1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
package handlers
import (
"auth-proxy/config"
"auth-proxy/logging"
"auth-proxy/models"
"auth-proxy/utils"
"encoding/json"
"net/http"
"time"
)
// RefreshTokenHandler handles exchanging a valid refresh token for a new access token.
func RefreshTokenHandler(w http.ResponseWriter, r *http.Request) {
ip := logging.GetClientIP(r)
// 1. Parse request body
var reqBody struct {
RefreshToken string `json:"refresh_token"`
}
if err := json.NewDecoder(r.Body).Decode(&reqBody); err != nil {
http.Error(w, "Invalid request body", http.StatusBadRequest)
return
}
if reqBody.RefreshToken == "" {
http.Error(w, "Missing refresh_token", http.StatusBadRequest)
return
}
// 2. Validate the refresh token in DB
refreshToken, err := models.GetRefreshTokenByToken(reqBody.RefreshToken)
if err != nil {
logging.AppLog.Error("Error getting refresh token from DB", "error", err, "ip", ip)
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
return
}
if refreshToken == nil || refreshToken.IsRevoked || time.Now().After(refreshToken.ExpiresAt) {
logging.SecurityLog.Warn("REFRESH TOKEN FAIL", "reason", "token not found, revoked, or expired", "ip", ip)
http.Error(w, "Unauthorized: Invalid refresh token", http.StatusUnauthorized)
return
}
// 3. Get user info
user, err := models.GetUserByID(refreshToken.UserID)
if err != nil || user == nil {
logging.AppLog.Error("Failed to get user from refresh token", "error", err, "user_id", refreshToken.UserID, "ip", ip)
http.Error(w, "Unauthorized: User not found", http.StatusUnauthorized)
return
}
// 4. Issue a new access token
newAccessToken, err := utils.GenerateJWT(user, time.Duration(config.Paths.AccessTokenDurationMinutes)*time.Minute, "access")
if err != nil {
logging.AppLog.Error("Failed to generate new access token", "error", err, "username", user.Username, "ip", ip)
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
return
}
// --- Optional: Token Rotation ---
// 5. Delete the old refresh token
if err := models.DeleteRefreshTokenByToken(refreshToken.Token); err != nil {
logging.AppLog.Error("Failed to delete old refresh token", "error", err, "ip", ip)
// Continue, but log the error
}
// 6. Issue a new refresh token
newRefreshToken, err := models.CreateRefreshToken(user, time.Duration(config.Paths.RefreshTokenDurationDays)*24*time.Hour)
if err != nil {
logging.AppLog.Error("Failed to create new refresh token", "error", err, "username", user.Username, "ip", ip)
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
return
}
// --- End Token Rotation ---
// 7. Respond with new tokens
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusOK)
if err := json.NewEncoder(w).Encode(map[string]string{
"access_token": newAccessToken,
"refresh_token": newRefreshToken.Token,
}); err != nil {
logging.AppLog.Error("Failed to encode token response", "error", err, "ip", ip)
}
}
// TokenHandler handles issuing JWT tokens for API clients.
func TokenHandler(w http.ResponseWriter, r *http.Request) {
ip := logging.GetClientIP(r)
if r.Method != http.MethodPost {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
var creds struct {
Username string `json:"username"`
Password string `json:"password"`
}
if err := json.NewDecoder(r.Body).Decode(&creds); err != nil {
http.Error(w, "Invalid request body", http.StatusBadRequest)
return
}
// Use the shared authentication logic
user, err := authenticateUser(creds.Username, creds.Password, ip)
if err != nil {
// Return a generic error to the API client
http.Error(w, "Unauthorized: "+err.Error(), http.StatusUnauthorized)
return
}
// --- Issue Tokens ---
// Access Token
accessToken, err := utils.GenerateJWT(user, time.Duration(config.Paths.AccessTokenDurationMinutes)*time.Minute, "access")
if err != nil {
logging.AppLog.Error("Failed to generate access token", "error", err, "username", user.Username, "ip", ip)
http.Error(w, "Failed to generate access token", http.StatusInternalServerError)
return
}
// Refresh Token
refreshToken, err := models.CreateRefreshToken(user, time.Duration(config.Paths.RefreshTokenDurationDays)*24*time.Hour)
if err != nil {
logging.AppLog.Error("Failed to create refresh token", "error", err, "username", user.Username, "ip", ip)
http.Error(w, "Failed to create refresh token", http.StatusInternalServerError)
return
}
// --- End Issue Tokens ---
w.Header().Set("Content-Type", "application/json")
w.WriteHeader(http.StatusOK)
if err := json.NewEncoder(w).Encode(map[string]string{
"access_token": accessToken,
"refresh_token": refreshToken.Token,
}); err != nil {
logging.AppLog.Error("Failed to encode token response", "error", err, "ip", ip)
}
}
|
