inventory-plus-plus/internal/server/middleware/auth.go

package middleware

import (
	"bytes"
	"context"
	"errors"
	"fmt"
	"io"
	"time"

	"ruben/inventory2/internal/consts"
	"ruben/inventory2/internal/domains/accounts"
	"ruben/inventory2/internal/domains/authentication"
	"ruben/inventory2/internal/logging"
	"ruben/inventory2/internal/server/cookies"
	"ruben/inventory2/internal/server/response"

	"github.com/gin-gonic/gin"
)

type (
	Auth struct {
		log   *logging.Logger
		auth  *authentication.Authenticator
		accts *accounts.Store
	}

	Identity struct {
		AccessToken string
		Claims      authentication.AccessTokenClaims
		User        accounts.OAuthUser
		Account     *accounts.Account
	}

	LoginURLProviderFunc = func(ctx context.Context, auth *authentication.Authenticator, targetURI string) (string, error)

	AuthorizationAssertions = response.HandlerFunc
)

func NewAuth(
	logger *logging.Logger,
	auth *authentication.Authenticator,
	accts *accounts.Store,
) *Auth {
	return &Auth{
		log:   logger,
		auth:  auth,
		accts: accts,
	}
}

// Identify will add an Identity to the context that can then be retrieved via GetIdentity.
func (a *Auth) Identify(c *gin.Context) {
	if err := a.addIdentity(c); err != nil {
		c.Error(err)
		c.Abort()
	}
}

func (a *Auth) addIdentity(c *gin.Context) error {
	r := c.Request

	ck, err := r.Cookie("access_token")
	if err != nil {
		return nil
	}

	ctx := r.Context()

	accessToken := ck.Value

	claims, err := a.auth.GetAccessTokenClaimsAndExpiration(ctx, accessToken)
	if err != nil {
		if errors.Is(err, consts.ErrNotFound) {
			return nil
		}

		return response.Errorf("failed to load authentication details: %w", err)
	}

	expiration := claims.Expiration
	if expiration.Before(time.Now()) {
		return nil
	}

	user, acct, err := a.accts.GetUserAndAccountByAccessToken(ctx, accessToken)
	if err != nil {
		return response.Errorf("failed to load user and account defails: %w", err)
	}

	c.Request = r.WithContext(SetIdentity(c, Identity{
		AccessToken: accessToken,
		Claims:      claims,
		User:        user,
		Account:     acct,
	}))

	return nil
}

// Authenticate should only be used along with and after Identify
// Typically used with response.Handler to make a gin.HandlerFunc.
func (a *Auth) Authenticate(assertions ...AuthorizationAssertions) func(c *gin.Context) {
	return response.Handler(a.AuthenticateHandler(assertions...))
}

// See Authenticate.
func (a *Auth) AuthenticateHandler(assertions ...AuthorizationAssertions) func(c *gin.Context) (response.Response, error) {
	return func(c *gin.Context) (response.Response, error) {
		id, ok := getIdentity(c)
		if !ok {
			return nil, response.Unauthorized().
				HTML([]byte(`
					<h1>Unauthorized</h1>
					<a href="/">Return to app</a>
				`)) // TODO: would be nice to have a better page for this
		}

		expiration := id.Claims.Expiration
		now := time.Now()

		// refresh tokens, when the access token is "old enough"

		// id token lifetime is 48 hours, allowing a person to use the app everyday comfortably, with wiggle room, without having to log in.
		const idTokenLifetime = 48 * time.Hour
		if refreshFloor := expiration.Add(-(idTokenLifetime / 4)); refreshFloor.Before(now) {
			accessToken, expiration, err := a.auth.RefreshAccessToken(c, id.AccessToken)
			if err != nil {
				a.log.Warn("failed to refresh access token", "error", err)
				return response.TemporaryRedirect("/").
					Body(io.NopCloser(bytes.NewBuffer([]byte(fmt.Sprintf("failed to refresh access token: %v", err))))).
					Cookie(cookies.Expired("access_token")), nil
			}

			// 'redirect' to same url, to set the new access_token cookie
			return response.TemporaryRedirect(c.Request.URL.String()).
				Cookie(cookies.AccessToken(accessToken, expiration)), nil
		}

		for _, as := range assertions {
			if res, err := as(c); res != nil || err != nil {
				return res, err
			}
		}

		return nil, nil
	}
}

type identityKey struct{}

// stores identity in context
func SetIdentity(ctx context.Context, id Identity) context.Context {
	c, ok := ctx.(*gin.Context)
	if ok {
		c.Set(identityKey{}, id)
		ctx = c.Request.Context()
	}
	return context.WithValue(ctx, identityKey{}, id)
}

// get identity from context
func GetIdentity(ctx context.Context) Identity {
	id, _ := getIdentity(ctx)
	return id
}

func getIdentity(ctx context.Context) (Identity, bool) {
	id, ok := ctx.Value(identityKey{}).(Identity)
	if ok {
		return id, true
	}

	c, ok := ctx.(*gin.Context)
	if !ok {
		return Identity{}, false
	}

	v, ok := c.Get(identityKey{})
	if !ok {
		return Identity{}, false
	}

	id, ok = v.(Identity)

	return id, ok
}