add backend auth

2026-07-14 09:47:55 +02:00
parent 6761141fed
commit 76ceafa56c
28 changed files with 1345 additions and 64 deletions
@@ -0,0 +1,135 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/vaultdrop/backend/pkg/api"
+)
+
+type AuthHandler struct {
+	auth *AuthService
+}
+
+func NewAuthHandler(auth *AuthService) *AuthHandler {
+	return &AuthHandler{auth: auth}
+}
+
+type registerRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+type loginRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+type refreshRequest struct {
+	RefreshToken string `json:"refresh_token" binding:"required"`
+}
+
+type logoutRequest struct {
+	RefreshToken string `json:"refresh_token" binding:"required"`
+}
+
+type authResponse struct {
+	User         UserResponse `json:"user"`
+	AccessToken  string       `json:"access_token"`
+	RefreshToken string       `json:"refresh_token"`
+}
+
+type tokenResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+func (h *AuthHandler) Register(c *gin.Context) {
+	var req registerRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "username and password are required")
+		return
+	}
+
+	tokens, user, err := h.auth.Register(c.Request.Context(), req.Username, req.Password)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrUsernameTaken):
+			api.Error(c, http.StatusConflict, "USERNAME_TAKEN", "username already taken")
+		default:
+			api.Error(c, http.StatusBadRequest, "VALIDATION_ERROR", err.Error())
+		}
+		return
+	}
+
+	c.JSON(http.StatusCreated, authResponse{
+		User:         *user,
+		AccessToken:  tokens.AccessToken,
+		RefreshToken: tokens.RefreshToken,
+	})
+}
+
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req loginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "username and password are required")
+		return
+	}
+
+	tokens, user, err := h.auth.Login(c.Request.Context(), req.Username, req.Password)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrInvalidCredentials):
+			api.Error(c, http.StatusUnauthorized, "INVALID_CREDENTIALS", "invalid username or password")
+		default:
+			api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
+		}
+		return
+	}
+
+	c.JSON(http.StatusOK, authResponse{
+		User:         *user,
+		AccessToken:  tokens.AccessToken,
+		RefreshToken: tokens.RefreshToken,
+	})
+}
+
+func (h *AuthHandler) Refresh(c *gin.Context) {
+	var req refreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "refresh_token is required")
+		return
+	}
+
+	tokens, err := h.auth.Refresh(c.Request.Context(), req.RefreshToken)
+	if err != nil {
+		switch {
+		case errors.Is(err, ErrInvalidToken):
+			api.Error(c, http.StatusUnauthorized, "INVALID_TOKEN", "invalid or expired refresh token")
+		default:
+			api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
+		}
+		return
+	}
+
+	c.JSON(http.StatusOK, tokenResponse{
+		AccessToken:  tokens.AccessToken,
+		RefreshToken: tokens.RefreshToken,
+	})
+}
+
+func (h *AuthHandler) Logout(c *gin.Context) {
+	var req logoutRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		api.Error(c, http.StatusBadRequest, "INVALID_INPUT", "refresh_token is required")
+		return
+	}
+
+	if err := h.auth.Logout(c.Request.Context(), req.RefreshToken); err != nil {
+		api.Error(c, http.StatusInternalServerError, "INTERNAL_ERROR", "something went wrong")
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
+}
@@ -0,0 +1,41 @@
+package auth
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+const UserIDKey = "userID"
+
+func (s *AuthService) RequireAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		header := c.GetHeader("Authorization")
