gpaste/auth.go

77 lines
1.5 KiB
Go

package gpaste
import (
"fmt"
"time"
"git.t-juice.club/torjus/gpaste/users"
"github.com/golang-jwt/jwt"
"github.com/google/uuid"
)
type AuthLevel int
const (
AuthLevelUnset AuthLevel = iota
AuthLevelUser
AuthLevelAdmin
)
type AuthService struct {
users users.UserStore
hmacSecret []byte
}
type Claims struct {
Role users.Role `json:"role,omitempty"`
jwt.StandardClaims
}
func NewAuthService(store users.UserStore, signingSecret []byte) *AuthService {
return &AuthService{users: store, hmacSecret: signingSecret}
}
func (as *AuthService) Login(username, password string) (string, error) {
user, err := as.users.Get(username)
if err != nil {
return "", err
}
if err := user.ValidatePassword(password); err != nil {
return "", err
}
// TODO: Set iss and aud
claims := new(Claims)
claims.Subject = user.Username
claims.ExpiresAt = time.Now().Add(7 * 24 * time.Hour).Unix()
claims.NotBefore = time.Now().Unix()
claims.IssuedAt = time.Now().Unix()
claims.Id = uuid.NewString()
claims.Role = user.Role
token := jwt.NewWithClaims(jwt.GetSigningMethod("HS256"), claims)
signed, err := token.SignedString(as.hmacSecret)
if err != nil {
return "", err
}
return signed, nil
}
func (as *AuthService) ValidateToken(rawToken string) (*Claims, error) {
claims := &Claims{}
token, err := jwt.ParseWithClaims(rawToken, claims, func(t *jwt.Token) (interface{}, error) {
return as.hmacSecret, nil
})
if err != nil {
return nil, err
}
if !token.Valid {
return nil, fmt.Errorf("invalid token")
}
return claims, nil
}