func main() { m := macaron.Classic() // New permissions middleware perm, err := permissionHSTORE.New() if err != nil { log.Fatalln(err) } // Blank slate, no default permissions //perm.Clear() // Logging middleware m.Use(macaron.Logger()) // Renderer middleware m.Use(macaron.Renderer()) // Set up a middleware handler for Macaron, with a custom "permission denied" message. permissionHandler := func(ctx *macaron.Context) { // Check if the user has the right admin/user rights if perm.Rejected(ctx.Resp, ctx.Req.Request) { fmt.Fprintf(ctx.Resp, "Permission denied!") // Deny the request ctx.Error(http.StatusForbidden) // Don't call other middleware handlers return } // Call the next middleware handler ctx.Next() } // Enable the permissions middleware, must come before recovery m.Use(permissionHandler) // Recovery middleware m.Use(macaron.Recovery()) // Get the userstate, used in the handlers below userstate := perm.UserState() m.Get("/", func(ctx *macaron.Context) (msg string) { msg += fmt.Sprintf("Has user bob: %v\n", userstate.HasUser("bob")) msg += fmt.Sprintf("Logged in on server: %v\n", userstate.IsLoggedIn("bob")) msg += fmt.Sprintf("Is confirmed: %v\n", userstate.IsConfirmed("bob")) msg += fmt.Sprintf("Username stored in cookies (or blank): %v\n", userstate.Username(ctx.Req.Request)) msg += fmt.Sprintf("Current user is logged in, has a valid cookie and *user rights*: %v\n", userstate.UserRights(ctx.Req.Request)) msg += fmt.Sprintf("Current user is logged in, has a valid cookie and *admin rights*: %v\n", userstate.AdminRights(ctx.Req.Request)) msg += fmt.Sprintln("\nTry: /register, /confirm, /remove, /login, /logout, /makeadmin, /clear, /data and /admin") return // msg }) m.Get("/register", func(ctx *macaron.Context) string { userstate.AddUser("bob", "hunter1", "*****@*****.**") return fmt.Sprintf("User bob was created: %v\n", userstate.HasUser("bob")) }) m.Get("/confirm", func(ctx *macaron.Context) string { userstate.MarkConfirmed("bob") return fmt.Sprintf("User bob was confirmed: %v\n", userstate.IsConfirmed("bob")) }) m.Get("/remove", func(ctx *macaron.Context) string { userstate.RemoveUser("bob") return fmt.Sprintf("User bob was removed: %v\n", !userstate.HasUser("bob")) }) m.Get("/login", func(ctx *macaron.Context) string { // Headers will be written, for storing a cookie userstate.Login(ctx.Resp, "bob") return fmt.Sprintf("bob is now logged in: %v\n", userstate.IsLoggedIn("bob")) }) m.Get("/logout", func(ctx *macaron.Context) string { userstate.Logout("bob") return fmt.Sprintf("bob is now logged out: %v\n", !userstate.IsLoggedIn("bob")) }) m.Get("/makeadmin", func(ctx *macaron.Context) string { userstate.SetAdminStatus("bob") return fmt.Sprintf("bob is now administrator: %v\n", userstate.IsAdmin("bob")) }) m.Get("/clear", func(ctx *macaron.Context) string { userstate.ClearCookie(ctx.Resp) return "Clearing cookie" }) m.Get("/data", func(ctx *macaron.Context) string { return "user page that only logged in users must see!" }) m.Get("/admin", func(ctx *macaron.Context) { fmt.Fprintf(ctx.Resp, "super secret information that only logged in administrators must see!\n\n") if usernames, err := userstate.AllUsernames(); err == nil { fmt.Fprintf(ctx.Resp, "list of all users: "+strings.Join(usernames, ", ")) } }) // Serve m.Run(3000) }
func main() { e := echo.New() // New permissions middleware perm, err := permissionHSTORE.New() if err != nil { log.Fatalln(err) } // Blank slate, no default permissions //perm.Clear() // Set up a middleware handler for Echo, with a custom "permission denied" message. permissionHandler := echo.MiddlewareFunc(func(next echo.HandlerFunc) echo.HandlerFunc { return echo.HandlerFunc(func(c echo.Context) error { // Check if the user has the right admin/user rights if perm.Rejected(w(c), req(c)) { // Deny the request return echo.NewHTTPError(http.StatusForbidden, "Permission denied!") } // Continue the chain of middleware return next(c) }) }) // Logging middleware e.Use(middleware.Logger()) // Enable the permissions middleware, must come before recovery e.Use(permissionHandler) // Recovery