1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
package kauth
import (
"context"
"errors"
"fmt"
"net/http"
"strconv"
"strings"
"time"
"github.com/martinlehoux/kagamigo/kcore"
"golang.org/x/exp/slog"
)
var (
ErrUserNotLoggedIn = errors.New("user not logged in")
ErrCookieExpired = errors.New("cookie expired")
ErrBadCookie = errors.New("invalid cookie")
ErrInvalidCredentials = errors.New("invalid credentials")
)
type identifyable interface {
ID() kcore.ID
}
// A backend needs a user store to authenticate and load users
type UserStore[U identifyable] interface {
LoadUser(ctx context.Context, id kcore.ID) (U, error)
Authenticate(ctx context.Context, username string, password string) (U, bool)
}
// A backend is responsible for authenticating users and managing their sessions
type Backend[U identifyable] struct {
UserStore[U]
Domain string
CookieSecret []byte
Now func() time.Time // injectable time provider
}
// Authenticate and persist the login in the user session
func (b *Backend[U]) Login(w http.ResponseWriter, ctx context.Context, username, password string) (U, error) {
user, ok := b.Authenticate(ctx, username, password)
if !ok {
return user, ErrInvalidCredentials
}
now := time.Now
if b.Now != nil {
now = b.Now
}
expiresAt := now().Add(24 * time.Hour)
cookie := http.Cookie{
Domain: b.Domain,
Name: "authentication",
Value: encrypt(b.CookieSecret, fmt.Sprintf("%s:%d", user.ID().String(), expiresAt.Unix())),
Expires: expiresAt,
Path: "/",
}
http.SetCookie(w, &cookie)
return user, nil
}
// Clears login from the response
func (b *Backend[U]) Logout(w http.ResponseWriter) {
// Set the cookie with MaxAge -1 to delete it
http.SetCookie(w, &http.Cookie{
Name: "authentication",
Value: "",
Path: "/",
Domain: b.Domain,
Expires: time.Unix(0, 0),
MaxAge: -1,
HttpOnly: true,
Secure: true,
})
}
type userContext struct{}
func (b *Backend[U]) PersistUser(r *http.Request, user U) *http.Request {
ctx := context.WithValue(r.Context(), userContext{}, user)
return r.WithContext(ctx)
}
func (b Backend[U]) CookieAuthMiddleware() func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
cookie, err := r.Cookie("authentication")
if errors.Is(err, http.ErrNoCookie) {
next.ServeHTTP(w, r)
return
}
kcore.Expect(err, "error reading cookie")
authentication, err := decrypt(b.CookieSecret, cookie.Value)
if err != nil {
err = kcore.Wrap(err, "error decrypting cookie")
slog.Warn(err.Error())
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
parts := strings.Split(authentication, ":")
if len(parts) != 2 {
slog.Warn(ErrBadCookie.Error())
http.Error(w, ErrBadCookie.Error(), http.StatusBadRequest)
return
}
userId, err := kcore.ParseID(parts[0])
if err != nil {
err = kcore.Wrap(err, "error parsing user id")
slog.Warn(err.Error())
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
expiresAtSeconds, err := strconv.Atoi(parts[1])
if err != nil {
err = kcore.Wrap(err, "error parsing expires at")
slog.Warn(err.Error())
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
now := time.Now
if b.Now != nil {
now = b.Now
}
expiresAt := time.Unix(int64(expiresAtSeconds), 0)
if now().After(expiresAt) {
slog.Warn(ErrCookieExpired.Error())
http.Error(w, ErrCookieExpired.Error(), http.StatusUnauthorized)
return
}
user, err := b.LoadUser(ctx, userId)
if err != nil {
err = kcore.Wrap(err, "error loading user")
slog.Warn(err.Error())
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
r = b.PersistUser(r, user)
ctx = context.WithValue(ctx, userContext{}, user)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
}
func (b *Backend[U]) User(ctx context.Context) (U, bool) {
user, ok := ctx.Value(userContext{}).(U)
return user, ok
}
|
