removed 'internal' directory

auth/auth.go

@@ -0,0 +1,49 @@
+package auth
+
+import (
+	_ "embed"
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/Bronku/iroon/models"
+	"github.com/Bronku/iroon/store"
+)
+
+type Authenticator struct {
+	sessions map[string]models.Token
+	s        *store.Store
+}
+
+func New(s *store.Store) *Authenticator {
+	var out Authenticator
+	var err error
+	out.s = s
+	out.sessions, err = s.GetSessions()
+	//fmt.Println(out.sessions)
+	if err != nil {
+		log.Fatal(err)
+	}
+	return &out
+}
+
+func (a *Authenticator) ensureAuth(in http.Handler) http.Handler {
+	fmt.Println("ensureAuth called")
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, err := a.getSession(r)
+		if err != nil {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		in.ServeHTTP(w, r)
+	})
+}
+
+func (a *Authenticator) Middleware(in http.Handler) http.Handler {
+	handler := http.NewServeMux()
+	handler.HandleFunc("GET /login", getLogin)
+	handler.HandleFunc("POST /login", a.login)
+	handler.HandleFunc("GET /logout", a.logout)
+	handler.Handle("/", a.ensureAuth(in))
+	return handler
+}

auth/credentials.go

@@ -0,0 +1,19 @@
+package auth
+
+import (
+	"errors"
+
+	"github.com/Bronku/iroon/crypto"
+)
+
+func (a *Authenticator) verifyCredentials(login, password string) error {
+	user, ok := a.s.GetUser(login)
+	if !ok {
+		return errors.New("user with this login doesn't exist")
+	}
+	hash := crypto.PasswordHash(password, user.Salt)
+	if hash == user.Password {
+		return nil
+	}
+	return errors.New("wrong credentials")
+}

auth/get.go

@@ -0,0 +1,17 @@
+package auth
+
+import (
+	"fmt"
+	"net/http"
+
+	_ "embed"
+)
+
+//go:embed  templates/login.html
+var loginHTML string
+
+func getLogin(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("content-type", "text/html")
+	fmt.Fprint(w, loginHTML)
+	return
+}

auth/session.go

@@ -0,0 +1,75 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/Bronku/iroon/models"
+)
+
+func (a *Authenticator) getSession(r *http.Request) (models.Token, error) {
+	c, err := r.Cookie("token")
+	if err != nil {
+		return models.Token{}, err
+	}
+	session, ok := a.sessions[c.Value]
+	if !ok {
+		return models.Token{}, errors.New("session not found")
+	}
+	if time.Since(session.Expiration) > 0 {
+		delete(a.sessions, c.Value)
+		err := a.s.CleanSessions()
+		if err != nil {
+			fmt.Println("error cleaning the sessions", err)
+		}
+		return models.Token{}, errors.New("session expired")
+	}
+	return session, nil
+}
+
+func (a *Authenticator) login(w http.ResponseWriter, r *http.Request) {
+	err := r.ParseForm()
+	if err != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+	login := r.PostFormValue("login")
+	password := r.PostFormValue("password")
+	if a.verifyCredentials(login, password) != nil {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+	cookie, err := a.newSession(login)
+	if err != nil {
+		w.Header().Set("content-type", "text/html")
+		fmt.Fprint(w, "internal server error")
+		return
+	}
+	http.SetCookie(w, &cookie)
+	http.Redirect(w, r, "/", http.StatusFound)
+}
+
+func (a *Authenticator) logout(w http.ResponseWriter, r *http.Request) {
+	var cookie http.Cookie
+	cookie.Name = "token"
+	cookie.Value = "nil"
+	cookie.HttpOnly = true
+	cookie.SameSite = http.SameSiteStrictMode
+	cookie.Path = "/"
+	http.SetCookie(w, &cookie)
+	http.Redirect(w, r, "/", http.StatusFound)
+	c, err := r.Cookie("token")
+	if err != nil {
+		return
+	}
+	_, ok := a.sessions[c.Value]
+	if !ok {
+		return
+	}
+	fmt.Println("removing session")
+	delete(a.sessions, c.Value)
+	err = a.s.RevokeSession(c.Value)
+	fmt.Println(err)
+}

auth/templates/login.html

@@ -0,0 +1,16 @@
+<header>
+    <h1>Login</h1>
+</header>
+<main>
+    <form method="post">
+        <label>Login</label>
+        <label>
+            <input type="text" name="login" />
+        </label>
+        <label>Password</label>
+        <label>
+            <input type="password" name="password" />
+        </label>
+        <button type="submit">login</button>
+    </form>
+</main>

auth/token.go

@@ -0,0 +1,30 @@
+package auth
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/Bronku/iroon/crypto"
+	"github.com/Bronku/iroon/models"
+)
+
+func (a *Authenticator) newSession(user string) (http.Cookie, error) {
+	key := crypto.GenerateKey()
+	var session models.Token
+	var cookie http.Cookie
+	session.User = user
+	session.Expiration = time.Now().Add(time.Hour * 24)
+	a.sessions[key] = session
+	err := a.s.AddSession(key, user, session.Expiration)
+	if err != nil {
+		return cookie, err
+	}
+
+	cookie.Name = "token"
+	cookie.Value = key
+	cookie.HttpOnly = true
+	cookie.SameSite = http.SameSiteStrictMode
+	cookie.Path = "/"
+	//cookie.Secure = true
+	return cookie, nil
+}