152 lines
3.7 KiB
Go
152 lines
3.7 KiB
Go
package authentication
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"ruben/inventory2/internal/consts"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
)
|
|
|
|
// NewState creates a new state for logging in, saving it in the database.
|
|
func (a *Authenticator) NewState(ctx context.Context) ([32]byte, error) {
|
|
state, err := generateRandomState()
|
|
if err != nil {
|
|
return state, fmt.Errorf("failed to generate random state: %w", err)
|
|
}
|
|
|
|
if _, err = a.db.Exec(
|
|
ctx,
|
|
"INSERT INTO oauth_login_states (state) VALUES (@state)",
|
|
pgx.NamedArgs{
|
|
"state": state[:],
|
|
},
|
|
); err != nil {
|
|
return state, fmt.Errorf("failed to execute query: %w", err)
|
|
}
|
|
|
|
return state, nil
|
|
}
|
|
|
|
func generateRandomState() ([32]byte, error) {
|
|
var b [32]byte
|
|
_, err := rand.Read(b[:])
|
|
return b, err
|
|
}
|
|
|
|
// GetStateExpiration get's the oauth state's expiration
|
|
// func (a *Authenticator) GetStateExpiration(ctx context.Context, state [32]byte) (time.Time, error) {
|
|
func (a *Authenticator) GetStateExpiration(ctx context.Context, state string) (time.Time, error) {
|
|
rows, err := a.db.Query(
|
|
ctx,
|
|
`SELECT expiration from oauth_login_states WHERE state = ('\x' || @state)::BYTEA`,
|
|
pgx.NamedArgs{
|
|
//"state": state[:],
|
|
"state": state,
|
|
},
|
|
)
|
|
if err != nil {
|
|
return time.Time{}, fmt.Errorf("failed to perform query: %w", err)
|
|
}
|
|
|
|
exp, err := pgx.CollectExactlyOneRow(rows, pgx.RowTo[time.Time])
|
|
if err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return time.Time{}, consts.ErrNotFound
|
|
}
|
|
|
|
return time.Time{}, fmt.Errorf("failed to scan row: %w", err)
|
|
}
|
|
|
|
return exp, nil
|
|
}
|
|
|
|
// TODO: need to automatically clean up expired tokens
|
|
func (a *Authenticator) DeleteOAuthTokens(ctx context.Context, accessToken string) error {
|
|
_, err := a.db.Exec(ctx, "DELETE FROM oauth_tokens WHERE access_token = @access_token", pgx.NamedArgs{"access_token": accessToken})
|
|
if err != nil {
|
|
return fmt.Errorf("failed to perform query: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (a *Authenticator) GetAccessTokenClaimsAndExpiration(ctx context.Context, accessToken string) (claims AccessTokenClaims, expiration time.Time, err error) {
|
|
rows, err := a.db.Query(
|
|
ctx,
|
|
`
|
|
SELECT
|
|
expiry,
|
|
claims
|
|
FROM
|
|
oauth_tokens
|
|
WHERE
|
|
access_token = @access_token
|
|
`,
|
|
pgx.NamedArgs{
|
|
"access_token": accessToken,
|
|
},
|
|
)
|
|
if err != nil {
|
|
return AccessTokenClaims{}, time.Time{}, fmt.Errorf("failed to perform query: %w", err)
|
|
}
|
|
|
|
type Row struct {
|
|
Expiry time.Time
|
|
Claims json.RawMessage
|
|
}
|
|
|
|
r, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByNameLax[Row])
|
|
if err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return AccessTokenClaims{}, time.Time{}, consts.ErrNotFound
|
|
}
|
|
return AccessTokenClaims{}, time.Time{}, fmt.Errorf("failed to scan row: %w", err)
|
|
}
|
|
|
|
if err := json.Unmarshal(r.Claims, &claims); err != nil {
|
|
return AccessTokenClaims{}, time.Time{}, fmt.Errorf("failed to scan claims json: %w", err)
|
|
}
|
|
|
|
return claims, r.Expiry, nil
|
|
}
|
|
|
|
func (a *Authenticator) getRefreshTokenForAccessToken(ctx context.Context, accessToken string) (refreshToken, tokenType string, err error) {
|
|
rows, err := a.db.Query(
|
|
ctx,
|
|
`
|
|
SELECT
|
|
refresh_token,
|
|
token_type
|
|
FROM
|
|
oauth_tokens
|
|
WHERE
|
|
access_token = @access_token
|
|
`,
|
|
pgx.NamedArgs{
|
|
"access_token": accessToken,
|
|
},
|
|
)
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("failed to perform query: %w", err)
|
|
}
|
|
|
|
type Row struct {
|
|
Refresh_token string
|
|
Token_type string
|
|
}
|
|
|
|
r, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByNameLax[Row])
|
|
if err != nil {
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return "", "", consts.ErrNotFound
|
|
}
|
|
return "", "", fmt.Errorf("failed to scan row: %w", err)
|
|
}
|
|
|
|
return r.Refresh_token, r.Token_type, nil
|
|
}
|