Add local auth: users, sessions, register/login/logout/me (#4)

Implements pansy's local (email + password) authentication and the session layer that OIDC (#5) will also reuse. - store: users.go (create/get-by-id/get-by-email/count) and sessions.go (create/get/touch/delete/delete-expired), scanning the existing 0001 schema. - service: the business-logic seam. auth.go (Register/Login/session lifecycle/Providers) + password.go (argon2id, 64 MiB/1/4, PHC-encoded, constant-time verify) + service.go (Service, clock injection, token hashing). First user is admin; closed registration still allows the bootstrap user; unknown-email and wrong-password are indistinguishable (same error, same argon2 work via a dummy hash). - api: POST /auth/register|login|logout, GET /auth/me|providers, plus a requireAuth middleware that resolves the HttpOnly session cookie (SameSite=Lax, Secure under https) to the actor. Handlers stay thin. - main: wires the service and a periodic expired-session sweep; sessions are also dropped lazily on access. Sliding 30-day expiry. - tests: service (register/login/expiry/renewal/cleanup, password) and api (cookie flow, middleware, validation, providers). Verified end-to-end via curl: register -> me -> restart -> session persists -> logout -> 401. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
2026-07-18 16:38:03 -04:00
parent 8305acf4b2
commit 0e41ccd95a
14 changed files with 1275 additions and 7 deletions
@@ -13,13 +13,21 @@ import (
 	sloggin "github.com/samber/slog-gin"

 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
 )

+// handlers carries the dependencies shared by every HTTP handler. Handlers stay
+// thin: decode the request, call a service method, encode the result.
+type handlers struct {
+	cfg *config.Config
+	svc *service.Service
+}
+
 // New builds the gin engine with the standard middleware stack and registers the
-// API routes. The embedded SPA fallback is registered separately by the caller
-// via RegisterSPA (see spa.go) so the API can be built and tested without a web
-// build present.
-func New(cfg *config.Config) *gin.Engine {
+// API routes against the given service. The embedded SPA fallback is registered
+// separately by the caller via RegisterSPA (see spa.go) so the API can be built
+// and tested without a web build present.
+func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	gin.SetMode(gin.ReleaseMode)

 	r := gin.New()
@@ -33,9 +41,21 @@ func New(cfg *config.Config) *gin.Engine {
 		_ = r.SetTrustedProxies(nil)
 	}

+	h := &handlers{cfg: cfg, svc: svc}
+
 	v1 := r.Group("/api/v1")
 	v1.GET("/healthz", healthz)

+	// Auth endpoints are exempt from requireAuth (you can't be logged in yet);
+	// /me is the one that needs a session. Feature routers in later issues attach
+	// h.requireAuth() to their own protected groups.
+	auth := v1.Group("/auth")
+	auth.POST("/register", h.register)
+	auth.POST("/login", h.login)
+	auth.POST("/logout", h.logout)
+	auth.GET("/providers", h.providers)
+	auth.GET("/me", h.requireAuth(), h.me)
+
 	return r
 }

