init

2026-08-22 02:59:16 +02:00
commit 6a5bb1d699
100 changed files with 17409 additions and 0 deletions
@@ -0,0 +1,93 @@
+package auth
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+)
+
+type Handler struct {
+	service *Service
+}
+
+func NewHandler(service *Service) *Handler {
+	return &Handler{service: service}
+}
+
+func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("POST /api/auth/register", h.Register)
+	mux.HandleFunc("POST /api/auth/login", h.Login)
+	mux.HandleFunc("POST /api/auth/logout", h.Logout)
+	mux.HandleFunc("GET /api/auth/me", h.Me)
+}
+
+type credentialsRequest struct {
+	Email    string `json:"email"`
+	Password string `json:"password"`
+	Name     string `json:"name"`
+}
+
+func (h *Handler) Register(w http.ResponseWriter, r *http.Request) {
+	var request credentialsRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	user, err := h.service.Register(r.Context(), request.Email, request.Password, request.Name)
+	if err != nil {
+		if errors.Is(err, ErrEmailTaken) {
+			writeJSON(w, http.StatusConflict, map[string]string{"error": "email is already registered"})
+			return
+		}
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	h.service.SetSession(w, user)
+	writeJSON(w, http.StatusCreated, map[string]User{"user": user})
+}
+
+func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
+	var request credentialsRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	user, err := h.service.Login(r.Context(), request.Email, request.Password)
+	if err != nil {
+		if errors.Is(err, ErrInvalidCredentials) {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid email or password"})
+			return
+		}
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "could not sign in"})
+		return
+	}
+	h.service.SetSession(w, user)
+	writeJSON(w, http.StatusOK, map[string]User{"user": user})
+}
+
+func (h *Handler) Logout(w http.ResponseWriter, _ *http.Request) {
+	h.service.ClearSession(w)
+	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+}
+
+func (h *Handler) Me(w http.ResponseWriter, r *http.Request) {
+	user, err := h.service.UserFromRequest(r.Context(), r)
+	if err != nil {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]User{"user": user})
+}
+
+func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
+	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/json") {
+		writeJSON(w, http.StatusUnsupportedMediaType, map[string]string{"error": "content type must be application/json"})
+		return false
+	}
+	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"})
+		return false
+	}
+	return true
+}
@@ -0,0 +1,14 @@
+package auth
+
+import "github.com/google/uuid"
+
+type User struct {
+	ID    uuid.UUID `json:"id"`
+	Email string    `json:"email"`
+	Name  string    `json:"name"`
+}
+
+type storedUser struct {
+	User
+	PasswordHash string
+}
@@ -0,0 +1,68 @@
+package auth
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/google/uuid"
+)
+
+type Repository struct {
+	db *sql.DB
+}
+
+func NewRepository(db *sql.DB) *Repository {
+	return &Repository{db: db}
+}
+
+var ErrEmailTaken = errors.New("email already registered")
+
+func (r *Repository) CreateUser(ctx context.Context, email, passwordHash, name string) (User, error) {
+	user := User{ID: uuid.New(), Email: strings.ToLower(strings.TrimSpace(email)), Name: strings.TrimSpace(name)}
+	_, err := r.db.ExecContext(ctx, `
+		INSERT INTO users (id, email, password_hash, name)
+		VALUES ($1, $2, $3, $4)
+	`, user.ID, user.Email, passwordHash, user.Name)
+	if err != nil {
+		if strings.Contains(strings.ToLower(err.Error()), "unique") {
+			return User{}, ErrEmailTaken
+		}
+		return User{}, fmt.Errorf("create user: %w", err)
+	}
+	return user, nil
+}
+
+func (r *Repository) FindByEmail(ctx context.Context, email string) (storedUser, error) {
+	var user storedUser
+	err := r.db.QueryRowContext(ctx, `
+		SELECT id, email, name, password_hash
+		FROM users
+		WHERE lower(email) = lower($1)
+	`, strings.TrimSpace(email)).Scan(&user.ID, &user.Email, &user.Name, &user.PasswordHash)
+	if errors.Is(err, sql.ErrNoRows) {
+		return storedUser{}, sql.ErrNoRows
+	}
+	if err != nil {
+		return storedUser{}, fmt.Errorf("find user by email: %w", err)