+		if header == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{"code": "MISSING_TOKEN", "message": "authorization header required"},
+			})
+			return
+		}
+
+		parts := strings.SplitN(header, " ", 2)
+		if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{"code": "INVALID_TOKEN", "message": "invalid authorization format"},
+			})
+			return
+		}
+
+		claims, err := s.ValidateAccessToken(parts[1])
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
+				"error": gin.H{"code": "INVALID_TOKEN", "message": "invalid or expired token"},
+			})
+			return
+		}
+
+		c.Set(UserIDKey, claims)
+		c.Next()
+	}
+}
@@ -0,0 +1,250 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"aidanwoods.dev/go-paseto"
+	"github.com/vaultdrop/backend/internal/config"
+	"github.com/vaultdrop/backend/internal/db"
+	"golang.org/x/crypto/argon2"
+)
+
+var (
+	ErrInvalidCredentials = errors.New("invalid credentials")
+	ErrUsernameTaken      = errors.New("username already taken")
+	ErrInvalidToken       = errors.New("invalid or expired token")
+)
+
+const (
+	accessTokenTTL  = 30 * time.Minute
+	refreshTokenTTL = 7 * 24 * time.Hour
+	saltLength       = 16
+)
+
+type AuthService struct {
+	queries *db.Queries
+	key     paseto.V4SymmetricKey
+	parser  *paseto.Parser
+}
+
+type TokenPair struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+}
+
+type UserResponse struct {
+	ID       string `json:"id"`
+	Username string `json:"username"`
+}
+
+func NewAuthService(queries *db.Queries, cfg *config.Config) (*AuthService, error) {
+	key, err := paseto.V4SymmetricKeyFromHex(cfg.PASETOKey)
+	if err != nil {
+		return nil, fmt.Errorf("invalid paseto key: %w", err)
+	}
+
+	parser := paseto.NewParser()
+	parser.AddRule(paseto.NotExpired())
+
+	return &AuthService{
+		queries: queries,
+		key:     key,
+		parser:  &parser,
+	}, nil
+}
+
+func (s *AuthService) Register(ctx context.Context, username, password string) (*TokenPair, *UserResponse, error) {
+	username = strings.TrimSpace(username)
+	if len(username) < 3 || len(username) > 30 {
+		return nil, nil, fmt.Errorf("username must be 3-30 characters")
+	}
+	if len(password) < 8 {
+		return nil, nil, fmt.Errorf("password must be at least 8 characters")
+	}
+
+	existing, err := s.queries.GetUserByUsername(ctx, username)
+	if err == nil && existing.ID != "" {
+		return nil, nil, ErrUsernameTaken
+	}
+
+	hash, err := hashPassword(password)
+	if err != nil {
+		return nil, nil, fmt.Errorf("hash password: %w", err)
+	}
+
+	user, err := s.queries.CreateUser(ctx, db.CreateUserParams{
+		Username:     username,
+		PasswordHash: hash,
+	})
+	if err != nil {
+		return nil, nil, fmt.Errorf("create user: %w", err)
+	}
+
+	tokens, err := s.generateTokens(ctx, user.ID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate tokens: %w", err)
+	}
+
+	return tokens, &UserResponse{ID: user.ID, Username: user.Username}, nil
+}
+
+func (s *AuthService) Login(ctx context.Context, username, password string) (*TokenPair, *UserResponse, error) {
+	user, err := s.queries.GetUserByUsername(ctx, strings.TrimSpace(username))
+	if err != nil {
+		return nil, nil, ErrInvalidCredentials
+	}
+
+	if !verifyPassword(password, user.PasswordHash) {
+		return nil, nil, ErrInvalidCredentials
+	}
+
+	tokens, err := s.generateTokens(ctx, user.ID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("generate tokens: %w", err)
+	}
+
+	return tokens, &UserResponse{ID: user.ID, Username: user.Username}, nil
+}
+
+func (s *AuthService) Refresh(ctx context.Context, refreshToken string) (*TokenPair, error) {