middleware e.Use(middleware.Recover()) // Get the userstate, used in the handlers below userstate := perm.UserState() e.Get("/", echo.HandlerFunc(func(c echo.Context) error { var buf bytes.Buffer b2s := map[bool]string{false: "false", true: "true"} buf.WriteString("Has user bob: " + b2s[userstate.HasUser("bob")] + "\n") buf.WriteString("Logged in on server: " + b2s[userstate.IsLoggedIn("bob")] + "\n") buf.WriteString("Is confirmed: " + b2s[userstate.IsConfirmed("bob")] + "\n") buf.WriteString("Username stored in cookies (or blank): " + userstate.Username(req(c)) + "\n") buf.WriteString("Current user is logged in, has a valid cookie and *user rights*: " + b2s[userstate.UserRights(req(c))] + "\n") buf.WriteString("Current user is logged in, has a valid cookie and *admin rights*: " + b2s[userstate.AdminRights(req(c))] + "\n") buf.WriteString("\nTry: /register, /confirm, /remove, /login, /logout, /makeadmin, /clear, /data and /admin") return c.String(http.StatusOK, buf.String()) })) e.Get("/register", echo.HandlerFunc(func(c echo.Context) error { userstate.AddUser("bob", "hunter1", "*****@*****.**") return c.String(http.StatusOK, fmt.Sprintf("User bob was created: %v\n", userstate.HasUser("bob"))) })) e.Get("/confirm", echo.HandlerFunc(func(c echo.Context) error { userstate.MarkConfirmed("bob") return c.String(http.StatusOK, fmt.Sprintf("User bob was confirmed: %v\n", userstate.IsConfirmed("bob"))) })) e.Get("/remove", echo.HandlerFunc(func(c echo.Context) error { userstate.RemoveUser("bob") return c.String(http.StatusOK, fmt.Sprintf("User bob was removed: %v\n", !userstate.HasUser("bob"))) })) e.Get("/login", echo.HandlerFunc(func(c echo.Context) error { // Headers will be written, for storing a cookie userstate.Login(w(c), "bob") return c.String(http.StatusOK, fmt.Sprintf("bob is now logged in: %v\n", userstate.IsLoggedIn("bob"))) })) e.Get("/logout", echo.HandlerFunc(func(c echo.Context) error { userstate.Logout("bob") return c.String(http.StatusOK, fmt.Sprintf("bob is now logged out: %v\n", !userstate.IsLoggedIn("bob"))) })) e.Get("/makeadmin", echo.HandlerFunc(func(c echo.Context) error { userstate.SetAdminStatus("bob") return c.String(http.StatusOK, fmt.Sprintf("bob is now administrator: %v\n", userstate.IsAdmin("bob"))) })) e.Get("/clear", echo.HandlerFunc(func(c echo.Context) error { userstate.ClearCookie(w(c)) return c.String(http.StatusOK, "Clearing cookie") })) e.Get("/data", echo.HandlerFunc(func(c echo.Context) error { return c.String(http.StatusOK, "user page that only logged in users must see!") })) e.Get("/admin", echo.HandlerFunc(func(c echo.Context) error { var buf bytes.Buffer buf.WriteString("super secret information that only logged in administrators must see!\n\n") if usernames, err := userstate.AllUsernames(); err == nil { buf.WriteString("list of all users: " + strings.Join(usernames, ", ")) } return c.String(http.StatusOK, buf.String()) })) // Serve e.Run(standard.New(":3000")) }
func main() { // New permissions middleware perm, err := permissionHSTORE.New() if err != nil { log.Fatalln(err) } // Blank slate, no default permissions //perm.Clear() // Get the userstate, used in the handlers below userstate := perm.UserState() goji.Get("/", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "Has user bob: %v\n", userstate.HasUser("bob")) fmt.Fprintf(w, "Logged in on server: %v\n", userstate.IsLoggedIn("bob")) fmt.Fprintf(w, "Is confirmed: %v\n", userstate.IsConfirmed("bob")) fmt.Fprintf(w, "Username stored in cookies (or blank): %v\n", userstate.Username(req)) fmt.Fprintf(w, "Current user is logged in, has a valid cookie and *user rights*: %v\n", userstate.UserRights(req)) fmt.Fprintf(w, "Current user is logged in, has a valid cookie and *admin rights*: %v\n", userstate.AdminRights(req)) fmt.Fprintf(w, "\nTry: /register, /confirm, /remove, /login, /logout, /makeadmin, /clear, /data and /admin") }) goji.Get("/register", func(w http.ResponseWriter, req *http.Request) { userstate.AddUser("bob", "hunter1", "*****@*****.