feat(api): identité user-first — login/password, ownership user, fin du token device
- 000006 : users.username/username_normalized/password_hash/is_admin, index unique partiel sur username_normalized, DROP idx_users_email (unicité V1 = username, jamais email) ; 000007 destructif : resources.owner_id→user_id (FK→users, reset base dev), l'unicité racine devient par user - pkg/passwd : argon2id (t=1,m=64MiB,p=4,k=32), comparaison constant-time, VerifyTimedEqual (délai égalisé dummy-hash) ; pkg/auth : subject=user_id + claim device_id, TTL 7 j sans refresh - repository : Users (count/get/resolve-exact/create/update-password/ mark-deleted), Devices.MarkUser (user_id INFORMATIF uniquement) - handlers : POST /devices sans token, POST /auth/login (401 indistinguable user inconnu/mauvais mdp, device requis), PATCH /users/me/password (current_password, tokens non révoqués — limite V1), GET /users/resolve (exact lowercase, jamais email/is_admin) ; middleware RequireAuth (user authorisant, device porté) ; tout le scoping ressources passe user - bootstrap admin : users vide + ADMIN_* absents → refus de démarrer ; .env.example ; docs/api-v1.md §2/§3/§7/§8 - tests : migrations 000006/000007 (up/down), pkg/auth Identity, handlers login/password/resolve, helpers refactorés registerAndLogin, repo tests scopés user — suite backend verte
This commit is contained in:
m
@@ -0,0 +1,178 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
|
||||
"github.com/vaultdrop/backend/pkg/api"
|
||||
"github.com/vaultdrop/backend/pkg/auth"
|
||||
"github.com/vaultdrop/backend/pkg/passwd"
|
||||
"github.com/vaultdrop/backend/repository"
|
||||
"github.com/vaultdrop/backend/service"
|
||||
)
|
||||
|
||||
type LoginRequest struct {
|
||||
Username string `json:"username"`
|
||||
Password string `json:"password"`
|
||||
DeviceID string `json:"device_id"`
|
||||
}
|
||||
|
||||
type LoginUserDTO struct {
|
||||
ID string `json:"id"`
|
||||
Username string `json:"username"`
|
||||
IsAdmin bool `json:"is_admin"`
|
||||
}
|
||||
|
||||
type LoginResponse struct {
|
||||
Token string `json:"token"`
|
||||
ExpiresAt int64 `json:"expires_at"`
|
||||
User LoginUserDTO `json:"user"`
|
||||
}
|
||||
|
||||
// AuthLogin est la SEULE porte d'émission de token (V1). L'erreur est
|
||||
// volontairement indistinguable entre « username inconnu » et « mauvais mot de
|
||||
// passe » — même code, même message, délai égalisé via passwd.VerifyTimedEqual.
|
||||
func AuthLogin(c *gin.Context) {
|
||||
if Store == nil || Store.Repository == nil || Auth == nil {
|
||||
api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
|
||||
return
|
||||
}
|
||||
|
||||
var req LoginRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
api.Error(c, http.StatusBadRequest, "INVALID_REQUEST", "invalid JSON body")
|
||||
return
|
||||
}
|
||||
if strings.TrimSpace(req.Username) == "" || req.Password == "" || req.DeviceID == "" {
|
||||
api.Error(c, http.StatusBadRequest, "INVALID_REQUEST", "username, password and device_id are required")
|
||||
return
|
||||
}
|
||||
|
||||
normalized := service.NormalizeUsername(req.Username)
|
||||
user, userErr := Store.Repository.Users.GetByUsernameNormalized(normalized)
|
||||
|
||||
// Même durée de traitement que le compte existe ou non (username inconnu =>
|
||||
// stored vide → vérification contre dummyHash).
