Thirdshop/Kazier
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add backend auth

Browse Source
This commit is contained in:
m
2026-07-14 09:47:55 +02:00
parent 6761141fed
commit 76ceafa56c
28 changed files with 1345 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/cmd/server/main.go
+7 -2
View File
@@ -5,6 +5,7 @@ import (
"github.com/gin-gonic/gin"
"github.com/joho/godotenv"
"github.com/vaultdrop/backend/internal/auth"
"github.com/vaultdrop/backend/internal/config"
"github.com/vaultdrop/backend/internal/db"
"github.com/vaultdrop/backend/internal/handler"
@@ -32,14 +33,18 @@ func main() {
fileSvc := service.NewFileService(queries, cfg)
ocrSvc := service.NewOCRService(cfg, fileSvc)
urlSvc := service.NewURLService(cfg.HMACSecret, cfg.ServerHost)
authSvc, err := auth.NewAuthService(queries, cfg)
if err != nil {
log.Fatalf("Failed to create auth service: %v", err)
}
ocrSvc.Start()
defer ocrSvc.Stop()
h := handler.New(fileSvc, ocrSvc, urlSvc)
h := handler.New(fileSvc, ocrSvc, urlSvc, auth.NewAuthHandler(authSvc))
r := gin.Default()
handler.SetupRoutes(r, h)
handler.SetupRoutes(r, h, authSvc)
log.Printf("Server starting on port %s", cfg.Port)
if err := r.Run(":" + cfg.Port); err != nil {
backend/go.mod
+4 -2
View File
@@ -3,14 +3,18 @@ module github.com/vaultdrop/backend
go 1.26.4
require (
aidanwoods.dev/go-paseto v1.6.0
github.com/gin-gonic/gin v1.12.0
github.com/golang-migrate/migrate/v4 v4.19.1
github.com/google/uuid v1.6.0
github.com/joho/godotenv v1.5.1
github.com/ledongthuc/pdf v0.0.0-20250511090121-5959a4027728
github.com/lib/pq v1.12.3
golang.org/x/crypto v0.52.0
)
require (
aidanwoods.dev/go-result v0.3.1 // indirect
github.com/bytedance/gopkg v0.1.3 // indirect
github.com/bytedance/sonic v1.15.0 // indirect
github.com/bytedance/sonic/loader v0.5.0 // indirect
@@ -22,7 +26,6 @@ require (
github.com/go-playground/validator/v10 v10.30.1 // indirect
github.com/goccy/go-json v0.10.5 // indirect
github.com/goccy/go-yaml v1.19.2 // indirect
github.com/joho/godotenv v1.5.1 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
github.com/leodido/go-urn v1.4.0 // indirect
@@ -36,7 +39,6 @@ require (
github.com/ugorji/go/codec v1.3.1 // indirect
go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
golang.org/x/arch v0.22.0 // indirect
golang.org/x/crypto v0.52.0 // indirect
golang.org/x/net v0.54.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/text v0.37.0 // indirect
backend/go.sum
+4
View File
@@ -1,3 +1,7 @@
aidanwoods.dev/go-paseto v1.6.0 h1:JA/PFk5lVsB/PakQGqnfmik/1tIHjE6F0UoPPoAO/nU=
aidanwoods.dev/go-paseto v1.6.0/go.mod h1:LdqkL0Z2mLL0kBWzmHVR1cGFniX+zyOweQmbNKYrDxQ=
aidanwoods.dev/go-result v0.3.1 h1:ee98hpohYUVYbI+pa6gUHTyoRerIudgjky/IPSowDXQ=
aidanwoods.dev/go-result v0.3.1/go.mod h1:GKnFg8p/BKulVD3wsfULiPhpPmrTWyiTIbz8EWuUqSk=
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
backend/internal/auth/handler.go
+135
View File
@@ -0,0 +1,135 @@
package auth
import (
"errors"
"net/http"
"github.com/gin-gonic/gin"
"github.com/vaultdrop/backend/pkg/api"
)
type AuthHandler struct {
auth *AuthService
}
func NewAuthHandler(auth *AuthService) *AuthHandler {
return &AuthHandler{auth: auth}
}
type registerRequest struct {
Username string `json:"username" binding:"required"`
Password string `json:"password" binding:"required"`
}
type loginRequest struct {
Username string `json:"username" binding:"required"`
Password string `json:"password" binding:"required"`
}
type refreshRequest struct {
RefreshToken string `json:"refresh_token" binding:"required"`
}
type logoutRequest struct {
RefreshToken string `json:"refresh_token" binding:"required"`
}
type authResponse struct {
User UserResponse `json:"user"`
