ファイアウォール & データプロテクション¶

// middleware/auth.go — AWS Cognito JWT (RS256) 検証
// AWS 利用はポリシー上 Cognito のみ
package middleware

import (
    "context"
    "net/http"
    "strings"

    "github.com/gin-gonic/gin"
    "github.com/lestrrat-go/jwx/v2/jwk"
    "github.com/lestrrat-go/jwx/v2/jwt"
)

type AuthMiddleware struct {
    jwks jwk.Set // Cognito JWKS (https://cognito-idp.<region>.amazonaws.com/<pool>/.well-known/jwks.json)
    issuer string
    audience string
}

func NewAuthMiddleware(ctx context.Context, jwksURL, issuer, audience string) (*AuthMiddleware, error) {
    set, err := jwk.Fetch(ctx, jwksURL)
    if err != nil {
        return nil, err
    }
    return &AuthMiddleware{jwks: set, issuer: issuer, audience: audience}, nil
}

func (m *AuthMiddleware) Authenticate() gin.HandlerFunc {
    return func(c *gin.Context) {
        authHeader := c.GetHeader("Authorization")
        if authHeader == "" {
            c.AbortWithStatusJSON(http.StatusUnauthorized,
                gin.H{"error": "missing authorization header"})
            return
        }
        parts := strings.SplitN(authHeader, " ", 2)
        if len(parts) != 2 || parts[0] != "Bearer" {
            c.AbortWithStatusJSON(http.StatusUnauthorized,
                gin.H{"error": "invalid authorization format"})
            return
        }
        tok, err := jwt.Parse([]byte(parts[1]),
            jwt.WithKeySet(m.jwks),
            jwt.WithIssuer(m.issuer),
            jwt.WithAudience(m.audience),
        )
        if err != nil {
            c.AbortWithStatusJSON(http.StatusUnauthorized,
                gin.H{"error": "invalid token"})
            return
        }
        c.Set("uid", tok.Subject())
        if email, ok := tok.Get("email"); ok {
            c.Set("email", email)
        }
        c.Next()
    }
}

// 全 API エンドポイントで binding タグによるバリデーション
type CreateEventRequest struct {
    Title       string `json:"title" binding:"required,min=1,max=200"`
    Description string `json:"description" binding:"max=2000"`
    StartDate   string `json:"start_date" binding:"required,datetime=2006-01-02T15:04:05Z07:00"`
    EndDate     string `json:"end_date" binding:"required,datetime=2006-01-02T15:04:05Z07:00,gtfield=StartDate"`
    Location    string `json:"location" binding:"max=500"`
    OrgID       uint   `json:"org_id" binding:"required,gt=0"`
}

// SQL インジェクション防御: GORM のパラメータバインディングを必須化
// NG: db.Where("name = '" + name + "'")
// OK: db.Where("name = ?", name)

// middleware/rbac.go
func RequireOrgRole(roles ...string) gin.HandlerFunc {
    return func(c *gin.Context) {
        uid := c.GetString("uid")
        orgID := c.Param("org_id")

        var orgUser models.OrgUser
        if err := db.Where("user_uid = ? AND organization_id = ?",
            uid, orgID).First(&orgUser).Error; err != nil {
            c.AbortWithStatusJSON(http.StatusForbidden,
                gin.H{"error": "not a member of this organization"})
            return
        }

        roleAllowed := false
        for _, role := range roles {
            if orgUser.OrgRole == role {
                roleAllowed = true
                break
            }
        }

        if !roleAllowed {
            c.AbortWithStatusJSON(http.StatusForbidden,
                gin.H{"error": "insufficient permissions"})
            return
        }

        c.Set("org_role", orgUser.OrgRole)
        c.Next()
    }
}

// Go 接続文字列
dsn := "user:pass@tcp(mysql:3306)/recerdo?tls=true&parseTime=true"