508 lines
15 KiB
Go
508 lines
15 KiB
Go
package handlers
|
||
|
||
import (
|
||
"context"
|
||
"crypto/sha256"
|
||
"encoding/hex"
|
||
"log"
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
"github.com/golang-jwt/jwt/v5"
|
||
"github.com/google/uuid"
|
||
"golang.org/x/crypto/bcrypt"
|
||
|
||
"git.gobha.me/xcaliber/chat-switchboard/auth"
|
||
"git.gobha.me/xcaliber/chat-switchboard/config"
|
||
"git.gobha.me/xcaliber/chat-switchboard/crypto"
|
||
"git.gobha.me/xcaliber/chat-switchboard/database"
|
||
"git.gobha.me/xcaliber/chat-switchboard/models"
|
||
"git.gobha.me/xcaliber/chat-switchboard/store"
|
||
)
|
||
|
||
// Claims represents the JWT payload.
|
||
//
|
||
// bcryptCost is shared across auth.go, settings.go, admin.go
|
||
const bcryptCost = 12
|
||
|
||
type Claims struct {
|
||
UserID string `json:"user_id"`
|
||
Email string `json:"email"`
|
||
Role string `json:"role"`
|
||
jwt.RegisteredClaims
|
||
}
|
||
|
||
type AuthHandler struct {
|
||
cfg *config.Config
|
||
stores store.Stores
|
||
uekCache *crypto.UEKCache
|
||
provider auth.Provider
|
||
}
|
||
|
||
func NewAuthHandler(cfg *config.Config, s store.Stores, uekCache *crypto.UEKCache, provider auth.Provider) *AuthHandler {
|
||
return &AuthHandler{cfg: cfg, stores: s, uekCache: uekCache, provider: provider}
|
||
}
|
||
|
||
func (h *AuthHandler) Register(c *gin.Context) {
|
||
if !h.provider.SupportsRegistration() {
|
||
c.JSON(http.StatusMethodNotAllowed, gin.H{"error": "registration not supported for this auth mode"})
|
||
return
|
||
}
|
||
|
||
result, err := h.provider.Register(c, h.stores)
|
||
if err != nil {
|
||
c.JSON(auth.ErrorToHTTPStatus(err), gin.H{"error": err.Error()})
|
||
return
|
||
}
|
||
|
||
if result.VaultHint != "" {
|
||
if err := h.initVault(c.Request.Context(), result.User.ID, result.VaultHint); err != nil {
|
||
log.Printf("⚠ Failed to init vault for user %s: %v", result.User.ID, err)
|
||
}
|
||
}
|
||
|
||
if !result.User.IsActive {
|
||
c.JSON(http.StatusCreated, gin.H{
|
||
"message": "Account created but requires admin approval",
|
||
"user_id": result.User.ID,
|
||
})
|
||
return
|
||
}
|
||
|
||
tokens, err := h.generateTokens(result.User)
|
||
if err != nil {
|
||
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate tokens"})
|
||
return
|
||
}
|
||
|
||
c.JSON(http.StatusCreated, tokens)
|
||
}
|
||
|
||
func (h *AuthHandler) Login(c *gin.Context) {
|
||
result, err := h.provider.Authenticate(c, h.stores)
|
||
if err != nil {
|
||
c.JSON(auth.ErrorToHTTPStatus(err), gin.H{"error": err.Error()})
|
||
return
|
||
}
|
||
|
||
if result.VaultHint != "" {
|
||
h.unlockVault(c.Request.Context(), result.User, result.VaultHint)
|
||
}
|
||
|
||
h.stores.Users.UpdateLastLogin(c.Request.Context(), result.User.ID)
|
||
|
||
tokens, err := h.generateTokens(result.User)
|
||
if err != nil {
|
||
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate tokens"})
|
||
return
|
||
}
|
||
|
||
c.JSON(http.StatusOK, tokens)
|
||
}
|
||
|
||
func (h *AuthHandler) Refresh(c *gin.Context) {
|
||
var req struct {
|
||
RefreshToken string `json:"refresh_token" binding:"required"`
|
||
}
|
||
if err := c.ShouldBindJSON(&req); err != nil {
|
||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||
return
|
||
}
|
||
|
||
