eintopf.info@v0.13.16/service/auth/auth.go

// Copyright (C) 2022 The Eintopf authors
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as
// published by the Free Software Foundation, either version 3 of the
// License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <https://www.gnu.org/licenses/>.

package auth

import (
	"context"
	"crypto/rsa"
	"fmt"
	"time"

	"github.com/golang-jwt/jwt/v4"

	"eintopf.info/internal/xerror"
)

// Service defines an authentication service.
// -go:generate go run github.com/petergtz/pegomock/pegomock generate eintopf.info/service/auth Service --output=../../internal/mock/auth_service.go --package=mock --mock-name=AuthService
type Service interface {
	// Login takes an email and a password. When valid returns a new JWT.
	Login(ctx context.Context, email, password string) (token string, err error)

	// Authenticate takes a JWT and checks wether it's valid.
	// If it is valid. It returns the stored id.
	Authenticate(token string) (id string, err error)

	// Authorize authorizes the given user identifier by returning its
	// authorization role.
	Authorize(ctx context.Context, id string) (role Role, err error)
}

// Authenticator determines wether a set of credentials are valid.
type Authenticator interface {
	// Validate takes an email and password and checks if they are valid.
	// If it is valid it returns a unique identifier corresponding to that
	// identifier.
	// It might return an error, when something unexpected happens during
	// validation.
	Validate(ctx context.Context, email, password string) (id string, err error)
}

// Role defines an authorization role.
type Role string

// Authorization roles.
const (
	RoleInternal  Role = "internal"
	RoleAdmin     Role = "admin"
	RoleModerator Role = "moderator"
	RoleNormal    Role = "normal"
)

// Authorizer checks the authorization for a given identifier.
type Authorizer interface {
	// Role returns the role for the given identifier.
	Role(ctx context.Context, id string) (role Role, err error)
}

// NewService returns a new authentication service.
func NewService(authenticator Authenticator, authorizer Authorizer, privateKey, publicKey []byte, tz *time.Location) (Service, error) {
	signKey, verifyKey, err := ParseAuthKeys(privateKey, publicKey)
	if err != nil {
		return nil, err
	}

	return &service{authenticator, authorizer, verifyKey, signKey, tz}, nil
}

type service struct {
	authenticator Authenticator
	authorizer    Authorizer

	verifyKey *rsa.PublicKey
	signKey   *rsa.PrivateKey
	tz        *time.Location
}

// ErrInvalidCredentials is the error, that gets returned by the login method, when
// the provided credentials where invalid.
var ErrInvalidCredentials = fmt.Errorf("invalid credentials")

// ErrDeactivated indicates, that the user is deactivated.
var ErrDeactivated = fmt.Errorf("deactivated")

func (s *service) Login(ctx context.Context, email, password string) (string, error) {
	id, err := s.authenticator.Validate(ctx, email, password)
	if err != nil {
		return "", err
	}
	if id == "" {
		return "", ErrInvalidCredentials
	}

	// Create a new token object, specifying signing method and the claims
	// you would like it to contain.
	token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
		"nbf": time.Date(2015, 10, 10, 12, 0, 0, 0, s.tz).Unix(),
		"id":  id,
	})

	// Sign and get the complete encoded token as a string using the secret
	tokenString, err := token.SignedString(s.signKey)
	if err != nil {
		return "", err
	}

	return tokenString, nil
}

func (s *service) Authenticate(tokenStr string) (string, error) {
	token, err := jwt.Parse(tokenStr, func(token *jwt.Token) (interface{}, error) {
		// since we only use the one private key to sign the tokens,
		// we also only use its public counter part to verify
		return s.verifyKey, nil
	})
	switch err.(type) {

	case nil: // no error

		if !token.Valid { // but may still be invalid
			return "", nil
		}

		claims, ok := token.Claims.(jwt.MapClaims)
		if !ok {
			return "", nil
		}

		id, ok := claims["id"].(string)
		if !ok {
			return "", nil
		}
		return id, nil
	case *jwt.ValidationError: // something was wrong during the validation
		return "", nil

	default: // something else went wrong
		return "", err
	}
}

// ErrUnauthorized indicates an unauthorized action.
var ErrUnauthorized = xerror.AuthError{Err: fmt.Errorf("unauthorized")}

func (s *service) Authorize(ctx context.Context, id string) (Role, error) {
	return s.authorizer.Role(ctx, id)
}