1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
|
package models
import (
"auth-proxy/database"
"auth-proxy/types"
"crypto/rand"
"database/sql"
"encoding/hex"
"time"
)
// GenerateSecureToken creates a random, secure token.
func GenerateSecureToken(length int) (string, error) {
bytes := make([]byte, length)
if _, err := rand.Read(bytes); err != nil {
return "", err
}
return hex.EncodeToString(bytes), nil
}
// CreateAuthToken creates a new token for a user, deleting any existing ones.
func CreateAuthToken(userID int64, duration time.Duration) (*types.AuthToken, error) {
tokenString, err := GenerateSecureToken(32)
if err != nil {
return nil, err
}
expiresAt := time.Now().Add(duration)
tx, err := database.DB.Begin()
if err != nil {
return nil, err
}
defer tx.Rollback() //nolint:errcheck
// Delete existing tokens for the user
deleteQuery := database.Rebind("DELETE FROM auth_tokens WHERE user_id = ?")
if _, err := tx.Exec(deleteQuery, userID); err != nil {
return nil, err
}
// Insert the new token
insertQuery := database.Rebind("INSERT INTO auth_tokens (user_id, token, expires_at) VALUES (?, ?, ?)")
if _, err := tx.Exec(insertQuery, userID, tokenString, expiresAt); err != nil {
return nil, err
}
if err := tx.Commit(); err != nil {
return nil, err
}
return &types.AuthToken{
UserID: userID,
Token: tokenString,
ExpiresAt: expiresAt,
}, nil
}
// GetUserByToken retrieves a user associated with a given token.
// It returns the user if the token is valid and not expired.
func GetUserByToken(tokenString string) (*types.User, error) {
query := database.Rebind("SELECT u.id, u.username, u.password_hash, u.role, u.is_active, u.failed_logins, u.last_login_at, u.created_at, u.updated_at FROM users u JOIN auth_tokens t ON u.id = t.user_id WHERE t.token = ? AND t.expires_at > ?")
row := database.DB.QueryRow(query, tokenString, time.Now())
user := &types.User{}
err := row.Scan(&user.ID, &user.Username, &user.PasswordHash, &user.Role, &user.IsActive, &user.FailedLogins, &user.LastLoginAt, &user.CreatedAt, &user.UpdatedAt)
if err != nil {
if err == sql.ErrNoRows {
return nil, nil // Token not found or expired, not a server error
}
return nil, err
}
return user, nil
}
// DeleteAuthToken deletes a token from the database.
func DeleteAuthToken(tokenString string) error {
query := database.Rebind("DELETE FROM auth_tokens WHERE token = ?")
_, err := database.DB.Exec(query, tokenString)
return err
}
// DeleteExpiredTokens cleans up expired tokens from the database.
func DeleteExpiredTokens() (int64, error) {
query := database.Rebind("DELETE FROM auth_tokens WHERE expires_at < ?")
res, err := database.DB.Exec(query, time.Now())
if err != nil {
return 0, err
}
return res.RowsAffected()
}
// CreateRefreshToken creates a new refresh token for a user.
func CreateRefreshToken(userID int64, duration time.Duration) (*types.RefreshToken, error) {
tokenString, err := GenerateSecureToken(32)
if err != nil {
return nil, err
}
expiresAt := time.Now().Add(duration)
tx, err := database.DB.Begin()
if err != nil {
return nil, err
}
defer tx.Rollback() //nolint:errcheck
// Delete existing, non-revoked refresh tokens for the user
deleteQuery := database.Rebind("DELETE FROM refresh_tokens WHERE user_id = ?")
if _, err := tx.Exec(deleteQuery, userID); err != nil {
return nil, err
}
// Insert the new refresh token
insertQuery := database.Rebind("INSERT INTO refresh_tokens (user_id, token, expires_at) VALUES (?, ?, ?)")
if _, err := tx.Exec(insertQuery, userID, tokenString, expiresAt); err != nil {
return nil, err
}
if err := tx.Commit(); err != nil {
return nil, err
}
return &types.RefreshToken{
UserID: userID,
Token: tokenString,
ExpiresAt: expiresAt,
}, nil
}
// GetRefreshTokenByToken retrieves a refresh token by its token string.
func GetRefreshTokenByToken(tokenString string) (*types.RefreshToken, error) {
query := database.Rebind("SELECT id, user_id, token, expires_at, is_revoked FROM refresh_tokens WHERE token = ?")
row := database.DB.QueryRow(query, tokenString)
token := &types.RefreshToken{}
err := row.Scan(&token.ID, &token.UserID, &token.Token, &token.ExpiresAt, &token.IsRevoked)
if err != nil {
if err == sql.ErrNoRows {
return nil, nil // Not found
}
return nil, err
}
return token, nil
}
// DeleteRefreshTokenByToken deletes a refresh token from the database by its token string.
func DeleteRefreshTokenByToken(tokenString string) error {
query := database.Rebind("DELETE FROM refresh_tokens WHERE token = ?")
_, err := database.DB.Exec(query, tokenString)
return err
}
|
