandlerName(h),
    60  		RequireSession:      true,
    61  		TrustRequester:      false,
    62  		RequireMfa:          false,
    63  		IsStatic:            false,
    64  	}
    65  	if *api.ConfigService.Config().ServiceSettings.WebserverMode == "gzip" {
    66  		return gziphandler.GzipHandler(handler)
    67  	}
    68  	return handler
    69  
    70  }
    71  
    72  // ApiHandlerTrustRequester provides a handler for API endpoints which do not require the user to be logged in and are
    73  // allowed to be requested directly rather than via javascript/XMLHttpRequest, such as site branding images or the
    74  // websocket.
    75  func (api *API) ApiHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
    76  	handler := &web.Handler{
    77  		GetGlobalAppOptions: api.GetGlobalAppOptions,
    78  		HandleFunc:          h,
    79  		HandlerName:         web.GetHandlerName(h),
    80  		RequireSession:      false,
    81  		TrustRequester:      true,
    82  		RequireMfa:          false,
    83  		IsStatic:            false,
    84  	}
    85  	if *api.ConfigService.Config().ServiceSettings.WebserverMode == "gzip" {
    86  		return gziphandler.GzipHandler(handler)
    87  	}
    88  	return handler
    89  
    90  }
    91  
    92  // ApiSessionRequiredTrustRequester provides a handler for API endpoints which do require the user to be logged in and
    93  // are allowed to be requested directly rather than via javascript/XMLHttpRequest, such as emoji or file uploads.
    94  func (api *API) ApiSessionRequiredTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
    95  	handler := &web.Handler{
    96  		GetGlobalAppOptions: api.GetGlobalAppOptions,
    97  		HandleFunc:          h,
    98  		HandlerName:         web.GetHandlerName(h),
    99  		RequireSession:      true,
   100  		TrustRequester:      true,
   101  		RequireMfa:          true,
   102  		IsStatic:            false,
   103  	}
   104  	if *api.ConfigService.Config().ServiceSettings.WebserverMode == "gzip" {
   105  		return gziphandler.GzipHandler(handler)
   106  	}
   107  	return handler
   108  
   109  }
   110  
   111  // DisableWhenBusy provides a handler for API endpoints which should be disabled when the server is under load,
   112  // responding with HTTP 503 (Service Unavailable).
   113  func (api *API) ApiSessionRequiredDisableWhenBusy(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
   114  	handler := &web.Handler{
   115  		GetGlobalAppOptions: api.GetGlobalAppOptions,
   116  		HandleFunc:          h,
   117  		HandlerName:         web.GetHandlerName(h),
   118  		RequireSession:      true,
   119  		TrustRequester:      false,
   120  		RequireMfa:          false,
   121  		IsStatic:            false,
   122  		DisableWhenBusy:     true,
   123  	}
   124  	if *api.ConfigService.Config().ServiceSettings.WebserverMode == "gzip" {
   125  		return gziphandler.GzipHandler(handler)
   126  	}
   127  	return handler
   128  
   129  }