84 lines
2.5 KiB
Go
84 lines
2.5 KiB
Go
package access
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
// ProfileTokenService mints and validates profile verification tokens.
|
|
type ProfileTokenService struct {
|
|
secret []byte
|
|
ttl time.Duration
|
|
}
|
|
|
|
type profileJWTClaims struct {
|
|
UserID int `json:"user_id"`
|
|
SessionID string `json:"session_id"`
|
|
ProfileID string `json:"profile_id"`
|
|
PolicyRevision int64 `json:"policy_revision"`
|
|
jwt.RegisteredClaims
|
|
}
|
|
|
|
// NewProfileTokenService creates a profile token service.
|
|
func NewProfileTokenService(secret string, ttl time.Duration) *ProfileTokenService {
|
|
return &ProfileTokenService{secret: []byte(secret), ttl: ttl}
|
|
}
|
|
|
|
// Mint creates a signed profile token. When ttl is zero or negative, the token
|
|
// is durable and is invalidated by session/profile/policy checks instead.
|
|
func (s *ProfileTokenService) Mint(claims ProfileTokenClaims) (string, time.Time, error) {
|
|
now := time.Now().UTC()
|
|
var expiresAt time.Time
|
|
registeredClaims := jwt.RegisteredClaims{
|
|
IssuedAt: jwt.NewNumericDate(now),
|
|
}
|
|
if s.ttl > 0 {
|
|
expiresAt = now.Add(s.ttl)
|
|
registeredClaims.ExpiresAt = jwt.NewNumericDate(expiresAt)
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, profileJWTClaims{
|
|
UserID: claims.UserID,
|
|
SessionID: claims.SessionID,
|
|
ProfileID: claims.ProfileID,
|
|
PolicyRevision: claims.PolicyRevision,
|
|
RegisteredClaims: registeredClaims,
|
|
})
|
|
signed, err := token.SignedString(s.secret)
|
|
if err != nil {
|
|
return "", time.Time{}, fmt.Errorf("signing profile token: %w", err)
|
|
}
|
|
return signed, expiresAt, nil
|
|
}
|
|
|
|
// Validate parses and validates a profile token.
|
|
func (s *ProfileTokenService) Validate(tokenStr string) (*ProfileTokenClaims, error) {
|
|
if tokenStr == "" {
|
|
return nil, ErrProfileUnverified
|
|
}
|
|
claims := &profileJWTClaims{}
|
|
token, err := jwt.ParseWithClaims(tokenStr, claims, func(token *jwt.Token) (interface{}, error) {
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
|
}
|
|
return s.secret, nil
|
|
})
|
|
if err != nil {
|
|
if errors.Is(err, jwt.ErrTokenExpired) {
|
|
return nil, fmt.Errorf("%w: expired", ErrProfileUnverified)
|
|
}
|
|
return nil, fmt.Errorf("%w: %v", ErrProfileUnverified, err)
|
|
}
|
|
if !token.Valid {
|
|
return nil, ErrProfileUnverified
|
|
}
|
|
return &ProfileTokenClaims{
|
|
UserID: claims.UserID,
|
|
SessionID: claims.SessionID,
|
|
ProfileID: claims.ProfileID,
|
|
PolicyRevision: claims.PolicyRevision,
|
|
}, nil
|
|
}
|