mostly reworking how the JWT is processed

This commit is contained in:
James Tombleson 2024-03-31 17:49:09 -07:00
parent ec24600269
commit 8f10fbfba1

View File

@ -2,9 +2,10 @@ package v1
import ( import (
"errors" "errors"
"go-cook/api/models" "go-cook/api/domain"
"go-cook/api/repositories" "go-cook/api/repositories"
"net/http" "net/http"
"strings"
"time" "time"
"github.com/golang-jwt/jwt/v5" "github.com/golang-jwt/jwt/v5"
@ -15,19 +16,57 @@ const (
ErrJwtMissing = "auth token is missing" ErrJwtMissing = "auth token is missing"
ErrJwtClaimsMissing = "claims missing on token" ErrJwtClaimsMissing = "claims missing on token"
ErrJwtExpired = "auth token has expired" ErrJwtExpired = "auth token has expired"
ErrJwtScopeMissing = "required scope is missing"
) )
type JwtToken struct { type JwtToken struct {
Exp time.Time `json:"exp"` Exp time.Time `json:"exp"`
Iss string `json:"iss"`
Authorized bool `json:"authorized"` Authorized bool `json:"authorized"`
UserName string `json:"username"` UserName string `json:"username"`
Token string `json:"token"` Scopes []string `json:"scopes"`
jwt.RegisteredClaims jwt.RegisteredClaims
} }
func generateJwt(username string) (string, error) { func (j JwtToken) IsValid(scope string) error {
//TODO use env here err := j.hasExpired()
secret := []byte("ThisIsABadSecretDontReallyUseThis") if err != nil {
return err
}
err = j.hasScope(scope)
if err != nil {
return err
}
return nil
}
func (j JwtToken) hasExpired() error {
// Check to see if the token has expired
hasExpired := j.Exp.Compare(time.Now())
if hasExpired == -1 {
return errors.New(ErrJwtExpired)
}
return nil
}
func (j JwtToken) hasScope(scope string) error {
// they have the scope to access everything, so let them pass.
if strings.Contains(domain.ScopeAll, scope) {
return nil
}
for _, s := range j.Scopes {
if strings.Contains(s, scope) {
return nil
}
}
return errors.New(ErrJwtScopeMissing)
}
func (h *Handler) generateJwt(username string) (string, error) {
secret := []byte(h.Config.JwtSecret)
token := jwt.New(jwt.SigningMethodHS256) token := jwt.New(jwt.SigningMethodHS256)
claims := token.Claims.(jwt.MapClaims) claims := token.Claims.(jwt.MapClaims)
@ -35,6 +74,10 @@ func generateJwt(username string) (string, error) {
claims["authorized"] = true claims["authorized"] = true
claims["username"] = username claims["username"] = username
var scopes []string
scopes = append(scopes, domain.ScopeRecipeRead)
claims["scopes"] = scopes
tokenString, err := token.SignedString(secret) tokenString, err := token.SignedString(secret)
if err != nil { if err != nil {
return "", err return "", err
@ -50,7 +93,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
// if we have an err, validate that if its not user not found. // if we have an err, validate that if its not user not found.
// if the user is not found, we can use that name // if the user is not found, we can use that name
if err.Error() != repositories.ErrUserNotFound { if err.Error() != repositories.ErrUserNotFound {
return c.JSON(http.StatusInternalServerError, models.ErrorResponse{ return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
HttpCode: http.StatusInternalServerError, HttpCode: http.StatusInternalServerError,
Message: err.Error(), Message: err.Error(),
}) })
@ -60,7 +103,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
password := c.QueryParam("password") password := c.QueryParam("password")
err = h.UserService.CheckPasswordForRequirements(password) err = h.UserService.CheckPasswordForRequirements(password)
if err != nil { if err != nil {
return c.JSON(http.StatusInternalServerError, models.ErrorResponse{ return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
HttpCode: http.StatusInternalServerError, HttpCode: http.StatusInternalServerError,
Message: err.Error(), Message: err.Error(),
}) })
@ -68,7 +111,7 @@ func (h *Handler) AuthRegister(c echo.Context) error {
_, err = h.userRepo.Create(username, password) _, err = h.userRepo.Create(username, password)
if err != nil { if err != nil {
return c.JSON(http.StatusInternalServerError, models.ErrorResponse{ return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
HttpCode: http.StatusInternalServerError, HttpCode: http.StatusInternalServerError,
Message: err.Error(), Message: err.Error(),
}) })
@ -93,7 +136,7 @@ func (h *Handler) AuthLogin(c echo.Context) error {
return c.JSON(http.StatusInternalServerError, err) return c.JSON(http.StatusInternalServerError, err)
} }
token, err := generateJwt(username) token, err := h.generateJwt(username)
if err != nil { if err != nil {
return c.JSON(http.StatusInternalServerError, err) return c.JSON(http.StatusInternalServerError, err)
} }
@ -101,6 +144,10 @@ func (h *Handler) AuthLogin(c echo.Context) error {
return c.JSON(http.StatusOK, token) return c.JSON(http.StatusOK, token)
} }
func (h *Handler) AddScope(c echo.Context) error {
}
func (h *Handler) RefreshJwtToken(c echo.Context) error { func (h *Handler) RefreshJwtToken(c echo.Context) error {
return nil return nil
} }
@ -118,11 +165,5 @@ func (h *Handler) getJwtToken(c echo.Context) (JwtToken, error) {
return JwtToken{}, errors.New(ErrJwtClaimsMissing) return JwtToken{}, errors.New(ErrJwtClaimsMissing)
} }
// Check to see if the token has expired
hasExpired := claims.Exp.Compare(time.Now())
if hasExpired == -1 {
return JwtToken{}, errors.New(ErrJwtExpired)
}
return *claims, nil return *claims, nil
} }