Squashed commit of the following:

commit d2ec8c0f07 Author: mario <dev.mario@sismedika@gmail.com> Date: Thu May 15 15:42:33 2025 +0700 add: db tx commit and rollback implementation commit 264435f67e Author: mario <dev.mario@sismedika@gmail.com> Date: Thu May 15 14:34:20 2025 +0700 fix: shortlink generation logic update/create commit 047ab1937a Author: mario <dev.mario@sismedika@gmail.com> Date: Thu May 15 11:06:04 2025 +0700 fix: if multiple studies patient, show first study by default commit c13f834b92 Author: mario <dev.mario@sismedika@gmail.com> Date: Thu May 15 09:46:32 2025 +0700 add: register and login with DB query AND some struct type correction commit dd4451c2a8 Author: mario <dev.mario@sismedika@gmail.com> Date: Wed May 14 10:23:33 2025 +0700 new file structure & koneksi ke DB commit 8289881df3 Author: mario <dev.mario@sismedika@gmail.com> Date: Tue May 13 16:49:07 2025 +0700 edit: rm debug route commit dd784da232 Author: mario <dev.mario@sismedika@gmail.com> Date: Tue May 13 15:44:11 2025 +0700 add: implement shortlink commit 2687a761cc Author: mario <dev.mario@sismedika@gmail.com> Date: Tue May 13 11:47:19 2025 +0700 add new dummy doctor user commit eb67eaca46 Author: mario <dev.mario@sismedika@gmail.com> Date: Tue May 13 11:46:28 2025 +0700 add: ref_doctor studylist filter commit 0d4825d152 Author: mario <dev.mario@sismedika@gmail.com> Date: Tue May 13 10:07:16 2025 +0700 edit study_iuids & accNum in patient jwt to array commit 2d1f135fda Author: mario <dev.mario@sismedika@gmail.com> Date: Tue May 13 09:52:45 2025 +0700 patient see their multiple studies commit 13bb380f51 Author: mario <dev.mario@sismedika@gmail.com> Date: Fri May 9 10:13:16 2025 +0700 add: cors handler route and readme commit 6c9ab574ce Author: mario <dev.mario@sismedika@gmail.com> Date: Mon May 5 11:50:36 2025 +0700 add: login & token validation tapi belum connect ke DB commit 297c9a6a01 Author: mario <dev.mario@sismedika@gmail.com> Date: Mon Apr 28 15:37:02 2025 +0700 add readme.md commit 9b8e0260f3 Author: mario <dev.mario@sismedika@gmail.com> Date: Mon Apr 7 15:46:07 2025 +0700 connected-to-google commit f340bc5916 Author: mario <dev.mario@sismedika.com> Date: Mon Apr 7 11:14:18 2025 +0700 init
2025-05-15 15:50:40 +07:00
parent 8a000ca6c8
commit c35ec4180d
42 changed files with 4826 additions and 19 deletions
--- a/internal/api/middleware/auth.go
+++ b/internal/api/middleware/auth.go
@@ -0,0 +1,234 @@
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"devone.aplikasi.web.id/gitea/mario/go-ohif-proxy/internal/api/service"
+	"devone.aplikasi.web.id/gitea/mario/go-ohif-proxy/internal/auth"
+	"go.uber.org/zap"
+)
+
+type contextKey string
+
+const (
+	UserIDKey    contextKey = "user_id"
+	UserRoleKey  contextKey = "user_role"
+	UserEmailKey contextKey = "user_email"
+	ClaimsKey    contextKey = "auth_claims" // Use this same key everywhere
+)
+
+// WhitelistedEndpoints contains paths that can be accessed without authentication
+var WhitelistedEndpoints = []*regexp.Regexp{
+	// Study by UID
+	regexp.MustCompile(`^/dicomWeb/studies\?.*StudyInstanceUID=.+`),
+
+	// Frame endpoint
+	regexp.MustCompile(`^/dicomWeb/studies/[^/]+/series/[^/]+/instances/[^/]+/frames/\d+$`),
+}
+
+// Auth middleware authenticates requests using JWT tokens
+func Auth(authService *service.AuthService, logger *zap.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Get authorization header
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				logger.Warn("Missing Authorization header", zap.String("path", r.URL.Path))
+				respondWithError(w, http.StatusUnauthorized, "missing authorization header")
+				return
+			}
+
+			// Extract token from Bearer token
