feat: add authentication domain

Author: sirrobot01

internal/auth/jwt.go

@@ -0,0 +1,139 @@
+package auth
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+var (
+	// ErrInvalidToken is returned when a token is invalid.
+	ErrInvalidToken = errors.New("invalid token")
+	// ErrExpiredToken is returned when a token has expired.
+	ErrExpiredToken = errors.New("token has expired")
+)
+
+// Claims represents JWT claims.
+type Claims struct {
+	UserID string `json:"user_id"`
+	Email  string `json:"email"`
+	jwt.RegisteredClaims
+}
+
+// JWTService handles JWT token operations.
+type JWTService struct {
+	secretKey       []byte
+	accessTokenTTL  time.Duration
+	refreshTokenTTL time.Duration
+}
+
+// NewJWTService creates a new JWT service.
+func NewJWTService(secretKey string, accessTokenTTL, refreshTokenTTL time.Duration) *JWTService {
+	return &JWTService{
+		secretKey:       []byte(secretKey),
+		accessTokenTTL:  accessTokenTTL,
+		refreshTokenTTL: refreshTokenTTL,
+	}
+}
+
+// GenerateAccessToken generates a new access token.
+func (s *JWTService) GenerateAccessToken(userID, email string) (string, error) {
+	now := time.Now()
+	claims := &Claims{
+		UserID: userID,
+		Email:  email,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(now.Add(s.accessTokenTTL)),
+			IssuedAt:  jwt.NewNumericDate(now),
+			NotBefore: jwt.NewNumericDate(now),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(s.secretKey)
+}
+
+// GenerateRefreshToken generates a new refresh token (random string).
+func (s *JWTService) GenerateRefreshToken() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(b), nil
+}
+
+// ValidateAccessToken validates an access token and returns the claims.
+func (s *JWTService) ValidateAccessToken(tokenString string) (*Claims, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return s.secretKey, nil
+	})
+
+	if err != nil {
+		if errors.Is(err, jwt.ErrTokenExpired) {
+			return nil, ErrExpiredToken
+		}
+		return nil, ErrInvalidToken
+	}
+
+	if claims, ok := token.Claims.(*Claims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, ErrInvalidToken
+}
+
+// HashToken hashes a token for storage.
+func HashToken(token string) string {
+	hash := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(hash[:])
+}
+
+// HashPassword hashes a password using bcrypt.
+func HashPassword(password string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hash), nil
+}
+
+// CheckPassword checks if a password matches a hash.
+func CheckPassword(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}
+
+// GenerateAPIKey generates a new API key.
+func GenerateAPIKey(prefix string) (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	random := base64.URLEncoding.EncodeToString(b)
+	// Remove padding and limit length
+	random = random[:40]
+	return fmt.Sprintf("%s%s", prefix, random), nil
+}
+
+// HashAPIKey hashes an API key for storage.
+func HashAPIKey(key string) string {
+	return HashToken(key)
+}
+
+// GetAPIKeyPrefix extracts the prefix from an API key for display.
+func GetAPIKeyPrefix(key string) string {
+	if len(key) > 12 {
+		return key[:12] + "..."
+	}
+	return key
+}

