@johnnyboy11234/esg-idea-contest 0.2.1 → 0.2.2

package/backend/cmd/server/main.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/config"
@@ -46,7 +47,12 @@ func run() error {
 
 	auditSvc := audit.New(db, log)
 	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
+	csrf, err := auth.NewCSRF(cfg.CSRFKey, cfg.CSRFKeyPrevious)
+	if err != nil {
+		return err
+	}
 	si := server.API{
+		Auth: auth.Handler{CSRF: csrf, Log: log},
 		Account: account.Handler{
 			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
 			Fail:    errs.Write,
@@ -55,5 +61,7 @@ func run() error {
 	}
 
 	var ready atomic.Bool
-	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si)), &ready, server.DBCheck(db))
+	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si),
+		auth.Middleware(auth.New(db), server.IsPublic, log),
+		csrf.Middleware(errs.Write, server.ActionFor)), &ready, server.DBCheck(db))
 }

package/backend/internal/auth/csrf.go

@@ -0,0 +1,212 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// CSRF names and sizes (PRD §6.5, Backend.md §6, D40).
+const (
+	// CSRFCookie is the double-submit cookie. The __Host- prefix forces Secure,
+	// Path=/ and no Domain; HttpOnly keeps it away from script, which reads the
+	// token from the GET /auth/csrf body instead.
+	CSRFCookie = "__Host-csrf"
+	// CSRFHeader carries the token on every write.
+	CSRFHeader = "X-CSRF-Token"
+
+	// MinCSRFKeyBytes is the shortest accepted HMAC key (the SHA-256 output size).
+	MinCSRFKeyBytes = 32
+
+	nonceBytes = 16
+)
+
+var anonymousBinding = []byte{0x00, 'a', 'n', 'o', 'n'}
+
+// CSRF signs and verifies session-bound double-submit tokens:
+//
+//	base64url(nonce) "." base64url(HMAC-SHA256(key, binding ‖ nonce))
+//
+// The binding is 0x01 ‖ SHA-256(session ID) with a session, a fixed anonymous
+// value without one. A token minted anonymously, or for another session,
+// therefore fails against a victim's session (D40).
+//
+// The first key signs; every key verifies. Rotation: make the new key current
+// and the old one previous, and drop the previous key after 8 h (Backend.md §6).
+// Tokens carry no expiry, so the operator's removal of the old key is the bound.
+type CSRF struct {
+	keys [][]byte
+}
+
+// NewCSRF returns a signer. current signs; previous (optional) only verifies.
+func NewCSRF(current string, previous ...string) (*CSRF, error) {
+	c := &CSRF{}
+	for i, k := range append([]string{current}, previous...) {
+		if i > 0 && k == "" {
+			continue // an unset previous key means "no rotation in progress"
+		}
+		if len(k) < MinCSRFKeyBytes {
+			return nil, fmt.Errorf("csrf key %d: need at least %d bytes", i, MinCSRFKeyBytes)
+		}
+		c.keys = append(c.keys, []byte(k))
+	}
+	return c, nil
+}
+
+// bindingFor returns the binding for a request: the session's when the session
+// middleware resolved one, else the anonymous value. ok is false only when a
+// validated session carries an ID that cannot be bound (cannot happen unless
+// the validator and Binding disagree).
+func bindingFor(r *http.Request) (b []byte, ok bool) {
+	if _, has := security.PrincipalFrom(r.Context()); !has {
+		return anonymousBinding, true
+	}
+	c, err := r.Cookie(SessionCookie)
+	if err != nil {
+		return nil, false
+	}
+	h, ok := Binding(c.Value)
+	if !ok {
+		return nil, false
+	}
+	return append([]byte{0x01}, h...), true
+}
+
+func mac(key, binding, nonce []byte) []byte {
+	m := hmac.New(sha256.New, key)
+	m.Write(binding)
+	m.Write(nonce)
+	return m.Sum(nil)
+}
+
+// Issue returns a fresh token for binding.
+func (c *CSRF) Issue(binding []byte) (string, error) {
+	nonce := make([]byte, nonceBytes)
+	if _, err := rand.Read(nonce); err != nil {
+		return "", err
+	}
+	return b64(nonce) + "." + b64(mac(c.keys[0], binding, nonce)), nil