tokenHash := hashToken(req.RefreshToken)
|
||
userID, err := h.stores.Users.GetRefreshToken(c.Request.Context(), tokenHash)
|
||
if err != nil {
|
||
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid refresh token"})
|
||
return
|
||
}
|
||
|
||
// Revoke the used token (rotate)
|
||
h.stores.Users.RevokeRefreshToken(c.Request.Context(), tokenHash)
|
||
|
||
user, err := h.stores.Users.GetByID(c.Request.Context(), userID)
|
||
if err != nil || !user.IsActive {
|
||
c.JSON(http.StatusUnauthorized, gin.H{"error": "user not found or inactive"})
|
||
return
|
||
}
|
||
|
||
tokens, err := h.generateTokens(user)
|
||
if err != nil {
|
||
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate tokens"})
|
||
return
|
||
}
|
||
|
||
c.JSON(http.StatusOK, tokens)
|
||
}
|
||
|
||
func (h *AuthHandler) Logout(c *gin.Context) {
|
||
var req struct {
|
||
RefreshToken string `json:"refresh_token"`
|
||
}
|
||
c.ShouldBindJSON(&req)
|
||
|
||
if req.RefreshToken != "" {
|
||
tokenHash := hashToken(req.RefreshToken)
|
||
h.stores.Users.RevokeRefreshToken(c.Request.Context(), tokenHash)
|
||
}
|
||
|
||
// Evict UEK from session cache
|
||
if userID, exists := c.Get("user_id"); exists {
|
||
h.uekCache.Evict(userID.(string))
|
||
}
|
||
|
||
c.JSON(http.StatusOK, gin.H{"message": "logged out"})
|
||
}
|
||
|
||
func (h *AuthHandler) generateTokens(user *models.User) (gin.H, error) {
|
||
// Access token (15 min)
|
||
accessClaims := Claims{
|
||
UserID: user.ID,
|
||
Email: user.Email,
|
||
Role: user.Role,
|
||
RegisteredClaims: jwt.RegisteredClaims{
|
||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
|
||
IssuedAt: jwt.NewNumericDate(time.Now()),
|
||
ID: uuid.New().String(),
|
||
},
|
||
}
|
||
accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
|
||
accessString, err := accessToken.SignedString([]byte(h.cfg.JWTSecret))
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
|
||
// Refresh token (7 days)
|
||
refreshRaw := uuid.New().String()
|
||
refreshHash := hashToken(refreshRaw)
|
||
expiresAt := time.Now().Add(7 * 24 * time.Hour)
|
||
|
||
if err := h.stores.Users.CreateRefreshToken(context.Background(), user.ID, refreshHash, expiresAt); err != nil {
|
||
log.Printf("warn: failed to store refresh token: %v", err)
|
||
}
|
||
|
||
return gin.H{
|
||
"access_token": accessString,
|
||
"refresh_token": refreshRaw,
|
||
"token_type": "Bearer",
|
||
"expires_in": 900,
|
||
"user": gin.H{
|
||
"id": user.ID,
|
||
"username": user.Username,
|
||
"email": user.Email,
|
||
"display_name": user.DisplayName,
|
||
"role": user.Role,
|
||
"handle": user.Handle,
|
||
"auth_source": user.AuthSource,
|
||
},
|
||
}, nil
|
||
}
|
||
|
||
func hashToken(token string) string {
|
||
h := sha256.Sum256([]byte(token))
|
||
return hex.EncodeToString(h[:])
|
||
}
|
||
|
||
// ── Vault Lifecycle ─────────────────────────
|
||
|
||
// DestroyVaultDB nullifies a user's vault columns and deletes personal
|
||
// provider configs. This is the shared DB-level operation used by:
|
||
// - unlockVault (stale seal recovery)
|
||
// - BootstrapAdmin / SeedUsers (password rotation at startup)
|
||
// - AdminHandler.destroyVault (admin-initiated reset)
|
||
//
|
||
// Does NOT evict from UEK cache or write audit logs — callers handle that.