+			bearerToken := strings.Split(authHeader, " ")
+			if len(bearerToken) != 2 || strings.ToLower(bearerToken[0]) != "bearer" {
+				logger.Warn("Invalid Authorization header format", zap.String("header", authHeader))
+				respondWithError(w, http.StatusUnauthorized, "invalid authorization format")
+				return
+			}
+
+			token := bearerToken[1]
+
+			// Validate token
+			claims, err := authService.ValidateToken(token)
+			if err != nil {
+				logger.Warn("Invalid or expired token", zap.Error(err))
+				respondWithError(w, http.StatusUnauthorized, "invalid or expired token")
+				return
+			}
+
+			// Check token type
+			if claims.TokenType != "access" {
+				logger.Warn("Invalid token type", zap.String("tokenType", claims.TokenType))
+				respondWithError(w, http.StatusUnauthorized, "invalid token type")
+				return
+			}
+
+			// Add user info to request context
+			ctx := context.WithValue(r.Context(), UserIDKey, claims.UserID)
+			ctx = context.WithValue(ctx, UserRoleKey, claims.Role)
+			ctx = context.WithValue(ctx, UserEmailKey, claims.Email) // TODO: Apakah kita perlu param email untuk generate access token?
+
+			// Store the claims with the defined context key
+			ctx = context.WithValue(ctx, ClaimsKey, claims)
+
+			// Log successful authentication
+			logger.Debug("Auth middleware: Token validated",
+				zap.String("userID", claims.UserID),
+				zap.String("role", claims.Role))
+
+			// Continue with the request
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+// RoleRequired middleware checks if user has the required role
+func RoleRequired(roles ...string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check if the request path is whitelisted first
+			path := r.URL.Path
+			if r.URL.RawQuery != "" {
+				path = path + "?" + r.URL.RawQuery
+			}
+
+			for _, pattern := range WhitelistedEndpoints {
+				if pattern.MatchString(path) {
+					// Path is whitelisted, skip role check
+					next.ServeHTTP(w, r)
+					return
+				}
+			}
+
+			// Get user role from context
+			userRole, ok := r.Context().Value(UserRoleKey).(string)
+			if !ok {
+				respondWithError(w, http.StatusUnauthorized, "user context not found")
+				return
+			}
+
+			// Check if user has one of the required roles
+			hasRole := false
+			for _, role := range roles {
+				if userRole == role {
+					hasRole = true
+					break
+				}
+			}
+
+			if !hasRole {
+				respondWithError(w, http.StatusForbidden, "insufficient permissions")
+				return
+			}
+
+			// Continue with the request
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// PatientViewRestriction ensures patients can only access their own studies
+func PatientViewRestriction(logger *zap.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Get claims from context using the defined key
+			claimsValue := r.Context().Value(ClaimsKey)
+			if claimsValue == nil {
+				logger.Error("Missing claims in context - PatientViewRestriction middleware",
+					zap.String("path", r.URL.Path),
+					zap.String("method", r.Method))
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				return
+			}
+
+			claims, ok := claimsValue.(*auth.CustomClaims)
+			if !ok {
+				logger.Error("Invalid claims type in context",
+					zap.String("type", fmt.Sprintf("%T", claimsValue)))
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				return
+			}
+
+			logger.Debug("PatientViewRestriction: Got claims from context",
+				zap.String("userID", claims.UserID),
+				zap.String("role", claims.Role))
+
+			// Only apply restrictions to patient role
+			if claims.Role != "patient" {
+				// For non-patient roles, continue with the request
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// Parse the path to extract StudyInstanceUID if present
