moved to gorm

auth/auth.go

@@ -2,41 +2,41 @@ package auth
 
 import (
 	_ "embed"
-	"fmt"
+	"errors"
 	"log"
 	"net/http"
 
+	"github.com/Bronku/iroon/crypto"
 	"github.com/Bronku/iroon/models"
-	"github.com/Bronku/iroon/store"
+	"gorm.io/gorm"
 )
 
 type Authenticator struct {
-	sessions map[string]models.Token
-	s        *store.Store
+	db *gorm.DB
 }
 
-func New(s *store.Store) *Authenticator {
-	var out Authenticator
-	var err error
-	out.s = s
-	out.sessions, err = s.GetSessions()
-	//fmt.Println(out.sessions)
+func New(db *gorm.DB) Authenticator {
+	err := db.AutoMigrate(&models.User{}, &models.Token{})
 	if err != nil {
-		log.Fatal(err)
+		log.Fatal("failed to initialize authenticator", err)
 	}
-	return &out
+	return Authenticator{db}
 }
 
-func (a *Authenticator) ensureAuth(in http.Handler) http.Handler {
-	fmt.Println("ensureAuth called")
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		_, err := a.getSession(r)
-		if err != nil {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
-			return
-		}
-		in.ServeHTTP(w, r)
-	})
+// #todo only used once, maybe remove it entierly later
+func (a *Authenticator) verifyCredentials(login, password string) error {
+	var user models.User
+
+	result := a.db.First(&user, "login = ?", login)
+	if result.Error != nil {
+		return errors.New("user with this login doesn't exist")
+	}
+
+	hash := crypto.PasswordHash(password, user.Salt)
+	if hash == user.Password {
+		return nil
+	}
+	return errors.New("wrong credentials")
 }
 
 func (a *Authenticator) Middleware(in http.Handler) http.Handler {
@@ -44,6 +44,13 @@ func (a *Authenticator) Middleware(in http.Handler) http.Handler {
 	handler.HandleFunc("GET /login", getLogin)
 	handler.HandleFunc("POST /login", a.login)
 	handler.HandleFunc("GET /logout", a.logout)
-	handler.Handle("/", a.ensureAuth(in))
+	handler.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		_, err := a.getSession(r)
+		if err != nil {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		in.ServeHTTP(w, r)
+	})
 	return handler
 }

auth/credentials.go

@@ -1,19 +0,0 @@
-package auth
-
-import (
-	"errors"
-
-	"github.com/Bronku/iroon/crypto"
-)
-
-func (a *Authenticator) verifyCredentials(login, password string) error {
-	user, ok := a.s.GetUser(login)
-	if !ok {
-		return errors.New("user with this login doesn't exist")
-	}
-	hash := crypto.PasswordHash(password, user.Salt)
-	if hash == user.Password {
-		return nil
-	}
-	return errors.New("wrong credentials")
-}

auth/get.go

@@ -10,6 +10,7 @@ import (
 //go:embed  templates/login.html
 var loginHTML string
 
+// returns a simple login page
 func getLogin(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("content-type", "text/html")
 	fmt.Fprint(w, loginHTML)

auth/session.go

@@ -2,10 +2,10 @@ package auth
 
 import (
 	"errors"
-	"fmt"
 	"net/http"
 	"time"
 
+	"github.com/Bronku/iroon/crypto"
 	"github.com/Bronku/iroon/models"
 )
 
@@ -14,62 +14,62 @@ func (a *Authenticator) getSession(r *http.Request) (models.Token, error) {
 	if err != nil {
 		return models.Token{}, err
 	}
-	session, ok := a.sessions[c.Value]
-	if !ok {
+	var session models.Token
+	result := a.db.First(&session, c.Value)
+	if result.Error != nil {
 		return models.Token{}, errors.New("session not found")
 	}
 	if time.Since(session.Expiration) > 0 {
-		delete(a.sessions, c.Value)
-		err := a.s.CleanSessions()
-		if err != nil {
-			fmt.Println("error cleaning the sessions", err)
-		}
+		a.db.Delete(&session)
 		return models.Token{}, errors.New("session expired")
 	}
 	return session, nil
 }
 
 func (a *Authenticator) login(w http.ResponseWriter, r *http.Request) {
-	err := r.ParseForm()
-	if err != nil {
-		http.Redirect(w, r, "/login", http.StatusSeeOther)
-		return
-	}
+	r.ParseForm()
 	login := r.PostFormValue("login")
 	password := r.PostFormValue("password")
 	if a.verifyCredentials(login, password) != nil {
 		http.Redirect(w, r, "/login", http.StatusSeeOther)
 		return
 	}
-	cookie, err := a.newSession(login)
-	if err != nil {
-		w.Header().Set("content-type", "text/html")
-		fmt.Fprint(w, "internal server error")
-		return
-	}
+	cookie := a.newSession(login)
 	http.SetCookie(w, &cookie)
 	http.Redirect(w, r, "/", http.StatusFound)
 }
 
 func (a *Authenticator) logout(w http.ResponseWriter, r *http.Request) {
-	var cookie http.Cookie
-	cookie.Name = "token"
-	cookie.Value = "nil"
-	cookie.HttpOnly = true
-	cookie.SameSite = http.SameSiteStrictMode
-	cookie.Path = "/"
+	cookie := http.Cookie{
+		Name:     "Token",
+		Value:    "nil",
+		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
+		Path:     "/",
+	}
 	http.SetCookie(w, &cookie)
 	http.Redirect(w, r, "/", http.StatusFound)
 	c, err := r.Cookie("token")
 	if err != nil {
 		return
 	}
-	_, ok := a.sessions[c.Value]
-	if !ok {
-		return
-	}
-	fmt.Println("removing session")
-	delete(a.sessions, c.Value)
-	err = a.s.RevokeSession(c.Value)
-	fmt.Println(err)
+	a.db.Delete(&models.Token{}, c.Value)
+}
+
+func (a *Authenticator) newSession(user string) http.Cookie {
+	key := crypto.GenerateKey()
+	var session models.Token
+	session.User = user
+	session.Expiration = time.Now().Add(time.Hour * 24)
+	a.db.Create(&session)
+
+	cookie := http.Cookie{
+		Name:     "token",
+		Value:    key,
+		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
+		Path:     "/",
+		// Secure: true, #todo
+	}
+	return cookie
 }

auth/token.go

@@ -1,30 +0,0 @@
-package auth
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/Bronku/iroon/crypto"
-	"github.com/Bronku/iroon/models"
-)
-
-func (a *Authenticator) newSession(user string) (http.Cookie, error) {
-	key := crypto.GenerateKey()
-	var session models.Token
-	var cookie http.Cookie
-	session.User = user
-	session.Expiration = time.Now().Add(time.Hour * 24)
-	a.sessions[key] = session
-	err := a.s.AddSession(key, user, session.Expiration)
-	if err != nil {
-		return cookie, err
-	}
-
-	cookie.Name = "token"
-	cookie.Value = key
-	cookie.HttpOnly = true
-	cookie.SameSite = http.SameSiteStrictMode
-	cookie.Path = "/"
-	//cookie.Secure = true
-	return cookie, nil
-}