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
}
type tokenResponse struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
}
func (h *AuthHandler) Register(c *gin.Context) {
var req registerRequest
if err := c.ShouldBindJSON(&req); err != nil {
api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "username and password are required")
return
}
tokens, user, err := h.auth.Register(c.Request.Context(), req.Username, req.Password)
if err != nil {
switch {
case errors.Is(err, ErrUsernameTaken):
api.Error(c, http.StatusConflict, "USERNAME_TAKEN", "username already taken")
default:
api.Error(c, http.StatusBadRequest, "VALIDATION_ERROR", err.Error())
}
return
}
c.JSON(http.StatusCreated, authResponse{
User: *user,
AccessToken: tokens.AccessToken,
RefreshToken: tokens.RefreshToken,
})
}
func (h *AuthHandler) Login(c *gin.Context) {
var req loginRequest
if err := c.ShouldBindJSON(&req); err != nil {
api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "username and password are required")
return
}
tokens, user, err := h.auth.Login(c.Request.Context(), req.Username, req.Password)
if err != nil {
switch {
case errors.Is(err, ErrInvalidCredentials):
api.Error(c, http.StatusUnauthorized, "INVALID_CREDENTIALS", "invalid username or password")
default:
api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
}
return
}
c.JSON(http.StatusOK, authResponse{
User: *user,
AccessToken: tokens.AccessToken,
RefreshToken: tokens.RefreshToken,
})
}
func (h *AuthHandler) Refresh(c *gin.Context) {
var req refreshRequest
if err := c.ShouldBindJSON(&req); err != nil {
api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "refresh_token is required")
return
}
tokens, err := h.auth.Refresh(c.Request.Context(), req.RefreshToken)
if err != nil {
switch {
case errors.Is(err, ErrInvalidToken):
api.Error(c, http.StatusUnauthorized, "INVALID_TOKEN", "invalid or expired refresh token")
default:
api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
}
return
}
c.JSON(http.StatusOK, tokenResponse{
AccessToken: tokens.AccessToken,
RefreshToken: tokens.RefreshToken,
})
}
func (h *AuthHandler) Logout(c *gin.Context) {
var req logoutRequest
if err := c.ShouldBindJSON(&req); err != nil {
api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "refresh_token is required")
return
}
if err := h.auth.Logout(c.Request.Context(), req.RefreshToken); err != nil {
api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
return
}
c.JSON(http.StatusOK, gin.H{"message": "logged out"})
}
backend/internal/auth/middleware.go
+41
View File
@@ -0,0 +1,41 @@
package auth
import (
"net/http"
"strings"
"github.com/gin-gonic/gin"
)
const UserIDKey = "userID"
func (s *AuthService) RequireAuth() gin.HandlerFunc {
return func(c *gin.Context) {
header := c.GetHeader("Authorization")
if header == "" {
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
"error": gin.H{"code": "MISSING_TOKEN", "message": "authorization header required"},
})
return
}
parts := strings.SplitN(header, " ", 2)
if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
"error": gin.H{"code": "INVALID_TOKEN", "message": "invalid authorization format"},
})
return
}
claims, err := s.ValidateAccessToken(parts[1])
if err != nil {
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
"error": gin.H{"code": "INVALID_TOKEN", "message": "invalid or expired token"},
})
return
}
c.Set(UserIDKey, claims)
c.Next()
}
}
backend/internal/auth/service.go
+250
View File
@@ -0,0 +1,250 @@
package auth
import (
"context"
"crypto/rand"
"crypto/sha256"
"encoding/base64"
"errors"
"fmt"
"strings"
"time"
"aidanwoods.dev/go-paseto"
"github.com/vaultdrop/backend/internal/config"
"github.com/vaultdrop/backend/internal/db"
"golang.org/x/crypto/argon2"
