Publish curated ITWorx-Pulse source from 0e0633c8ac91cb71312a26837f791035a78d81b8

internal/sessionapi/handler.go

@@ -0,0 +1,53 @@
+package sessionapi
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/itworx/pulse/internal/auth"
+	"github.com/itworx/pulse/internal/problem"
+)
+
+type Permissions struct {
+	View    bool `json:"view"`
+	Operate bool `json:"operate"`
+	Edit    bool `json:"edit"`
+	Admin   bool `json:"admin"`
+}
+
+type Response struct {
+	Subject     string      `json:"subject"`
+	Role        auth.Role   `json:"role"`
+	Environment string      `json:"environment"`
+	Permissions Permissions `json:"permissions"`
+}
+
+type Handler struct {
+	Environment string
+}
+
+func (handler Handler) ServeHTTP(response http.ResponseWriter, request *http.Request) {
+	response.Header().Set("Cache-Control", "private, no-store")
+	if request.Method != http.MethodGet {
+		problem.Write(response, request, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "Method not allowed", "Only GET is supported for the session capability view.", nil)
+		return
+	}
+	principal, ok := auth.PrincipalFromContext(request.Context())
+	if !ok {
+		problem.Write(response, request, http.StatusUnauthorized, "UNAUTHORIZED", "Authentication required", "An authenticated Pulse session is required.", nil)
+		return
+	}
+	payload := Response{
+		Subject:     principal.Subject,
+		Role:        principal.Role,
+		Environment: handler.Environment,
+		Permissions: Permissions{
+			View:    auth.Allows(principal.Role, auth.PermissionView),
+			Operate: auth.Allows(principal.Role, auth.PermissionOperate),
+			Edit:    auth.Allows(principal.Role, auth.PermissionEdit),
+			Admin:   auth.Allows(principal.Role, auth.PermissionAdmin),
+		},
+	}
+	response.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(response).Encode(payload)
+}