auth: Refactor how authentication methods are passed to server/auth library.

server/settings/admin/handlers.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 // Package admin implements HTTP routes for settings UI.
 package admin
 
 import (
         "html/template"
         "net"
         "net/http"
 
         "golang.org/x/net/context"
 
         "github.com/luci/luci-go/common/errors"
+        "github.com/luci/luci-go/common/logging"
 
         "github.com/luci/luci-go/server/auth"
         "github.com/luci/luci-go/server/auth/authdb"
         "github.com/luci/luci-go/server/auth/identity"
         "github.com/luci/luci-go/server/auth/xsrf"
         "github.com/luci/luci-go/server/router"
         "github.com/luci/luci-go/server/templates"
 
         "github.com/luci/luci-go/server/settings/admin/internal/assets"
 )
@@ skipping 27 matching lines @@
 
         adminDB := adminBypassDB{
                 authdb.ErroringDB{
                         Error: errors.New("admin: unexpected call to authdb.DB on admin page"),
                 },
         }
 
         rr := r.Subrouter("/admin/settings")
         rr.Use(base.Extend(
                 templates.WithTemplates(tmpl),
-                auth.Use(auth.Authenticator{adminAuth}),
                 adminDB.install,
-                auth.Autologin,
-                adminOnly,
+                auth.Authenticate(adminAuth),
+                adminAutologin,
         ))
 
         rr.GET("", router.MiddlewareChain{}, indexPage)
         rr.GET("/:SettingsKey", router.MiddlewareChain{}, settingsPageGET)
         rr.POST("/:SettingsKey", router.NewMiddlewareChain(xsrf.WithTokenCheck), settingsPagePOST)
 }
 
 // replyError sends HTML error page with status 500 on transient errors or 400
 // on fatal ones.
 func replyError(c context.Context, rw http.ResponseWriter, err error) {
@@ skipping 29 matching lines @@
 
 func (d adminBypassDB) install(c *router.Context, next router.Handler) {
         c.Context = auth.ModifyConfig(c.Context, func(cfg *auth.Config) {
                 cfg.DBProvider = func(context.Context) (authdb.DB, error) {
                         return d, nil
                 }
         })
         next(c)
 }
 
-// adminOnly is middleware that ensures authenticated user is local site admin
-// aka superuser. On GAE it grants access only to users that have Editor or
-// Owner roles in the Cloud Project.
-func adminOnly(c *router.Context, next router.Handler) {
-        if !auth.CurrentUser(c.Context).Superuser {
+// adminAutologin is middleware that ensures authenticated user is local site
+// admin (aka superuser).
+//
+// On GAE it grants access only to users that have Editor or Owner roles in
+// the Cloud Project.
+//
+// It redirect anonymous users to login page, and displays "Access denied" page
+// to authenticated non-admin users.
+func adminAutologin(c *router.Context, next router.Handler) {
+        u := auth.CurrentUser(c.Context)
+
+        // Redirect anonymous users to a login page that redirects back to the current
+        // page.
+        if u.Identity == identity.AnonymousIdentity {
+                // Make the current URL relative to the host.
+                destURL := *c.Request.URL
+                destURL.Host = ""
+                destURL.Scheme = ""
+                url, err := auth.LoginURL(c.Context, destURL.String())
+                if err != nil {
+                        logging.WithError(err).Errorf(c.Context, "Error when generating login URL")
+                        if errors.IsTransient(err) {
+                                http.Error(c.Writer, "Transient error when generating login URL, see logs", 500)
+                        } else {
+                                http.Error(c.Writer, "Can't generate login URL, see logs", 401)
+                        }
+                        return
+                }
+                http.Redirect(c.Writer, c.Request, url, 302)
+                return
+        }
+
+        // Non anonymous users must be admins to proceed.
+        if !u.Superuser {
                 c.Writer.WriteHeader(http.StatusForbidden)
                 templates.MustRender(c.Context, c.Writer, "pages/access_denied.html", nil)
                 return
         }
+
         next(c)
 }