package v1 import ( "errors" "strings" "time" "git.jamestombleson.com/jtom38/newsbot-api/internal/domain" "github.com/golang-jwt/jwt/v5" ) const ( ErrJwtMissing = "auth token is missing" ErrJwtClaimsMissing = "claims missing on token" ErrJwtExpired = "auth token has expired" ErrJwtScopeMissing = "required scope is missing" ) type JwtToken struct { Exp time.Time `json:"exp"` Iss string `json:"iss"` Authorized bool `json:"authorized"` UserName string `json:"username"` Scopes []string `json:"scopes"` jwt.RegisteredClaims } func (j JwtToken) IsValid(scope string) error { err := j.hasExpired() if err != nil { return err } err = j.hasScope(scope) if err != nil { return err } return nil } func (j JwtToken) GetUsername() string { return j.UserName } func (j JwtToken) hasExpired() error { // Check to see if the token has expired hasExpired := j.Exp.Compare(time.Now()) if hasExpired == -1 { return errors.New(ErrJwtExpired) } return nil } func (j JwtToken) hasScope(scope string) error { // they have the scope to access everything, so let them pass. if strings.Contains(domain.ScopeAll, scope) { return nil } for _, s := range j.Scopes { if strings.Contains(s, scope) { return nil } } return errors.New(ErrJwtScopeMissing) } func (h *Handler) generateJwt(username, issuer string) (string, error) { return h.generateJwtWithExp(username, issuer, time.Now().Add(10*time.Minute)) } func (h *Handler) generateJwtWithExp(username, issuer string, expiresAt time.Time) (string, error) { secret := []byte(h.config.JwtSecret) // Anyone who wants to decrypt the key needs to use the same method token := jwt.New(jwt.SigningMethodHS256) claims := token.Claims.(jwt.MapClaims) claims["exp"] = expiresAt claims["authorized"] = true claims["username"] = username claims["iss"] = issuer var scopes []string if username == "admin" { scopes = append(scopes, domain.ScopeAll) claims["scopes"] = scopes } else { scopes = append(scopes, domain.ScopeRead) claims["scopes"] = scopes } tokenString, err := token.SignedString(secret) if err != nil { return "", err } return tokenString, nil }