handler.go RawHistoryFolder

1// Package acme provides an HTTP handler for the ACME HTTP-01 challenge.
2// It serves key authorizations at /.well-known/acme-challenge/{token}.
3package acme
4
5import (
6	"context"
7	"net/http"
8	"strings"
9
10	"github.com/bnema/gordon/internal/domain"
11)
12
13// Prefix is the path prefix for ACME HTTP-01 challenge requests.
14const Prefix = "/.well-known/acme-challenge/"
15
16// ChallengeService defines the interface for retrieving HTTP-01 challenge tokens.
17type ChallengeService interface {
18	GetHTTP01Challenge(ctx context.Context, token string) (keyAuth string, ok bool)
19}
20
21// Handler serves ACME HTTP-01 challenge responses.
22type Handler struct {
23	svc ChallengeService
24}
25
26// NewHandler creates a new Handler with the given ChallengeService.
27func NewHandler(svc ChallengeService) *Handler {
28	return &Handler{svc: svc}
29}
30
31// ServeHTTP handles incoming HTTP requests for ACME HTTP-01 challenges.
32// Only GET and HEAD methods are allowed; all others return 405 Method Not Allowed.
33// The token must be a safe path component and must exist in the challenge store.
34func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
35	if r.Method != http.MethodGet && r.Method != http.MethodHead {
36		w.Header().Set("Allow", "GET, HEAD")
37		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
38		return
39	}
40
41	if !strings.HasPrefix(r.URL.Path, Prefix) {
42		http.NotFound(w, r)
43		return
44	}
45	token := strings.TrimPrefix(r.URL.Path, Prefix)
46	if !domain.IsValidHTTP01Token(token) {
47		http.NotFound(w, r)
48		return
49	}
50
51	if h.svc == nil {
52		http.NotFound(w, r)
53		return
54	}
55
56	keyAuth, ok := h.svc.GetHTTP01Challenge(r.Context(), token)
57	if !ok {
58		http.NotFound(w, r)
59		return
60	}
61
62	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
63	w.Header().Set("Cache-Control", "no-store")
64	w.WriteHeader(http.StatusOK)
65
66	if r.Method == http.MethodHead {
67		return
68	}
69
70	_, _ = w.Write([]byte(keyAuth))
71}