Move Firebase auth into OpenAPI validator

cmd/server/main.go

@@ -10,9 +10,10 @@ import (
 	"github.com/fun-dotto/admin-bff-api/internal/infrastructure"
 	"github.com/fun-dotto/admin-bff-api/internal/middleware"
 	"github.com/getkin/kin-openapi/openapi3"
+	"github.com/getkin/kin-openapi/openapi3filter"
 	"github.com/gin-gonic/gin"
 	"github.com/joho/godotenv"
-	oapimiddleware "github.com/oapi-codegen/gin-middleware"
+	"github.com/oapi-codegen/gin-middleware"
 )
 
 func main() {
@@ -39,8 +40,18 @@ func main() {
 
 	router := gin.Default()
 
-	router.Use(oapimiddleware.OapiRequestValidator(spec))
-	router.Use(middleware.FirebaseAuth(authClient))
+	router.Use(ginmiddleware.OapiRequestValidatorWithOptions(spec, &ginmiddleware.Options{
+		ErrorHandler: func(c *gin.Context, message string, statusCode int) {
+			if authStatusCode, authMessage, ok := middleware.GetAuthenticationError(c); ok {
+				c.AbortWithStatusJSON(authStatusCode, gin.H{"error": authMessage})
+				return
+			}
+			c.AbortWithStatusJSON(statusCode, gin.H{"error": message})
+		},
+		Options: openapi3filter.Options{
+			AuthenticationFunc: middleware.FirebaseAuthenticationFunc(authClient),
+		},
+	}))
 
 	clients, err := infrastructure.NewExternalClients(ctx)
 	if err != nil {

internal/middleware/firebase_auth.go

@@ -2,60 +2,145 @@ package middleware
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"strings"
 
 	"firebase.google.com/go/v4/auth"
+	"github.com/getkin/kin-openapi/openapi3filter"
 	"github.com/gin-gonic/gin"
+	ginmiddleware "github.com/oapi-codegen/gin-middleware"
 )
 
 type firebaseTokenKey struct{}
+type authErrorStatusKey struct{}
+type authErrorMessageKey struct{}
 
 // FirebaseTokenContextKey は Gin の context および context.Context に
 // Firebase ID トークンの検証結果を格納するキーです。
 var FirebaseTokenContextKey = firebaseTokenKey{}
 
+var (
+	authenticationErrorStatusKey  = authErrorStatusKey{}
+	authenticationErrorMessageKey = authErrorMessageKey{}
+)
+
+type AuthenticationError struct {
+	StatusCode int
+	Message    string
+}
+
+func (e *AuthenticationError) Error() string {
+	return e.Message
+}
+
+// FirebaseAuthenticationFunc は OpenAPI validator 向けの AuthenticationFunc を返します。
+// 認証に成功した場合は検証済みトークンを Gin / request context に格納します。
+func FirebaseAuthenticationFunc(authClient *auth.Client) openapi3filter.AuthenticationFunc {
+	return func(ctx context.Context, _ *openapi3filter.AuthenticationInput) error {
+		ginCtx := ginmiddleware.GetGinContext(ctx)
+		if ginCtx == nil {
+			return &AuthenticationError{
+				StatusCode: http.StatusUnauthorized,
+				Message:    "Authentication context is unavailable",
+			}
+		}
+
+		token, err := verifyFirebaseToken(ginCtx.GetHeader("Authorization"), ginCtx.Request.Context(), authClient)
+		if err != nil {
+			var authErr *AuthenticationError
+			if errors.As(err, &authErr) {
+				ginCtx.Set(authenticationErrorStatusKey, authErr.StatusCode)
+				ginCtx.Set(authenticationErrorMessageKey, authErr.Message)
+			}
+			return err
+		}
+
+		setFirebaseToken(ginCtx, token)
+		return nil
+	}
+}
+
 // FirebaseAuth は Authorization: Bearer <Firebase ID Token> を検証する Gin ミドルウェアです。
 // 検証に成功すると、デコードされたトークン（*auth.Token）を context に格納して次のハンドラに渡します。
 func FirebaseAuth(authClient *auth.Client) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
-		if authHeader == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": "Authorization header is required",
-			})
+		token, err := verifyFirebaseToken(c.GetHeader("Authorization"), c.Request.Context(), authClient)
+		if err != nil {
+			var authErr *AuthenticationError
+			if errors.As(err, &authErr) {
+				c.AbortWithStatusJSON(authErr.StatusCode, gin.H{"error": authErr.Message})
+				return
+			}
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Authentication failed"})
 			return
 		}
 
-		parts := strings.SplitN(authHeader, " ", 2)
-		if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": "Authorization header must be Bearer <token>",
-			})
-			return
+		setFirebaseToken(c, token)
+		c.Next()
+	}
+}
+
+func verifyFirebaseToken(authHeader string, ctx context.Context, authClient *auth.Client) (*auth.Token, error) {
+	if authHeader == "" {
+		return nil, &AuthenticationError{
+			StatusCode: http.StatusUnauthorized,
+			Message:    "Authorization header is required",
 		}
+	}
 
-		idToken := strings.TrimSpace(parts[1])
-		if idToken == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": "ID token is required",
-			})
-			return
+	parts := strings.SplitN(authHeader, " ", 2)
+	if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
+		return nil, &AuthenticationError{
+			StatusCode: http.StatusUnauthorized,
+			Message:    "Authorization header must be Bearer <token>",
 		}
+	}
 
-		ctx := c.Request.Context()
-		token, err := authClient.VerifyIDToken(ctx, idToken)
-		if err != nil {
-			status, message := authErrorResponse(err)
-			c.AbortWithStatusJSON(status, gin.H{"error": message})
-			return
+	idToken := strings.TrimSpace(parts[1])
+	if idToken == "" {
+		return nil, &AuthenticationError{
+			StatusCode: http.StatusUnauthorized,
+			Message:    "ID token is required",
 		}
+	}
 
-		c.Set(FirebaseTokenContextKey, token)
-		ctx = context.WithValue(ctx, FirebaseTokenContextKey, token)
-		c.Request = c.Request.WithContext(ctx)
-		c.Next()
+	token, err := authClient.VerifyIDToken(ctx, idToken)
+	if err != nil {
+		status, message := authErrorResponse(err)
+		return nil, &AuthenticationError{
+			StatusCode: status,
+			Message:    message,
+		}
 	}
+
+	return token, nil
+}
+
+func setFirebaseToken(c *gin.Context, token *auth.Token) {
+	ctx := context.WithValue(c.Request.Context(), FirebaseTokenContextKey, token)
+	c.Set(FirebaseTokenContextKey, token)
+	c.Request = c.Request.WithContext(ctx)
+}
+
+// GetAuthenticationError は validator の AuthenticationFunc が格納した認証失敗情報を返します。
+func GetAuthenticationError(c *gin.Context) (int, string, bool) {
+	status, statusExists := c.Get(authenticationErrorStatusKey)
+	message, messageExists := c.Get(authenticationErrorMessageKey)
+	if !statusExists || !messageExists {
+		return 0, "", false
+	}
+
+	statusCode, ok := status.(int)
+	if !ok {
+		return 0, "", false
+	}
+	errorMessage, ok := message.(string)
+	if !ok {
+		return 0, "", false
+	}
+
+	return statusCode, errorMessage, true
 }
 
 // authErrorResponse は Firebase Auth の検証エラーから HTTP ステータスとメッセージを返します。