Issue 4 jwt (#24)

2026-02-15 23:41:48 +00:00
parent c75f976a2d
commit 8f10352e7d
9 changed files with 883 additions and 159 deletions
--- a/server/handlers/auth.go
+++ b/server/handlers/auth.go
@@ -0,0 +1,323 @@
+package handlers
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+
+	"git.gobha.me/xcaliber/chat-switchboard/config"
+	"git.gobha.me/xcaliber/chat-switchboard/database"
+)
+
+const (
+	accessTokenDuration  = 15 * time.Minute
+	refreshTokenDuration = 7 * 24 * time.Hour
+	bcryptCost           = 12
+)
+
+// Claims is the JWT access token payload.
+type Claims struct {
+	UserID string `json:"user_id"`
+	Email  string `json:"email"`
+	Role   string `json:"role"`
+	jwt.RegisteredClaims
+}
+
+// ── Request / Response types ────────────────
+
+type registerRequest struct {
+	Username string `json:"username" binding:"required,min=3,max=50"`
+	Email    string `json:"email"    binding:"required,email"`
+	Password string `json:"password" binding:"required,min=8,max=128"`
+}
+
+type loginRequest struct {
+	Login    string `json:"login"    binding:"required"` // email or username
+	Password string `json:"password" binding:"required"`
+}
+
+type refreshRequest struct {
+	RefreshToken string `json:"refresh_token" binding:"required"`
+}
+
+type authResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+	ExpiresIn    int    `json:"expires_in"` // seconds
+	User         userResponse `json:"user"`
+}
+
+type userResponse struct {
+	ID          string  `json:"id"`
+	Username    string  `json:"username"`
+	Email       string  `json:"email"`
+	DisplayName *string `json:"display_name"`
+	Role        string  `json:"role"`
+}
+
+// AuthHandler holds dependencies for auth endpoints.
+type AuthHandler struct {
+	cfg *config.Config
+}
+
+// NewAuthHandler creates a new auth handler.
+func NewAuthHandler(cfg *config.Config) *AuthHandler {
+	return &AuthHandler{cfg: cfg}
+}
+
+// ── Register ────────────────────────────────
+
+func (h *AuthHandler) Register(c *gin.Context) {
+	var req registerRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	req.Email = strings.ToLower(strings.TrimSpace(req.Email))
+	req.Username = strings.TrimSpace(req.Username)
+
+	// Hash password
+	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcryptCost)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to hash password"})
+		return
+	}
+
+	// Insert user
+	var user userResponse
+	err = database.DB.QueryRow(`
+		INSERT INTO users (username, email, password_hash, role)
+		VALUES ($1, $2, $3, 'user')
+		RETURNING id, username, email, display_name, role
+	`, req.Username, req.Email, string(hash)).Scan(
+		&user.ID, &user.Username, &user.Email, &user.DisplayName, &user.Role,
+	)
+	if err != nil {
+		if strings.Contains(err.Error(), "duplicate key") {
+			field := "email"
+			if strings.Contains(err.Error(), "username") {
+				field = "username"
+			}
+			c.JSON(http.StatusConflict, gin.H{"error": fmt.Sprintf("%s already taken", field)})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create user"})
+		return
+	}
+
+	// Generate tokens
+	resp, err := h.generateTokenPair(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate tokens"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, resp)
+}
+
+// ── Login ───────────────────────────────────
+
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req loginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	req.Login = strings.TrimSpace(req.Login)
+
+	// Look up user by email or username
+	var user userResponse
+	var passwordHash string
+	var isActive bool
+
+	err := database.DB.QueryRow(`
+		SELECT id, username, email, display_name, role, password_hash, is_active
+		FROM users
+		WHERE email = $1 OR username = $1
+	`, req.Login).Scan(
+		&user.ID, &user.Username, &user.Email, &user.DisplayName,
+		&user.Role, &passwordHash, &isActive,
+	)
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "authentication failed"})
+		return
+	}
+
+	if !isActive {
+		c.JSON(http.StatusForbidden, gin.H{"error": "account disabled"})
+		return
+	}
+
+	// Verify password
+	if err := bcrypt.CompareHashAndPassword([]byte(passwordHash), []byte(req.Password)); err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
