#
# authorisisation proxy using vouch-proxy
#
# Idea:
#
# vcl_recv
#   restarts == 0
#       save client req method, url, Content-Length, Content-Type in var
#       method := GET
#       url := /validate
#       backend := vouch-proxy
#       remove Content-Length, Content-Type
#   restarts > 0
#       check vouch-proxy headers (roles, groups)
#
# vcl_deliver
#   resp == vouch-proxy,GET,/validate,200
#       restore req method, url, Content-Length, Content-Type from var
#       forward vouch-proxy response headers to req
#       restart (client) req
#
# Links:
#   - https://web.archive.org/web/20121124064818/https://adayinthelifeof.nl/2012/07/06/using-varnish-to-offload-and-cache-your-oauth-requests/
#   - https://github.com/vouch/vouch-proxy
#   - https://nginx.org/en/docs/http/ngx_http_auth_request_module.html
#
# Usage:
#   in vcl_recv
#
#       var.set_backend("vouch_proxy", …);
#
#       call vouch_proxy_auth;
#       if (req.http.X-Vouch-Claims-Roles !~ {""…""}) {
#           # missing role
#           return(synth(403, "Forbidden"));
#       }


sub choose_vouch_proxy {
    if (req.http.host ~ "^vouch.") {
        set req.backend_hint = var.get_backend("vouch_proxy");
        return(pass);
    }
}


sub vouch_proxy_auth {
    if (req.restarts == 0 && var.get_backend("vouch_proxy") != default) {
        # original request from external client
        # - remove X-Vouch-Success header to ensure header is set correctly
        if (req.http.X-Vouch-Success) {
            unset req.http.X-Vouch-Success;
        }
        # - we have to check authorisisation
        if (cookie.get("VouchCookie")) {
            # existing vouch-proxy authorisisation session
            # - intercept request
            # - send request to /validate endpoint
            if (! req.http.Content-Length || req.method !~ "^(?:POST|PUT|PATCH|DELETE)$") {
                # send validate request for all requests without body
                # (Workaround for POST, PUT, …)
                if (req.method != "GET") {
                    var.set_string("req.method", req.method);
                    set req.method = "GET";
                }
                set req.url = "/__vouch_proxy/validate";
                if (req.http.Content-Length) {
                    var.set_string("req.http.Content-Length", req.http.Content-Length);
                    unset req.http.Content-Length;
                }
                if (req.http.Content-Type) {
                    var.set_string("req.http.Content-Type", req.http.Content-Type);
                    unset req.http.Content-Type;
                }
                var.set_int("allow_cache_with_cookie", 1);
                set req.backend_hint = var.get_backend("vouch_proxy");
                return(hash);
            }
        } else {
            # missing authorisisation session
            # - redirect to OIDC login
            return(synth(308, var.get_string("vouch_vhost") + "/__vouch_proxy/login?url=https://" + req.http.X-Portal + req.http.X-Url));
        }
    }
}

sub vcl_recv {
    if (false) {
        call choose_vouch_proxy;
        call vouch_proxy_auth;
    }
}

sub vcl_hash {
    if (req.url == "/__vouch_proxy/validate") {
        # hash the OIDC validation request for current user
        hash_data(req.http.host);
        hash_data(req.url);
        hash_data(cookie.get("VouchCookie"));
        hash_data(client.identity);
        return (lookup);
    }
}

sub vcl_backend_response {
    if (bereq.url ~ "^/__vouch_proxy" && beresp.status != 200) {
        # negative TTL for failed requests
        set beresp.ttl = 5s;
    }
}

sub vcl_deliver {
    if (req.restarts == 0 && req.url == "/__vouch_proxy/validate") {
        if (resp.status == 200) {
            if (var.get_string("req.method")) {
                set req.method = var.get_string("req.method");
            }
            set req.url = req.http.X-Url;
            if (req.http.host != req.http.X-Portal) {
                set req.http.host = req.http.X-Portal;
            }
            if (var.get_string("req.http.Content-Type")) {
                set req.http.Content-Type = var.get_string("req.http.Content-Type");
            }
            if (var.get_string("req.http.Content-Length")) {
                set req.http.Content-Length = var.get_string("req.http.Content-Length");
            }
            #
            # forward vouch validate response headers to application backend request
            #
            if (resp.http.X-Vouch-User) {
                set req.http.X-Vouch-User = resp.http.X-Vouch-User;
            }
            if (resp.http.X-Vouch-Success) {
                set req.http.X-Vouch-Success = resp.http.X-Vouch-Success;
            }
            if (resp.http.X-Vouch-Claims-Groups) {
                set req.http.X-Vouch-Claims-Groups = resp.http.X-Vouch-Claims-Groups;
            }
            if (resp.http.X-Vouch-Claims-Locale) {
                set req.http.X-Vouch-Claims-Locale = resp.http.X-Vouch-Claims-Locale;
            }
            if (resp.http.X-Vouch-Claims-Preferred-Username) {
                set req.http.X-Vouch-Claims-Preferred-Username = resp.http.X-Vouch-Claims-Preferred-Username;
            }
            if (resp.http.X-Vouch-Claims-Roles) {
                set req.http.X-Vouch-Claims-Roles = resp.http.X-Vouch-Claims-Roles;
            }
            return(restart);
        } else {
            return(synth(308, var.get_string("vouch_vhost") + "/__vouch_proxy/login?url=https://" + req.http.X-Portal + req.http.X-Url));
        }
    }
}