)
var (
ErrInvalidCredentials = errors.New("invalid credentials")
ErrUsernameTaken = errors.New("username already taken")
ErrInvalidToken = errors.New("invalid or expired token")
)
const (
accessTokenTTL = 30 * time.Minute
refreshTokenTTL = 7 * 24 * time.Hour
saltLength = 16
)
type AuthService struct {
queries *db.Queries
key paseto.V4SymmetricKey
parser *paseto.Parser
}
type TokenPair struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
}
type UserResponse struct {
ID string `json:"id"`
Username string `json:"username"`
}
func NewAuthService(queries *db.Queries, cfg *config.Config) (*AuthService, error) {
key, err := paseto.V4SymmetricKeyFromHex(cfg.PASETOKey)
if err != nil {
return nil, fmt.Errorf("invalid paseto key: %w", err)
}
parser := paseto.NewParser()
parser.AddRule(paseto.NotExpired())
return &AuthService{
queries: queries,
key: key,
parser: &parser,
}, nil
}
func (s *AuthService) Register(ctx context.Context, username, password string) (*TokenPair, *UserResponse, error) {
username = strings.TrimSpace(username)
if len(username) < 3 || len(username) > 30 {
return nil, nil, fmt.Errorf("username must be 3-30 characters")
}
if len(password) < 8 {
return nil, nil, fmt.Errorf("password must be at least 8 characters")
}
existing, err := s.queries.GetUserByUsername(ctx, username)
if err == nil && existing.ID != "" {
return nil, nil, ErrUsernameTaken
}
hash, err := hashPassword(password)
if err != nil {
return nil, nil, fmt.Errorf("hash password: %w", err)
}
user, err := s.queries.CreateUser(ctx, db.CreateUserParams{
Username: username,
PasswordHash: hash,
})
if err != nil {
return nil, nil, fmt.Errorf("create user: %w", err)
}
tokens, err := s.generateTokens(ctx, user.ID)
if err != nil {
return nil, nil, fmt.Errorf("generate tokens: %w", err)
}
return tokens, &UserResponse{ID: user.ID, Username: user.Username}, nil
}
func (s *AuthService) Login(ctx context.Context, username, password string) (*TokenPair, *UserResponse, error) {
user, err := s.queries.GetUserByUsername(ctx, strings.TrimSpace(username))
if err != nil {
return nil, nil, ErrInvalidCredentials
}
if !verifyPassword(password, user.PasswordHash) {
return nil, nil, ErrInvalidCredentials
}
tokens, err := s.generateTokens(ctx, user.ID)
if err != nil {
return nil, nil, fmt.Errorf("generate tokens: %w", err)
}
return tokens, &UserResponse{ID: user.ID, Username: user.Username}, nil
}
func (s *AuthService) Refresh(ctx context.Context, refreshToken string) (*TokenPair, error) {
userID, err := s.validateRefreshToken(refreshToken)
if err != nil {
return nil, ErrInvalidToken
}
tokenHash := hashToken(refreshToken)
stored, err := s.queries.GetRefreshToken(ctx, tokenHash)
if err != nil {
return nil, ErrInvalidToken
}
if stored.UserID != userID {
return nil, ErrInvalidToken
}
if err := s.queries.RevokeRefreshToken(ctx, tokenHash); err != nil {
return nil, fmt.Errorf("revoke refresh token: %w", err)
}
tokens, err := s.generateTokens(ctx, userID)
if err != nil {
return nil, fmt.Errorf("generate tokens: %w", err)
}
return tokens, nil
}
func (s *AuthService) Logout(ctx context.Context, refreshToken string) error {
tokenHash := hashToken(refreshToken)
return s.queries.RevokeRefreshToken(ctx, tokenHash)
}
func (s *AuthService) ValidateAccessToken(token string) (string, error) {
parsed, err := s.parser.ParseV4Local(s.key, token, nil)
if err != nil {
return "", ErrInvalidToken
}
userID, err := parsed.GetString("user_id")
if err != nil || userID == "" {
return "", ErrInvalidToken
}
return userID, nil
}
func (s *AuthService) generateTokens(ctx context.Context, userID string) (*TokenPair, error) {
accessToken, err := s.createAccessToken(userID)
if err != nil {
return nil, err
}
