zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-07-30 06:26:15 +02:00
Code Issues Projects Releases Packages Wiki Activity

Added client cert control to every REPP APi request

Browse source
This commit is contained in:
Sergei Tsõganov 2022-06-13 16:26:42 +03:00
parent 7ec5c914bc
commit 9f6c628453
2 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

10
app/controllers/repp/v1/base_controller.rb
View file

@ -7,6 +7,7 @@ module Repp
before_action :authenticate_user before_action :authenticate_user
before_action :validate_webclient_ca before_action :validate_webclient_ca
before_action :check_ip_restriction before_action :check_ip_restriction
before_action :validate_client_certs
before_action :set_paper_trail_whodunnit before_action :set_paper_trail_whodunnit
private private
@ -144,6 +145,15 @@ module Repp
render(json: @response, status: :unauthorized) render(json: @response, status: :unauthorized)
end end
def validate_client_certs
return if Rails.env.development? || Rails.env.test?
return if @current_user.pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'],
request.env['HTTP_SSL_CLIENT_S_DN_CN'], api: false)
@response = { code: 2202, message: 'Invalid certificate' }
render(json: @response, status: :unauthorized)
end
def logger def logger
Rails.logger Rails.logger
end end

11
app/controllers/repp/v1/registrar/auth_controller.rb
View file

@ -4,16 +4,12 @@ module Repp
class AuthController < BaseController class AuthController < BaseController
skip_before_action :authenticate_user, only: :tara_callback skip_before_action :authenticate_user, only: :tara_callback
skip_before_action :check_ip_restriction, only: :tara_callback skip_before_action :check_ip_restriction, only: :tara_callback
skip_before_action :validate_client_certs, only: :tara_callback
api :GET, 'repp/v1/registrar/auth' api :GET, 'repp/v1/registrar/auth'
desc 'check user auth info and return data' desc 'check user auth info and return data'
def index def index
registrar = current_user.registrar registrar = current_user.registrar
unless client_certs_ok
handle_non_epp_errors(current_user, 'Invalid certificate')
return
end
render_success(data: auth_values_to_data(registrar: registrar)) render_success(data: auth_values_to_data(registrar: registrar))
end end
@ -48,11 +44,6 @@ module Repp
def auth_params def auth_params
params.require(:auth).permit(:uid, :new_user_id) params.require(:auth).permit(:uid, :new_user_id)
end end
def client_certs_ok
current_user.pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'],
request.env['HTTP_SSL_CLIENT_S_DN_CN'], api: false)
end
end end
end end
end end