@@ -0,0 +1,180 @@
+package api
+
+import (
+	"errors"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
+)
+
+// sessionCookie is the name of the HttpOnly cookie carrying the raw session token.
+const sessionCookie = "pansy_session"
+
+// actorKey is the gin-context key under which requireAuth stashes the
+// authenticated *domain.User.
+const actorKey = "actor"
+
+// registerRequest / loginRequest are the JSON bodies for the local-auth
+// endpoints. gin's binding validates them before the service is called.
+type registerRequest struct {
+	Email       string `json:"email" binding:"required,email"`
+	DisplayName string `json:"displayName" binding:"required"`
+	Password    string `json:"password" binding:"required,min=8,max=1024"`
+}
+
+type loginRequest struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required"`
+}
+
+// register creates a local account and logs it in (sets the session cookie).
+func (h *handlers) register(c *gin.Context) {
+	var req registerRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "email, display name, and an 8+ character password are required")
+		return
+	}
+
+	user, err := h.svc.Register(c.Request.Context(), service.RegisterInput{
+		Email:       req.Email,
+		DisplayName: req.DisplayName,
+		Password:    req.Password,
+	})
+	if err != nil {
+		h.writeServiceError(c, err)
+		return
+	}
+
+	if err := h.startSession(c, user.ID); err != nil {
+		writeAPIError(c, http.StatusInternalServerError, "INTERNAL", "could not start session")
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// login verifies credentials and sets the session cookie.
+func (h *handlers) login(c *gin.Context) {
+	var req loginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "email and password are required")
+		return
+	}
+
+	user, err := h.svc.Login(c.Request.Context(), req.Email, req.Password)
+	if err != nil {
+		h.writeServiceError(c, err)
+		return
+	}
+
+	if err := h.startSession(c, user.ID); err != nil {
+		writeAPIError(c, http.StatusInternalServerError, "INTERNAL", "could not start session")
+		return
+	}
+	c.JSON(http.StatusOK, user)
+}
+
+// logout deletes the current session (if any) and clears the cookie. It is
+// idempotent and never requires a valid session.
+func (h *handlers) logout(c *gin.Context) {
+	if token, err := c.Cookie(sessionCookie); err == nil && token != "" {
+		if err := h.svc.Logout(c.Request.Context(), token); err != nil {
+			slog.Error("api: logout", "error", err)
+		}
+	}
+	h.clearSessionCookie(c)
+	c.JSON(http.StatusOK, gin.H{"ok": true})
+}
+
+// me returns the authenticated user. It sits behind requireAuth.
+func (h *handlers) me(c *gin.Context) {
+	c.JSON(http.StatusOK, mustActor(c))
+}
+
+// providers reports which login methods to render on the login page.
+func (h *handlers) providers(c *gin.Context) {
+	c.JSON(http.StatusOK, h.svc.Providers())
+}
+
+// requireAuth is middleware that rejects requests without a valid session and,
+// on success, stashes the resolved user in the context. Feature routers added by
+// later issues (gardens, objects, …) attach this to their protected groups.
+func (h *handlers) requireAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token, err := c.Cookie(sessionCookie)
+		if err != nil || token == "" {
+			writeAPIError(c, http.StatusUnauthorized, "UNAUTHENTICATED", "authentication required")
+			c.Abort()
+			return
+		}
+		user, err := h.svc.ResolveSession(c.Request.Context(), token)
+		if err != nil {
+			// Any resolution failure (missing/expired/tampered) is 401, never 404:
+			// the client should log in, not think a resource is gone.
+			writeAPIError(c, http.StatusUnauthorized, "UNAUTHENTICATED", "authentication required")
+			c.Abort()
+			return
+		}
+		c.Set(actorKey, user)
+		c.Next()
+	}
+}
+
+// startSession issues a session and writes the cookie.
+func (h *handlers) startSession(c *gin.Context, userID int64) error {
+	token, expiresAt, err := h.svc.CreateSession(c.Request.Context(), userID)
+	if err != nil {
+		return err
+	}
+	h.setSessionCookie(c, token, expiresAt)
+	return nil
+}
+
+// cookieSecure reports whether the session cookie should carry the Secure
+// attribute: only when the instance is served over HTTPS (PANSY_BASE_URL).
+// Marking it Secure under plain-http local dev would make the browser drop it.
+func (h *handlers) cookieSecure() bool {
+	return strings.HasPrefix(h.cfg.BaseURL, "https://")
+}
+
+func (h *handlers) setSessionCookie(c *gin.Context, token string, expiresAt time.Time) {
+	maxAge := max(int(time.Until(expiresAt).Seconds()), 1)
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(sessionCookie, token, maxAge, "/", "", h.cookieSecure(), true)
+}
+
+func (h *handlers) clearSessionCookie(c *gin.Context) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(sessionCookie, "", -1, "/", "", h.cookieSecure(), true)
+}
+
+// mustActor returns the user stashed by requireAuth. It panics if called on a
+// route that isn't behind requireAuth — a programming error.
+func mustActor(c *gin.Context) *domain.User {
+	return c.MustGet(actorKey).(*domain.User)
+}
+
+// writeServiceError maps a service-layer sentinel error to pansy's JSON error
+// envelope. Login failures never leak which of email/password was wrong.
+func (h *handlers) writeServiceError(c *gin.Context, err error) {
+	switch {
+	case errors.Is(err, domain.ErrInvalidCredentials):
+		writeAPIError(c, http.StatusUnauthorized, "INVALID_CREDENTIALS", "invalid email or password")
+	case errors.Is(err, domain.ErrEmailTaken):
+		writeAPIError(c, http.StatusConflict, "EMAIL_TAKEN", "an account with that email already exists")
+	case errors.Is(err, domain.ErrRegistrationClosed):
+		writeAPIError(c, http.StatusForbidden, "REGISTRATION_CLOSED", "registration is closed")
