mostly reworking how the JWT is processed
This commit is contained in:
parent
ec24600269
commit
8f10fbfba1
@ -2,9 +2,10 @@ package v1
|
|||||||
|
|
||||||
import (
|
import (
|
||||||
"errors"
|
"errors"
|
||||||
"go-cook/api/models"
|
"go-cook/api/domain"
|
||||||
"go-cook/api/repositories"
|
"go-cook/api/repositories"
|
||||||
"net/http"
|
"net/http"
|
||||||
|
"strings"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
"github.com/golang-jwt/jwt/v5"
|
"github.com/golang-jwt/jwt/v5"
|
||||||
@ -15,19 +16,57 @@ const (
|
|||||||
ErrJwtMissing = "auth token is missing"
|
ErrJwtMissing = "auth token is missing"
|
||||||
ErrJwtClaimsMissing = "claims missing on token"
|
ErrJwtClaimsMissing = "claims missing on token"
|
||||||
ErrJwtExpired = "auth token has expired"
|
ErrJwtExpired = "auth token has expired"
|
||||||
|
ErrJwtScopeMissing = "required scope is missing"
|
||||||
)
|
)
|
||||||
|
|
||||||
type JwtToken struct {
|
type JwtToken struct {
|
||||||
Exp time.Time `json:"exp"`
|
Exp time.Time `json:"exp"`
|
||||||
|
Iss string `json:"iss"`
|
||||||
Authorized bool `json:"authorized"`
|
Authorized bool `json:"authorized"`
|
||||||
UserName string `json:"username"`
|
UserName string `json:"username"`
|
||||||
Token string `json:"token"`
|
Scopes []string `json:"scopes"`
|
||||||
jwt.RegisteredClaims
|
jwt.RegisteredClaims
|
||||||
}
|
}
|
||||||
|
|
||||||
func generateJwt(username string) (string, error) {
|
func (j JwtToken) IsValid(scope string) error {
|
||||||
//TODO use env here
|
err := j.hasExpired()
|
||||||
secret := []byte("ThisIsABadSecretDontReallyUseThis")
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
err = j.hasScope(scope)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j JwtToken) hasExpired() error {
|
||||||
|
// Check to see if the token has expired
|
||||||
|
hasExpired := j.Exp.Compare(time.Now())
|
||||||
|
if hasExpired == -1 {
|
||||||
|
return errors.New(ErrJwtExpired)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (j JwtToken) hasScope(scope string) error {
|
||||||
|
// they have the scope to access everything, so let them pass.
|
||||||
|
if strings.Contains(domain.ScopeAll, scope) {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, s := range j.Scopes {
|
||||||
|
if strings.Contains(s, scope) {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return errors.New(ErrJwtScopeMissing)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (h *Handler) generateJwt(username string) (string, error) {
|
||||||
|
secret := []byte(h.Config.JwtSecret)
|
||||||
|
|
||||||
token := jwt.New(jwt.SigningMethodHS256)
|
token := jwt.New(jwt.SigningMethodHS256)
|
||||||
claims := token.Claims.(jwt.MapClaims)
|
claims := token.Claims.(jwt.MapClaims)
|
||||||
@ -35,6 +74,10 @@ func generateJwt(username string) (string, error) {
|
|||||||
claims["authorized"] = true
|
claims["authorized"] = true
|
||||||
claims["username"] = username
|
claims["username"] = username
|
||||||
|
|
||||||
|
var scopes []string
|
||||||
|
scopes = append(scopes, domain.ScopeRecipeRead)
|
||||||
|
claims["scopes"] = scopes
|
||||||
|
|
||||||
tokenString, err := token.SignedString(secret)
|
tokenString, err := token.SignedString(secret)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return "", err
|
return "", err
|
||||||
@ -50,7 +93,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
|
|||||||
// if we have an err, validate that if its not user not found.
|
// if we have an err, validate that if its not user not found.
|
||||||
// if the user is not found, we can use that name
|
// if the user is not found, we can use that name
|
||||||
if err.Error() != repositories.ErrUserNotFound {
|
if err.Error() != repositories.ErrUserNotFound {
|
||||||
return c.JSON(http.StatusInternalServerError, models.ErrorResponse{
|
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
|
||||||
HttpCode: http.StatusInternalServerError,
|
HttpCode: http.StatusInternalServerError,
|
||||||
Message: err.Error(),
|
Message: err.Error(),
|
||||||
})
|
})
|
||||||
@ -60,7 +103,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
|
|||||||
password := c.QueryParam("password")
|
password := c.QueryParam("password")
|
||||||
err = h.UserService.CheckPasswordForRequirements(password)
|
err = h.UserService.CheckPasswordForRequirements(password)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return c.JSON(http.StatusInternalServerError, models.ErrorResponse{
|
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
|
||||||
HttpCode: http.StatusInternalServerError,
|
HttpCode: http.StatusInternalServerError,
|
||||||
Message: err.Error(),
|
Message: err.Error(),
|
||||||
})
|
})
|
||||||
@ -68,7 +111,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
|
|||||||
|
|
||||||
_, err = h.userRepo.Create(username, password)
|
_, err = h.userRepo.Create(username, password)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return c.JSON(http.StatusInternalServerError, models.ErrorResponse{
|
return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
|
||||||
HttpCode: http.StatusInternalServerError,
|
HttpCode: http.StatusInternalServerError,
|
||||||
Message: err.Error(),
|
Message: err.Error(),
|
||||||
})
|
})
|
||||||
@ -93,7 +136,7 @@ func (h *Handler) AuthLogin(c echo.Context) error {
|
|||||||
return c.JSON(http.StatusInternalServerError, err)
|
return c.JSON(http.StatusInternalServerError, err)
|
||||||
}
|
}
|
||||||
|
|
||||||
token, err := generateJwt(username)
|
token, err := h.generateJwt(username)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return c.JSON(http.StatusInternalServerError, err)
|
return c.JSON(http.StatusInternalServerError, err)
|
||||||
}
|
}
|
||||||
@ -101,6 +144,10 @@ func (h *Handler) AuthLogin(c echo.Context) error {
|
|||||||
return c.JSON(http.StatusOK, token)
|
return c.JSON(http.StatusOK, token)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func (h *Handler) AddScope(c echo.Context) error {
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
func (h *Handler) RefreshJwtToken(c echo.Context) error {
|
func (h *Handler) RefreshJwtToken(c echo.Context) error {
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@ -118,11 +165,5 @@ func (h *Handler) getJwtToken(c echo.Context) (JwtToken, error) {
|
|||||||
return JwtToken{}, errors.New(ErrJwtClaimsMissing)
|
return JwtToken{}, errors.New(ErrJwtClaimsMissing)
|
||||||
}
|
}
|
||||||
|
|
||||||
// Check to see if the token has expired
|
|
||||||
hasExpired := claims.Exp.Compare(time.Now())
|
|
||||||
if hasExpired == -1 {
|
|
||||||
return JwtToken{}, errors.New(ErrJwtExpired)
|
|
||||||
}
|
|
||||||
|
|
||||||
return *claims, nil
|
return *claims, nil
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user