Graham McIntire
b252cb81b9
- H6: batch interface stats query in get_site_capacity_summary, replacing per-interface SELECT with a single grouped query - H8: explicit expires_at check in MobileAuth and GraphQLAuth plugs as defense in depth — the query already filters expired rows, but a future refactor dropping the filter can't quietly re-enable revoked sessions - H17: Reports LiveView (toggle/delete/run_now) now uses Reports.get_organization_report/2 to scope by organization_id, fixing IDOR where a user could manipulate other tenants' reports by ID - H18: ToweropsWeb.Api.ParamFilter strips identity fields (id, organization_id, user_id, created_by_id, inserted_at, updated_at) from user-supplied API params; applied to devices, sites, checks, and escalation_policies create/update paths to prevent mass-assignment of tenant ownership fields if a changeset cast list ever drifts
94 lines
2.6 KiB
Elixir
94 lines
2.6 KiB
Elixir
defmodule ToweropsWeb.Plugs.GraphQLAuth do
|
|
@moduledoc """
|
|
Plug for authenticating GraphQL requests using either API tokens or mobile session tokens.
|
|
|
|
Accepts two token types via Authorization: Bearer <token>:
|
|
- API tokens (prefixed with "towerops_") → sets current_organization_id + current_user
|
|
- Mobile session tokens → sets current_user only (no org_id)
|
|
|
|
Returns 401 Unauthorized if neither token type is valid.
|
|
"""
|
|
|
|
import Phoenix.Controller, only: [json: 2]
|
|
import Plug.Conn
|
|
|
|
alias Towerops.Accounts
|
|
alias Towerops.ApiTokens
|
|
alias Towerops.MobileSessions
|
|
|
|
def init(opts), do: opts
|
|
|
|
def call(conn, _opts) do
|
|
case get_req_header(conn, "authorization") do
|
|
["Bearer " <> token] ->
|
|
authenticate(conn, token)
|
|
|
|
_ ->
|
|
unauthorized(conn, "Missing or invalid Authorization header")
|
|
end
|
|
end
|
|
|
|
defp authenticate(conn, "towerops_" <> _ = token) do
|
|
case ApiTokens.verify_token(token) do
|
|
{:ok, organization_id, user} ->
|
|
conn
|
|
|> assign(:current_organization_id, organization_id)
|
|
|> assign(:current_user, user)
|
|
|
|
{:error, :invalid_token} ->
|
|
unauthorized(conn, "Invalid or expired API token")
|
|
end
|
|
end
|
|
|
|
defp authenticate(conn, token) do
|
|
with {:ok, session} <- validate_mobile_session(token),
|
|
{:ok, user} <- get_user(session.user_id) do
|
|
_ =
|
|
Task.Supervisor.start_child(Towerops.TaskSupervisor, fn ->
|
|
MobileSessions.touch_session(session)
|
|
end)
|
|
|
|
assign(conn, :current_user, user)
|
|
else
|
|
{:error, _reason} ->
|
|
unauthorized(conn, "Invalid or expired authentication token")
|
|
end
|
|
end
|
|
|
|
defp validate_mobile_session(token) do
|
|
case MobileSessions.get_session_by_token(token) do
|
|
nil ->
|
|
{:error, :invalid_token}
|
|
|
|
session ->
|
|
# Defense in depth: the query already filters expired rows, but
|
|
# explicitly verifying here means a refactor that drops the filter
|
|
# can't quietly re-enable revoked sessions.
|
|
if session_expired?(session) do
|
|
{:error, :invalid_token}
|
|
else
|
|
{:ok, session}
|
|
end
|
|
end
|
|
end
|
|
|
|
defp session_expired?(%{expires_at: nil}), do: true
|
|
|
|
defp session_expired?(%{expires_at: expires_at}) do
|
|
DateTime.compare(expires_at, DateTime.utc_now()) != :gt
|
|
end
|
|
|
|
defp get_user(user_id) do
|
|
case Accounts.get_user(user_id) do
|
|
nil -> {:error, :user_not_found}
|
|
user -> {:ok, user}
|
|
end
|
|
end
|
|
|
|
defp unauthorized(conn, message) do
|
|
conn
|
|
|> put_status(:unauthorized)
|
|
|> json(%{error: message})
|
|
|> halt()
|
|
end
|
|
end
|