+	case errors.Is(err, domain.ErrLocalAuthDisabled):
+		writeAPIError(c, http.StatusForbidden, "LOCAL_AUTH_DISABLED", "local authentication is disabled")
+	case errors.Is(err, domain.ErrInvalidInput):
+		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "invalid input")
+	default:
+		slog.Error("api: unhandled service error", "error", err)
+		writeAPIError(c, http.StatusInternalServerError, "INTERNAL", "internal error")
+	}
+}
@@ -0,0 +1,168 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/store"
+)
+
+// authEngine builds an API engine backed by a fresh in-memory database.
+func authEngine(t *testing.T, cfg *config.Config) *gin.Engine {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	db, err := store.Open(":memory:")
+	if err != nil {
+		t.Fatalf("store.Open: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	if err := db.Migrate(context.Background()); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+	return New(cfg, service.New(db, cfg))
+}
+
+func localCfg() *config.Config {
+	return &config.Config{Registration: config.RegistrationOpen, LocalAuth: true}
+}
+
+// doJSON issues a JSON request, optionally carrying a session cookie.
+func doJSON(t *testing.T, r *gin.Engine, method, path string, body any, cookie *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	var buf bytes.Buffer
+	if body != nil {
+		if err := json.NewEncoder(&buf).Encode(body); err != nil {
+			t.Fatalf("encode body: %v", err)
+		}
+	}
+	req := httptest.NewRequest(method, path, &buf)
+	req.Header.Set("Content-Type", "application/json")
+	if cookie != nil {
+		req.AddCookie(cookie)
+	}
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+	return w
+}
+
+// sessionCookieFrom extracts the pansy_session cookie from a response.
+func sessionCookieFrom(t *testing.T, w *httptest.ResponseRecorder) *http.Cookie {
+	t.Helper()
+	for _, ck := range w.Result().Cookies() {
+		if ck.Name == sessionCookie {
+			return ck
+		}
+	}
+	t.Fatalf("no %s cookie set (status %d, body %s)", sessionCookie, w.Code, w.Body.String())
+	return nil
+}
+
+func TestRegisterLoginMeLogoutFlow(t *testing.T) {
+	r := authEngine(t, localCfg())
+
+	// Register auto-logs-in and sets a cookie.
+	w := doJSON(t, r, http.MethodPost, "/api/v1/auth/register",
+		map[string]string{"email": "[email protected]", "displayName": "Alice", "password": "password123"}, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("register status = %d, body %s", w.Code, w.Body.String())
+	}
+	cookie := sessionCookieFrom(t, w)
+	if !cookie.HttpOnly {
+		t.Error("session cookie must be HttpOnly")
+	}
+	if cookie.SameSite != http.SameSiteLaxMode {
+		t.Errorf("session cookie SameSite = %v, want Lax", cookie.SameSite)
+	}
+	if cookie.Secure {
+		t.Error("session cookie must not be Secure without an https base URL")
+	}
+
+	// /me with the cookie returns the user; password hash is never serialized.
+	w = doJSON(t, r, http.MethodGet, "/api/v1/auth/me", nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("me status = %d, body %s", w.Code, w.Body.String())
+	}
+	if strings.Contains(w.Body.String(), "password") {
+		t.Errorf("/me leaked a password field: %s", w.Body.String())
+	}
+
+	// Logout clears the cookie and invalidates the session.
+	w = doJSON(t, r, http.MethodPost, "/api/v1/auth/logout", nil, cookie)
+	if w.Code != http.StatusOK {
+		t.Fatalf("logout status = %d", w.Code)
+	}
+	w = doJSON(t, r, http.MethodGet, "/api/v1/auth/me", nil, cookie)
+	if w.Code != http.StatusUnauthorized {
+		t.Errorf("me after logout status = %d, want 401", w.Code)
+	}
+}
+
+func TestMeRequiresAuth(t *testing.T) {
+	r := authEngine(t, localCfg())
+	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/me", nil, nil)
+	if w.Code != http.StatusUnauthorized {
+		t.Errorf("me without cookie status = %d, want 401", w.Code)
+	}
+}
+
+func TestLoginWrongPasswordIs401(t *testing.T) {
+	r := authEngine(t, localCfg())
+	doJSON(t, r, http.MethodPost, "/api/v1/auth/register",
+		map[string]string{"email": "[email protected]", "displayName": "Alice", "password": "password123"}, nil)
+
+	w := doJSON(t, r, http.MethodPost, "/api/v1/auth/login",
+		map[string]string{"email": "[email protected]", "password": "wrong"}, nil)
+	if w.Code != http.StatusUnauthorized {
+		t.Errorf("bad login status = %d, want 401", w.Code)
+	}
+}
+
+func TestRegisterValidationRejectsShortPassword(t *testing.T) {
+	r := authEngine(t, localCfg())
+	w := doJSON(t, r, http.MethodPost, "/api/v1/auth/register",
+		map[string]string{"email": "[email protected]", "displayName": "Alice", "password": "short"}, nil)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("short-password register status = %d, want 400", w.Code)
+	}
+}
+
+func TestProvidersEndpoint(t *testing.T) {
+	r := authEngine(t, localCfg())
+	w := doJSON(t, r, http.MethodGet, "/api/v1/auth/providers", nil, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("providers status = %d", w.Code)
+	}
+	var got struct {
+		Local bool `json:"local"`
+		OIDC  bool `json:"oidc"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode providers: %v", err)
+	}
+	if !got.Local || got.OIDC {
+		t.Errorf("providers = %+v, want local=true oidc=false", got)
+	}
+}
+
+func TestSecureCookieWithHTTPSBaseURL(t *testing.T) {
+	cfg := localCfg()
+	cfg.BaseURL = "https://pansy.example.com"
+	r := authEngine(t, cfg)
+	w := doJSON(t, r, http.MethodPost, "/api/v1/auth/register",
+		map[string]string{"email": "[email protected]", "displayName": "Alice", "password": "password123"}, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("register status = %d", w.Code)
+	}
+	if !sessionCookieFrom(t, w).Secure {
+		t.Error("session cookie should be Secure when base URL is https")
+	}
+}