Using Custom Middleware on a per route basis?

[joa23]

Hi,
I read the Auth Huma documentation. So we want to use Zitadel as auth provider with Huma.
It comes with middleware https://github.com/zitadel/zitadel-go/blob/next/example/api/http/main.go we want to reuse.
How would one use the Zitadel middleware with Huma in the same way as outlined in the Zitadel example.
It seems like Huma middle ware is global for all end points but we want to flexible configure e.g. require custom roles for different end points.
Thanks for any help.

[danielgtaylor]

@joa23 for router-agnostic middleware, you can use huma.Operation.Middlewares when registering the operation.

However, it looks like your middleware requires the use of the stdlib http.Handler/http.HandlerFunc and you won't have access to the raw request/response at the Huma level. The middleware is just a few lines, so maybe you could rewrite it as a Huma middleware, see https://github.com/zitadel/zitadel-go/blob/next/pkg/http/middleware/authz.go.

Alternatively you could write a middleware for your underlying router that only calls this middleware if the patch matches some prefix.

[joa23]

Thanks that helped.
I do think it would be very valuable to have access to underlaying req/res.

[danielgtaylor]

Just FYI, this is now possible via unwrapping: https://huma.rocks/features/middleware/#unwrapping

[SamiNassim]

Just FYI, this is now possible via unwrapping: https://huma.rocks/features/middleware/#unwrapping

"While generally not recommended"
Is there a specific reason it's not recommended ?

[danielgtaylor]

@SamiNassim just mentioning it because it makes the middleware router-specific, i.e. you cannot easily use a middleware that uses e.g. humachi.Unwrap if you use a different router. Within your own project it's fine, but it's problematic to share middleware libraries that way.

[blmundie]

@joa23 I was looking at the same tool and made a basic middleware. You just pass the authorizer provided from zitadel and the options like normal

package middleware

import (
	"errors"
	"net/http"

	"github.com/danielgtaylor/huma/v2"
	"github.com/zitadel/zitadel-go/v3/pkg/authorization"
	"github.com/zitadel/zitadel-go/v3/pkg/authorization/oauth"
)

func RequireAuthorizationHuma(api huma.API, authorizer *authorization.Authorizer[*oauth.IntrospectionContext], options ...authorization.CheckOption) func(ctx huma.Context, next func(huma.Context)) {
	return func(ctx huma.Context, next func(huma.Context)) {
		var anyOfNeededScopes []string
		for _, opScheme := range ctx.Operation().Security {
			var ok bool
			if anyOfNeededScopes, ok = opScheme["zitadel"]; ok {
				break
			}
		}
	
		// Add required scopes as required roles for zitadel
		for _, scope := range anyOfNeededScopes {
			options = append(options, authorization.WithRole(scope))
		} 

		_, err := authorizer.CheckAuthorization(ctx.Context(), ctx.Header("Authorization"), options...)
		if err != nil {
			if errors.Is(err, &authorization.UnauthorizedErr{}) {
				huma.WriteErr(api, ctx, http.StatusUnauthorized, "error", err)
				return
			}
			huma.WriteErr(api, ctx, http.StatusForbidden, "error", err)
			return
		}
		next(ctx)
	}
}