auth.go

package main

import (
	"chirpy/internal/auth"
	"chirpy/internal/database"
	"encoding/json"
	"errors"
	"net/http"
	"strconv"
	"time"
)

func (cfg *apiConfig) handleLogin(w http.ResponseWriter, r *http.Request) {
	type parameters struct {
		Email    string `json:"email"`
		Password string `json:"password"`
	}
	type response struct {
		User
		Token        string `json:"token"`
		RefreshToken string `json:"refresh_token"`
	}

	decoder := json.NewDecoder(r.Body)
	params := parameters{}
	err := decoder.Decode(&params)

	if err != nil {
		respondWithError(w, http.StatusInternalServerError, "Couldn't decode parameters")
		return
	}

	user, err := cfg.DB.GetUserByEmail(params.Email)
	if err != nil {
		respondWithError(w, http.StatusNotFound, "Couldn't find user")
		return
	}

	err = auth.CheckPasswordHash(params.Password, user.HashedPassword)
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Wrong credentials")
		return
	}

	token, err := auth.MakeJWT(user.ID, "chirpy-access", cfg.jwtSecret, time.Duration(1*time.Hour))
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Error making JWT Access Token")
		return
	}

	refreshToken, err := auth.MakeJWT(user.ID, "chirpy-refresh", cfg.jwtSecret, time.Duration(60*24*time.Hour))
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Error making JWT Refresh Token")
		return
	}

	respondWithJSON(
		w,
		http.StatusOK,
		response{
			User:         User{ID: user.ID, Email: user.Email, IsChirpyRed: user.IsChirpyRed},
			Token:        token,
			RefreshToken: refreshToken,
		},
	)
}

func (cfg *apiConfig) handleRefresh(w http.ResponseWriter, r *http.Request) {
	type response struct {
		Token string `json:"token"`
	}

	token, err := auth.GetBearerToken(r.Header)
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Couldn't find JWT")
		return
	}

	subject, err := auth.ValidateRefreshJWT(token, cfg.jwtSecret)
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Couldn't Validate JWT")
		return
	}

	if _, err := cfg.DB.GetRevocation(token); !errors.Is(err, database.ErrNotExist) {
		respondWithError(w, http.StatusUnauthorized, "This token is revoked")
		return
	}

	userID, err := strconv.Atoi(subject)
	if err != nil {
		respondWithError(w, http.StatusInternalServerError, "Couldn't parse user ID")
		return
	}

	accessToken, err := auth.MakeJWT(userID, "chirpy-access", cfg.jwtSecret, time.Duration(1*time.Hour))
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Error making JWT Access Token")
		return
	}

	respondWithJSON(w, http.StatusOK, response{Token: accessToken})
}

func (cfg *apiConfig) handleRevoke(w http.ResponseWriter, r *http.Request) {
	token, err := auth.GetBearerToken(r.Header)
	if err != nil {
		respondWithError(w, http.StatusUnauthorized, "Couldn't find JWT")
		return
	}

	_, err = cfg.DB.GetRevocation(token)
	if err == nil {
		respondWithError(w, http.StatusBadRequest, "Token was already revoked")
		return
	}

	if err != database.ErrNotExist {
		respondWithError(w, http.StatusInternalServerError, "Error fetching revocation")
		return
	}

	_, err = cfg.DB.CreateRevocation(token)
	if err != nil {
		respondWithError(w, http.StatusInternalServerError, "Error revoking token")
		return
	}
	respondWithJSON(w, http.StatusOK, "Token revoked successfuly")
}