|
||||
stored := ""
|
||||
if userErr == nil && user != nil {
|
||||
stored = user.PasswordHash
|
||||
}
|
||||
if err := passwd.VerifyTimedEqual(req.Password, stored); err != nil {
|
||||
if errors.Is(err, passwd.ErrMismatch) {
|
||||
api.Error(c, http.StatusUnauthorized, "UNAUTHORIZED", "invalid credentials")
|
||||
return
|
||||
}
|
||||
api.Error(c, http.StatusInternalServerError, "INTERNAL", "could not verify credentials")
|
||||
return
|
||||
}
|
||||
|
||||
exists, err := Store.Repository.Devices.Exists(req.DeviceID)
|
||||
if err != nil {
|
||||
api.Error(c, http.StatusInternalServerError, "INTERNAL", "could not check device")
|
||||
return
|
||||
}
|
||||
if !exists {
|
||||
api.Error(c, http.StatusBadRequest, "INVALID_DEVICE_ID", "device not registered")
|
||||
return
|
||||
}
|
||||
|
||||
if err := Store.Repository.Devices.MarkUser(req.DeviceID, user.ID); err != nil {
|
||||
api.Error(c, http.StatusInternalServerError, "INTERNAL", "could not update device")
|
||||
return
|
||||
}
|
||||
|
||||
token, err := Auth.Issue(user.ID, req.DeviceID)
|
||||
if err != nil {
|
||||
api.Error(c, http.StatusInternalServerError, "TOKEN_ERROR", "could not issue token")
|
||||
return
|
||||
}
|
||||
|
||||
api.OK(c, LoginResponse{
|
||||
Token: token,
|
||||
ExpiresAt: time.Now().Add(auth.TokenTTL).UnixMilli(),
|
||||
User: LoginUserDTO{
|
||||
ID: user.ID,
|
||||
Username: user.Username,
|
||||
IsAdmin: user.IsAdmin,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
type changePasswordRequest struct {
|
||||
CurrentPassword string `json:"current_password"`
|
||||
NewPassword string `json:"new_password"`
|
||||
}
|
||||
|
||||
// ChangePassword met à jour le hash du compte connecté. Le mot de passe
|
||||
// courant est requis. Limite connue V1 : les tokens déjà émis restent valides
|
||||
// jusqu'à expiration (7 j, pas de révocation) — cf. docs/api-v1.md §7.
|
||||
func ChangePassword(c *gin.Context) {
|
||||
if Store == nil || Store.Repository == nil {
|
||||
api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
|
||||
return
|
||||
}
|
||||
userID := c.GetString(UserIDKey)
|
||||
|
||||
var req changePasswordRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
api.Error(c, http.StatusBadRequest, "INVALID_REQUEST", "invalid JSON body")
|
||||
return
|
||||
}
|
||||
if len(req.NewPassword) < 8 {
|
||||
api.Error(c, http.StatusBadRequest, "INVALID_PASSWORD", "new password must be at least 8 characters")
|
||||
return
|
||||
}
|
||||
|
||||
user, err := Store.Repository.Users.GetByID(userID)
|
||||
if err != nil {
|
||||
api.Error(c, http.StatusUnauthorized, "UNAUTHORIZED", "account not found")
|
||||
return
|
||||
}
|
||||
if err := passwd.Verify(req.CurrentPassword, user.PasswordHash); err != nil {
|
||||
api.Error(c, http.StatusForbidden, "INVALID_PASSWORD", "current password is incorrect")
|
||||
return
|
||||
}
|
||||
|
||||
newHash, err := passwd.Hash(req.NewPassword)
|
||||
if err != nil {
|
||||
api.Error(c, http.StatusInternalServerError, "INTERNAL", "could not hash new password")
|
||||
return
|
||||
}
|
||||
if err := Store.Repository.Users.UpdatePassword(userID, newHash); err != nil {
|
||||
api.Error(c, http.StatusInternalServerError, "INTERNAL", "could not update password")
|
||||
return
|
||||
}
|
||||
|
||||
api.OK(c, gin.H{"id": userID})
|
||||
}
|
||||
|
||||
// ResolveUser résout UN destinataire par username EXACT (normalisé lowercase).
|
||||
// Jamais de listing ni de préfixe (pas d'énumération de comptes). Ne renvoie
|
||||
// que {id, username} — jamais email/is_admin/created_at.
|
||||
func ResolveUser(c *gin.Context) {
|
||||
if Store == nil || Store.Repository == nil {
|
||||
api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
|
||||
return
|
||||
}
|
||||
username := service.NormalizeUsername(c.Query("username"))
|
||||
if username == "" {
|
||||
api.Error(c, http.StatusBadRequest, "INVALID_REQUEST", "username is required")
|
||||
return
|
||||
}
|
||||
|
||||
user, err := Store.Repository.Users.ResolveExact(username)
|
||||
if errors.Is(err, repository.ErrNotFound) {
|
||||
api.Error(c, http.StatusNotFound, "NOT_FOUND", "user not found")
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
api.Error(c, http.StatusInternalServerError, "INTERNAL", "could not resolve user")
|
||||
return
|
||||
}
|
||||
|
||||
api.OK(c, gin.H{"id": user.ID, "username": user.Username})
|
||||
}
|
||||
Reference in New Issue
Block a user