+}
+
+// Verify reports whether token was issued by one of the keys for binding.
+func (c *CSRF) Verify(token string, binding []byte) bool {
+	n, s, found := strings.Cut(token, ".")
+	if !found {
+		return false
+	}
+	nonce, err1 := base64.RawURLEncoding.DecodeString(n)
+	sig, err2 := base64.RawURLEncoding.DecodeString(s)
+	if err1 != nil || err2 != nil || len(nonce) != nonceBytes {
+		return false
+	}
+	ok := false
+	for _, k := range c.keys { // no early exit: time does not tell which key matched
+		if hmac.Equal(sig, mac(k, binding, nonce)) {
+			ok = true
+		}
+	}
+	return ok
+}
+
+func b64(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
+
+// safeMethod is the set that is never CSRF-checked (RFC 9110 §9.2.1).
+func safeMethod(m string) bool {
+	return m == http.MethodGet || m == http.MethodHead || m == http.MethodOptions
+}
+
+// ActionFor names the audit action of the write r attempts, or "" when it is
+// unknown (unrouted path). A rejected attempt is audited only with an action.
+type ActionFor func(r *http.Request) string
+
+// Middleware enforces the CSRF check on every non-safe method. It runs after
+// the session middleware (so 401 wins) and before routing (so 403 beats 404),
+// reads only the header and the cookie and never the body. Accepted only if
+// cookie and header are both present and equal, the signature verifies, and
+// the binding matches the request's session (or anonymous without one).
+//
+// fail is the central error adapter; it audits the denial when the *web.Error
+// carries an AuditReason and an action.
+func (c *CSRF) Middleware(fail func(http.ResponseWriter, *http.Request, error), action ActionFor) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if safeMethod(r.Method) {
+				next.ServeHTTP(w, r)
+				return
+			}
+			if reason := c.check(r); reason != "" {
+				e := web.NewError(web.CodeCSRFInvalid, "CSRF token missing or invalid.")
+				if action != nil {
+					if a := action(r); a != "" {
+						e.AuditAction, e.AuditReason = a, reason
+					}
+				}
+				fail(w, r, e)
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// check returns "" when r passes, else the audit reason (never sent to the client).
+func (c *CSRF) check(r *http.Request) string {
+	hdr := r.Header.Get(CSRFHeader)
+	ck, err := r.Cookie(CSRFCookie)
+	switch {
+	case hdr == "" || err != nil || ck.Value == "":
+		return "csrf_missing"
+	case subtle.ConstantTimeCompare([]byte(hdr), []byte(ck.Value)) != 1:
+		return "csrf_mismatch"
+	}
+	b, ok := bindingFor(r)
+	if !ok || !c.Verify(hdr, b) {
+		return "csrf_invalid_binding"
+	}
+	return ""
+}
+
+// Handler serves GET /auth/csrf: a token for the caller's current binding in
+// the body and in the cookie. It is public; with a session the token is bound
+// to it. Login and logout change the binding, so the client refetches then.
+type Handler struct {
+	CSRF *CSRF
+	Log  *slog.Logger
+}
+
+// GetCsrfToken serves GET /auth/csrf.
+func (h Handler) GetCsrfToken(w http.ResponseWriter, r *http.Request) {
+	b, ok := bindingFor(r)
+	if !ok {
+		h.fail(w, r, errors.New("session without bindable ID"))
+		return
+	}
+	tok, err := h.CSRF.Issue(b)
+	if err != nil {
+		h.fail(w, r, err)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name: CSRFCookie, Value: tok, Path: "/",
+		Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+	w.Header().Set("Cache-Control", "no-store")
+	web.WriteJSON(w, http.StatusOK, api.CsrfTokenResponse{Token: tok})
+}
+
+func (h Handler) fail(w http.ResponseWriter, r *http.Request, err error) {
+	h.Log.ErrorContext(r.Context(), "csrf token issue failed",
+		"requestId", web.RequestIDFrom(r.Context()), "error", err)
+	web.WriteProblem(w, r, web.NewError(web.CodeInternalError, ""))
+}