|
||
func DestroyVaultDB(ctx context.Context, userID string) (providersDeleted int64) {
|
||
_, err := database.DB.ExecContext(ctx, database.Q(`
|
||
UPDATE users
|
||
SET encrypted_uek = NULL, uek_salt = NULL, uek_nonce = NULL, vault_set = false
|
||
WHERE id = $1
|
||
`), userID)
|
||
if err != nil {
|
||
log.Printf("⚠ DestroyVaultDB: failed to clear vault columns for user %s: %v", userID, err)
|
||
}
|
||
|
||
result, err := database.DB.ExecContext(ctx, database.Q(`
|
||
DELETE FROM provider_configs WHERE scope = 'personal' AND owner_id = $1
|
||
`), userID)
|
||
if err != nil {
|
||
log.Printf("⚠ DestroyVaultDB: failed to delete personal providers for user %s: %v", userID, err)
|
||
return 0
|
||
}
|
||
rows, _ := result.RowsAffected()
|
||
return rows
|
||
}
|
||
|
||
// ProbeAndRepairVault checks whether a user's vault can be unlocked with
|
||
// the given password. If the vault doesn't exist (vault_set=false), this is
|
||
// a no-op. If the vault exists but the seal is stale (encrypted_uek was
|
||
// wrapped with a different password), the vault and personal providers are
|
||
// destroyed so initVault fires cleanly on next login.
|
||
//
|
||
// Used by BootstrapAdmin and SeedUsers where the password is known at
|
||
// startup but the UEK cache is not available.
|
||
func ProbeAndRepairVault(ctx context.Context, userID, password string) {
|
||
var vaultSet bool
|
||
var encryptedUEK, salt, nonce []byte
|
||
|
||
err := database.DB.QueryRowContext(ctx, database.Q(`
|
||
SELECT vault_set, encrypted_uek, uek_salt, uek_nonce
|
||
FROM users WHERE id = $1
|
||
`), userID).Scan(&vaultSet, &encryptedUEK, &salt, &nonce)
|
||
if err != nil || !vaultSet {
|
||
return // no vault to probe
|
||
}
|
||
|
||
pdk := crypto.DeriveKeyFromPassword(password, salt)
|
||
if _, err := crypto.UnwrapUEK(encryptedUEK, nonce, pdk); err == nil {
|
||
return // vault seal matches current password — all good
|
||
}
|
||
|
||
// Stale seal: password has actually changed since the vault was sealed
|
||
deleted := DestroyVaultDB(ctx, userID)
|
||
if deleted > 0 {
|
||
log.Printf(" 🔐 Vault stale-seal repair for user %s: cleared %d personal provider(s)", userID, deleted)
|
||
} else {
|
||
log.Printf(" 🔐 Vault stale-seal repair for user %s: vault columns cleared", userID)
|
||
}
|
||
}
|
||
|
||
// initVault generates a UEK, wraps it with the user's password, and stores
|
||
// the encrypted UEK + salt + nonce on the user record. Called on registration
|
||
// and on first login for pre-migration users.
|
||
func (h *AuthHandler) initVault(ctx context.Context, userID, password string) error {
|
||
if h.uekCache == nil {
|
||
return nil // Vault not configured (e.g. tests)
|
||
}
|
||
|
||
uek, err := crypto.GenerateUEK()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
|
||
salt, err := crypto.GenerateSalt()
|
||
if err != nil {
|
||
return err
|
||
}
|
||
|
||
pdk := crypto.DeriveKeyFromPassword(password, salt)
|
||
encryptedUEK, nonce, err := crypto.WrapUEK(uek, pdk)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
|
||
_, err = database.DB.ExecContext(ctx, database.Q(`
|
||
UPDATE users
|
||
SET encrypted_uek = $1, uek_salt = $2, uek_nonce = $3, vault_set = true
|
||
WHERE id = $4
|
||
`), encryptedUEK, salt, nonce, userID)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
|
||
// Cache the UEK for the session
|
||
h.uekCache.Store(userID, uek)
|
||
log.Printf(" 🔐 Vault initialized for user %s", userID)
|
||
return nil
|
||
}
|
||
|
||
// unlockVault unwraps the UEK on login and caches it. If the user doesn't
|
||
// have a vault yet (pre-migration account), initializes one.