refreshToken, err := s.createRefreshToken(userID)
if err != nil {
return nil, err
}
refreshHash := hashToken(refreshToken)
_, err = s.queries.CreateRefreshToken(ctx, db.CreateRefreshTokenParams{
UserID: userID,
TokenHash: refreshHash,
ExpiresAt: time.Now().Add(refreshTokenTTL),
})
if err != nil {
return nil, fmt.Errorf("store refresh token: %w", err)
}
return &TokenPair{
AccessToken: accessToken,
RefreshToken: refreshToken,
}, nil
}
func (s *AuthService) createAccessToken(userID string) (string, error) {
token := paseto.NewToken()
token.Set("user_id", userID)
token.SetExpiration(time.Now().Add(accessTokenTTL))
return token.V4Encrypt(s.key, nil), nil
}
func (s *AuthService) createRefreshToken(userID string) (string, error) {
token := paseto.NewToken()
token.Set("user_id", userID)
token.SetExpiration(time.Now().Add(refreshTokenTTL))
return token.V4Encrypt(s.key, nil), nil
}
func (s *AuthService) validateRefreshToken(token string) (string, error) {
parsed, err := s.parser.ParseV4Local(s.key, token, nil)
if err != nil {
return "", ErrInvalidToken
}
userID, err := parsed.GetString("user_id")
if err != nil || userID == "" {
return "", ErrInvalidToken
}
return userID, nil
}
func hashPassword(password string) (string, error) {
salt := make([]byte, saltLength)
if _, err := rand.Read(salt); err != nil {
return "", err
}
hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
return fmt.Sprintf("$argon2id$v=19$m=65536,t=1,p=4$%s$%s",
base64.RawStdEncoding.EncodeToString(salt),
base64.RawStdEncoding.EncodeToString(hash),
), nil
}
func verifyPassword(password, encodedHash string) bool {
parts := strings.Split(encodedHash, "$")
if len(parts) != 6 {
return false
}
salt, err := base64.RawStdEncoding.DecodeString(parts[4])
if err != nil {
return false
}
expectedHash, err := base64.RawStdEncoding.DecodeString(parts[5])
if err != nil {
return false
}
hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
return sha256.Sum256(hash) == sha256.Sum256(expectedHash)
}
func hashToken(token string) string {
h := sha256.Sum256([]byte(token))
return base64.RawURLEncoding.EncodeToString(h[:])
}
backend/internal/config/config.go
+2
View File
@@ -9,6 +9,7 @@ type Config struct {
UploadDir string
HMACSecret string
ServerHost string
PASETOKey string
}
func Load() *Config {
@@ -19,6 +20,7 @@ func Load() *Config {
UploadDir: envOr("UPLOAD_DIR", "./uploads"),
HMACSecret: envOr("HMAC_SECRET", "thisismyrandomstring"),
ServerHost: envOr("SERVER_HOST", "http://192.168.1.17:8080"),
PASETOKey: envOr("PASETO_KEY", "01234567890123456789012345678901234567890123456789012345678901234"),
}
}
backend/internal/db/auth.sql.go
+132
View File
@@ -0,0 +1,132 @@
// Code generated by sqlc. DO NOT EDIT.
// versions:
// sqlc v1.31.1
// source: auth.sql
package db
import (
"context"
"time"
)
const createRefreshToken = `-- name: CreateRefreshToken :one
INSERT INTO refresh_tokens (user_id, token_hash, expires_at)
VALUES ($1, $2, $3)
RETURNING id, user_id, token_hash, expires_at, revoked, created_at
`
type CreateRefreshTokenParams struct {
UserID string `json:"user_id"`
TokenHash string `json:"token_hash"`
ExpiresAt time.Time `json:"expires_at"`
}
func (q *Queries) CreateRefreshToken(ctx context.Context, arg CreateRefreshTokenParams) (RefreshToken, error) {
row := q.db.QueryRowContext(ctx, createRefreshToken, arg.UserID, arg.TokenHash, arg.ExpiresAt)
var i RefreshToken
err := row.Scan(
&i.ID,
&i.UserID,
&i.TokenHash,
&i.ExpiresAt,
&i.Revoked,
&i.CreatedAt,
)
return i, err
}
const createUser = `-- name: CreateUser :one
INSERT INTO users (username, password_hash)
VALUES ($1, $2)
RETURNING id, username, password_hash, created_at, updated_at
`
type CreateUserParams struct {
Username string `json:"username"`