package/backend/internal/auth/csrf_test.go

@@ -0,0 +1,281 @@
+package auth_test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+const (
+	keyA = "0123456789abcdef0123456789abcdef"
+	keyB = "fedcba9876543210fedcba9876543210"
+)
+
+func sid(t *testing.T) string {
+	t.Helper()
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		t.Fatal(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+func mustCSRF(t *testing.T, cur string, prev ...string) *auth.CSRF {
+	t.Helper()
+	c, err := auth.NewCSRF(cur, prev...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+type denial struct{ action, reason string }
+
+// csrfChain mirrors production order: session middleware, then CSRF, then router.
+func csrfChain(c *auth.CSRF, v auth.Validator, got *denial) http.Handler {
+	r := chi.NewRouter()
+	r.NotFound(web.NotFound)
+	r.MethodNotAllowed(web.MethodNotAllowed)
+	ok := func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }
+	r.Get("/auth/csrf", auth.Handler{CSRF: c, Log: slog.New(slog.DiscardHandler)}.GetCsrfToken)
+	r.Post("/w", ok)
+	r.Put("/w", ok)
+	r.Delete("/w", ok)
+	r.Post("/auth/logout", ok)
+	fail := func(w http.ResponseWriter, req *http.Request, err error) {
+		var e *web.Error
+		if errors.As(err, &e) && got != nil {
+			*got = denial{e.AuditAction, e.AuditReason}
+		}
+		web.WriteError(w, req, err)
+	}
+	action := func(req *http.Request) string {
+		if req.URL.Path == "/auth/logout" {
+			return "AUTH_LOGOUT"
+		}
+		return ""
+	}
+	public := func(req *http.Request) bool { return req.URL.Path == "/auth/csrf" || req.URL.Path == "/auth/logout" }
+	log := slog.New(slog.DiscardHandler)
+	return web.RequestID(auth.Middleware(v, public, log)(c.Middleware(fail, action)(r)))
+}
+
+func fetch(t *testing.T, h http.Handler, session string) string {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/auth/csrf", nil)
+	if session != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 200 {
+		t.Fatalf("GET /auth/csrf = %d %s", rec.Code, rec.Body)
+	}
+	var body struct{ Token string }
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil || body.Token == "" {
+		t.Fatalf("body %s: %v", rec.Body, err)
+	}
+	var ck *http.Cookie
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == auth.CSRFCookie {
+			ck = c
+		}
+	}
+	if ck == nil || ck.Value != body.Token {
+		t.Fatalf("cookie %v does not match body token", ck)
+	}
+	if !ck.HttpOnly || !ck.Secure || ck.Path != "/" || ck.Domain != "" || ck.SameSite != http.SameSiteLaxMode {
+		t.Errorf("cookie attributes: %+v", ck)
+	}
+	if rec.Header().Get("Cache-Control") != "no-store" {
+		t.Errorf("Cache-Control = %q", rec.Header().Get("Cache-Control"))
+	}
+	return body.Token
+}
+
+func write(method, path, session, cookie, header string) *http.Request {
+	req := httptest.NewRequest(method, path, strings.NewReader("ignored"))
+	if session != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	}
+	if cookie != "" {
+		req.AddCookie(&http.Cookie{Name: auth.CSRFCookie, Value: cookie})
+	}
+	if header != "" {
+		req.Header.Set(auth.CSRFHeader, header)
+	}
+	return req
+}
+
+func TestCSRFWrites(t *testing.T) {
+	c := mustCSRF(t, keyA)
+	s1, s2 := sid(t), sid(t)
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	v := &fakeValidator{live: map[string]security.Principal{s1: user, s2: user}}
+	h := csrfChain(c, v, nil)
+
+	anon, tok1, tok2 := fetch(t, h, ""), fetch(t, h, s1), fetch(t, h, s2)
+	other := mustCSRF(t, keyB)
+	foreign, _ := other.Issue([]byte("x"))
+
+	tests := []struct {
+		name                    string
+		method, path            string
+		session, cookie, header string
+		status                  int
+	}{
+		{"session token, own session", "POST", "/w", s1, tok1, tok1, 204},
+		{"anonymous token, no session", "POST", "/auth/logout", "", anon, anon, 204},
+		{"PUT and DELETE are checked", "PUT", "/w", s1, "", "", 403},
+		{"DELETE with token", "DELETE", "/w", s1, tok1, tok1, 204},
+		{"no header", "POST", "/w", s1, tok1, "", 403},
+		{"no cookie", "POST", "/w", s1, "", tok1, 403},
+		{"cookie and header differ", "POST", "/w", s1, tok1, tok2, 403},
+		{"other session's token", "POST", "/w", s1, tok2, tok2, 403},
+		{"anonymous token against a session", "POST", "/w", s1, anon, anon, 403},
+		{"session token without a session (logout)", "POST", "/auth/logout", "", tok1, tok1, 403},
+		{"session token, stale session cookie (logout)", "POST", "/auth/logout", sid(t), tok1, tok1, 403},
+		{"signed by an unknown key", "POST", "/w", s1, foreign, foreign, 403},
