// AuthMiddleware is responsible for authenicating user and setting appropriate values to a context
AuthMiddleware is responsible for authenicating user and setting appropriate values to a context
// AuthMiddleware is responsible for authenicating user and setting appropriate values to a context
func (c *Context) AuthMiddleware(w web.ResponseWriter, r *web.Request, next web.NextMiddlewareFunc) {
	var (
		userUuid     string
		session      = sessionStore.Load(r.Request)
		oneMinute, _ = time.ParseDuration("20m")
		now          = time.Now()
	)
	if len(r.URL.Query()["token"]) > 0 {
		apiSession, err := FindAPISessionByToken(r.URL.Query()["token"][0])
		if err != nil {
			http.NotFound(w, r.Request)
			return
		}
		c.APISession = apiSession
		if !c.APISession.IsTwoFactorSession || (c.APISession.IsTwoFactorSession && c.APISession.IsSecondFactorCompleted) {
			userUuid = apiSession.UserUuid
		}
		if apiSession.User.Banned {
			http.NotFound(w, r.Request)
			return
		}
	} else {
		userUuid, _ = session.GetString("UserUuid")
	}
	allowPassthrough := false
	if authorizedUrls[r.URL.Path] {
		allowPassthrough = true
	}
	for prefix, _ := range authorizedUrls {
		if prefix != "/" {
			if strings.HasPrefix(r.URL.Path, prefix) {
				allowPassthrough = true
			}
		}
	}
	if userUuid != "" {
		user, _ := FindUserByUuid(userUuid)
		if user == nil || user.Banned {
			http.NotFound(w, r.Request)
			return
		}
		if user.LastLoginDate.Add(oneMinute).Before(now) {
			user.LastLoginDate = now
			go user.Save()
		}
		vu := user.ViewUser(user.Language, false)
		c.ViewUser = &vu
	} else if !allowPassthrough {
		http.Redirect(w, r.Request, "/auth/login", 302)
		return
	} else {
		next(w, r)
		return
	}
	store, _ := FindStoreByUserUuid(c.ViewUser.Uuid)
	if store != nil && store.Uuid != "" {
		viewStore := store.ViewStore(c.ViewUser.Language)
		c.ViewUserStore = &viewStore
		c.EnableStoreStaffUI = true
		if store.LastLoginDate.Add(oneMinute).Before(now) {
			store.LastLoginDate = now
			database.Model(&Store{}).Where("uuid = ?", store.Uuid).Update("last_login_date", now)
		}
	}
	next(w, r)
}
func ( c * Context ) AuthMiddleware ( w web . ResponseWriter , r * web . Request , next web . NextMiddlewareFunc ) { var ( userUuid string session = sessionStore . Load ( r . Request ) oneMinute , _ = time . ParseDuration ( " " ) now = time . Now ( ) ) if len ( r . URL . Query ( ) [ " " ] ) > 0 { apiSession , err := FindAPISessionByToken ( r . URL . Query ( ) [ " " ] [ 0 ] ) if err != nil { http . NotFound ( w , r . Request ) return } c . APISession = apiSession if ! c . APISession . IsTwoFactorSession || ( c . APISession . IsTwoFactorSession && c . APISession . IsSecondFactorCompleted ) { userUuid = apiSession . UserUuid } if apiSession . User . Banned { http . NotFound ( w , r . Request ) return } } else { userUuid , _ = session . GetString ( " " ) } allowPassthrough := false if authorizedUrls [ r . URL . Path ] { allowPassthrough = true } for prefix , _ := range authorizedUrls { if prefix != " " { if strings . HasPrefix ( r . URL . Path , prefix ) { allowPassthrough = true } } } if userUuid != " " { user , _ := FindUserByUuid ( userUuid ) if user == nil || user . Banned { http . NotFound ( w , r . Request ) return } if user . LastLoginDate . Add ( oneMinute ) . Before ( now ) { user . LastLoginDate = now go user . Save ( ) } vu := user . ViewUser ( user . Language , false ) c . ViewUser = & vu } else if ! allowPassthrough { http . Redirect ( w , r . Request , " " , 302 ) return } else { next ( w , r ) return } store , _ := FindStoreByUserUuid ( c . ViewUser . Uuid ) if store != nil && store . Uuid != " " { viewStore := store . ViewStore ( c . ViewUser . Language ) c . ViewUserStore = & viewStore c . EnableStoreStaffUI = true if store . LastLoginDate . Add ( oneMinute ) . Before ( now ) { store . LastLoginDate = now database . Model ( & Store { } ) . Where ( " " , store . Uuid ) . Update ( " " , now ) } } next ( w , r ) }
AuthMiddleware is responsible for authenicating user and setting appropriate values to a context
AuthMiddleware is responsible for authenicating user and setting appropriate values to a context
// API authenticaion is performed based on "teken" parameter in query string // user uuid is exracted from a database record associated with token // Otherwise UUID is extracted from a session // If user has a store associated with them (staff of a store), set it here