Basic Access & Refresh Token
This commit is contained in:
@@ -4,7 +4,6 @@ import (
|
||||
"errors"
|
||||
|
||||
"github.com/google/uuid"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
log "github.com/sirupsen/logrus"
|
||||
"gorm.io/gorm"
|
||||
"reichard.io/imagini/internal/db"
|
||||
@@ -35,7 +34,7 @@ func NewMgr(db *db.DBManager, c *config.Config) *AuthManager {
|
||||
}
|
||||
}
|
||||
|
||||
func (auth *AuthManager) AuthenticateUser(creds models.APICredentials) bool {
|
||||
func (auth *AuthManager) AuthenticateUser(creds models.APICredentials) (bool, models.User) {
|
||||
// By Username
|
||||
foundUser, err := auth.DB.User(models.User{Username: creds.User})
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
@@ -45,10 +44,10 @@ func (auth *AuthManager) AuthenticateUser(creds models.APICredentials) bool {
|
||||
// Error Checking
|
||||
if errors.Is(err, gorm.ErrRecordNotFound) {
|
||||
log.Warn("[auth] User not found: ", creds.User)
|
||||
return false
|
||||
return false, foundUser
|
||||
} else if err != nil {
|
||||
log.Error(err)
|
||||
return false
|
||||
return false, foundUser
|
||||
}
|
||||
|
||||
log.Info("[auth] Authenticating user: ", foundUser.Username)
|
||||
@@ -56,76 +55,59 @@ func (auth *AuthManager) AuthenticateUser(creds models.APICredentials) bool {
|
||||
// Determine Type
|
||||
switch foundUser.AuthType {
|
||||
case "Local":
|
||||
return authenticateLocalUser(foundUser, creds.Password)
|
||||
return authenticateLocalUser(foundUser, creds.Password), foundUser
|
||||
case "LDAP":
|
||||
return authenticateLDAPUser(foundUser, creds.Password)
|
||||
return authenticateLDAPUser(foundUser, creds.Password), foundUser
|
||||
default:
|
||||
return false
|
||||
return false, foundUser
|
||||
}
|
||||
}
|
||||
|
||||
func (auth *AuthManager) ValidateJWTToken(userJWT string) bool {
|
||||
byteUserJWT := []byte(userJWT)
|
||||
|
||||
serverToken, err := jwt.ParseBytes(byteUserJWT, jwt.WithVerify(jwa.HS256, auth.Config.JWTSecret))
|
||||
func (auth *AuthManager) getRole(user models.User) string {
|
||||
// TODO: Lookup role of user
|
||||
return "User"
|
||||
}
|
||||
|
||||
func (auth *AuthManager) ValidateJWTAccessToken(accessJWT string) (jwt.Token, bool) {
|
||||
byteAccessJWT := []byte(accessJWT)
|
||||
verifiedToken, err := jwt.ParseBytes(byteAccessJWT, jwt.WithVerify(jwa.HS256, []byte(auth.Config.JWTSecret)))
|
||||
if err != nil {
|
||||
fmt.Println("failed to parse payload: ", err)
|
||||
return nil, false
|
||||
}
|
||||
|
||||
uid, ok := serverToken.Get("uid");
|
||||
if !ok {
|
||||
fmt.Println("failed to acquire uid")
|
||||
}
|
||||
|
||||
userID := fmt.Sprintf("%v", uid)
|
||||
userKey := auth.Session.Get(userID)
|
||||
|
||||
userToken, err := jwt.ParseBytes(byteUserJWT, jwt.WithVerify(jwa.HS256, userKey))
|
||||
if err != nil {
|
||||
fmt.Println("failed to parse payload: ", err)
|
||||
}
|
||||
_ = userToken
|
||||
|
||||
// TODO:
|
||||
// - Get User ID from UNVALIDATED token
|
||||
// - Lookup user key, concat with server key
|
||||
// - Validate with concatted user & server key
|
||||
// validatedToken, err := jwt.ParseBytes(byteUserJWT, jwt.WithVerify(jwa.HS256, concatKey))
|
||||
// if err != nil {
|
||||
// fmt.Printf("failed to parse payload: %s\n", err)
|
||||
// }
|
||||
|
||||
// userToken := auth.Session.Get(userID)
|
||||
// log.Info("[auth] DEBUG: ", userToken)
|
||||
|
||||
return false
|
||||
return verifiedToken, true
|
||||
}
|
||||
|
||||
func (auth *AuthManager) RevokeRefreshToken() {
|
||||
|
||||
}
|
||||
|
||||
func (auth *AuthManager) ValidateRefreshToken(refreshToken, deviceID string) bool {
|
||||
// Acquire Device
|
||||
deviceUUID, err := uuid.Parse(deviceID)
|
||||
device := models.Device{Base: models.Base{UUID: deviceUUID}}
|
||||
foundDevice, err := auth.DB.Device(device)
|
||||
func (auth *AuthManager) ValidateJWTRefreshToken(refreshJWT string) (jwt.Token, bool) {
|
||||
byteRefreshJWT := []byte(refreshJWT)