+		{"garbage", "POST", "/w", s1, "abc", "abc", 403},
+		{"truncated signature", "POST", "/w", s1, tok1[:len(tok1)-2], tok1[:len(tok1)-2], 403},
+		{"no dot", "POST", "/w", s1, strings.ReplaceAll(tok1, ".", ""), strings.ReplaceAll(tok1, ".", ""), 403},
+		{"403 beats 404 on unknown path", "POST", "/nope", s1, "", "", 403},
+		{"unknown path, valid token, is 404", "POST", "/nope", s1, tok1, tok1, 404},
+		{"401 beats 403", "POST", "/w", "", "", "", 401},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			h.ServeHTTP(rec, write(tc.method, tc.path, tc.session, tc.cookie, tc.header))
+			if rec.Code != tc.status {
+				t.Fatalf("status = %d, want %d (%s)", rec.Code, tc.status, rec.Body)
+			}
+			if tc.status == 403 && !strings.Contains(rec.Body.String(), `"code":"CSRF_INVALID"`) {
+				t.Errorf("body %s", rec.Body)
+			}
+		})
+	}
+}
+
+func TestCSRFSafeMethodsAreNotChecked(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	for _, m := range []string{"GET", "HEAD", "OPTIONS"} {
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, httptest.NewRequest(m, "/auth/csrf", nil))
+		if rec.Code == 403 {
+			t.Errorf("%s was CSRF-checked", m)
+		}
+	}
+}
+
+func TestCSRFNeverReadsBody(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	req := write("POST", "/auth/logout", "", "", "")
+	req.Body = failReader{t}
+	h.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+type failReader struct{ t *testing.T }
+
+func (f failReader) Read([]byte) (int, error) { f.t.Error("body was read"); return 0, context.Canceled }
+func (failReader) Close() error               { return nil }
+
+func TestCSRFDenialAuditFields(t *testing.T) {
+	c := mustCSRF(t, keyA)
+	anon := fetch(t, csrfChain(c, &fakeValidator{}, nil), "")
+	for _, tc := range []struct{ name, cookie, header, reason string }{
+		{"missing", "", "", "csrf_missing"},
+		{"mismatch", anon, anon + "x", "csrf_mismatch"},
+		{"bad signature", "a.b", "a.b", "csrf_invalid_binding"},
+	} {
+		var d denial
+		rec := httptest.NewRecorder()
+		csrfChain(c, &fakeValidator{}, &d).ServeHTTP(rec, write("POST", "/auth/logout", "", tc.cookie, tc.header))
+		if rec.Code != 403 || d != (denial{"AUTH_LOGOUT", tc.reason}) {
+			t.Errorf("%s: status %d, audit %+v", tc.name, rec.Code, d)
+		}
+	}
+	// Unrouted write: denied, but nothing to audit.
+	var d denial
+	csrfChain(c, &fakeValidator{live: map[string]security.Principal{"x": {}}}, &d).
+		ServeHTTP(httptest.NewRecorder(), write("POST", "/w", "", "", ""))
+	if d != (denial{}) {
+		t.Errorf("unknown action was audited: %+v", d)
+	}
+}
+
+func TestCSRFTokensAreFresh(t *testing.T) {
+	h := csrfChain(mustCSRF(t, keyA), &fakeValidator{}, nil)
+	first, second := fetch(t, h, ""), fetch(t, h, "")
+	if first == second {
+		t.Error("two tokens are equal")
+	}
+}
+
+func TestCSRFKeyRotation(t *testing.T) {
+	b := []byte("binding")
+	old := mustCSRF(t, keyA)
+	tok, _ := old.Issue(b)
+
+	rotated := mustCSRF(t, keyB, keyA)
+	if !rotated.Verify(tok, b) {
+		t.Error("previous key must still verify")
+	}
+	if fresh, _ := rotated.Issue(b); !mustCSRF(t, keyB).Verify(fresh, b) || old.Verify(fresh, b) {
+		t.Error("new tokens must be signed by the current key only")
+	}
+	if mustCSRF(t, keyB).Verify(tok, b) {
+		t.Error("after the previous key is dropped the old token must fail")
+	}
+	if !mustCSRF(t, keyB, "").Verify(mustTok(t, mustCSRF(t, keyB), b), b) {
+		t.Error("empty previous key means none")
+	}
+	if old.Verify(tok, []byte("other")) {
+		t.Error("binding must be part of the signature")
+	}
+}
+
+func mustTok(t *testing.T, c *auth.CSRF, b []byte) string {
+	t.Helper()
+	tok, err := c.Issue(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tok
+}
+
+func TestNewCSRFRejectsShortKeys(t *testing.T) {
+	if _, err := auth.NewCSRF("short"); err == nil {
+		t.Error("short current key accepted")
+	}
+	if _, err := auth.NewCSRF(keyA, "short"); err == nil {
+		t.Error("short previous key accepted")
+	}
+}
+
+func TestCSRFSessionWithUnbindableIDIs500(t *testing.T) {
+	// A validator that accepts an ID Binding cannot parse is a wiring bug: fail closed.
+	v := &fakeValidator{live: map[string]security.Principal{"not-an-id": {Role: security.RoleUser}}}
+	h := csrfChain(mustCSRF(t, keyA), v, nil)
+	req := httptest.NewRequest("GET", "/auth/csrf", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: "not-an-id"})
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 500 {
+		t.Errorf("status = %d", rec.Code)
+	}
+}