+	userID, err := s.validateRefreshToken(refreshToken)
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+
+	tokenHash := hashToken(refreshToken)
+	stored, err := s.queries.GetRefreshToken(ctx, tokenHash)
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+
+	if stored.UserID != userID {
+		return nil, ErrInvalidToken
+	}
+
+	if err := s.queries.RevokeRefreshToken(ctx, tokenHash); err != nil {
+		return nil, fmt.Errorf("revoke refresh token: %w", err)
+	}
+
+	tokens, err := s.generateTokens(ctx, userID)
+	if err != nil {
+		return nil, fmt.Errorf("generate tokens: %w", err)
+	}
+
+	return tokens, nil
+}
+
+func (s *AuthService) Logout(ctx context.Context, refreshToken string) error {
+	tokenHash := hashToken(refreshToken)
+	return s.queries.RevokeRefreshToken(ctx, tokenHash)
+}
+
+func (s *AuthService) ValidateAccessToken(token string) (string, error) {
+	parsed, err := s.parser.ParseV4Local(s.key, token, nil)
+	if err != nil {
+		return "", ErrInvalidToken
+	}
+
+	userID, err := parsed.GetString("user_id")
+	if err != nil || userID == "" {
+		return "", ErrInvalidToken
+	}
+
+	return userID, nil
+}
+
+func (s *AuthService) generateTokens(ctx context.Context, userID string) (*TokenPair, error) {
+	accessToken, err := s.createAccessToken(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	refreshToken, err := s.createRefreshToken(userID)
+	if err != nil {
+		return nil, err
+	}
+
+	refreshHash := hashToken(refreshToken)
+	_, err = s.queries.CreateRefreshToken(ctx, db.CreateRefreshTokenParams{
+		UserID:    userID,
+		TokenHash: refreshHash,
+		ExpiresAt: time.Now().Add(refreshTokenTTL),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("store refresh token: %w", err)
+	}
+
+	return &TokenPair{
+		AccessToken:  accessToken,
+		RefreshToken: refreshToken,
+	}, nil
+}
+
+func (s *AuthService) createAccessToken(userID string) (string, error) {
+	token := paseto.NewToken()
+	token.Set("user_id", userID)
+	token.SetExpiration(time.Now().Add(accessTokenTTL))
+	return token.V4Encrypt(s.key, nil), nil
+}
+
+func (s *AuthService) createRefreshToken(userID string) (string, error) {
+	token := paseto.NewToken()
+	token.Set("user_id", userID)
+	token.SetExpiration(time.Now().Add(refreshTokenTTL))
+	return token.V4Encrypt(s.key, nil), nil
+}
+
+func (s *AuthService) validateRefreshToken(token string) (string, error) {
+	parsed, err := s.parser.ParseV4Local(s.key, token, nil)
+	if err != nil {
+		return "", ErrInvalidToken
+	}
+
+	userID, err := parsed.GetString("user_id")
+	if err != nil || userID == "" {
+		return "", ErrInvalidToken
+	}
+
+	return userID, nil
+}
+
+func hashPassword(password string) (string, error) {
+	salt := make([]byte, saltLength)
+	if _, err := rand.Read(salt); err != nil {
+		return "", err
+	}
+	hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
+	return fmt.Sprintf("$argon2id$v=19$m=65536,t=1,p=4$%s$%s",
+		base64.RawStdEncoding.EncodeToString(salt),
+		base64.RawStdEncoding.EncodeToString(hash),
+	), nil
+}
+
+func verifyPassword(password, encodedHash string) bool {
+	parts := strings.Split(encodedHash, "$")
+	if len(parts) != 6 {
+		return false
+	}
+	salt, err := base64.RawStdEncoding.DecodeString(parts[4])
+	if err != nil {
+		return false
+	}
+	expectedHash, err := base64.RawStdEncoding.DecodeString(parts[5])
+	if err != nil {
+		return false
+	}
+	hash := argon2.IDKey([]byte(password), salt, 1, 64*1024, 4, 32)
+	return sha256.Sum256(hash) == sha256.Sum256(expectedHash)
+}
+
+func hashToken(token string) string {
+	h := sha256.Sum256([]byte(token))
+	return base64.RawURLEncoding.EncodeToString(h[:])
+}