tokens tied to useragent

endpoints/authorization.go

@@ -15,26 +15,37 @@ const (
 )
 
 func getAuthorization(c *gin.Context) (AuthorizationScope, string) {
+	//get auth header
 	header := c.GetHeader("Authorization")
 	if header == "" {
 		return AuthorizationScopeNone, ""
 	}
+
+	//check if user is authorized
 	headerSpl := strings.Split(header, " ")
 	if len(headerSpl) != 2 {
 		return AuthorizationScopeNone, ""
 	}
 	prefix := headerSpl[0]
 	token := strings.ToLower(headerSpl[1])
-	if prefix == "Bearer" {
-		if storage.CheckLoginToken(token, c.ClientIP()) {
-			return AuthorizationScopeUser, token
-		}
-	}
 	if prefix == "Bot" {
+		//attempt to authorize as bot
 		if found, _ := storage.BotTokenFromToken(token); found {
 			return AuthorizationScopeBot, token
 		}
 	}
+	if prefix == "Bearer" {
+		//attempt to authorize as user
+		userAgentString := c.GetHeader("User-Agent")
+		if userAgentString == "" {
+			return AuthorizationScopeNone, ""
+		}
+		ua := storage.ParseUA(userAgentString)
+		
+		if storage.CheckLoginToken(token, c.ClientIP(), ua) {
+			return AuthorizationScopeUser, token
+		}
+	}
 	return AuthorizationScopeNone, ""
 
 }