go-cook/api/handlers/v1/auth.go

package v1

import (
	"errors"
	"go-cook/api/domain"
	"go-cook/api/repositories"
	"net/http"
	"strings"
	"time"

	"github.com/golang-jwt/jwt/v5"
	"github.com/labstack/echo/v4"
)

const (
	ErrJwtMissing       = "auth token is missing"
	ErrJwtClaimsMissing = "claims missing on token"
	ErrJwtExpired       = "auth token has expired"
	ErrJwtScopeMissing  = "required scope is missing"
	ErrUserNotFound     = "requested user does not exist"
)

type JwtToken struct {
	Exp        time.Time `json:"exp"`
	Iss        string    `json:"iss"`
	Authorized bool      `json:"authorized"`
	UserName   string    `json:"username"`
	Scopes     []string  `json:"scopes"`
	jwt.RegisteredClaims
}

func (j JwtToken) IsValid(scope string) error {
	err := j.hasExpired()
	if err != nil {
		return err
	}

	err = j.hasScope(scope)
	if err != nil {
		return err
	}

	return nil
}

func (j JwtToken) hasExpired() error {
	// Check to see if the token has expired
	hasExpired := j.Exp.Compare(time.Now())
	if hasExpired == -1 {
		return errors.New(ErrJwtExpired)
	}
	return nil
}

func (j JwtToken) hasScope(scope string) error {
	// they have the scope to access everything, so let them pass.
	if strings.Contains(domain.ScopeAll, scope) {
		return nil
	}

	for _, s := range j.Scopes {
		if strings.Contains(s, scope) {
			return nil
		}
	}
	return errors.New(ErrJwtScopeMissing)
}

func (h *Handler) generateJwt(username string) (string, error) {
	secret := []byte(h.Config.JwtSecret)

	token := jwt.New(jwt.SigningMethodHS256)
	claims := token.Claims.(jwt.MapClaims)
	claims["exp"] = time.Now().Add(10 * time.Minute)
	claims["authorized"] = true
	claims["username"] = username

	var scopes []string
	scopes = append(scopes, domain.ScopeRecipeRead)
	claims["scopes"] = scopes

	tokenString, err := token.SignedString(secret)
	if err != nil {
		return "", err
	}

	return tokenString, nil
}

func (h *Handler) generateAdminJwt(username string) (string, error) {
	secret := []byte(h.Config.JwtSecret)

	token := jwt.New(jwt.SigningMethodHS256)
	claims := token.Claims.(jwt.MapClaims)
	claims["exp"] = time.Now().Add(10 * time.Minute)
	claims["authorized"] = true
	claims["username"] = username
	claims["scopes"] = domain.ScopeAll

	tokenString, err := token.SignedString(secret)
	if err != nil {
		return "", err
	}

	return tokenString, nil
}

func (h *Handler) AuthRegister(c echo.Context) error {
	username := c.QueryParam("username")
	_, err := h.userRepo.GetByName(username)
	if err != nil {
		// if we have an err, validate that if its not user not found.
		// if the user is not found, we can use that name
		if err.Error() != repositories.ErrUserNotFound {
			return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
				HttpCode: http.StatusInternalServerError,
				Message:  err.Error(),
			})
		}
	}

	password := c.QueryParam("password")
	err = h.UserService.CheckPasswordForRequirements(password)
	if err != nil {
		return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
			HttpCode: http.StatusInternalServerError,
			Message:  err.Error(),
		})
	}

	_, err = h.userRepo.Create(username, password)
	if err != nil {
		return c.JSON(http.StatusInternalServerError, domain.ErrorResponse{
			HttpCode: http.StatusInternalServerError,
			Message:  err.Error(),
		})
	}

	return nil
}

func (h *Handler) AuthLogin(c echo.Context) error {
	username := c.QueryParam("username")
	password := c.QueryParam("password")

	// Check to see if they are trying to login with the admin token
	if username == "" {
		if h.Config.AdminToken != password {
			return h.ReturnUnauthorizedResponse(c, ErrUserNotFound)
		}

		token, err := h.generateAdminJwt("admin")
		if err != nil {
			return h.InternalServerErrorResponse(c, err.Error())
		}

		return c.JSON(http.StatusOK, token)
	}

	// check if the user exists
	err := h.UserService.DoesUserExist(username)
	if err != nil {
		return h.InternalServerErrorResponse(c, err.Error())
	}

	// make sure the hash matches
	err = h.UserService.DoesPasswordMatchHash(username, password)
	if err != nil {
		return h.InternalServerErrorResponse(c, err.Error())
	}

	token, err := h.generateJwt(username)
	if err != nil {
		return h.InternalServerErrorResponse(c, err.Error())
	}

	return c.JSON(http.StatusOK, token)
}

//func (h *Handler) AddScope(c echo.Context) error {
//
//}

func (h *Handler) RefreshJwtToken(c echo.Context) error {
	return nil
}

func (h *Handler) getJwtToken(c echo.Context) (JwtToken, error) {
	// Make sure that the request came with a jwtToken
	token, ok := c.Get("user").(*jwt.Token)
	if !ok {
		return JwtToken{}, errors.New(ErrJwtMissing)
	}

	// Generate the claims from the token
	claims, ok := token.Claims.(*JwtToken)
	if !ok {
		return JwtToken{}, errors.New(ErrJwtClaimsMissing)
	}

	return *claims, nil
}