authorization enforced on webpages

internal/domains/accounts/accounts.go

@@ -25,6 +25,10 @@ type (
 		ID     int64
 		Email  string
 	}
+
+	OAuthUser struct {
+		UserID string
+	}
 )
 
 func NewStore(db *pgxpool.Pool) *Store {
@@ -52,6 +56,7 @@ func (db *Store) CreateAccount(ctx context.Context, userID, email string) (Accou
 				@user_id,
 				@email
 			)
+			ON CONFLICT DO NOTHING
 			RETURNING
 				account_id
 		`,
@@ -67,7 +72,7 @@ func (db *Store) CreateAccount(ctx context.Context, userID, email string) (Accou
 	acctID, err := pgx.CollectExactlyOneRow(rows, pgx.RowTo[int64])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
-			return Account{}, consts.ErrNotFound
+			return Account{}, fmt.Errorf("account already exists: %w", consts.ErrConflict)
 		}
 		return Account{}, fmt.Errorf("failed to scan row: %w", err)
 	}
@@ -171,6 +176,55 @@ func (db *Store) GetAccountByEmail(ctx context.Context, email string) (Account,
 	}, nil
 }
 
+func (db *Store) GetUserAndAccountByAccessToken(ctx context.Context, accessToken string) (OAuthUser, *Account, error) {
+	rows, err := db.db.Query(
+		ctx,
+		`
+			SELECT
+				u.user_id,
+				a.account_id,
+				a.email
+			FROM oauth_users u
+			LEFT JOIN oauth_tokens t
+				ON u.user_id = id_token_subject
+			LEFT JOIN accounts a
+				USING (user_id)
+			WHERE access_token = @access_token
+		`,
+		pgx.NamedArgs{
+			"access_token": accessToken,
+		},
+	)
+	if err != nil {
+		return OAuthUser{}, nil, fmt.Errorf("failed to perform query: %w", err)
+	}
+
+	type Row struct {
+		User_ID    string
+		Account_ID *int64
+		Email      *string
+	}
+
+	r, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByNameLax[Row])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return OAuthUser{}, nil, consts.ErrNotFound
+		}
+		return OAuthUser{}, nil, fmt.Errorf("failed to scan row: %w", err)
+	}
+
+	var acct *Account
+	if r.Account_ID != nil {
+		acct = &Account{
+			UserID: r.User_ID,
+			ID:     *r.Account_ID,
+			Email:  *r.Email,
+		}
+	}
+
+	return OAuthUser{UserID: r.User_ID}, acct, nil
+}
+
 func (db *StoreWithContext) CreateAccount(userID, email string) (Account, error) {
 	return db.db.CreateAccount(db.ctx, userID, email)
 }

internal/domains/authentication/auth.go

@@ -100,22 +100,16 @@ func (a *Authenticator) Exchange(ctx context.Context, state, code string) (acces
 		return "", time.Time{}, fmt.Errorf("failed to exchange an authorization code for a token: %w", err)
 	}
 
-	fmt.Println("TOKEN:", token)
-
 	idToken, err := a.VerifyIDToken(ctx, token)
 	if err != nil {
 		return "", time.Time{}, fmt.Errorf("failed to verify ID Token: %w", err)
 	}
 
-	fmt.Println("ID TOKEN:", idToken)
-
 	var claims map[string]any
 	if err := idToken.Claims(&claims); err != nil {
 		return "", time.Time{}, fmt.Errorf("Failed to obtain id token claims: %w", err)
 	}
 
-	fmt.Println("CUSTOM CLAIMS / PROFILE:", claims)
-
 	claimsJSON, _ := json.Marshal(claims)
 
 	// store the token, and the potentially new user