amberframework/amber

#pipes/authenticate_jwt.cr

class HTTP::Server::Context
  property current_user : User?
end

class AuthenticateJWT < Amber::Pipe::Base
  PUBLIC_PATHS = ["/", "/signin",  "/session", 
    "/signup", "/registration",  "/register"]

  # add the regular expressions of paths that have public access
  REGEX_PATHS = [
    %r(/categories(/\d+)?$/),
    %r(/products(/\d+)?$/),
    %r(/comments(/\d+)?$/),
    %r(/support/.*$/),
   ]

  def call(context)
    token = context.params["token"]? || context.request.headers["x-jwt-token"]?
    if token 
      payload, header = JWT.decode(token, Amber.settings.secret_key_base, JWT::Algorithm::HS256)
      user = User.find_by(email: payload["email"].to_s) unless payload["email"]?.nil?
    elsif user_id = context.session["user_id"]?
      user = User.find user_id
    end

    if user
      context.current_user = user

      if context.request.path.starts_with?("/admin") && ! user.is_admin? 
        context.flash[:warning] = "Access forbidden"
        context.response.headers.add "Location", "/"
        context.response.status_code = 302
      else
          call_next(context)
      end

    else
      return call_next(context) if public_path?(context.request.path, context.session["user_id"]?)
      context.flash[:warning] = "Please Sign In"
      context.response.headers.add "Location", "/signin"
      context.response.status_code = 302
    end
  end

  private def public_path?(path, user_id)
    return true if PUBLIC_PATHS.includes?(path)

    # Different strategies can be used to determine if a path is public
    # Example, if /admin/* paths are the only private paths
    # return false if path.starts_with?("/admin")
    #
    # Example, if only a few private paths exist
    # return false if ["/secret", "/super/secret", "/private"].includes?(path)

    REGEX_PATHS.count { |r| r.match(path) } > 0
  end
end