Initial

backend/internal/rest/handler_auth.go

@@ -0,0 +1,95 @@
+package rest
+
+import (
+	"net/http"
+
+	"goAuth/internal/auth"
+	"goAuth/internal/user"
+)
+
+type signupRequest struct {
+	Login    string `json:"login"`
+	Password string `json:"password"`
+	Invite   string `json:"invite"`
+}
+
+type signinRequest struct {
+	Login    string `json:"login"`
+	Password string `json:"password"`
+	Remember bool   `json:"remember"`
+}
+
+func (h *Handler) signup(w http.ResponseWriter, r *http.Request) {
+	var req signupRequest
+	if err := decodeJson(r, &req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+
+	if !verifyLogin(req.Login) {
+		writeError(w, http.StatusBadRequest, "invalid login")
+		return
+	}
+	if !verifyPassword(req.Password) {
+		writeError(w, http.StatusBadRequest, "invalid password")
+		return
+	}
+	if req.Invite == "" {
+		writeError(w, http.StatusBadRequest, "invite is required")
+		return
+	}
+
+	address := clientAddress(r)
+	device := h.sessions.ClassifiedUserAgent(r.UserAgent())
+
+	u, session, err := h.sessions.RegisterUser(r.Context(), req.Login, req.Password, req.Invite, address, device)
+	if err != nil {
+		h.fail(w, err)
+		return
+	}
+
+	auth.SigninSetup(w, h.cfg.Cookies.SessionName, session.Token, session.ExpiresAt, h.cfg.Cookies.Secure)
+	h.refreshCsrf(w)
+	writeJson(w, http.StatusCreated, newUserResponse(u))
+}
+
+func (h *Handler) signin(w http.ResponseWriter, r *http.Request) {
+	var req signinRequest
+	if err := decodeJson(r, &req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if req.Login == "" || req.Password == "" {
+		writeError(w, http.StatusBadRequest, "login and password are required")
+		return
+	}
+
+	address := clientAddress(r)
+	device := h.sessions.ClassifiedUserAgent(r.UserAgent())
+
+	u, session, err := h.sessions.LoginUser(r.Context(), req.Login, req.Password, address, device, req.Remember)
+	if err != nil {
+		if err == user.ErrNotFound || err == user.ErrInvalidPassword {
+			writeError(w, http.StatusUnauthorized, "invalid credentials")
+			return
+		}
+		h.fail(w, err)
+		return
+	}
+
+	auth.SigninSetup(w, h.cfg.Cookies.SessionName, session.Token, session.ExpiresAt, h.cfg.Cookies.Secure)
+	h.refreshCsrf(w)
+	writeJson(w, http.StatusOK, newUserResponse(u))
+}
+
+func (h *Handler) signout(w http.ResponseWriter, r *http.Request) {
+	session := sessionFromRequest(r)
+	if err := h.sessions.DeleteSession(r.Context(), session); err != nil {
+		h.fail(w, err)
+		return
+	}
+
+	auth.SignoutCleanup(w, h.cfg.Cookies.SessionName, h.cfg.Cookies.Secure)
+	h.refreshCsrf(w)
+	writeNoContent(w)
+}