27 lines
1.1 KiB
Go
27 lines
1.1 KiB
Go
|
package onboarding
|
||
|
|
|
||
|
|
import (
|
||
|
|
"data-terminal-cloud/internal/deviceauth"
|
||
|
|
"mime"
|
||
|
|
"net/http"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
// AuthenticateCallRequest verifies ONBOARDING-1.1 identity without applying the
|
||
|
|
// legacy voice route's admission rules. CALL-MEMORY-1.1 performs its own scoped
|
||
|
|
// admission and allows old-session end receipts without issuing new authority.
|
||
|
|
func (s *Service) AuthenticateCallRequest(r *http.Request) (deviceauth.Identity, []byte, []byte, error) {
|
||
|
|
mediaType, _, mediaErr := mime.ParseMediaType(r.Header.Get("Content-Type"))
|
||
|
|
if !s.secure(r) || r.URL.RawQuery != "" || mediaErr != nil || mediaType != "application/json" {
|
||
|
|
return deviceauth.Identity{}, nil, nil, errAuth
|
||
|
|
}
|
||
|
|
d, raw, e := s.authenticate(r)
|
||
|
|
if e != nil {
|
||
|
|
return deviceauth.Identity{}, nil, nil, e
|
||
|
|
}
|
||
|
|
if e = s.limit(r.Context(), "call-device:"+d.ID, 300, time.Minute); e != nil {
|
||
|
|
return deviceauth.Identity{}, nil, nil, e
|
||
|
|
}
|
||
|
|
return deviceauth.Identity{ID: d.ID, PublicID: d.PublicID, TenantID: d.TenantID, Status: d.Status, ActivationState: d.Lifecycle, EnrollmentMode: d.Mode, BindingGeneration: d.Generation, CredentialRef: "onboarding://" + d.FactoryID}, d.Key, raw, nil
|
||
|
|
}
|