ai slop ah

2026-08-22 17:27:55 +02:00
parent 6a5bb1d699
commit dc124d0d77
64 changed files with 7308 additions and 2448 deletions
@@ -5,6 +5,8 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+
+	"github.com/gin-gonic/gin"
 )

 type Handler struct {
@@ -15,11 +17,16 @@ func NewHandler(service *Service) *Handler {
 	return &Handler{service: service}
 }

-func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
-	mux.HandleFunc("POST /api/auth/register", h.Register)
-	mux.HandleFunc("POST /api/auth/login", h.Login)
-	mux.HandleFunc("POST /api/auth/logout", h.Logout)
-	mux.HandleFunc("GET /api/auth/me", h.Me)
+func (h *Handler) RegisterRoutes(router gin.IRouter) {
+	router.POST("/api/auth/register", h.Register)
+	router.POST("/api/auth/login", h.Login)
+	router.POST("/api/auth/logout", h.Logout)
+	router.GET("/api/auth/me", h.Me)
+}
+
+func (h *Handler) RegisterProtectedRoutes(router gin.IRouter, require gin.HandlerFunc) {
+	router.PATCH("/api/auth/me", require, h.UpdateMe)
+	router.POST("/api/auth/password", require, h.ChangePassword)
 }

 type credentialsRequest struct {
@@ -28,66 +35,188 @@ type credentialsRequest struct {
 	Name     string `json:"name"`
 }

-func (h *Handler) Register(w http.ResponseWriter, r *http.Request) {
+type profileRequest struct {
+	Email string `json:"email"`
+	Name  string `json:"name"`
+}
+
+type passwordRequest struct {
+	CurrentPassword string `json:"currentPassword"`
+	NewPassword     string `json:"newPassword"`
+}
+
+// Register godoc
+// @Summary Register a photographer account
+// @Tags authentication
+// @Accept json
+// @Produce json
+// @Param request body credentialsRequest true "Account details"
+// @Success 201 {object} map[string]interface{}
+// @Failure 400 {object} map[string]string
+// @Failure 409 {object} map[string]string
+// @Router /api/auth/register [post]
+func (h *Handler) Register(c *gin.Context) {
 	var request credentialsRequest
-	if !decodeJSON(w, r, &request) {
+	if !decodeJSON(c, &request) {
 		return
 	}
-	user, err := h.service.Register(r.Context(), request.Email, request.Password, request.Name)
+	user, err := h.service.Register(c.Request.Context(), request.Email, request.Password, request.Name)
 	if err != nil {
 		if errors.Is(err, ErrEmailTaken) {
-			writeJSON(w, http.StatusConflict, map[string]string{"error": "email is already registered"})
+			writeJSON(c, http.StatusConflict, map[string]string{"error": "email is already registered"})
 			return
 		}
-		writeJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		writeJSON(c, http.StatusBadRequest, map[string]string{"error": err.Error()})
 		return
 	}
-	h.service.SetSession(w, user)
-	writeJSON(w, http.StatusCreated, map[string]User{"user": user})
+	h.service.SetSession(c, user)
+	writeJSON(c, http.StatusCreated, map[string]User{"user": user})
 }

-func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
+// Login godoc
+// @Summary Sign in a photographer
+// @Tags authentication
+// @Accept json
+// @Produce json
+// @Param request body credentialsRequest true "Account credentials"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Router /api/auth/login [post]
+func (h *Handler) Login(c *gin.Context) {
 	var request credentialsRequest
-	if !decodeJSON(w, r, &request) {
+	if !decodeJSON(c, &request) {
 		return
 	}
-	user, err := h.service.Login(r.Context(), request.Email, request.Password)
+	user, err := h.service.Login(c.Request.Context(), request.Email, request.Password)
 	if err != nil {
 		if errors.Is(err, ErrInvalidCredentials) {
-			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid email or password"})
+			writeJSON(c, http.StatusUnauthorized, map[string]string{"error": "invalid email or password"})
 			return
 		}
-		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "could not sign in"})
+		writeJSON(c, http.StatusInternalServerError, map[string]string{"error": "could not sign in"})
 		return
 	}
-	h.service.SetSession(w, user)
-	writeJSON(w, http.StatusOK, map[string]User{"user": user})
+	h.service.SetSession(c, user)
+	writeJSON(c, http.StatusOK, map[string]User{"user": user})
 }

