auth.go

@@ -0,0 +1,61 @@
+package gpaste
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/golang-jwt/jwt"
+	"github.com/google/uuid"
+)
+
+type AuthService struct {
+	users      UserStore
+	hmacSecret []byte
+}
+
+func NewAuthService(store UserStore, signingSecret []byte) *AuthService {
+	return &AuthService{users: store, hmacSecret: signingSecret}
+}
+
+func (as *AuthService) Login(username, password string) (string, error) {
+	user, err := as.users.Get(username)
+	if err != nil {
+		return "", err
+	}
+
+	if err := user.ValidatePassword(password); err != nil {
+		return "", err
+	}
+
+	// TODO: Set iss and aud
+	claims := jwt.StandardClaims{
+		Subject:   user.Username,
+		ExpiresAt: time.Now().Add(7 * 24 * time.Hour).Unix(),
+		NotBefore: time.Now().Unix(),
+		IssuedAt:  time.Now().Unix(),
+		Id:        uuid.NewString(),
+	}
+
+	token := jwt.NewWithClaims(jwt.GetSigningMethod("HS256"), claims)
+	signed, err := token.SignedString(as.hmacSecret)
+	if err != nil {
+		return "", err
+	}
+
+	return signed, nil
+}
+
+func (as *AuthService) ValidateToken(rawToken string) error {
+	claims := &jwt.StandardClaims{}
+	token, err := jwt.ParseWithClaims(rawToken, claims, func(t *jwt.Token) (interface{}, error) {
+		return as.hmacSecret, nil
+	})
+	if err != nil {
+		return err
+	}
+	if !token.Valid {
+		return fmt.Errorf("invalid token")
+	}
+
+	return nil
+}

auth_test.go

@@ -0,0 +1,39 @@
+package gpaste_test
+
+import (
+	"testing"
+
+	"git.t-juice.club/torjus/gpaste"
+)
+
+func TestAuth(t *testing.T) {
+	t.Run("Token", func(t *testing.T) {
+		us := gpaste.NewMemoryUserStore()
+		secret := []byte(randomString(16))
+		as := gpaste.NewAuthService(us, secret)
+
+		username := randomString(8)
+		password := randomString(16)
+
+		user := &gpaste.User{Username: username}
+		if err := user.SetPassword(password); err != nil {
+			t.Fatalf("error setting user password: %s", err)
+		}
+		if err := us.Store(user); err != nil {
+			t.Fatalf("Error storing user: %s", err)
+		}
+
+		token, err := as.Login(username, password)
+		if err != nil {
+			t.Fatalf("Error creating token: %s", err)
+		}
+
+		if err := as.ValidateToken(token); err != nil {
+			t.Fatalf("Error validating token: %s", err)
+		}
+		invalidToken := `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NDMyMjk3NjMsImp0aSI6ImUzNDk5NWI1LThiZmMtNDQyNy1iZDgxLWFmNmQ3OTRiYzM0YiIsImlhdCI6MTY0MjYyNDk2MywibmJmIjoxNjQyNjI0OTYzLCJzdWIiOiJYdE5Hemt5ZSJ9.VM6dkwSLaBv8cStkWRVVv9ADjdUrHGHrlB7GB7Ly7n8`
+		if err := as.ValidateToken(invalidToken); err == nil {
+			t.Fatalf("Invalid token passed validation")
+		}
+	})
+}

go.mod

@@ -7,10 +7,13 @@ require github.com/google/uuid v1.3.0
 require github.com/go-chi/chi/v5 v5.0.7
 
 require (
+	github.com/golang-jwt/jwt v3.2.2+incompatible
 	github.com/google/go-cmp v0.5.6
 	github.com/pelletier/go-toml v1.9.4
 	github.com/urfave/cli/v2 v2.3.0
+	go.etcd.io/bbolt v1.3.6
 	go.uber.org/zap v1.20.0
+	golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce
 )
 
 require (
@@ -18,4 +21,5 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.7.0 // indirect
+	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
 )

go.sum

@@ -9,6 +9,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-chi/chi/v5 v5.0.7 h1:rDTPXLDHGATaeHvVlLcR4Qe0zftYethFucbjVQ1PxU8=
 github.com/go-chi/chi/v5 v5.0.7/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
+github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
@@ -33,6 +35,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
 github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
+go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
@@ -45,22 +49,31 @@ go.uber.org/zap v1.20.0 h1:N4oPlghZwYG55MlU6LXk/Zp00FVNE9X9wrYO8CEs4lc=
 go.uber.org/zap v1.20.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce h1:Roh6XWxHFKrPgC/EQhVubSAGQ6Ozk6IdxHSzt1mR0EI=
+golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 h1:XfKQ4OlFl8okEOr5UvAqFRVj8pY/4yfcXrddB8qAbU0=
+golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

user.go

@@ -0,0 +1,27 @@
+package gpaste
+
+import "golang.org/x/crypto/bcrypt"
+
+type User struct {
+	Username       string `json:"username"`
+	HashedPassword []byte `json:"hashed_password"`
+}
+
+type UserStore interface {
+	Get(username string) (*User, error)
+	Store(user *User) error
+	Delete(username string) error
+}
+
+func (u *User) ValidatePassword(password string) error {
+	return bcrypt.CompareHashAndPassword(u.HashedPassword, []byte(password))
+}
+
+func (u *User) SetPassword(password string) error {
+	hashed, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return err
+	}
+	u.HashedPassword = hashed
+	return nil
+}