+		return
+	}
+
+	// Update last_login_at
+	_, _ = database.DB.Exec(`UPDATE users SET last_login_at = NOW() WHERE id = $1`, user.ID)
+
+	// Generate tokens
+	resp, err := h.generateTokenPair(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate tokens"})
+		return
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+// ── Refresh ─────────────────────────────────
+
+func (h *AuthHandler) Refresh(c *gin.Context) {
+	var req refreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	tokenHash := hashToken(req.RefreshToken)
+
+	// Find and validate the refresh token
+	var tokenID, userID string
+	var expiresAt time.Time
+
+	err := database.DB.QueryRow(`
+		SELECT rt.id, rt.user_id, rt.expires_at
+		FROM refresh_tokens rt
+		WHERE rt.token_hash = $1 AND rt.revoked_at IS NULL
+	`, tokenHash).Scan(&tokenID, &userID, &expiresAt)
+
+	if err == sql.ErrNoRows {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid refresh token"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "token validation failed"})
+		return
+	}
+
+	if time.Now().After(expiresAt) {
+		// Revoke expired token
+		_, _ = database.DB.Exec(`UPDATE refresh_tokens SET revoked_at = NOW() WHERE id = $1`, tokenID)
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "refresh token expired"})
+		return
+	}
+
+	// Revoke the old token (rotation)
+	_, _ = database.DB.Exec(`UPDATE refresh_tokens SET revoked_at = NOW() WHERE id = $1`, tokenID)
+
+	// Look up user
+	var user userResponse
+	var isActive bool
+	err = database.DB.QueryRow(`
+		SELECT id, username, email, display_name, role, is_active
+		FROM users WHERE id = $1
+	`, userID).Scan(
+		&user.ID, &user.Username, &user.Email, &user.DisplayName, &user.Role, &isActive,
+	)
+	if err != nil || !isActive {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "account unavailable"})
+		return
+	}
+
+	// Issue new pair
+	resp, err := h.generateTokenPair(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate tokens"})
+		return
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+// ── Logout ──────────────────────────────────
+
+func (h *AuthHandler) Logout(c *gin.Context) {
+	var req refreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		// No refresh token provided — just acknowledge
+		c.JSON(http.StatusOK, gin.H{"message": "logged out"})
+		return
+	}
+
+	tokenHash := hashToken(req.RefreshToken)
+
+	// Revoke the refresh token
+	_, _ = database.DB.Exec(`
+		UPDATE refresh_tokens SET revoked_at = NOW()
+		WHERE token_hash = $1 AND revoked_at IS NULL
+	`, tokenHash)
+
+	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
+}
+
+// ── Token Generation ────────────────────────
+
+func (h *AuthHandler) generateTokenPair(user userResponse) (*authResponse, error) {
+	now := time.Now()
+
+	// Access token (JWT)
+	claims := Claims{
+		UserID: user.ID,
+		Email:  user.Email,
+		Role:   user.Role,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(accessTokenDuration)),
+			Issuer:    "chat-switchboard",
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	accessToken, err := token.SignedString([]byte(h.cfg.JWTSecret))
+	if err != nil {
+		return nil, fmt.Errorf("sign access token: %w", err)
+	}
+
+	// Refresh token (opaque random string, stored hashed)
+	refreshBytes := make([]byte, 32)
+	if _, err := rand.Read(refreshBytes); err != nil {
+		return nil, fmt.Errorf("generate refresh token: %w", err)
+	}
+	refreshToken := hex.EncodeToString(refreshBytes)
+	refreshHash := hashToken(refreshToken)
+
+	// Store refresh token
+	_, err = database.DB.Exec(`
+		INSERT INTO refresh_tokens (user_id, token_hash, expires_at)
+		VALUES ($1, $2, $3)
+	`, user.ID, refreshHash, now.Add(refreshTokenDuration))
+	if err != nil {
+		return nil, fmt.Errorf("store refresh token: %w", err)
+	}
+
+	return &authResponse{
+		AccessToken:  accessToken,
+		RefreshToken: refreshToken,
+		ExpiresIn:    int(accessTokenDuration.Seconds()),
+		User:         user,
+	}, nil
+}
+
+// hashToken returns a SHA-256 hex digest of a token string.
+// Refresh tokens are stored hashed so a DB leak doesn't
+// compromise active sessions.
+func hashToken(token string) string {
+	h := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(h[:])
+}