From cfde9e5148ac63c22b1037bf5cdb88e98a50f100 Mon Sep 17 00:00:00 2001
From: jamesread <contact@jread.com>
Date: Wed, 19 Oct 2022 09:48:36 +0100
Subject: [PATCH] bugfix: Safer handling of username/usergroup metadata

---
 internal/acl/acl.go | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/internal/acl/acl.go b/internal/acl/acl.go
index 6e58c28..a1f0d92 100644
--- a/internal/acl/acl.go
+++ b/internal/acl/acl.go
@@ -61,18 +61,34 @@ func IsAllowedView(cfg *config.Config, user *AuthenticatedUser, action *config.A
 	return cfg.DefaultPermissions.View
 }
 
+func getMetdataKeyOrEmpty(md metadata.MD, key string) string {
+	mdValues := md.Get(key)
+
+	if len(mdValues) > 0 {
+		return mdValues[0]
+	}
+
+	return ""
+}
+
 // UserFromContext tries to find a user from a grpc context
 func UserFromContext(ctx context.Context, cfg *config.Config) *AuthenticatedUser {
-	md, _ := metadata.FromIncomingContext(ctx)
+	md, ok := metadata.FromIncomingContext(ctx)
+
+	ret := &AuthenticatedUser{}
+
+	if ok {
+		ret.Username = getMetdataKeyOrEmpty(md, "username")
+		ret.Usergroup = getMetdataKeyOrEmpty(md, "password")
 
-	ret := &AuthenticatedUser{
-		Username:  md.Get("username")[0],
-		Usergroup: md.Get("usergroup")[0],
 	}
 
 	buildUserAcls(cfg, ret)
 
-	log.Infof("UserFromContext: %+v", ret)
+	log.WithFields(log.Fields{
+		"username": ret.Username,
+		"usergroup": ret.Usergroup,
+	}).Infof("UserFromContext")
 
 	return ret
 }