-func (h *Handler) Logout(w http.ResponseWriter, _ *http.Request) {
-	h.service.ClearSession(w)
-	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+// Logout godoc
+// @Summary Sign out the current photographer
+// @Tags authentication
+// @Produce json
+// @Success 200 {object} map[string]string
+// @Router /api/auth/logout [post]
+func (h *Handler) Logout(c *gin.Context) {
+	h.service.ClearSession(c)
+	writeJSON(c, http.StatusOK, map[string]string{"status": "ok"})
 }

-func (h *Handler) Me(w http.ResponseWriter, r *http.Request) {
-	user, err := h.service.UserFromRequest(r.Context(), r)
+// Me godoc
+// @Summary Get the current photographer
+// @Tags authentication
+// @Produce json
+// @Security studioSession
+// @Success 200 {object} map[string]interface{}
+// @Failure 401 {object} map[string]string
+// @Router /api/auth/me [get]
+func (h *Handler) Me(c *gin.Context) {
+	user, err := h.service.UserFromRequest(c.Request.Context(), c.Request)
 	if err != nil {
-		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+		writeJSON(c, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]User{"user": user})
+	writeJSON(c, http.StatusOK, map[string]User{"user": user})
 }

-func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
-	if !strings.HasPrefix(r.Header.Get("Content-Type"), "application/json") {
-		writeJSON(w, http.StatusUnsupportedMediaType, map[string]string{"error": "content type must be application/json"})
+// UpdateMe godoc
+// @Summary Update the current photographer profile
+// @Tags authentication
+// @Accept json
+// @Produce json
+// @Security studioSession
+// @Param request body profileRequest true "Profile details"
+// @Success 200 {object} map[string]interface{}
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Failure 409 {object} map[string]string
+// @Router /api/auth/me [patch]
+func (h *Handler) UpdateMe(c *gin.Context) {
+	user, ok := UserFromContext(c)
+	if !ok {
+		writeJSON(c, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+		return
+	}
+	var request profileRequest
+	if !decodeJSON(c, &request) {
+		return
+	}
+	updated, err := h.service.UpdateProfile(c.Request.Context(), user.ID, request.Email, request.Name)
+	if err != nil {
+		if errors.Is(err, ErrEmailTaken) {
+			writeJSON(c, http.StatusConflict, map[string]string{"error": "email is already registered"})
+			return
+		}
+		if strings.HasPrefix(err.Error(), "enter ") || strings.HasPrefix(err.Error(), "name ") {
+			writeJSON(c, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			return
+		}
+		writeJSON(c, http.StatusInternalServerError, map[string]string{"error": "could not update profile"})
+		return
+	}
+	writeJSON(c, http.StatusOK, map[string]User{"user": updated})
+}
+
+// ChangePassword godoc
+// @Summary Change the current photographer password
+// @Tags authentication
+// @Accept json
+// @Produce json
+// @Security studioSession
+// @Param request body passwordRequest true "Password details"
+// @Success 200 {object} map[string]string
+// @Failure 400 {object} map[string]string
+// @Failure 401 {object} map[string]string
+// @Router /api/auth/password [post]
+func (h *Handler) ChangePassword(c *gin.Context) {
+	user, ok := UserFromContext(c)
+	if !ok {
+		writeJSON(c, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+		return
+	}
+	var request passwordRequest
+	if !decodeJSON(c, &request) {
+		return
+	}