PasswordHash string `json:"password_hash"`
}
func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) (User, error) {
row := q.db.QueryRowContext(ctx, createUser, arg.Username, arg.PasswordHash)
var i User
err := row.Scan(
&i.ID,
&i.Username,
&i.PasswordHash,
&i.CreatedAt,
&i.UpdatedAt,
)
return i, err
}
const getRefreshToken = `-- name: GetRefreshToken :one
SELECT id, user_id, token_hash, expires_at, revoked, created_at FROM refresh_tokens
WHERE token_hash = $1 AND revoked = FALSE AND expires_at > NOW()
`
func (q *Queries) GetRefreshToken(ctx context.Context, tokenHash string) (RefreshToken, error) {
row := q.db.QueryRowContext(ctx, getRefreshToken, tokenHash)
var i RefreshToken
err := row.Scan(
&i.ID,
&i.UserID,
&i.TokenHash,
&i.ExpiresAt,
&i.Revoked,
&i.CreatedAt,
)
return i, err
}
const getUserByID = `-- name: GetUserByID :one
SELECT id, username, password_hash, created_at, updated_at FROM users WHERE id = $1
`
func (q *Queries) GetUserByID(ctx context.Context, id string) (User, error) {
row := q.db.QueryRowContext(ctx, getUserByID, id)
var i User
err := row.Scan(
&i.ID,
&i.Username,
&i.PasswordHash,
&i.CreatedAt,
&i.UpdatedAt,
)
return i, err
}
const getUserByUsername = `-- name: GetUserByUsername :one
SELECT id, username, password_hash, created_at, updated_at FROM users WHERE username = $1
`
func (q *Queries) GetUserByUsername(ctx context.Context, username string) (User, error) {
row := q.db.QueryRowContext(ctx, getUserByUsername, username)
var i User
err := row.Scan(
&i.ID,
&i.Username,
&i.PasswordHash,
&i.CreatedAt,
&i.UpdatedAt,
)
return i, err
}
const revokeAllUserRefreshTokens = `-- name: RevokeAllUserRefreshTokens :exec
UPDATE refresh_tokens SET revoked = TRUE WHERE user_id = $1
`
func (q *Queries) RevokeAllUserRefreshTokens(ctx context.Context, userID string) error {
_, err := q.db.ExecContext(ctx, revokeAllUserRefreshTokens, userID)
return err
}
const revokeRefreshToken = `-- name: RevokeRefreshToken :exec
UPDATE refresh_tokens SET revoked = TRUE WHERE token_hash = $1
`
func (q *Queries) RevokeRefreshToken(ctx context.Context, tokenHash string) error {
_, err := q.db.ExecContext(ctx, revokeRefreshToken, tokenHash)
return err
}
backend/internal/db/migrations/009_users_default.down.sql
+5
View File
@@ -0,0 +1,5 @@
CREATE TABLE users (
id TEXT NOT NULL DEFAULT gen_random_uuid(),
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);
backend/internal/db/migrations/009_users_default.up.sql
+1
View File
@@ -0,0 +1 @@
DROP TABLE IF EXISTS users;
backend/internal/db/migrations/010_auth.down.sql
+2
View File
@@ -0,0 +1,2 @@
DROP TABLE IF EXISTS refresh_tokens;
DROP TABLE IF EXISTS users;
backend/internal/db/migrations/010_auth.up.sql
+19
View File
@@ -0,0 +1,19 @@
CREATE TABLE users (
id TEXT PRIMARY KEY DEFAULT gen_random_uuid(),
username TEXT NOT NULL UNIQUE,
password_hash TEXT NOT NULL,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);
CREATE TABLE refresh_tokens (
id TEXT NOT NULL DEFAULT gen_random_uuid(),
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
token_hash TEXT NOT NULL,
expires_at TIMESTAMP NOT NULL,
revoked BOOLEAN NOT NULL DEFAULT FALSE,
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);
CREATE INDEX idx_refresh_tokens_user_id ON refresh_tokens(user_id);
CREATE INDEX idx_refresh_tokens_token_hash ON refresh_tokens(token_hash);
backend/internal/db/models.go
+17
View File
@@ -29,6 +29,15 @@ type FileTag struct {
FileID sql.NullString `json:"file_id"`
}
type RefreshToken struct {
ID string `json:"id"`
UserID string `json:"user_id"`
TokenHash string `json:"token_hash"`
ExpiresAt time.Time `json:"expires_at"`
Revoked bool `json:"revoked"`
CreatedAt time.Time `json:"created_at"`
}