**") fmt.Fprintf(w, "User bob was created: %v\n", userstate.HasUser("bob")) }) goji.Get("/confirm", func(w http.ResponseWriter, req *http.Request) { userstate.MarkConfirmed("bob") fmt.Fprintf(w, "User bob was confirmed: %v\n", userstate.IsConfirmed("bob")) }) goji.Get("/remove", func(w http.ResponseWriter, req *http.Request) { userstate.RemoveUser("bob") fmt.Fprintf(w, "User bob was removed: %v\n", !userstate.HasUser("bob")) }) goji.Get("/login", func(w http.ResponseWriter, req *http.Request) { userstate.Login(w, "bob") fmt.Fprintf(w, "bob is now logged in: %v\n", userstate.IsLoggedIn("bob")) }) goji.Get("/logout", func(w http.ResponseWriter, req *http.Request) { userstate.Logout("bob") fmt.Fprintf(w, "bob is now logged out: %v\n", !userstate.IsLoggedIn("bob")) }) goji.Get("/makeadmin", func(w http.ResponseWriter, req *http.Request) { userstate.SetAdminStatus("bob") fmt.Fprintf(w, "bob is now administrator: %v\n", userstate.IsAdmin("bob")) }) goji.Get("/clear", func(w http.ResponseWriter, req *http.Request) { userstate.ClearCookie(w) fmt.Fprintf(w, "Clearing cookie") }) goji.Get("/data", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "user page that only logged in users must see!") }) goji.Get("/admin", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "super secret information that only logged in administrators must see!\n\n") if usernames, err := userstate.AllUsernames(); err == nil { fmt.Fprintf(w, "list of all users: "+strings.Join(usernames, ", ")) } }) // Custom "permissions denied" message perm.SetDenyFunction(func(w http.ResponseWriter, req *http.Request) { http.Error(w, "Permission denied!", http.StatusForbidden) }) // Permissions middleware for Goji permissionHandler := func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { // Check if the user has the right admin/user rights if perm.Rejected(w, req) { // Deny the request perm.DenyFunction()(w, req) return } // Serve the requested page next.ServeHTTP(w, req) }) } // Enable the permissions middleware goji.Use(permissionHandler) // Goji will listen to port 8000 by default goji.Serve() }
func main() { n := negroni.Classic() mux := http.NewServeMux() // New permissions middleware perm, err := permissionHSTORE.New() if err != nil { log.Fatalln(err) } // Blank slate, no default permissions //perm.Clear() // Get the userstate, used in the handlers below userstate := perm.UserState() mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "Has user bob: %v\n", userstate.HasUser("bob")) fmt.Fprintf(w, "Logged in on server: %v\n", userstate.IsLoggedIn("bob")) fmt.Fprintf(w, "Is confirmed: %v\n", userstate.IsConfirmed("bob")) fmt.Fprintf(w, "Username stored in cookies (or blank): %v\n", userstate.Username(req)) fmt.Fprintf(w, "Current user is logged in, has a valid cookie and *user rights*: %v\n", userstate.UserRights(req)) fmt.Fprintf(w, "Current user is logged in, has a valid cookie and *admin rights*: %v\n", userstate.AdminRights(req)) fmt.Fprintf(w, "\nTry: /register, /confirm, /remove, /login, /logout, /makeadmin, /clear, /data and /admin") }) mux.HandleFunc("/register", func(w http.ResponseWriter, req *http.Request) { userstate.AddUser("bob", "hunter1", "*****@*****.**") fmt.Fprintf(w, "User bob was created: %v\n", userstate.HasUser("bob")) }) mux.HandleFunc("/confirm", func(w http.ResponseWriter, req *http.Request) { userstate.MarkConfirmed("bob") fmt.Fprintf(w, "User bob was confirmed: %v\n", userstate.IsConfirmed("bob")) }) mux.HandleFunc("/remove", func(w http.ResponseWriter, req *http.Request) { userstate.RemoveUser("bob") fmt.Fprintf(w, "User bob was removed: %v\n", !userstate.HasUser("bob")) }) mux.HandleFunc("/login", func(w http.ResponseWriter, req *http.Request) { userstate.Login(w, "bob") fmt.Fprintf(w, "bob is now logged in: %v\n", userstate.IsLoggedIn("bob")) }) mux.HandleFunc("/logout", func(w http.ResponseWriter, req *http.Request) { userstate.Logout("bob") fmt.Fprintf(w, "bob is now logged out: %v\n", !userstate.IsLoggedIn("bob")) }) mux.HandleFunc("/makeadmin", func(w http.ResponseWriter, req *http.Request) { userstate.SetAdminStatus("bob") fmt.Fprintf(w, "bob is now administrator: %v\n", userstate.IsAdmin("bob")) }) mux.HandleFunc("/clear", func(w http.ResponseWriter, req *http.Request) { userstate.ClearCookie(w) fmt.Fprintf(w, "Clearing cookie") }) mux.HandleFunc("/data", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "user page that only logged in users must see!") }) mux.HandleFunc("/admin", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "super secret information that only logged in administrators must see!