#73 change authorization
This commit is contained in:
273
service/auth.go
Normal file
273
service/auth.go
Normal file
@@ -0,0 +1,273 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/rand"
|
||||
"database/sql"
|
||||
"encoding/base64"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/mail"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"me-fit/template"
|
||||
"me-fit/template/auth"
|
||||
|
||||
"github.com/a-h/templ"
|
||||
"github.com/google/uuid"
|
||||
"golang.org/x/crypto/argon2"
|
||||
)
|
||||
|
||||
type User struct {
|
||||
user_uuid uuid.UUID
|
||||
email string
|
||||
}
|
||||
|
||||
func HandleSignInPage(db *sql.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
user_comp := UserInfoComp(verifySessionAndReturnUser(db, r))
|
||||
signIn := auth.SignInOrUp(true)
|
||||
template.Layout(signIn, user_comp).Render(r.Context(), w)
|
||||
}
|
||||
}
|
||||
|
||||
func HandleSignUpPage(db *sql.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
user_comp := UserInfoComp(verifySessionAndReturnUser(db, r))
|
||||
signIn := auth.SignInOrUp(false)
|
||||
template.Layout(signIn, user_comp).Render(r.Context(), w)
|
||||
}
|
||||
}
|
||||
|
||||
func UserInfoComp(user *User) templ.Component {
|
||||
|
||||
if user != nil {
|
||||
return auth.UserComp(user.email)
|
||||
} else {
|
||||
return auth.UserComp("")
|
||||
}
|
||||
}
|
||||
|
||||
func HandleSignUp(db *sql.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
var email = r.FormValue("email")
|
||||
var password = r.FormValue("password")
|
||||
|
||||
_, err := mail.ParseAddress(email)
|
||||
if err != nil {
|
||||
http.Error(w, "Invalid email", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
if len(password) < 8 ||
|
||||
!strings.ContainsAny(password, "0123456789") ||
|
||||
!strings.ContainsAny(password, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") ||
|
||||
!strings.ContainsAny(password, "abcdefghijklmnopqrstuvwxyz") ||
|
||||
!strings.ContainsAny(password, "!@#$%^&*()_+-=[]{}\\|;:'\",.<>/?") {
|
||||
http.Error(w, "Password needs to be 8 characters long, contain at least one number, one special, one uppercase and one lowercase character", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
user_uuid, err := uuid.NewRandom()
|
||||
if err != nil {
|
||||
log.Printf("Could not generate UUID: %v", err)
|
||||
auth.Error("Internal Server Error").Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
salt := make([]byte, 16)
|
||||
rand.Read(salt)
|
||||
|
||||
hash := getHashPassword(password, salt)
|
||||
|
||||
_, err = db.Exec("INSERT INTO user (user_uuid, email, email_verified, is_admin, password, salt, created_at) VALUES (?, ?, FALSE, FALSE, ?, ?, datetime())", user_uuid, email, hash, salt)
|
||||
if err != nil {
|
||||
if strings.Contains(err.Error(), "email") {
|
||||
auth.Error("Bad Request").Render(r.Context(), w)
|
||||
return
|
||||
}
|
||||
|
||||
auth.Error("Internal Server Error").Render(r.Context(), w)
|
||||
log.Printf("Could not insert user: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
result := tryCreateSessionAndSetCookie(w, db, user_uuid)
|
||||
if !result {
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Add("HX-Redirect", "/")
|
||||
w.WriteHeader(http.StatusOK)
|
||||
}
|
||||
}
|
||||
|
||||
func HandleSignIn(db *sql.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
var email = r.FormValue("email")
|
||||
var password = r.FormValue("password")
|
||||
|
||||
var result bool = true
|
||||
start := time.Now()
|
||||
|
||||
var user_uuid uuid.UUID
|
||||
var saved_hash []byte
|
||||
var salt []byte
|
||||
err := db.QueryRow("SELECT user_uuid, password, salt FROM user WHERE email = ?", email).Scan(&user_uuid, &saved_hash, &salt)
|
||||
if err != nil {
|
||||
result = false
|
||||
}
|
||||
|
||||
if result {
|
||||
new_hash := getHashPassword(password, salt)
|
||||
|
||||
if !bytes.Equal(new_hash, saved_hash) {
|
||||
result = false
|
||||
}
|
||||
}
|
||||
|
||||
if result {
|
||||
result := tryCreateSessionAndSetCookie(w, db, user_uuid)
|
||||
if !result {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
duration := time.Since(start)
|
||||
time_to_wait := 100 - duration.Milliseconds()
|
||||
