From 378fedbc638f13cdb77708d92dc0795431f53fb6 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Fri, 24 Sep 2021 13:26:41 +0200
Subject: [PATCH] Add @anoninternal support code

This is a slightly better approach to the previous commit.
---
 auth/middleware.go   | 22 ++++++++++++----------
 server/directives.go | 10 ++++++++++
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/auth/middleware.go b/auth/middleware.go
index a39131a8388ba59043b0d602ffd88f2a42a0b28b..d157ec3f816ba5bf3b4d021bdaf1bed4a560fb05 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -49,15 +49,18 @@ const (
 )
 
 const (
-	AUTH_OAUTH_LEGACY = "OAUTH_LEGACY"
-	AUTH_OAUTH2       = "OAUTH2"
-	AUTH_COOKIE       = "COOKIE"
-	AUTH_INTERNAL     = "INTERNAL"
-	AUTH_WEBHOOK      = "WEBHOOK"
+	AUTH_OAUTH_LEGACY  = "OAUTH_LEGACY"
+	AUTH_OAUTH2        = "OAUTH2"
+	AUTH_COOKIE        = "COOKIE"
+	AUTH_INTERNAL      = "INTERNAL"
+	AUTH_ANON_INTERNAL = "ANON_INTERNAL"
+	AUTH_WEBHOOK       = "WEBHOOK"
 )
 
 type AuthContext struct {
 	AuthMethod       string
+
+	// Only filled out for non-anonymous authentication
 	UserID           int
 	Created          time.Time
 	Updated          time.Time
@@ -299,22 +302,21 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 	var auth *AuthContext
 	if internalAuth.OAuthClientUUID != "" {
 		auth, err = authForOAuthClient(r.Context(), internalAuth.OAuthClientUUID)
+		auth.AuthMethod = AUTH_INTERNAL
 	} else if internalAuth.Name != "" {
 		auth, err = authForUsername(r.Context(), internalAuth.Name)
+		auth.AuthMethod = AUTH_INTERNAL
 	} else {
 		// Using anonymous internal auth. This is only used in one specific
-		// situation: registering for a new account
-		//
-		// This will leave a lot of stuff unset in the auth context, which can
-		// cause problems if not properly accounted for.
+		// situation: registering for a new account.
 		auth = &AuthContext{}
+		auth.AuthMethod = AUTH_ANON_INTERNAL
 	}
 	if err != nil {
 		authError(w, err.Error(), http.StatusForbidden)
 		return
 	}
 
-	auth.AuthMethod = AUTH_INTERNAL
 	auth.InternalAuth = internalAuth
 
 	ctx := context.WithValue(r.Context(), userCtxKey, auth)
diff --git a/server/directives.go b/server/directives.go
index 778de157b3436b724b947b1621dcc5b8c79ef94a..a6c8a11edec6eb371ce4f8afdaa846c3db63aa26 100644
--- a/server/directives.go
+++ b/server/directives.go
@@ -9,6 +9,16 @@ import (
 	"git.sr.ht/~sircmpwn/core-go/auth"
 )
 
+func AnonInternal(ctx context.Context, obj interface{},
+	next graphql.Resolver) (interface{}, error) {
+
+	if auth.ForContext(ctx).AuthMethod != auth.AUTH_ANON_INTERNAL {
+		return nil, fmt.Errorf("Internal auth access denied")
+	}
+
+	return next(ctx)
+}
+
 func Internal(ctx context.Context, obj interface{},
 	next graphql.Resolver) (interface{}, error) {