+	}
+	return user, nil
+}
+
+func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (User, error) {
+	var user User
+	err := r.db.QueryRowContext(ctx, `
+		SELECT id, email, name
+		FROM users
+		WHERE id = $1
+	`, id).Scan(&user.ID, &user.Email, &user.Name)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, sql.ErrNoRows
+	}
+	if err != nil {
+		return User{}, fmt.Errorf("find user by id: %w", err)
+	}
+	return user, nil
+}
@@ -0,0 +1,243 @@
+package auth
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+const (
+	sessionCookieName = "studio_session"
+	visitorCookieName = "studio_visitor"
+	accessCookieName  = "studio_gallery_access"
+	sessionDuration   = 7 * 24 * time.Hour
+	accessDuration    = 12 * time.Hour
+)
+
+var (
+	ErrInvalidCredentials = errors.New("invalid credentials")
+	ErrInvalidSession     = errors.New("invalid session")
+)
+
+type Service struct {
+	repository *Repository
+	secret     []byte
+	secure     bool
+}
+
+func NewService(repository *Repository, secret string, secureCookie bool) (*Service, error) {
+	if len(secret) < 32 {
+		return nil, fmt.Errorf("session secret must be at least 32 characters")
+	}
+	return &Service{repository: repository, secret: []byte(secret), secure: secureCookie}, nil
+}
+
+func (s *Service) Register(ctx context.Context, email, password, name string) (User, error) {
+	email = strings.ToLower(strings.TrimSpace(email))
+	name = strings.TrimSpace(name)
+	if !strings.Contains(email, "@") || len(email) > 254 {
+		return User{}, fmt.Errorf("enter a valid email address")
+	}
+	if len(password) < 8 {
+		return User{}, fmt.Errorf("password must be at least 8 characters")
+	}
+	if name == "" || len(name) > 120 {
+		return User{}, fmt.Errorf("name is required")
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return User{}, fmt.Errorf("hash password: %w", err)
+	}
+	return s.repository.CreateUser(ctx, email, string(hash), name)
+}
+
+func (s *Service) Login(ctx context.Context, email, password string) (User, error) {
+	user, err := s.repository.FindByEmail(ctx, email)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, ErrInvalidCredentials
+	}
+	if err != nil {
+		return User{}, err
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
+		return User{}, ErrInvalidCredentials
+	}
+	return user.User, nil
+}
+
+func (s *Service) SetSession(w http.ResponseWriter, user User) {
+	payload := sessionPayload{UserID: user.ID.String(), ExpiresAt: time.Now().Add(sessionDuration).Unix()}
+	token, err := s.signJSON(payload)
+	if err != nil {
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    token,
+		Path:     "/",
+		MaxAge:   int(sessionDuration.Seconds()),
+		HttpOnly: true,
+		Secure:   s.secure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (s *Service) ClearSession(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     sessionCookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   s.secure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (s *Service) UserFromRequest(ctx context.Context, r *http.Request) (User, error) {
+	cookie, err := r.Cookie(sessionCookieName)
+	if err != nil {
+		return User{}, ErrInvalidSession
+	}
+	var payload sessionPayload
+	if err := s.verifyJSON(cookie.Value, &payload); err != nil {
+		return User{}, ErrInvalidSession
+	}
+	userID, err := uuid.Parse(payload.UserID)
+	if err != nil || payload.ExpiresAt <= time.Now().Unix() {
+		return User{}, ErrInvalidSession
+	}
+	user, err := s.repository.FindByID(ctx, userID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, ErrInvalidSession
+	}
+	return user, err
+}
+
+type contextKey string
+
+const userContextKey contextKey = "authenticated-user"
+
+func (s *Service) Require(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user, err := s.UserFromRequest(r.Context(), r)
+		if err != nil {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+			return
+		}
+		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), userContextKey, user)))
+	})
+}
+
+func UserFromContext(ctx context.Context) (User, bool) {
+	user, ok := ctx.Value(userContextKey).(User)
+	return user, ok
+}
+
+func (s *Service) EnsureVisitor(w http.ResponseWriter, r *http.Request) string {
