131 lines
3.9 KiB
Go
131 lines
3.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/google/uuid"
|
|
|
|
"backend/internal/modules/users"
|
|
"backend/internal/platform/middleware"
|
|
"backend/internal/platform/security"
|
|
)
|
|
|
|
const (
|
|
adminRefreshCookieName = "admin_refresh_token"
|
|
adminRefreshCookiePath = "/api/auth/admin"
|
|
)
|
|
|
|
// AdminHandler exposes the admin-space auth endpoints. It is kept entirely
|
|
// separate from CustomerHandler: different cookie name, different cookie
|
|
// path, different JWT audience, so an admin session can never be replayed
|
|
// against a future customer-facing endpoint.
|
|
type AdminHandler struct {
|
|
service *Service
|
|
cookieSecure bool
|
|
}
|
|
|
|
func NewAdminHandler(service *Service, cookieSecure bool) *AdminHandler {
|
|
return &AdminHandler{service: service, cookieSecure: cookieSecure}
|
|
}
|
|
|
|
type loginRequest struct {
|
|
Username string `json:"username" binding:"required"`
|
|
Password string `json:"password" binding:"required"`
|
|
}
|
|
|
|
type authUserResponse struct {
|
|
ID uuid.UUID `json:"id"`
|
|
Username string `json:"username"`
|
|
Role string `json:"role"`
|
|
}
|
|
|
|
type accessTokenResponse struct {
|
|
AccessToken string `json:"access_token"`
|
|
User *authUserResponse `json:"user,omitempty"`
|
|
}
|
|
|
|
func (h *AdminHandler) Login(c *gin.Context) {
|
|
var req loginRequest
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "validation error", "details": err.Error()})
|
|
return
|
|
}
|
|
|
|
pair, user, err := h.service.Login(c.Request.Context(), security.AudienceAdmin, users.RoleAdmin, req.Username, req.Password)
|
|
if err != nil {
|
|
h.respondLoginError(c, err)
|
|
return
|
|
}
|
|
|
|
h.setRefreshCookie(c, pair.RefreshToken)
|
|
c.JSON(http.StatusOK, accessTokenResponse{
|
|
AccessToken: pair.AccessToken,
|
|
User: &authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role},
|
|
})
|
|
}
|
|
|
|
func (h *AdminHandler) Refresh(c *gin.Context) {
|
|
token, err := c.Cookie(adminRefreshCookieName)
|
|
if err != nil || token == "" {
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "missing refresh token"})
|
|
return
|
|
}
|
|
|
|
pair, err := h.service.Refresh(c.Request.Context(), security.AudienceAdmin, token)
|
|
if err != nil {
|
|
h.clearRefreshCookie(c)
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid or expired refresh token"})
|
|
return
|
|
}
|
|
|
|
h.setRefreshCookie(c, pair.RefreshToken)
|
|
c.JSON(http.StatusOK, accessTokenResponse{AccessToken: pair.AccessToken})
|
|
}
|
|
|
|
func (h *AdminHandler) Logout(c *gin.Context) {
|
|
if token, err := c.Cookie(adminRefreshCookieName); err == nil && token != "" {
|
|
_ = h.service.Logout(c.Request.Context(), security.AudienceAdmin, token)
|
|
}
|
|
h.clearRefreshCookie(c)
|
|
c.JSON(http.StatusOK, gin.H{"message": "logged out"})
|
|
}
|
|
|
|
func (h *AdminHandler) Me(c *gin.Context) {
|
|
userID, ok := middleware.GetUserID(c)
|
|
if !ok {
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
|
|
return
|
|
}
|
|
user, err := h.service.Me(c.Request.Context(), userID)
|
|
if err != nil {
|
|
if errors.Is(err, users.ErrNotFound) {
|
|
c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
|
|
return
|
|
}
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to load user"})
|
|
return
|
|
}
|
|
c.JSON(http.StatusOK, authUserResponse{ID: user.ID, Username: user.Username, Role: user.Role})
|
|
}
|
|
|
|
func (h *AdminHandler) respondLoginError(c *gin.Context, err error) {
|
|
switch {
|
|
case errors.Is(err, ErrInvalidCredentials), errors.Is(err, ErrAccountDisabled):
|
|
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
|
|
default:
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "login failed"})
|
|
}
|
|
}
|
|
|
|
func (h *AdminHandler) setRefreshCookie(c *gin.Context, token string) {
|
|
c.SetSameSite(http.SameSiteStrictMode)
|
|
c.SetCookie(adminRefreshCookieName, token, int(h.service.RefreshTTL().Seconds()), adminRefreshCookiePath, "", h.cookieSecure, true)
|
|
}
|
|
|
|
func (h *AdminHandler) clearRefreshCookie(c *gin.Context) {
|
|
c.SetSameSite(http.SameSiteStrictMode)
|
|
c.SetCookie(adminRefreshCookieName, "", -1, adminRefreshCookiePath, "", h.cookieSecure, true)
|
|
}
|