From fbc8f491b0e7cd9c9b1280bd4ee29b3c0684d53b Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Fri, 24 Sep 2021 13:07:18 +0200
Subject: [PATCH] auth: implement internal anonymous authentication

This is used for meta.sr.ht's GraphQL user registration resolver, which
needs to run prior to the user's information being added to the database.
---
 auth/middleware.go | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/auth/middleware.go b/auth/middleware.go
index 08954c2db16ec6b409f6ff2b8ac8e7731e76ba23..a39131a8388ba59043b0d602ffd88f2a42a0b28b 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -57,6 +57,7 @@ const (
 )
 
 type AuthContext struct {
+	AuthMethod       string
 	UserID           int
 	Created          time.Time
 	Updated          time.Time
@@ -67,7 +68,6 @@ type AuthContext struct {
 	Location         *string
 	Bio              *string
 	SuspensionNotice *string
-	AuthMethod       string
 
 	// Only set for meta.sr.ht-api
 	PGPKey *string
@@ -299,8 +299,15 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 	var auth *AuthContext
 	if internalAuth.OAuthClientUUID != "" {
 		auth, err = authForOAuthClient(r.Context(), internalAuth.OAuthClientUUID)
-	} else {
+	} else if internalAuth.Name != "" {
 		auth, err = authForUsername(r.Context(), internalAuth.Name)
+	} else {
+		// Using anonymous internal auth. This is only used in one specific
+		// situation: registering for a new account
+		//
+		// This will leave a lot of stuff unset in the auth context, which can
+		// cause problems if not properly accounted for.
+		auth = &AuthContext{}
 	}
 	if err != nil {
 		authError(w, err.Error(), http.StatusForbidden)