+	if err := h.service.ChangePassword(c.Request.Context(), user.ID, request.CurrentPassword, request.NewPassword); err != nil {
+		if errors.Is(err, ErrCurrentPassword) {
+			writeJSON(c, http.StatusBadRequest, map[string]string{"error": "current password is incorrect"})
+			return
+		}
+		if strings.HasPrefix(err.Error(), "new password") {
+			writeJSON(c, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			return
+		}
+		writeJSON(c, http.StatusInternalServerError, map[string]string{"error": "could not update password"})
+		return
+	}
+	writeJSON(c, http.StatusOK, map[string]string{"status": "ok"})
+}
+
+func decodeJSON(c *gin.Context, target any) bool {
+	if !strings.HasPrefix(c.GetHeader("Content-Type"), "application/json") {
+		writeJSON(c, http.StatusUnsupportedMediaType, map[string]string{"error": "content type must be application/json"})
 		return false
 	}
-	decoder := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
+	decoder := json.NewDecoder(http.MaxBytesReader(c.Writer, c.Request.Body, 1<<20))
 	decoder.DisallowUnknownFields()
 	if err := decoder.Decode(target); err != nil {
-		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"})
+		writeJSON(c, http.StatusBadRequest, map[string]string{"error": "invalid JSON body"})
 		return false
 	}
 	return true
 }
+
+func writeJSON(c *gin.Context, status int, value any) {
+	c.JSON(status, value)
+}
@@ -66,3 +66,50 @@ func (r *Repository) FindByID(ctx context.Context, id uuid.UUID) (User, error) {
 	}
 	return user, nil
 }
+
+func (r *Repository) FindByIDWithPassword(ctx context.Context, id uuid.UUID) (storedUser, error) {
+	var user storedUser
+	err := r.db.QueryRowContext(ctx, `
+		SELECT id, email, name, password_hash
+		FROM users
+		WHERE id = $1
+	`, id).Scan(&user.ID, &user.Email, &user.Name, &user.PasswordHash)
+	if errors.Is(err, sql.ErrNoRows) {
+		return storedUser{}, sql.ErrNoRows
+	}
+	if err != nil {
+		return storedUser{}, fmt.Errorf("find user credentials: %w", err)
+	}
+	return user, nil
+}
+
+func (r *Repository) UpdateUser(ctx context.Context, id uuid.UUID, email, name string) (User, error) {
+	_, err := r.db.ExecContext(ctx, `
+		UPDATE users
+		SET email = $1, name = $2, updated_at = CURRENT_TIMESTAMP
+		WHERE id = $3
+	`, strings.ToLower(strings.TrimSpace(email)), strings.TrimSpace(name), id)
+	if err != nil {
+		if strings.Contains(strings.ToLower(err.Error()), "unique") {
+			return User{}, ErrEmailTaken
+		}
+		return User{}, fmt.Errorf("update user: %w", err)
+	}
+	return r.FindByID(ctx, id)
+}
+
+func (r *Repository) UpdatePassword(ctx context.Context, id uuid.UUID, passwordHash string) error {
+	result, err := r.db.ExecContext(ctx, `
+		UPDATE users
+		SET password_hash = $1, updated_at = CURRENT_TIMESTAMP
+		WHERE id = $2
+	`, passwordHash, id)
+	if err != nil {
+		return fmt.Errorf("update password: %w", err)
+	}
+	count, err := result.RowsAffected()
+	if err != nil || count == 0 {
+		return sql.ErrNoRows
+	}
+	return nil
+}
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"time"

+	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"golang.org/x/crypto/bcrypt"
 )
@@ -29,6 +30,7 @@ const (
 var (
 	ErrInvalidCredentials = errors.New("invalid credentials")
 	ErrInvalidSession     = errors.New("invalid session")
+	ErrCurrentPassword    = errors.New("current password is incorrect")
 )

 type Service struct {
@@ -78,33 +80,47 @@ func (s *Service) Login(ctx context.Context, email, password string) (User, erro
 	return user.User, nil
 }

