feat: jwt authentication

internal/domain/auth.go

@@ -0,0 +1,136 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type AuthRepository interface {
+	GetByEmail(ctx context.Context, email string) (*AuthUser, error)
+}
+
+type AuthService struct {
+	repo      AuthRepository
+	jwtSecret []byte
+}
+
+type AuthToken struct {
+	Token string `json:"token"`
+}
+
+type AuthUser struct {
+	ID           string
+	Email        string
+	Name         string
+	PasswordHash string
+}
+
+type AuthContext struct {
+	UserID string
+	Email  string
+	Name   string
+}
+
+func GetAuthContext(ctx context.Context) (*AuthContext, error) {
+	v := ctx.Value(AuthContextKey)
+	if v == nil {
+		return nil, errors.New("no auth context")
+	}
+	ac, ok := v.(*AuthContext)
+	if !ok {
+		return nil, errors.New("invalid auth context")
+	}
+	return ac, nil
+}
+
+func NewAuthService(r AuthRepository, jwtSecret []byte) *AuthService {
+	return &AuthService{repo: r, jwtSecret: jwtSecret}
+}
+
+func (s *AuthService) authenticate(ctx context.Context, email string, password string) (*AuthUser, error) {
+	user, err := s.repo.GetByEmail(ctx, email)
+	if err != nil {
+		return user, err
+	}
+
+	err = bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password))
+	if err != nil {
+		if errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
+			return user, errors.New("invalid email or password")
+		}
+		return user, err
+	}
+
+	return user, nil
+}
+
+func (s *AuthService) Login(ctx context.Context, email string, password string) (AuthToken, error) {
+	var authToken AuthToken
+
+	user, err := s.authenticate(ctx, email, password)
+	if err != nil {
+		return authToken, err
+	}
+
+	authToken.Token, err = s.GenerateToken(user)
+	if err != nil {
+		return authToken, err
+	}
+
+	return authToken, nil
+}
+
+type JWTClaims struct {
+	UserID string `json:"user_id"`
+	Email  string `json:"email"`
+	Name   string `json:"name"`
+	jwt.RegisteredClaims
+}
+
+type contextKey string
+
+const AuthContextKey = contextKey("auth")
+
+func (s *AuthService) GenerateToken(authUser *AuthUser) (string, error) {
+	claims := JWTClaims{
+		UserID: authUser.ID,
+		Email:  authUser.Email,
+		Name:   authUser.Name,
+	}
+	claims.ExpiresAt = jwt.NewNumericDate(time.Now().Add(time.Hour * 24))
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+
+	tokenString, err := token.SignedString(s.jwtSecret)
+	if err != nil {
+		return "", err
+	}
+
+	return tokenString, nil
+}
+
+func (s *AuthService) ParseToken(ctx context.Context, tokenString string) (*AuthContext, error) {
+	claims := &JWTClaims{}
+	token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (any, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return s.jwtSecret, nil
+	})
+	if err != nil || !token.Valid {
+		slog.ErrorContext(ctx, "invalid or expired token", slog.Any("token", token))
+		return nil, err
+	}
+
+	return &AuthContext{
+		UserID: claims.UserID,
+		Email:  claims.Email,
+		Name:   claims.Name,
+	}, nil
+}