mkelvers/mal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: add recovery and account security

Browse Source
This commit is contained in:
mkelvers
2026-04-11 18:05:51 +02:00
parent 810a50c606
commit 6b83f6bde6
11 changed files with 424 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

144
internal/features/auth/auth.go
View File

@@ -3,8 +3,10 @@ package auth
import (
"context"
"crypto/rand"
"crypto/sha256"
"database/sql"
"encoding/base64"
"encoding/hex"
"errors"
"fmt"
"net/http"
@@ -23,6 +25,7 @@ var (
ErrUserExists = errors.New("username already exists")
ErrNotAuthenticated = errors.New("not authenticated")
ErrInvalidPassword = errors.New("password does not meet security requirements")
ErrInvalidRecoveryKey = errors.New("invalid recovery details")
)
type Service struct {
@@ -33,15 +36,27 @@ func NewService(db database.Querier) *Service {
return &Service{db: db}
}
// generateSessionToken generates a secure random 32-byte token.
func generateSessionToken() (string, error) {
b := make([]byte, 32)
func generateToken(size int) (string, error) {
b := make([]byte, size)
if _, err := rand.Read(b); err != nil {
return "", err
}
return base64.URLEncoding.EncodeToString(b), nil
}
func generateSessionToken() (string, error) {
return generateToken(32)
}
func generateRecoveryKey() (string, error) {
return generateToken(24)
}
func hashRecoveryKey(recoveryKey string) string {
sum := sha256.Sum256([]byte(recoveryKey))
return hex.EncodeToString(sum[:])
}
func ValidatePassword(password string) error {
if len(password) < 12 {
return fmt.Errorf("password must be at least 12 characters long")
@@ -67,28 +82,135 @@ func ValidatePassword(password string) error {
return nil
}
func (s *Service) RegisterUser(ctx context.Context, username, password string) (*database.User, error) {
func (s *Service) RegisterUser(ctx context.Context, username, password string) (*database.User, string, error) {
if err := ValidatePassword(password); err != nil {
return nil, fmt.Errorf("%w: %v", ErrInvalidPassword, err)
return nil, "", fmt.Errorf("%w: %v", ErrInvalidPassword, err)
}
hash, err := bcrypt.GenerateFromPassword([]byte(password), 12) // higher cost
if err != nil {
return nil, fmt.Errorf("failed to hash password: %w", err)
return nil, "", fmt.Errorf("failed to hash password: %w", err)
}
recoveryKey, err := generateRecoveryKey()
if err != nil {
return nil, "", fmt.Errorf("failed to generate recovery key: %w", err)
}
id := uuid.New().String()
user, err := s.db.CreateUser(ctx, database.CreateUserParams{
ID: id,
Username: username,
PasswordHash: string(hash),
ID: id,
Username: username,
PasswordHash: string(hash),
RecoveryKeyHash: hashRecoveryKey(recoveryKey),
})
if err != nil {
// Assuming unique constraint failure for username
return nil, ErrUserExists
return nil, "", ErrUserExists
}
return &user, nil
return &user, recoveryKey, nil
}
func (s *Service) RecoverAccount(ctx context.Context, username, recoveryKey, newPassword string) (string, error) {
if err := ValidatePassword(newPassword); err != nil {
return "", fmt.Errorf("%w: %v", ErrInvalidPassword, err)
}
user, err := s.db.GetUserByUsernameAndRecoveryKeyHash(ctx, database.GetUserByUsernameAndRecoveryKeyHashParams{
Username: username,
RecoveryKeyHash: hashRecoveryKey(recoveryKey),
})
if err != nil {
if errors.Is(err, sql.ErrNoRows) {
return "", ErrInvalidRecoveryKey
}
return "", fmt.Errorf("failed to lookup user for recovery: %w", err)
}
newPasswordHash, err := bcrypt.GenerateFromPassword([]byte(newPassword), 12)
if err != nil {
return "", fmt.Errorf("failed to hash new password: %w", err)
}
newRecoveryKey, err := generateRecoveryKey()
if err != nil {
return "", fmt.Errorf("failed to generate new recovery key: %w", err)
}
err = s.db.UpdateUserPasswordAndRecoveryKeyHash(ctx, database.UpdateUserPasswordAndRecoveryKeyHashParams{
ID: user.ID,
PasswordHash: string(newPasswordHash),
RecoveryKeyHash: hashRecoveryKey(newRecoveryKey),
})
if err != nil {
return "", fmt.Errorf("failed to update recovered account: %w", err)
}
err = s.db.DeleteUserSessions(ctx, user.ID)
if err != nil {
return "", fmt.Errorf("failed to clear existing sessions: %w", err)
}
return newRecoveryKey, nil
}
func (s *Service) ChangePassword(ctx context.Context, userID, currentPassword, newPassword string) error {
if err := ValidatePassword(newPassword); err != nil {
return fmt.Errorf("%w: %v", ErrInvalidPassword, err)
}
user, err := s.db.GetUser(ctx, userID)
if err != nil {
return fmt.Errorf("failed to lookup user: %w", err)
}
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)); err != nil {
return ErrInvalidCredentials
}
newPasswordHash, err := bcrypt.GenerateFromPassword([]byte(newPassword), 12)
if err != nil {
return fmt.Errorf("failed to hash new password: %w", err)
}
err = s.db.UpdateUserPasswordAndRecoveryKeyHash(ctx, database.UpdateUserPasswordAndRecoveryKeyHashParams{
ID: user.ID,
PasswordHash: string(newPasswordHash),
RecoveryKeyHash: user.RecoveryKeyHash,
})
if err != nil {
return fmt.Errorf("failed to update password: %w", err)
}
return nil
}
func (s *Service) RegenerateRecoveryKey(ctx context.Context, userID, password string) (string, error) {
user, err := s.db.GetUser(ctx, userID)
if err != nil {
return "", fmt.Errorf("failed to lookup user: %w", err)
}
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
return "", ErrInvalidCredentials
}
newRecoveryKey, err := generateRecoveryKey()
if err != nil {
return "", fmt.Errorf("failed to generate new recovery key: %w", err)
}
err = s.db.UpdateUserPasswordAndRecoveryKeyHash(ctx, database.UpdateUserPasswordAndRecoveryKeyHashParams{
ID: user.ID,
PasswordHash: user.PasswordHash,
RecoveryKeyHash: hashRecoveryKey(newRecoveryKey),
})
if err != nil {
return "", fmt.Errorf("failed to rotate recovery key: %w", err)
}
return newRecoveryKey, nil
}
func (s *Service) Login(ctx context.Context, username, password string) (*database.Session, error) {