// It is important to sleep for a while to prevent timing attacks
|
||||
// If the email is correct, the server will calculate the hash, which will take some time
|
||||
// This way an attacker could guess emails when comparing the response time
|
||||
// Because of that, we cant use WriteHeader in the middle of the function. We have to wait until the end
|
||||
time.Sleep(time.Duration(time_to_wait) * time.Millisecond)
|
||||
|
||||
if result {
|
||||
w.Header().Add("HX-Redirect", "/")
|
||||
w.WriteHeader(http.StatusOK)
|
||||
} else {
|
||||
auth.Error("Invalid email or password").Render(r.Context(), w)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func HandleSignOutComp(db *sql.DB) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
id := getSessionID(r)
|
||||
|
||||
_, err := db.Exec("DELETE FROM session WHERE session_id = ?", id)
|
||||
if err != nil {
|
||||
log.Printf("Could not delete session: %v", err)
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
c := http.Cookie{
|
||||
Name: "id",
|
||||
Value: "",
|
||||
MaxAge: -1,
|
||||
Secure: true,
|
||||
HttpOnly: true,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
Path: "/",
|
||||
}
|
||||
|
||||
http.SetCookie(w, &c)
|
||||
auth.UserComp("").Render(r.Context(), w)
|
||||
}
|
||||
}
|
||||
|
||||
// var (
|
||||
// metricsAuthSignUp = promauto.NewCounterVec(
|
||||
// prometheus.CounterOpts{
|
||||
// Name: "mefit_api_auth_signup_total",
|
||||
// Help: "The total number of auth signup api requests processed",
|
||||
// },
|
||||
// []string{"result"},
|
||||
// )
|
||||
//
|
||||
// metricsError = promauto.NewCounterVec(
|
||||
// prometheus.CounterOpts{
|
||||
// Name: "mefit_api_error_total",
|
||||
// Help: "The total number of errors",
|
||||
// },
|
||||
// []string{"result"},
|
||||
// )
|
||||
//
|
||||
// // metricsAuthSignIn = promauto.NewCounterVec(
|
||||
// // prometheus.CounterOpts{
|
||||
// // Name: "mefit_api_auth_signin_total",
|
||||
// // },
|
||||
// // []string{"result"},
|
||||
// // )
|
||||
// )
|
||||
|
||||
func tryCreateSessionAndSetCookie(w http.ResponseWriter, db *sql.DB, user_uuid uuid.UUID) bool {
|
||||
var session_id_bytes []byte = make([]byte, 32)
|
||||
_, err := rand.Reader.Read(session_id_bytes)
|
||||
if err != nil {
|
||||
log.Printf("Could not generate session ID: %v", err)
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return false
|
||||
}
|
||||
session_id := base64.StdEncoding.EncodeToString(session_id_bytes)
|
||||
|
||||
_, err = db.Exec("INSERT INTO session (session_id, user_uuid, created_at) VALUES (?, ?, datetime())", session_id, user_uuid)
|
||||
if err != nil {
|
||||
log.Printf("Could not insert session: %v", err)
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return false
|
||||
}
|
||||
|
||||
cookie := http.Cookie{
|
||||
Name: "id",
|
||||
Value: session_id,
|
||||
MaxAge: 60 * 60 * 8, // 8 hours
|
||||
Secure: true,
|
||||
HttpOnly: true,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
Path: "/",
|
||||
}
|
||||
http.SetCookie(w, &cookie)
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
func getSessionID(r *http.Request) string {
|
||||
for _, c := range r.Cookies() {
|
||||
if c.Name == "id" {
|
||||
return c.Value
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func verifySessionAndReturnUser(db *sql.DB, r *http.Request) *User {
|
||||
session_id := getSessionID(r)
|
||||
if session_id == "" {
|
||||
return nil
|
||||
}
|
||||
|
||||
var user User
|
||||
var created_at time.Time
|
||||
|
||||
err := db.QueryRow(`
|
||||
SELECT u.user_uuid, u.email, s.created_at
|
||||
FROM session s
|
||||
INNER JOIN user u ON s.user_uuid = u.user_uuid
|
||||
WHERE session_id = ?`, session_id).Scan(&user.user_uuid, &user.email, &created_at)
|
||||
if err != nil {
|
||||
log.Printf("Could not verify session: %v", err)
|
||||
return nil
|
||||
}
|
||||
|
||||
if created_at.Add(time.Duration(8 * time.Hour)).Before(time.Now()) {
|
||||
return nil
|
||||
}
|
||||
|
||||
return &user
|
||||
}
|
||||
|
||||
func getHashPassword(password string, salt []byte) []byte {
|
||||
return argon2.IDKey([]byte(password), salt, 1, 64*1024, 1, 16)
|
||||
}
|
||||
Reference in New Issue
Block a user