|
||
func (h *AuthHandler) unlockVault(ctx context.Context, user *models.User, password string) {
|
||
if h.uekCache == nil {
|
||
return
|
||
}
|
||
|
||
var vaultSet bool
|
||
var encryptedUEK, salt, nonce []byte
|
||
|
||
err := database.DB.QueryRowContext(ctx, database.Q(`
|
||
SELECT vault_set, encrypted_uek, uek_salt, uek_nonce
|
||
FROM users WHERE id = $1
|
||
`), user.ID).Scan(&vaultSet, &encryptedUEK, &salt, &nonce)
|
||
if err != nil {
|
||
log.Printf("⚠ Vault query failed for user %s: %v", user.ID, err)
|
||
return
|
||
}
|
||
|
||
if !vaultSet {
|
||
// Pre-migration user: initialize vault on first login
|
||
if err := h.initVault(ctx, user.ID, password); err != nil {
|
||
log.Printf("⚠ Vault init on login failed for user %s: %v", user.ID, err)
|
||
}
|
||
return
|
||
}
|
||
|
||
// Derive PDK from password and unwrap UEK
|
||
pdk := crypto.DeriveKeyFromPassword(password, salt)
|
||
uek, err := crypto.UnwrapUEK(encryptedUEK, nonce, pdk)
|
||
if err != nil {
|
||
// Stale seal: encrypted_uek was wrapped with a different password
|
||
// (e.g. admin reset, BootstrapAdmin rotation, or pre-UEK migration).
|
||
// The old UEK is irrecoverable. Destroy the vault and re-initialize
|
||
// with the current password so the user isn't permanently locked out.
|
||
deleted := DestroyVaultDB(ctx, user.ID)
|
||
if deleted > 0 {
|
||
log.Printf("⚠ Vault stale-seal recovery for user %s: cleared %d personal provider(s)", user.ID, deleted)
|
||
} else {
|
||
log.Printf("⚠ Vault stale-seal recovery for user %s: no personal providers to clear", user.ID)
|
||
}
|
||
|
||
if err := h.initVault(ctx, user.ID, password); err != nil {
|
||
log.Printf("⚠ Vault re-init failed for user %s: %v", user.ID, err)
|
||
}
|
||
return
|
||
}
|
||
|
||
h.uekCache.Store(user.ID, uek)
|
||
}
|
||
|
||
// BootstrapAdmin creates/updates the admin user from env vars (K8s secret).
|
||
func BootstrapAdmin(cfg *config.Config, s store.Stores) {
|
||
if cfg.AdminUsername == "" || cfg.AdminPassword == "" {
|
||
return
|
||
}
|
||
|
||
ctx := context.Background()
|
||
hash, err := bcrypt.GenerateFromPassword([]byte(cfg.AdminPassword), bcryptCost)
|
||
if err != nil {
|
||
log.Printf("⚠ Failed to hash admin password: %v", err)
|
||
return
|
||
}
|
||
|
||
existing, _ := s.Users.GetByUsername(ctx, cfg.AdminUsername)
|
||
if existing != nil {
|
||
// Update password and ensure admin role
|
||
s.Users.Update(ctx, existing.ID, map[string]interface{}{
|
||
"password_hash": string(hash),
|
||
"role": models.UserRoleAdmin,
|
||
"is_active": true,
|
||
})
|
||
// If the actual password changed, the vault seal is stale. Probe it
|
||
// with the current password and destroy only if unwrap fails.
|
||
// Ensure handle exists (backfill for pre-v0.24.0 users)
|
||
if existing.Handle == "" {
|
||
handle := auth.UniqueHandle(ctx, s.Users, models.HandleFromName(cfg.AdminUsername))
|
||
s.Users.Update(ctx, existing.ID, map[string]interface{}{"handle": handle})
|
||
}
|
||
ProbeAndRepairVault(ctx, existing.ID, cfg.AdminPassword)
|
||
log.Printf(" ✅ Admin user '%s' updated", cfg.AdminUsername)
|
||
return
|
||
}
|
||
|
||
email := cfg.AdminEmail
|
||
if email == "" {
|
||
email = cfg.AdminUsername + "@switchboard.local"
|
||
}
|
||
|
||
handle := auth.UniqueHandle(ctx, s.Users, models.HandleFromName(cfg.AdminUsername))
|
||
user := &models.User{
|
||
Username: strings.ToLower(cfg.AdminUsername),
|
||
Email: strings.ToLower(email),
|
||
PasswordHash: string(hash),
|
||
Role: models.UserRoleAdmin,
|
||
IsActive: true,
|
||
AuthSource: "builtin",
|
||
Handle: handle,
|
||
}
|
||
|
||
if err := s.Users.Create(ctx, user); err != nil {
|
||
log.Printf("⚠ Failed to create admin user: %v", err)
|
||
return
|
||
}
|
||
log.Printf(" ✅ Admin user '%s' created", cfg.AdminUsername)
|
||
}
|
||
|
||
// SeedUsers creates or updates users from the SEED_USERS env var.