|
||||
|
||||
// Validate Expiration
|
||||
expTime, err := time.Parse(time.RFC3339, foundDevice.RefreshExp)
|
||||
if expTime.Before(time.Now()) {
|
||||
return false
|
||||
// Acquire Relevant Device
|
||||
unverifiedToken, err := jwt.ParseBytes(byteRefreshJWT)
|
||||
did, ok := unverifiedToken.Get("did")
|
||||
if !ok {
|
||||
return nil, false
|
||||
}
|
||||
deviceID, err := uuid.Parse(fmt.Sprintf("%v", did))
|
||||
if err != nil {
|
||||
return nil, false
|
||||
}
|
||||
device, err := auth.DB.Device(models.Device{Base: models.Base{UUID: deviceID}})
|
||||
if err != nil {
|
||||
return nil, false
|
||||
}
|
||||
|
||||
// Validate Token
|
||||
bRefreshToken :=[]byte(refreshToken)
|
||||
err = bcrypt.CompareHashAndPassword([]byte(foundDevice.RefreshToken), bRefreshToken)
|
||||
if err == nil {
|
||||
log.Info("[auth] Refresh Token validation succeeded: ", foundDevice.UUID)
|
||||
return true
|
||||
// Verify Token
|
||||
verifiedToken, err := jwt.ParseBytes(byteRefreshJWT, jwt.WithVerify(jwa.HS256, []byte(device.RefreshKey)))
|
||||
if err != nil {
|
||||
fmt.Println("failed to parse payload: ", err)
|
||||
return nil, false
|
||||
}
|
||||
log.Warn("[auth] Refresh Token validation failed: ", foundDevice.UUID)
|
||||
return false
|
||||
return verifiedToken, true
|
||||
}
|
||||
|
||||
func (auth *AuthManager) UpdateRefreshToken(deviceID string) error {
|
||||
@@ -135,30 +117,49 @@ func (auth *AuthManager) UpdateRefreshToken(deviceID string) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
func (auth *AuthManager) CreateRefreshToken(deviceID string) (string, error) {
|
||||
// TODO:
|
||||
// - Create regular bcrypt password
|
||||
// - Create Expiration (Depends on Device Type)
|
||||
// - Store in DB: DeviceID, ValidUntil
|
||||
func (auth *AuthManager) CreateJWTRefreshToken(user models.User, device models.Device) (string, error) {
|
||||
// Acquire Refresh Key
|
||||
byteKey := []byte(device.RefreshKey)
|
||||
|
||||
generatedToken := uuid.New().String()
|
||||
hashedRefreshToken, err := bcrypt.GenerateFromPassword([]byte(generatedToken), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
log.Error(err)
|
||||
return "", err
|
||||
}
|
||||
_ = string(hashedRefreshToken)
|
||||
|
||||
return "", nil
|
||||
}
|
||||
|
||||
func (auth *AuthManager) CreateJWTAccessToken(user, role, deviceID string) (string, error) {
|
||||
// Create New Token
|
||||
tm := time.Now()
|
||||
t := jwt.New()
|
||||
t.Set(`did`, deviceID) // Device ID
|
||||
t.Set(`did`, device.UUID) // Device ID
|
||||
t.Set(jwt.SubjectKey, user.UUID) // User ID
|
||||
t.Set(jwt.AudienceKey, `imagini`) // App ID
|
||||
t.Set(jwt.IssuedAtKey, tm) // Issued At
|
||||
|
||||
// TODO: Depends on Device
|
||||
t.Set(jwt.ExpirationKey, tm.Add(time.Hour * 24)) // 1 Day Access Key
|
||||
|
||||
// Validate Token Creation
|
||||
_, err := json.MarshalIndent(t, "", " ")
|
||||
if err != nil {
|
||||
fmt.Printf("failed to generate JSON: %s\n", err)
|
||||
return "", err
|
||||
}
|
||||
|
||||
// Sign Token
|
||||
signed, err := jwt.Sign(t, jwa.HS256, byteKey)
|
||||
if err != nil {
|
||||
log.Printf("failed to sign token: %s", err)
|
||||
return "", err
|
||||
}
|
||||
|
||||
// Return Token
|
||||
return string(signed), nil
|
||||
}
|
||||
|
||||
func (auth *AuthManager) CreateJWTAccessToken(user models.User, device models.Device) (string, error) {
|
||||
// Acquire Role
|
||||
role := auth.getRole(user)
|
||||
|
||||
// Create New Token
|
||||
tm := time.Now()
|
||||
t := jwt.New()
|
||||
t.Set(`did`, device.UUID) // Device ID
|
||||
t.Set(`role`, role) // User Role (Admin / User)
|
||||
t.Set(jwt.SubjectKey, user) // User ID
|
||||
t.Set(jwt.SubjectKey, user.UUID) // User ID
|
||||
t.Set(jwt.AudienceKey, `imagini`) // App ID
|
||||
t.Set(jwt.IssuedAtKey, tm) // Issued At
|
||||
t.Set(jwt.ExpirationKey, tm.Add(time.Minute * 30)) // 30 Minute Access Key
|
||||
|
||||
Reference in New Issue
Block a user