user_test.go

@@ -0,0 +1,37 @@
+package gpaste_test
+
+import (
+	"math/rand"
+	"testing"
+
+	"git.t-juice.club/torjus/gpaste"
+)
+
+func TestUser(t *testing.T) {
+	t.Run("Password", func(t *testing.T) {
+		userMap := make(map[string]string)
+		for i := 0; i < 10; i++ {
+			userMap[randomString(8)] = randomString(16)
+		}
+
+		for username, password := range userMap {
+			user := &gpaste.User{Username: username}
+			if err := user.SetPassword(password); err != nil {
+				t.Fatalf("Error setting password: %s", err)
+			}
+			if err := user.ValidatePassword(password); err != nil {
+				t.Fatalf("Error validating password: %s", err)
+			}
+		}
+	})
+}
+
+func randomString(length int) string {
+	const charset = "abcdefghijklmnopqrstabcdefghijklmnopqrstuvwxyz" +
+		"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	b := make([]byte, length)
+	for i := range b {
+		b[i] = charset[rand.Intn(len(charset))]
+	}
+	return string(b)
+}

userstore_bolt.go

@@ -0,0 +1,69 @@
+package gpaste
+
+import (
+	"encoding/json"
+
+	"go.etcd.io/bbolt"
+)
+
+var keyUsers = []byte("users")
+
+type BoltUserStore struct {
+	db *bbolt.DB
+}
+
+func NewBoltUserStore(path string) (*BoltUserStore, error) {
+	db, err := bbolt.Open(path, 0666, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := db.Update(func(tx *bbolt.Tx) error {
+		_, err := tx.CreateBucketIfNotExists(keyUsers)
+		return err
+	}); err != nil {
+		return nil, err
+	}
+
+	return &BoltUserStore{db: db}, nil
+}
+
+func (s *BoltUserStore) Close() error {
+	return s.db.Close()
+}
+
+func (s *BoltUserStore) Get(username string) (*User, error) {
+	var user User
+	err := s.db.View(func(tx *bbolt.Tx) error {
+		bkt := tx.Bucket(keyUsers)
+		rawUser := bkt.Get([]byte(username))
+		if err := json.Unmarshal(rawUser, &user); err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+
+func (s *BoltUserStore) Store(user *User) error {
+	return s.db.Update(func(tx *bbolt.Tx) error {
+		bkt := tx.Bucket(keyUsers)
+
+		data, err := json.Marshal(user)
+		if err != nil {
+			return err
+		}
+
+		return bkt.Put([]byte(user.Username), data)
+	})
+}
+
+func (s *BoltUserStore) Delete(username string) error {
+	return s.db.Update(func(tx *bbolt.Tx) error {
+		bkt := tx.Bucket(keyUsers)
+		return bkt.Delete([]byte(username))
+	})
+}

userstore_bolt_test.go

@@ -0,0 +1,27 @@
+package gpaste_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"git.t-juice.club/torjus/gpaste"
+)
+
+func TestBoltUserStore(t *testing.T) {
+	tmpDir := t.TempDir()
+	newFunc := func() (func(), gpaste.UserStore) {
+		tmpFile := filepath.Join(tmpDir, randomString(8))
+
+		store, err := gpaste.NewBoltUserStore(tmpFile)
+		if err != nil {
+			t.Fatalf("Error creating store: %s", err)
+		}
+		cleanup := func() {
+			store.Close()
+		}
+		return cleanup, store
+	}
+
+	RunUserStoreTest(newFunc, t)
+
+}

userstore_memory.go

@@ -0,0 +1,39 @@
+package gpaste
+
+import (
+	"fmt"
+	"sync"
+)
+
+type MemoryUserStore struct {
+	users map[string]*User
+	lock  sync.Mutex
+}
+
+func NewMemoryUserStore() *MemoryUserStore {
+	return &MemoryUserStore{users: make(map[string]*User)}
+}
+func (s *MemoryUserStore) Get(username string) (*User, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	user, ok := s.users[username]
+	if !ok {
+		return nil, fmt.Errorf("no such user: %s", username)
+	}
+
+	return user, nil
+}
+
+func (s *MemoryUserStore) Store(user *User) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	s.users[user.Username] = user
+	return nil
+}
+
+func (s *MemoryUserStore) Delete(username string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+	delete(s.users, username)
+	return nil
+}

userstore_memory_test.go

@@ -0,0 +1,15 @@
+package gpaste_test
+
+import (
+	"testing"
+
+	"git.t-juice.club/torjus/gpaste"
+)
+
+func TestMemoryUserStore(t *testing.T) {
+	newFunc := func() (func(), gpaste.UserStore) {
+		return func() {}, gpaste.NewMemoryUserStore()
+	}
+
+	RunUserStoreTest(newFunc, t)
+}

userstore_test.go

@@ -0,0 +1,41 @@
+package gpaste_test
+
+import (
+	"testing"
+
+	"git.t-juice.club/torjus/gpaste"
+)
+
+func RunUserStoreTest(newFunc func() (func(), gpaste.UserStore), t *testing.T) {
+	t.Run("Basics", func(t *testing.T) {
+		cleanup, s := newFunc()
+		t.Cleanup(cleanup)
+
+		userMap := make(map[string]string)
+		for i := 0; i < 10; i++ {
+			userMap[randomString(8)] = randomString(16)
+		}
+
+		for k, v := range userMap {
+			user := &gpaste.User{
+				Username: k,
+			}
+			if err := user.SetPassword(v); err != nil {
+				t.Fatalf("Error setting password: %s", err)
+			}
+			if err := s.Store(user); err != nil {
+				t.Fatalf("Error storing user: %s", err)
+			}
+		}
+
+		for k, v := range userMap {
+			user, err := s.Get(k)
+			if err != nil {
+				t.Errorf("Error getting user: %s", err)
+			}
+			if err := user.ValidatePassword(v); err != nil {
+				t.Errorf("Error verifying password: %s", err)
+			}
+		}
+	})
+}