save "create sync group" table in database

internal/site/middleware/auth.go

@@ -0,0 +1,180 @@
+package middleware
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"ruben/inventory2/internal/consts"
+	"ruben/inventory2/internal/domains/accounts"
+	"ruben/inventory2/internal/domains/authentication"
+	"ruben/inventory2/internal/site/cookies"
+	"ruben/inventory2/internal/site/response"
+)
+
+type (
+	Auth struct {
+		auth        *authentication.Authenticator
+		newLoginURL LoginURLProviderFunc
+		accts       *accounts.Store
+	}
+
+	Identity struct {
+		AccessToken string
+		Claims      authentication.AccessTokenClaims
+		User        accounts.OAuthUser
+		Account     *accounts.Account
+	}
+
+	LoginURLProviderFunc = func(ctx context.Context, auth *authentication.Authenticator, targetURI string) (string, error)
+
+	AuthorizationAssertions = response.HandlerFunc
+)
+
+func NewAuth(
+	auth *authentication.Authenticator,
+	newLoginURL LoginURLProviderFunc,
+	accts *accounts.Store,
+) *Auth {
+	return &Auth{
+		auth:        auth,
+		newLoginURL: newLoginURL,
+		accts:       accts,
+	}
+}
+
+func (a *Auth) AddIdentity(fn response.HandlerFunc) response.HandlerFunc {
+	return func(r *http.Request) (response.Response, error) {
+		r, err := a.AddIdentityToRequest(r)
+		if err != nil {
+			return nil, err
+		}
+
+		return fn(r)
+	}
+}
+
+func (a *Auth) AddIdentityToRequest(r *http.Request) (*http.Request, error) {
+	ck, err := r.Cookie("access_token")
+	if err != nil {
+		return r, nil
+	}
+
+	ctx := r.Context()
+
+	accessToken := ck.Value
+
+	claims, expiration, err := a.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
+	if err != nil {
+		if errors.Is(err, consts.ErrNotFound) {
+			return r, nil
+		}
+
+		return r, response.Errorf("failed to load authentication details: %w", err)
+	}
+
+	if expiration.Before(time.Now()) {
+		return r, nil
+	}
+
+	user, acct, err := a.accts.GetUserAndAccountByAccessToken(ctx, accessToken)
+	if err != nil {
+		return r, response.Errorf("failed to load user and account defails: %w", err)
+	}
+
+	return r.WithContext(SetIdentity(ctx, Identity{
+		AccessToken: accessToken,
+		Claims:      claims,
+		User:        user,
+		Account:     acct,
+	})), nil
+}
+
+// TODO: after getting auth, consider making http handler functions take 'claims', etc, as function arguments
+//	- then consider doing the same with authorizationAssertions
+
+// auth middleware to verify access_token cookie and set custom claims in the request context
+func (a *Auth) AuthenticateAndAddIdentity(f response.HandlerFunc, assertions ...AuthorizationAssertions) response.HandlerFunc {
+	return func(r *http.Request) (response.Response, error) {
+		ck, err := r.Cookie("access_token")
+		if err != nil {
+			return response.TemporaryRedirect("/").
+				JSON("no access_token cookie provided"), nil
+		}
+
+		ctx := r.Context()
+
+		accessToken := ck.Value
+
+		claims, expiration, err := a.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
+		if err != nil {
+			if errors.Is(err, consts.ErrNotFound) {
+				u, err := a.newLoginURL(ctx, a.auth, r.URL.String())
+				if err != nil {
+					return nil, response.Errorf("failed to generate login url: %w", err)
+				}
+
+				return response.TemporaryRedirect(u), nil
+			}
+
+			return nil, response.Errorf("failed to authenticate: %w", err)
+		}
+
+		now := time.Now()
+
+		// refresh tokens, when the access token is "old enough"
+
+		// id token lifetime is 48 hours, allowing a person to use the app everyday comfortably, with wiggle room, without having to log in.
+		const idTokenLifetime = 48 * time.Hour
+		if refreshFloor := expiration.Add(-(idTokenLifetime / 4)); refreshFloor.Before(now) {
+			accessToken, expiration, err = a.auth.RefreshAccessToken(ctx, accessToken)
+			if err != nil {
+				fmt.Println("failed to refresh access token:", err)
+				return response.TemporaryRedirect("/").
+					Body(io.NopCloser(bytes.NewBuffer([]byte(fmt.Sprintf("failed to refresh access token: %v", err))))).
+					Cookie(cookies.Expired("access_token")), nil
+			}
+
+			// 'redirect' to same url, to set the new access_token cookie
+			return response.TemporaryRedirect(r.URL.String()).
+				Cookie(cookies.AccessToken(accessToken, expiration)), nil
+		}
+
+		// add identity info to request context
+
+		user, acct, err := a.accts.GetUserAndAccountByAccessToken(ctx, accessToken)
+		if err != nil {
+			return nil, response.Errorf("failed to authorize: %w", err)
+		}
+
+		for _, as := range assertions {
+			if res, err := as(r); res != nil || err != nil {
+				return res, err
+			}
+		}
+
+		return f(r.WithContext(SetIdentity(ctx, Identity{
+			AccessToken: accessToken,
+			Claims:      claims,
+			User:        user,
+			Account:     acct,
+		})))
+	}
+}
+
+type identityKey struct{}
+
+// stores identity in request context
+func SetIdentity(ctx context.Context, id Identity) context.Context {
+	return context.WithValue(ctx, identityKey{}, id)
+}
+
+// get identity from request context
+func GetIdentity(ctx context.Context) Identity {
+	id, _ := ctx.Value(identityKey{}).(Identity)
+	return id
+}