-func (s *Service) SetSession(w http.ResponseWriter, user User) {
+func (s *Service) UpdateProfile(ctx context.Context, userID uuid.UUID, email, name string) (User, error) {
+	email = strings.ToLower(strings.TrimSpace(email))
+	name = strings.TrimSpace(name)
+	if !strings.Contains(email, "@") || len(email) > 254 {
+		return User{}, fmt.Errorf("enter a valid email address")
+	}
+	if name == "" || len(name) > 120 {
+		return User{}, fmt.Errorf("name is required")
+	}
+	return s.repository.UpdateUser(ctx, userID, email, name)
+}
+
+func (s *Service) ChangePassword(ctx context.Context, userID uuid.UUID, currentPassword, newPassword string) error {
+	if len(newPassword) < 8 {
+		return fmt.Errorf("new password must be at least 8 characters")
+	}
+	user, err := s.repository.FindByIDWithPassword(ctx, userID)
+	if err != nil {
+		return err
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)); err != nil {
+		return ErrCurrentPassword
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(newPassword), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("hash new password: %w", err)
+	}
+	return s.repository.UpdatePassword(ctx, userID, string(hash))
+}
+
+func (s *Service) SetSession(c *gin.Context, user User) {
 	payload := sessionPayload{UserID: user.ID.String(), ExpiresAt: time.Now().Add(sessionDuration).Unix()}
 	token, err := s.signJSON(payload)
 	if err != nil {
 		return
 	}
-	http.SetCookie(w, &http.Cookie{
-		Name:     sessionCookieName,
-		Value:    token,
-		Path:     "/",
-		MaxAge:   int(sessionDuration.Seconds()),
-		HttpOnly: true,
-		Secure:   s.secure,
-		SameSite: http.SameSiteLaxMode,
-	})
+	s.setCookie(c, sessionCookieName, token, int(sessionDuration.Seconds()), true)
 }

-func (s *Service) ClearSession(w http.ResponseWriter) {
-	http.SetCookie(w, &http.Cookie{
-		Name:     sessionCookieName,
-		Value:    "",
-		Path:     "/",
-		MaxAge:   -1,
-		HttpOnly: true,
-		Secure:   s.secure,
-		SameSite: http.SameSiteLaxMode,
-	})
+func (s *Service) ClearSession(c *gin.Context) {
+	s.setCookie(c, sessionCookieName, "", -1, true)
 }

 func (s *Service) UserFromRequest(ctx context.Context, r *http.Request) (User, error) {
@@ -131,61 +147,47 @@ type contextKey string

 const userContextKey contextKey = "authenticated-user"

-func (s *Service) Require(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		user, err := s.UserFromRequest(r.Context(), r)
+func (s *Service) Require() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		user, err := s.UserFromRequest(c.Request.Context(), c.Request)
 		if err != nil {
-			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
+			c.AbortWithStatusJSON(http.StatusUnauthorized, map[string]string{"error": "authentication required"})
 			return
 		}
-		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), userContextKey, user)))
-	})
+		c.Set(userContextKey, user)
+		c.Next()
+	}
 }

-func UserFromContext(ctx context.Context) (User, bool) {
-	user, ok := ctx.Value(userContextKey).(User)
-	return user, ok
+func UserFromContext(c *gin.Context) (User, bool) {
+	value, ok := c.Get(userContextKey)
+	user, valid := value.(User)
+	return user, ok && valid
 }

-func (s *Service) EnsureVisitor(w http.ResponseWriter, r *http.Request) string {
-	if cookie, err := r.Cookie(visitorCookieName); err == nil {
+func (s *Service) EnsureVisitor(c *gin.Context) string {
+	if cookie, err := c.Request.Cookie(visitorCookieName); err == nil {
 		if _, err := uuid.Parse(cookie.Value); err == nil {
 			return cookie.Value
 		}
 	}

 	visitorID := uuid.NewString()
-	http.SetCookie(w, &http.Cookie{
-		Name:     visitorCookieName,
-		Value:    visitorID,
-		Path:     "/",
-		MaxAge:   int(365 * 24 * time.Hour / time.Second),
-		HttpOnly: true,
-		Secure:   s.secure,
-		SameSite: http.SameSiteLaxMode,
-	})
+	s.setCookie(c, visitorCookieName, visitorID, int(365*24*time.Hour/time.Second), true)
 	return visitorID
 }

