wijtransferen/backend/internal/auth/service.go

package auth

import (
	"context"
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"database/sql"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/google/uuid"
	"golang.org/x/crypto/bcrypt"
)

const (
	sessionCookieName = "studio_session"
	visitorCookieName = "studio_visitor"
	accessCookieName  = "studio_gallery_access"
	sessionDuration   = 7 * 24 * time.Hour
	accessDuration    = 12 * time.Hour
)

var (
	ErrInvalidCredentials = errors.New("invalid credentials")
	ErrInvalidSession     = errors.New("invalid session")
)

type Service struct {
	repository *Repository
	secret     []byte
	secure     bool
}

func NewService(repository *Repository, secret string, secureCookie bool) (*Service, error) {
	if len(secret) < 32 {
		return nil, fmt.Errorf("session secret must be at least 32 characters")
	}
	return &Service{repository: repository, secret: []byte(secret), secure: secureCookie}, nil
}

func (s *Service) Register(ctx context.Context, email, password, name string) (User, error) {
	email = strings.ToLower(strings.TrimSpace(email))
	name = strings.TrimSpace(name)
	if !strings.Contains(email, "@") || len(email) > 254 {
		return User{}, fmt.Errorf("enter a valid email address")
	}
	if len(password) < 8 {
		return User{}, fmt.Errorf("password must be at least 8 characters")
	}
	if name == "" || len(name) > 120 {
		return User{}, fmt.Errorf("name is required")
	}

	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return User{}, fmt.Errorf("hash password: %w", err)
	}
	return s.repository.CreateUser(ctx, email, string(hash), name)
}

func (s *Service) Login(ctx context.Context, email, password string) (User, error) {
	user, err := s.repository.FindByEmail(ctx, email)
	if errors.Is(err, sql.ErrNoRows) {
		return User{}, ErrInvalidCredentials
	}
	if err != nil {
		return User{}, err
	}
	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
		return User{}, ErrInvalidCredentials
	}
	return user.User, nil
}

func (s *Service) SetSession(w http.ResponseWriter, user User) {
	payload := sessionPayload{UserID: user.ID.String(), ExpiresAt: time.Now().Add(sessionDuration).Unix()}
	token, err := s.signJSON(payload)
	if err != nil {
		return
	}
	http.SetCookie(w, &http.Cookie{
		Name:     sessionCookieName,
		Value:    token,
		Path:     "/",
		MaxAge:   int(sessionDuration.Seconds()),
		HttpOnly: true,
		Secure:   s.secure,
		SameSite: http.SameSiteLaxMode,
	})
}

func (s *Service) ClearSession(w http.ResponseWriter) {
	http.SetCookie(w, &http.Cookie{
		Name:     sessionCookieName,
		Value:    "",
		Path:     "/",
		MaxAge:   -1,
		HttpOnly: true,
		Secure:   s.secure,
		SameSite: http.SameSiteLaxMode,
	})
}

func (s *Service) UserFromRequest(ctx context.Context, r *http.Request) (User, error) {
	cookie, err := r.Cookie(sessionCookieName)
	if err != nil {
		return User{}, ErrInvalidSession
	}
	var payload sessionPayload
	if err := s.verifyJSON(cookie.Value, &payload); err != nil {
		return User{}, ErrInvalidSession
	}
	userID, err := uuid.Parse(payload.UserID)
	if err != nil || payload.ExpiresAt <= time.Now().Unix() {
		return User{}, ErrInvalidSession
	}
	user, err := s.repository.FindByID(ctx, userID)
	if errors.Is(err, sql.ErrNoRows) {
		return User{}, ErrInvalidSession
	}
	return user, err
}

type contextKey string

const userContextKey contextKey = "authenticated-user"

func (s *Service) Require(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		user, err := s.UserFromRequest(r.Context(), r)
		if err != nil {
			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "authentication required"})
			return
		}
		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), userContextKey, user)))
	})
}

func UserFromContext(ctx context.Context) (User, bool) {
	user, ok := ctx.Value(userContextKey).(User)
	return user, ok
}

func (s *Service) EnsureVisitor(w http.ResponseWriter, r *http.Request) string {
	if cookie, err := r.Cookie(visitorCookieName); err == nil {
		if _, err := uuid.Parse(cookie.Value); err == nil {
			return cookie.Value
		}
	}

	visitorID := uuid.NewString()
	http.SetCookie(w, &http.Cookie{
		Name:     visitorCookieName,
		Value:    visitorID,
		Path:     "/",
		MaxAge:   int(365 * 24 * time.Hour / time.Second),
		HttpOnly: true,
		Secure:   s.secure,
		SameSite: http.SameSiteLaxMode,
	})
	return visitorID
}

func (s *Service) GrantGalleryAccess(w http.ResponseWriter, slug string) {
	payload := accessPayload{Slug: slug, ExpiresAt: time.Now().Add(accessDuration).Unix()}
	token, err := s.signJSON(payload)
	if err != nil {
		return
	}
	http.SetCookie(w, &http.Cookie{
		Name:     accessCookieName,
		Value:    token,
		Path:     "/",
		MaxAge:   int(accessDuration.Seconds()),
		HttpOnly: true,
		Secure:   s.secure,
		SameSite: http.SameSiteLaxMode,
	})
}

func (s *Service) HasGalleryAccess(r *http.Request, slug string) bool {
	cookie, err := r.Cookie(accessCookieName)
	if err != nil {
		return false
	}
	var payload accessPayload
	if err := s.verifyJSON(cookie.Value, &payload); err != nil {
		return false
	}
	return payload.Slug == slug && payload.ExpiresAt > time.Now().Unix()
}

type sessionPayload struct {
	UserID    string `json:"userId"`
	ExpiresAt int64  `json:"expiresAt"`
}

type accessPayload struct {
	Slug      string `json:"slug"`
	ExpiresAt int64  `json:"expiresAt"`
}

func (s *Service) signJSON(value any) (string, error) {
	data, err := json.Marshal(value)
	if err != nil {
		return "", err
	}
	encoded := base64.RawURLEncoding.EncodeToString(data)
	return encoded + "." + s.signature(encoded), nil
}

func (s *Service) verifyJSON(token string, target any) error {
	encoded, signature, ok := strings.Cut(token, ".")
	if !ok || subtle.ConstantTimeCompare([]byte(signature), []byte(s.signature(encoded))) != 1 {
		return ErrInvalidSession
	}
	data, err := base64.RawURLEncoding.DecodeString(encoded)
	if err != nil {
		return ErrInvalidSession
	}
	if err := json.Unmarshal(data, target); err != nil {
		return ErrInvalidSession
	}
	return nil
}

func (s *Service) signature(value string) string {
	hash := hmac.New(sha256.New, s.secret)
	_, _ = hash.Write([]byte(value))
	return base64.RawURLEncoding.EncodeToString(hash.Sum(nil))
}

func writeJSON(w http.ResponseWriter, status int, value any) {
	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(value)
}