Files
silo-server/internal/access/profile_token.go

84 lines
2.5 KiB
Go

package access
import (
"errors"
"fmt"
"time"
"github.com/golang-jwt/jwt/v5"
)
// ProfileTokenService mints and validates profile verification tokens.
type ProfileTokenService struct {
secret []byte
ttl time.Duration
}
type profileJWTClaims struct {
UserID int `json:"user_id"`
SessionID string `json:"session_id"`
ProfileID string `json:"profile_id"`
PolicyRevision int64 `json:"policy_revision"`
jwt.RegisteredClaims
}
// NewProfileTokenService creates a profile token service.
func NewProfileTokenService(secret string, ttl time.Duration) *ProfileTokenService {
return &ProfileTokenService{secret: []byte(secret), ttl: ttl}
}
// Mint creates a signed profile token. When ttl is zero or negative, the token
// is durable and is invalidated by session/profile/policy checks instead.
func (s *ProfileTokenService) Mint(claims ProfileTokenClaims) (string, time.Time, error) {
now := time.Now().UTC()
var expiresAt time.Time
registeredClaims := jwt.RegisteredClaims{
IssuedAt: jwt.NewNumericDate(now),
}
if s.ttl > 0 {
expiresAt = now.Add(s.ttl)
registeredClaims.ExpiresAt = jwt.NewNumericDate(expiresAt)
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, profileJWTClaims{
UserID: claims.UserID,
SessionID: claims.SessionID,
ProfileID: claims.ProfileID,
PolicyRevision: claims.PolicyRevision,
RegisteredClaims: registeredClaims,
})
signed, err := token.SignedString(s.secret)
if err != nil {
return "", time.Time{}, fmt.Errorf("signing profile token: %w", err)
}
return signed, expiresAt, nil
}
// Validate parses and validates a profile token.
func (s *ProfileTokenService) Validate(tokenStr string) (*ProfileTokenClaims, error) {
if tokenStr == "" {
return nil, ErrProfileUnverified
}
claims := &profileJWTClaims{}
token, err := jwt.ParseWithClaims(tokenStr, claims, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
}
return s.secret, nil
})
if err != nil {
if errors.Is(err, jwt.ErrTokenExpired) {
return nil, fmt.Errorf("%w: expired", ErrProfileUnverified)
}
return nil, fmt.Errorf("%w: %v", ErrProfileUnverified, err)
}
if !token.Valid {
return nil, ErrProfileUnverified
}
return &ProfileTokenClaims{
UserID: claims.UserID,
SessionID: claims.SessionID,
ProfileID: claims.ProfileID,
PolicyRevision: claims.PolicyRevision,
}, nil
}