+	if cookie, err := r.Cookie(visitorCookieName); err == nil {
+		if _, err := uuid.Parse(cookie.Value); err == nil {
+			return cookie.Value
+		}
+	}
+
+	visitorID := uuid.NewString()
+	http.SetCookie(w, &http.Cookie{
+		Name:     visitorCookieName,
+		Value:    visitorID,
+		Path:     "/",
+		MaxAge:   int(365 * 24 * time.Hour / time.Second),
+		HttpOnly: true,
+		Secure:   s.secure,
+		SameSite: http.SameSiteLaxMode,
+	})
+	return visitorID
+}
+
+func (s *Service) GrantGalleryAccess(w http.ResponseWriter, slug string) {
+	payload := accessPayload{Slug: slug, ExpiresAt: time.Now().Add(accessDuration).Unix()}
+	token, err := s.signJSON(payload)
+	if err != nil {
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     accessCookieName,
+		Value:    token,
+		Path:     "/",
+		MaxAge:   int(accessDuration.Seconds()),
+		HttpOnly: true,
+		Secure:   s.secure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (s *Service) HasGalleryAccess(r *http.Request, slug string) bool {
+	cookie, err := r.Cookie(accessCookieName)
+	if err != nil {
+		return false
+	}
+	var payload accessPayload
+	if err := s.verifyJSON(cookie.Value, &payload); err != nil {
+		return false
+	}
+	return payload.Slug == slug && payload.ExpiresAt > time.Now().Unix()
+}
+
+type sessionPayload struct {
+	UserID    string `json:"userId"`
+	ExpiresAt int64  `json:"expiresAt"`
+}
+
+type accessPayload struct {
+	Slug      string `json:"slug"`
+	ExpiresAt int64  `json:"expiresAt"`
+}
+
+func (s *Service) signJSON(value any) (string, error) {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return "", err
+	}
+	encoded := base64.RawURLEncoding.EncodeToString(data)
+	return encoded + "." + s.signature(encoded), nil
+}
+
+func (s *Service) verifyJSON(token string, target any) error {
+	encoded, signature, ok := strings.Cut(token, ".")
+	if !ok || subtle.ConstantTimeCompare([]byte(signature), []byte(s.signature(encoded))) != 1 {
+		return ErrInvalidSession
+	}
+	data, err := base64.RawURLEncoding.DecodeString(encoded)
+	if err != nil {
+		return ErrInvalidSession
+	}
+	if err := json.Unmarshal(data, target); err != nil {
+		return ErrInvalidSession
+	}
+	return nil
+}
+
+func (s *Service) signature(value string) string {
+	hash := hmac.New(sha256.New, s.secret)
+	_, _ = hash.Write([]byte(value))
+	return base64.RawURLEncoding.EncodeToString(hash.Sum(nil))
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
@@ -0,0 +1,56 @@
+package auth
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	appdb "github.com/example/sndit/backend/internal/db"
+)
+
+func TestRegisterLoginAndSession(t *testing.T) {
+	ctx := context.Background()
+	database, err := appdb.New(ctx, "sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite database: %v", err)
+	}
+	defer database.Close()
+	if _, err := database.ExecContext(ctx, `
+		CREATE TABLE users (
+			id TEXT PRIMARY KEY NOT NULL,
+			email TEXT NOT NULL UNIQUE,
+			password_hash TEXT NOT NULL,
+			name TEXT NOT NULL,
+			created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+			updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+		)
+	`); err != nil {
+		t.Fatalf("create users table: %v", err)
+	}
+
+	service, err := NewService(NewRepository(database), "test-session-secret-that-is-long-enough", false)
+	if err != nil {
+		t.Fatalf("create auth service: %v", err)
+	}
+	user, err := service.Register(ctx, "Photographer@Example.com", "DemoPassword123!", "Northline Studio")
+	if err != nil {
+		t.Fatalf("register user: %v", err)
+	}
+	if user.Email != "photographer@example.com" {
+		t.Fatalf("email was not normalized: %q", user.Email)
+	}
+	loggedIn, err := service.Login(ctx, "PHOTOGRAPHER@example.com", "DemoPassword123!")
+	if err != nil || loggedIn.ID != user.ID {
+		t.Fatalf("login failed: user=%+v err=%v", loggedIn, err)
+	}
+
+	recorder := httptest.NewRecorder()
+	service.SetSession(recorder, user)
+	request := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
+	request.AddCookie(recorder.Result().Cookies()[0])
+	fromSession, err := service.UserFromRequest(ctx, request)
+	if err != nil || fromSession.ID != user.ID {
+		t.Fatalf("session lookup failed: user=%+v err=%v", fromSession, err)
+	}
+}