Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: implement Phase 1 and 2 security remediations
Some checks failed
Automated Container Build / build-and-push (push) Has been cancelled
Details

Browse source
This commit is contained in:
Elijah 2026-05-26 13:32:09 -07:00
parent 82731e93b1
commit 701766b611
14 changed files with 213 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

15
backend/middleware/auth.go
View file

@ -111,7 +111,7 @@ func GenerateRefreshToken(userID int, username, secret string, rememberMe bool)
}
// GenerateDownloadToken creates a short-lived download token.
func GenerateDownloadToken(userID int, username, secret string) (string, error) {
func GenerateDownloadToken(userID int, username, secret, filePath string) (string, error) {
claims := jwt.MapClaims{
"sub": userID,
"username": username,
@ -120,12 +120,16 @@ func GenerateDownloadToken(userID int, username, secret string) (string, error)
"type": "download",
}
if filePath != "" {
claims["path"] = filePath
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
return token.SignedString([]byte(secret))
}
// ValidateDownloadToken validates a download token
func ValidateDownloadToken(tokenString, secret, expectedUsername string) error {
func ValidateDownloadToken(tokenString, secret, expectedUsername, expectedPath string) error {
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
return []byte(secret), nil
})
@ -143,5 +147,12 @@ func ValidateDownloadToken(tokenString, secret, expectedUsername string) error {
return fiber.NewError(fiber.StatusUnauthorized, "token belongs to different context")
}
if expectedPath != "" {
tokenPath, _ := claims["path"].(string)
if tokenPath != "" && !strings.HasPrefix(expectedPath, tokenPath) {
return fiber.NewError(fiber.StatusUnauthorized, "token not valid for this path")
}
}
return nil
}