type Tag struct {
ID string `json:"id"`
ParentTagID sql.NullString `json:"parent_tag_id"`
@@ -37,3 +46,11 @@ type Tag struct {
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
type User struct {
ID string `json:"id"`
Username string `json:"username"`
PasswordHash string `json:"password_hash"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
backend/internal/db/queries/auth.sql
+25
View File
@@ -0,0 +1,25 @@
-- name: CreateUser :one
INSERT INTO users (username, password_hash)
VALUES ($1, $2)
RETURNING *;
-- name: GetUserByUsername :one
SELECT * FROM users WHERE username = $1;
-- name: GetUserByID :one
SELECT * FROM users WHERE id = $1;
-- name: CreateRefreshToken :one
INSERT INTO refresh_tokens (user_id, token_hash, expires_at)
VALUES ($1, $2, $3)
RETURNING *;
-- name: GetRefreshToken :one
SELECT * FROM refresh_tokens
WHERE token_hash = $1 AND revoked = FALSE AND expires_at > NOW();
-- name: RevokeRefreshToken :exec
UPDATE refresh_tokens SET revoked = TRUE WHERE token_hash = $1;
-- name: RevokeAllUserRefreshTokens :exec
UPDATE refresh_tokens SET revoked = TRUE WHERE user_id = $1;
backend/internal/handler/handler.go
+4 -1
View File
@@ -1,6 +1,7 @@
package handler
import (
"github.com/vaultdrop/backend/internal/auth"
"github.com/vaultdrop/backend/internal/service"
)
@@ -8,12 +9,14 @@ type Handler struct {
File *FileHandler
OCR *OCRHandler
Health *HealthHandler
Auth *auth.AuthHandler
}
func New(fileSvc *service.FileService, ocrSvc *service.OCRService, urlSvc *service.URLService) *Handler {
func New(fileSvc *service.FileService, ocrSvc *service.OCRService, urlSvc *service.URLService, authHandler *auth.AuthHandler) *Handler {
return &Handler{
File: &FileHandler{files: fileSvc, urls: urlSvc, ocr: ocrSvc},
OCR: &OCRHandler{ocr: ocrSvc, files: fileSvc},
Health: &HealthHandler{ocr: ocrSvc},
Auth: authHandler,
}
}
backend/internal/handler/router.go
+27 -15
View File
@@ -1,25 +1,37 @@
package handler
import "github.com/gin-gonic/gin"
import (
"github.com/gin-gonic/gin"
"github.com/vaultdrop/backend/internal/auth"
)
func SetupRoutes(r *gin.Engine, h *Handler) {
func SetupRoutes(r *gin.Engine, h *Handler, authMiddleware *auth.AuthService) {
api := r.Group("/api/v1")
// Public
api.GET("/health", h.Health.Check)
api.POST("/auth/register", h.Auth.Register)
api.POST("/auth/login", h.Auth.Login)
api.POST("/auth/refresh", h.Auth.Refresh)
api.POST("/auth/logout", h.Auth.Logout)
api.GET("/files", h.File.List)
api.POST("/files/upload", h.File.Upload)
api.POST("/files/move", h.File.MoveFiles)
api.POST("/files/folders", h.File.CreateFolder)
api.GET("/files/folders", h.File.ListFolders)
api.GET("/files/folders/:id/files", h.File.ListFilesByParent)
api.GET("/files/download/:id", h.File.Download)
api.DELETE("/files/:id", h.File.Delete)
api.GET("/files/:id", h.File.Get)
// Protected
protected := api.Group("")
protected.Use(authMiddleware.RequireAuth())
api.POST("/files/:id/tags", h.File.AddTags)
api.GET("/files/:id/tags", h.File.GetTags)
protected.GET("/files", h.File.List)
protected.POST("/files/upload", h.File.Upload)
protected.POST("/files/move", h.File.MoveFiles)
protected.POST("/files/folders", h.File.CreateFolder)
protected.GET("/files/folders", h.File.ListFolders)
protected.GET("/files/folders/:id/files", h.File.ListFilesByParent)
protected.GET("/files/download/:id", h.File.Download)
protected.DELETE("/files/:id", h.File.Delete)
protected.GET("/files/:id", h.File.Get)
api.POST("/ocr/jobs", h.OCR.CreateJob)
api.GET("/ocr/jobs/:id", h.OCR.GetJobStatus)
protected.POST("/files/:id/tags", h.File.AddTags)
protected.GET("/files/:id/tags", h.File.GetTags)
protected.POST("/ocr/jobs", h.OCR.CreateJob)
protected.GET("/ocr/jobs/:id", h.OCR.GetJobStatus)
}