From 6c7d89a921074517344f948393547653ee603b73 Mon Sep 17 00:00:00 2001
From: Denis Arh <denis.arh@gmail.com>
Date: Sat, 22 Jan 2022 21:22:56 +0100
Subject: [PATCH] Fix user-id claim parsing

---
 pkg/auth/identity.go         | 17 +++++++----------
 pkg/auth/token_issuer.go     |  4 ++++
 pkg/auth/token_middleware.go |  2 +-
 3 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkg/auth/identity.go b/pkg/auth/identity.go
index b57405166..f82fd52b3 100644
--- a/pkg/auth/identity.go
+++ b/pkg/auth/identity.go
@@ -46,16 +46,13 @@ func (i identity) String() string {
 
 func ExtractFromSubClaim(sub string) (userID uint64, rr []uint64) {
 	parts := strings.Split(sub, " ")
-
-	if len(parts) > 1 {
-		rr = make([]uint64, len(parts)-1)
-		for p := range parts {
-			id, _ := strconv.ParseUint(parts[p], 10, 64)
-			if p == 0 {
-				userID = id
-			} else {
-				rr[p-1] = id
-			}
+	rr = make([]uint64, len(parts)-1)
+	for p := range parts {
+		id, _ := strconv.ParseUint(parts[p], 10, 64)
+		if p == 0 {
+			userID = id
+		} else {
+			rr[p-1] = id
 		}
 	}
 
diff --git a/pkg/auth/token_issuer.go b/pkg/auth/token_issuer.go
index 734f77ddd..2da5f0023 100644
--- a/pkg/auth/token_issuer.go
+++ b/pkg/auth/token_issuer.go
@@ -223,6 +223,10 @@ func makeToken(req *TokenRequest) (_ jwt.Token, err error) {
 
 // IdentityFromToken decodes sub & roles claims into identity
 func IdentityFromToken(token jwt.Token) *identity {
+	if token == nil {
+		return Anonymous()
+	}
+
 	var (
 		roles, _ = token.Get("roles")
 	)
diff --git a/pkg/auth/token_middleware.go b/pkg/auth/token_middleware.go
index e7c842205..b9ed6d11c 100644
--- a/pkg/auth/token_middleware.go
+++ b/pkg/auth/token_middleware.go
@@ -44,7 +44,7 @@ func HttpTokenValidator(scope ...string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			token, err := verifyToken(r.Context(), TokenIssuer, scope...)
-			if err != nil {
+			if err != nil && !errors.Is(err, jwtauth.ErrNoTokenFound) {
 				errors.ProperlyServeHTTP(w, r, err, false)
 				return
 			}