package/backend/internal/auth/middleware.go

@@ -0,0 +1,66 @@
+package auth
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// SessionCookie is the session cookie name (openapi sessionCookie). The
+// __Host- prefix forces Secure, Path=/ and no Domain.
+const SessionCookie = "__Host-session"
+
+// Validator resolves a cookie value to its caller. *Sessions implements it.
+type Validator interface {
+	Validate(ctx context.Context, id string) (p security.Principal, ok bool, err error)
+}
+
+// Public reports whether a request may be served without a session. It is
+// decided on method and path before routing, so unknown paths are not public.
+type Public func(r *http.Request) bool
+
+// Middleware is the session middleware (Backend.md §3, §6). It must wrap the
+// router, not sit inside it, so that an unknown path without a session answers
+// 401 and only a caller with a session learns it is a 404 (PRD §6.1).
+//
+//   - Public request: a valid session is still resolved (the principal is then
+//     in the context for the audit actor and the session-bound CSRF token); a
+//     missing or invalid one is simply anonymous.
+//   - Any other request: no valid session → 401 UNAUTHENTICATED. With a valid
+//     session the principal is stored in the context and routing continues, so
+//     404 and 405 come from the router.
+//
+// It never reads the body. A database failure answers 500, never a guess.
+func Middleware(v Validator, public Public, log *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			isPublic := public != nil && public(r)
+
+			var (
+				p  security.Principal
+				ok bool
+			)
+			if c, err := r.Cookie(SessionCookie); err == nil && c.Value != "" {
+				var verr error
+				if p, ok, verr = v.Validate(r.Context(), c.Value); verr != nil {
+					log.ErrorContext(r.Context(), "session validation failed",
+						"requestId", web.RequestIDFrom(r.Context()), "error", verr)
+					web.WriteProblem(w, r, web.NewError(web.CodeInternalError, ""))
+					return
+				}
+			}
+
+			switch {
+			case ok:
+				r = r.WithContext(security.WithPrincipal(r.Context(), p))
+			case !isPublic:
+				web.WriteProblem(w, r, web.NewError(web.CodeUnauthenticated, "Authentication required."))
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}