internal/auth/jwt_test.go

@@ -0,0 +1,190 @@
+package auth
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestJWTService_GenerateAccessToken(t *testing.T) {
+	service := NewJWTService("test-secret-key", 15*time.Minute, 7*24*time.Hour)
+
+	token, err := service.GenerateAccessToken("user-123", "test@example.com")
+
+	require.NoError(t, err)
+	assert.NotEmpty(t, token)
+}
+
+func TestJWTService_ValidateAccessToken_Valid(t *testing.T) {
+	service := NewJWTService("test-secret-key", 15*time.Minute, 7*24*time.Hour)
+
+	userID := "user-123"
+	email := "test@example.com"
+
+	token, err := service.GenerateAccessToken(userID, email)
+	require.NoError(t, err)
+
+	claims, err := service.ValidateAccessToken(token)
+
+	require.NoError(t, err)
+	assert.Equal(t, userID, claims.UserID)
+	assert.Equal(t, email, claims.Email)
+	assert.False(t, claims.ExpiresAt.Time.IsZero())
+}
+
+func TestJWTService_ValidateAccessToken_Invalid(t *testing.T) {
+	service := NewJWTService("test-secret-key", 15*time.Minute, 7*24*time.Hour)
+
+	invalidToken := "invalid.token.here"
+
+	claims, err := service.ValidateAccessToken(invalidToken)
+
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrInvalidToken)
+	assert.Nil(t, claims)
+}
+
+func TestJWTService_ValidateAccessToken_WrongSecret(t *testing.T) {
+	service1 := NewJWTService("secret1", 15*time.Minute, 7*24*time.Hour)
+	service2 := NewJWTService("secret2", 15*time.Minute, 7*24*time.Hour)
+
+	token, err := service1.GenerateAccessToken("user-123", "test@example.com")
+	require.NoError(t, err)
+
+	claims, err := service2.ValidateAccessToken(token)
+
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrInvalidToken)
+	assert.Nil(t, claims)
+}
+
+func TestJWTService_ValidateAccessToken_Expired(t *testing.T) {
+	// Create a service with a very short TTL
+	service := NewJWTService("test-secret-key", 1*time.Millisecond, 7*24*time.Hour)
+
+	token, err := service.GenerateAccessToken("user-123", "test@example.com")
+	require.NoError(t, err)
+
+	// Wait for token to expire
+	time.Sleep(10 * time.Millisecond)
+
+	claims, err := service.ValidateAccessToken(token)
+
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, ErrExpiredToken)
+	assert.Nil(t, claims)
+}
+
+func TestJWTService_GenerateRefreshToken(t *testing.T) {
+	service := NewJWTService("test-secret-key", 15*time.Minute, 7*24*time.Hour)
+
+	token1, err1 := service.GenerateRefreshToken()
+	token2, err2 := service.GenerateRefreshToken()
+
+	require.NoError(t, err1)
+	require.NoError(t, err2)
+	assert.NotEmpty(t, token1)
+	assert.NotEmpty(t, token2)
+	// Tokens should be unique
+	assert.NotEqual(t, token1, token2)
+}
+
+func TestHashToken(t *testing.T) {
+	token := "test-token-12345"
+
+	hash1 := HashToken(token)
+	hash2 := HashToken(token)
+
+	assert.NotEmpty(t, hash1)
+	// Same token should produce same hash
+	assert.Equal(t, hash1, hash2)
+	// Hash should be 64 characters (SHA256 hex)
+	assert.Len(t, hash1, 64)
+	// Hash should be different from original
+	assert.NotEqual(t, token, hash1)
+}
+
+func TestHashPassword(t *testing.T) {
+	password := "securePassword123!"
+
+	hash, err := HashPassword(password)
+
+	require.NoError(t, err)
+	assert.NotEmpty(t, hash)
+	// Hash should be different from password
+	assert.NotEqual(t, password, hash)
+	// Hash should start with bcrypt prefix
+	assert.Contains(t, hash, "$2a$")
+}
+
+func TestCheckPassword_Valid(t *testing.T) {
+	password := "securePassword123!"
+
+	hash, err := HashPassword(password)
+	require.NoError(t, err)
+
+	isValid := CheckPassword(password, hash)
+
+	assert.True(t, isValid)
+}
+
+func TestCheckPassword_Invalid(t *testing.T) {
+	password := "securePassword123!"
+	wrongPassword := "wrongPassword"
+
+	hash, err := HashPassword(password)
+	require.NoError(t, err)
+
+	isValid := CheckPassword(wrongPassword, hash)
+
+	assert.False(t, isValid)
+}
+
+func TestGenerateAPIKey(t *testing.T) {
+	prefix := "mcpulse_"
+
+	key1, err1 := GenerateAPIKey(prefix)
+	key2, err2 := GenerateAPIKey(prefix)
+
+	require.NoError(t, err1)
+	require.NoError(t, err2)
+	assert.NotEmpty(t, key1)
+	assert.NotEmpty(t, key2)
+	// Keys should be unique
+	assert.NotEqual(t, key1, key2)
+	// Keys should start with prefix
+	assert.Contains(t, key1, prefix)
+	assert.Contains(t, key2, prefix)
+}
+
+func TestHashAPIKey(t *testing.T) {
+	key := "mcpulse_testkey12345"
+
+	hash := HashAPIKey(key)
+
+	assert.NotEmpty(t, hash)
+	assert.NotEqual(t, key, hash)
+	// Hash should be 64 characters (SHA256 hex)
+	assert.Len(t, hash, 64)
+}
+
+func TestGetAPIKeyPrefix(t *testing.T) {
+	t.Run("long key", func(t *testing.T) {
+		key := "mcpulse_verylongkey12345678"
+
+		prefix := GetAPIKeyPrefix(key)
+
+		assert.Equal(t, "mcpulse_very...", prefix)
+		assert.Len(t, prefix, 15) // 12 + "..."
+	})
+
+	t.Run("short key", func(t *testing.T) {
+		key := "short"
+
+		prefix := GetAPIKeyPrefix(key)
+
+		assert.Equal(t, "short", prefix)
+	})
+}