+			path := r.URL.Path
+			parts := strings.Split(path, "/")
+
+			// Check if this is a study-specific request
+			var requestedStudyUID string
+			for i, part := range parts {
+				if part == "studies" && i+1 < len(parts) {
+					requestedStudyUID = parts[i+1]
+					break
+				}
+			}
+
+			// If there's no study UID in the path, check query parameters
+			if requestedStudyUID == "" {
+				queryStudyUID := r.URL.Query().Get("StudyInstanceUID")
+				if queryStudyUID != "" {
+					requestedStudyUID = queryStudyUID
+				}
+			}
+
+			// If a study is being requested, verify patient has access
+			if requestedStudyUID != "" && len(claims.StudyIUIDs) > 0 {
+				// Check if the requested study is authorized
+				isAuthorized := false
+
+				for _, studyUID := range claims.StudyIUIDs {
+					if studyUID == requestedStudyUID {
+						isAuthorized = true
+						logger.Debug("Patient authorized to access study",
+							zap.String("userID", claims.UserID),
+							zap.String("requestedStudy", requestedStudyUID))
+						break
+					}
+				}
+
+				// If not authorized, return 403 Forbidden
+				if !isAuthorized {
+					logger.Warn("Patient attempted to access unauthorized study",
+						zap.String("userID", claims.UserID),
+						zap.String("role", claims.Role),
+						zap.String("requestedStudy", requestedStudyUID),
+						zap.Strings("authorizedStudies", claims.StudyIUIDs))
+
+					// Return 403 Forbidden with a clear message
+					w.Header().Set("Content-Type", "application/json")
+					w.WriteHeader(http.StatusForbidden)
+					json.NewEncoder(w).Encode(map[string]string{
+						"error": "Access denied: You do not have permission to view this study",
+						"code":  "forbidden_study_access",
+					})
+					return
+				}
+			}
+
+			// Patient has access or is requesting a list (which will be filtered)
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// Helper function to respond with an error
+func respondWithError(w http.ResponseWriter, statusCode int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	json.NewEncoder(w).Encode(map[string]string{"error": message})
+}
--- a/internal/api/middleware/logging.go
+++ b/internal/api/middleware/logging.go
@@ -0,0 +1,61 @@
+package middleware
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5/middleware"
+	"go.uber.org/zap"
+)
+
+// Logger middleware adds request logging
+func Logger(logger *zap.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			start := time.Now()
+
+			// Create a wrapped response writer to capture the status code
+			ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
+
+			// Process request
+			next.ServeHTTP(ww, r)
+
+			// Calculate request time
+			latency := time.Since(start)
+
+			// Log request details
+			logger.Info("API Request",
+				zap.String("method", r.Method),
+				zap.String("path", r.URL.Path),
+				zap.String("query", r.URL.RawQuery),
+				zap.Int("status", ww.Status()),
+				zap.Duration("latency", latency),
+				zap.String("ip", r.RemoteAddr),
+				zap.String("user-agent", r.UserAgent()),
+				zap.Int("bytes", ww.BytesWritten()),
+			)
+		})
+	}
+}
+
+// AuditLog middleware records detailed information about DICOM requests
+func AuditLog(logger *zap.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Extract user info (placeholder for now)
+			userID := "TODO: userID"
+
+			// Process request
+			ww := middleware.NewWrapResponseWriter(w, r.ProtoMajor)
+			next.ServeHTTP(ww, r)
+
+			// Audit log after request completes
+			logger.Info("DICOM Access",
+				zap.String("userID", userID),
+				zap.String("action", r.Method),
+				zap.String("resource", r.URL.Path),
+				zap.Int("status", ww.Status()),
+			)
+		})
+	}
+}