MG-94 - Add authorization on downstream messages in WS (#96)

* feat(ws.go): add auth on downstream publish

Signed-off-by: Felix Gateru <[email protected]>

* ci: add no contextcheck on failing cases

Signed-off-by: Felix Gateru <[email protected]>

* refactor: rearrange nolint comment lines

Signed-off-by: Felix Gateru <[email protected]>

---------

Signed-off-by: Felix Gateru <[email protected]>

Author: felixgateru

pkg/http/http.go

@@ -79,6 +79,7 @@ func (p Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if isWebSocketRequest(r) {
+		//nolint:contextcheck // handleWebSocket does not need context
 		p.handleWebSocket(w, r, s)
 		return
 	}

pkg/http/ws.go

@@ -101,13 +101,18 @@ func (p *Proxy) stream(ctx context.Context, topic string, src, dest *websocket.C
 		if err != nil {
 			return handleStreamErr(err, upstream)
 		}
-		if upstream {
+		switch upstream {
+		case true:
 			if err := p.session.AuthPublish(ctx, &topic, &payload); err != nil {
 				return err
 			}
 			if err := p.session.Publish(ctx, &topic, &payload); err != nil {
 				return err
 			}
+		default:
+			if err := p.session.AuthSubscribe(ctx, &[]string{topic}); err != nil {
+				return err
+			}
 		}
 		if err := dest.WriteMessage(messageType, payload); err != nil {
 			return err

pkg/mqtt/websocket/websocket.go

@@ -67,6 +67,7 @@ func (p Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	//nolint:contextcheck // new context is created in pass method
 	go p.pass(cconn)
 }