|
||
// Format: "user:pass:role,user2:pass2:role2" where role is "admin" or "user".
|
||
// Upsert: existing users get their password and role refreshed on every restart.
|
||
// Gated to non-production environments.
|
||
func SeedUsers(cfg *config.Config, s store.Stores) {
|
||
if cfg.SeedUsers == "" {
|
||
log.Printf(" ℹ SEED_USERS not set, skipping")
|
||
return
|
||
}
|
||
|
||
if cfg.Environment == "production" {
|
||
log.Printf("⚠ SEED_USERS ignored in production environment")
|
||
return
|
||
}
|
||
|
||
ctx := context.Background()
|
||
entries := strings.Split(cfg.SeedUsers, ",")
|
||
log.Printf(" 🌱 SEED_USERS: %d entries to process", len(entries))
|
||
|
||
for _, entry := range entries {
|
||
entry = strings.TrimSpace(entry)
|
||
if entry == "" {
|
||
continue
|
||
}
|
||
|
||
parts := strings.SplitN(entry, ":", 3)
|
||
if len(parts) < 2 {
|
||
log.Printf("⚠ Seed user skipped (bad format, want user:pass[:role]): %q", entry)
|
||
continue
|
||
}
|
||
|
||
username := strings.ToLower(strings.TrimSpace(parts[0]))
|
||
password := strings.TrimSpace(parts[1])
|
||
role := models.UserRoleUser
|
||
if len(parts) >= 3 && strings.TrimSpace(parts[2]) == "admin" {
|
||
role = models.UserRoleAdmin
|
||
}
|
||
|
||
if username == "" || password == "" {
|
||
log.Printf("⚠ Seed user skipped (empty username or password)")
|
||
continue
|
||
}
|
||
|
||
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
|
||
if err != nil {
|
||
log.Printf("⚠ Seed user '%s' skipped (hash error): %v", username, err)
|
||
continue
|
||
}
|
||
|
||
// Upsert: update password+role if user exists, create if not
|
||
existing, _ := s.Users.GetByUsername(ctx, username)
|
||
if existing != nil {
|
||
s.Users.Update(ctx, existing.ID, map[string]interface{}{
|
||
"password_hash": string(hash),
|
||
"role": role,
|
||
"is_active": true,
|
||
})
|
||
// Probe vault with current password — only destroys if seal is stale
|
||
if existing.Handle == "" {
|
||
handle := auth.UniqueHandle(ctx, s.Users, models.HandleFromName(username))
|
||
s.Users.Update(ctx, existing.ID, map[string]interface{}{"handle": handle})
|
||
}
|
||
ProbeAndRepairVault(ctx, existing.ID, password)
|
||
log.Printf(" 🌱 Seed user '%s' updated (role=%s)", username, role)
|
||
continue
|
||
}
|
||
|
||
handle := auth.UniqueHandle(ctx, s.Users, models.HandleFromName(username))
|
||
user := &models.User{
|
||
Username: username,
|
||
Email: username + "@switchboard.local",
|
||
PasswordHash: string(hash),
|
||
Role: role,
|
||
IsActive: true,
|
||
AuthSource: "builtin",
|
||
Handle: handle,
|
||
}
|
||
|
||
if err := s.Users.Create(ctx, user); err != nil {
|
||
log.Printf("⚠ Seed user '%s' failed: %v", username, err)
|
||
continue
|
||
}
|
||
log.Printf(" 🌱 Seed user '%s' created (role=%s, active=true)", username, role)
|
||
}
|
||
}
|
||
|
||
// IsRegistrationEnabled checks the platform policy.
|
||
func IsRegistrationEnabled(s store.Stores) bool {
|
||
val, _ := s.Policies.GetBool(context.Background(), "allow_registration")
|
||
return val
|
||
}
|