\n\n") if usernames, err := userstate.AllUsernames(); err == nil { fmt.Fprintf(w, "list of all users: "+strings.Join(usernames, ", ")) } }) // Custom handler for when permissions are denied perm.SetDenyFunction(func(w http.ResponseWriter, req *http.Request) { http.Error(w, "Permission denied!", http.StatusForbidden) }) // Enable the permissions middleware n.Use(perm) // Use mux for routing, this goes last n.UseHandler(mux) // Serve n.Run(":3000") }
func main() { mux := http.NewServeMux() // New permissionHSTORE middleware perm, err := permissionHSTORE.New() if err != nil { log.Fatal("Could not open Bolt database") } // Blank slate, no default permissions //perm.Clear() // Get the userstate, used in the handlers below userstate := perm.UserState() mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "Has user bob: %v\n", userstate.HasUser("bob")) fmt.Fprintf(w, "Logged in on server: %v\n", userstate.IsLoggedIn("bob")) fmt.Fprintf(w, "Is confirmed: %v\n", userstate.IsConfirmed("bob")) fmt.Fprintf(w, "Username stored in cookies (or blank): %v\n", userstate.Username(req)) fmt.Fprintf(w, "Current user is logged in, has a valid cookie and *user rights*: %v\n", userstate.UserRights(req)) fmt.Fprintf(w, "Current user is logged in, has a valid cookie and *admin rights*: %v\n", userstate.AdminRights(req)) fmt.Fprintf(w, "\nTry: /register, /confirm, /remove, /login, /logout, /makeadmin, /clear, /data and /admin") }) mux.HandleFunc("/register", func(w http.ResponseWriter, req *http.Request) { userstate.AddUser("bob", "hunter1", "*****@*****.**") fmt.Fprintf(w, "User bob was created: %v\n", userstate.HasUser("bob")) }) mux.HandleFunc("/confirm", func(w http.ResponseWriter, req *http.Request) { userstate.MarkConfirmed("bob") fmt.Fprintf(w, "User bob was confirmed: %v\n", userstate.IsConfirmed("bob")) }) mux.HandleFunc("/remove", func(w http.ResponseWriter, req *http.Request) { userstate.RemoveUser("bob") fmt.Fprintf(w, "User bob was removed: %v\n", !userstate.HasUser("bob")) }) mux.HandleFunc("/login", func(w http.ResponseWriter, req *http.Request) { userstate.Login(w, "bob") fmt.Fprintf(w, "bob is now logged in: %v\n", userstate.IsLoggedIn("bob")) }) mux.HandleFunc("/logout", func(w http.ResponseWriter, req *http.Request) { userstate.Logout("bob") fmt.Fprintf(w, "bob is now logged out: %v\n", !userstate.IsLoggedIn("bob")) }) mux.HandleFunc("/makeadmin", func(w http.ResponseWriter, req *http.Request) { userstate.SetAdminStatus("bob") fmt.Fprintf(w, "bob is now administrator: %v\n", userstate.IsAdmin("bob")) }) mux.HandleFunc("/clear", func(w http.ResponseWriter, req *http.Request) { userstate.ClearCookie(w) fmt.Fprintf(w, "Clearing cookie") }) mux.HandleFunc("/data", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "user page that only logged in users must see!") }) mux.HandleFunc("/admin", func(w http.ResponseWriter, req *http.Request) { fmt.Fprintf(w, "super secret information that only logged in administrators must see!\n\n") if usernames, err := userstate.AllUsernames(); err == nil { fmt.Fprintf(w, "list of all users: "+strings.Join(usernames, ", ")) } }) // Custom handler for when permissions are denied perm.SetDenyFunction(func(w http.ResponseWriter, req *http.Request) { http.Error(w, "Permission denied!", http.StatusForbidden) }) // Configure the HTTP server and permissionHandler struct s := &http.Server{ Addr: ":3000", Handler: &permissionHandler{perm, mux}, ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second, MaxHeaderBytes: 1 << 20, } log.Println("Listening for requests on port 3000") // Start listening s.ListenAndServe() }