package v1 import ( "errors" "go-cook/api/domain" "strings" "time" "github.com/golang-jwt/jwt/v5" ) type JwtToken struct { Exp time.Time `json:"exp"` Iss string `json:"iss"` Authorized bool `json:"authorized"` UserName string `json:"username"` Scopes []string `json:"scopes"` jwt.RegisteredClaims } func (j JwtToken) IsValid(scope string) error { err := j.hasExpired() if err != nil { return err } err = j.hasScope(scope) if err != nil { return err } return nil } func (j JwtToken) hasExpired() error { // Check to see if the token has expired hasExpired := j.Exp.Compare(time.Now()) if hasExpired == -1 { return errors.New(ErrJwtExpired) } return nil } func (j JwtToken) hasScope(scope string) error { // they have the scope to access everything, so let them pass. if strings.Contains(domain.ScopeAll, scope) { return nil } for _, s := range j.Scopes { if strings.Contains(s, scope) { return nil } } return errors.New(ErrJwtScopeMissing) } func (h *Handler) generateJwt(username string) (string, error) { secret := []byte(h.Config.JwtSecret) token := jwt.New(jwt.SigningMethodHS256) claims := token.Claims.(jwt.MapClaims) claims["exp"] = time.Now().Add(10 * time.Minute) claims["authorized"] = true claims["username"] = username var scopes []string scopes = append(scopes, domain.ScopeRecipeRead) claims["scopes"] = scopes tokenString, err := token.SignedString(secret) if err != nil { return "", err } return tokenString, nil } func (h *Handler) generateAdminJwt(username string) (string, error) { secret := []byte(h.Config.JwtSecret) token := jwt.New(jwt.SigningMethodHS256) claims := token.Claims.(jwt.MapClaims) claims["exp"] = time.Now().Add(10 * time.Minute) claims["authorized"] = true claims["username"] = username claims["scopes"] = domain.ScopeAll tokenString, err := token.SignedString(secret) if err != nil { return "", err } return tokenString, nil }