-func (s *Service) GrantGalleryAccess(w http.ResponseWriter, slug string) {
+func (s *Service) GrantGalleryAccess(c *gin.Context, slug string) {
 	payload := accessPayload{Slug: slug, ExpiresAt: time.Now().Add(accessDuration).Unix()}
 	token, err := s.signJSON(payload)
 	if err != nil {
 		return
 	}
-	http.SetCookie(w, &http.Cookie{
-		Name:     accessCookieName,
-		Value:    token,
-		Path:     "/",
-		MaxAge:   int(accessDuration.Seconds()),
-		HttpOnly: true,
-		Secure:   s.secure,
-		SameSite: http.SameSiteLaxMode,
-	})
+	s.setCookie(c, accessCookieName, token, int(accessDuration.Seconds()), true)
 }

-func (s *Service) HasGalleryAccess(r *http.Request, slug string) bool {
-	cookie, err := r.Cookie(accessCookieName)
+func (s *Service) HasGalleryAccess(c *gin.Context, slug string) bool {
+	cookie, err := c.Request.Cookie(accessCookieName)
 	if err != nil {
 		return false
 	}
@@ -196,6 +198,11 @@ func (s *Service) HasGalleryAccess(r *http.Request, slug string) bool {
 	return payload.Slug == slug && payload.ExpiresAt > time.Now().Unix()
 }

+func (s *Service) setCookie(c *gin.Context, name, value string, maxAge int, httpOnly bool) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(name, value, maxAge, "/", "", s.secure, httpOnly)
+}
+
 type sessionPayload struct {
 	UserID    string `json:"userId"`
 	ExpiresAt int64  `json:"expiresAt"`
@@ -235,9 +242,3 @@ func (s *Service) signature(value string) string {
 	_, _ = hash.Write([]byte(value))
 	return base64.RawURLEncoding.EncodeToString(hash.Sum(nil))
 }
-
-func writeJSON(w http.ResponseWriter, status int, value any) {
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(value)
-}
@@ -2,11 +2,13 @@ package auth

 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"

 	appdb "github.com/example/sndit/backend/internal/db"
+	"github.com/gin-gonic/gin"
 )

 func TestRegisterLoginAndSession(t *testing.T) {
@@ -33,7 +35,7 @@ func TestRegisterLoginAndSession(t *testing.T) {
 	if err != nil {
 		t.Fatalf("create auth service: %v", err)
 	}
-	user, err := service.Register(ctx, "Photographer@Example.com", "DemoPassword123!", "Northline Studio")
+	user, err := service.Register(ctx, "Photographer@Example.com", "DemoPassword123!", "Noah Bianchi")
 	if err != nil {
 		t.Fatalf("register user: %v", err)
 	}
@@ -44,9 +46,24 @@ func TestRegisterLoginAndSession(t *testing.T) {
 	if err != nil || loggedIn.ID != user.ID {
 		t.Fatalf("login failed: user=%+v err=%v", loggedIn, err)
 	}
+	updated, err := service.UpdateProfile(ctx, user.ID, "updated@example.com", "Updated Studio")
+	if err != nil || updated.Email != "updated@example.com" || updated.Name != "Updated Studio" {
+		t.Fatalf("profile update failed: user=%+v err=%v", updated, err)
+	}
+	if err := service.ChangePassword(ctx, user.ID, "DemoPassword123!", "NewPassword123!"); err != nil {
+		t.Fatalf("password update failed: %v", err)
+	}
+	if _, err := service.Login(ctx, "updated@example.com", "DemoPassword123!"); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("old password should be invalid, got %v", err)
+	}
+	if _, err := service.Login(ctx, "updated@example.com", "NewPassword123!"); err != nil {
+		t.Fatalf("new password should work: %v", err)
+	}

 	recorder := httptest.NewRecorder()
-	service.SetSession(recorder, user)
+	ginContext, _ := gin.CreateTestContext(recorder)
+	ginContext.Request = httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
+	service.SetSession(ginContext, user)
 	request := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
 	request.AddCookie(recorder.Result().Cookies()[0])
 	fromSession, err := service.UserFromRequest(ctx, request)