210
internal/features/auth/handler.go
View File

@@ -1,8 +1,11 @@
package auth
import (
"errors"
"net/http"
"time"
"mal/internal/database"
"mal/internal/templates"
)
@@ -10,6 +13,40 @@ type Handler struct {
authService *Service
}
const rateLimitFormError = "Too many attempts in a short time. Please wait a minute and try again."
const (
accountPasswordChangedMessage = "Password updated successfully."
accountRecoveryKeyRotatedMessage = "Recovery key rotated. Save this new key now."
accountPasswordErrorMessage = "Unable to update password with those details."
accountRecoveryErrorMessage = "Unable to rotate recovery key with those details."
accountUnexpectedErrorMessage = "Something went wrong. Please try again."
accountMissingFieldsErrorMessage = "Please complete all required fields."
accountPasswordMismatchErrorMessage = "New password and confirm password must match."
)
func (h *Handler) accountUserFromRequest(r *http.Request) (*database.User, bool) {
cookie, err := r.Cookie("session_id")
if err != nil {
return nil, false
}
user, err := h.authService.ValidateSession(r.Context(), cookie.Value)
if err != nil {
return nil, false
}
return user, true
}
func accountCreatedAt(createdAt time.Time) string {
return createdAt.Local().Format("Jan 2, 2006 at 15:04")
}
func renderAccountPage(w http.ResponseWriter, r *http.Request, user *database.User, passwordError string, passwordSuccess string, recoveryError string, recoverySuccess string, recoveryKey string) {
templates.Account(user.Username, accountCreatedAt(user.CreatedAt), passwordError, passwordSuccess, recoveryError, recoverySuccess, recoveryKey).Render(r.Context(), w)
}
func NewHandler(authService *Service) *Handler {
return &Handler{authService: authService}
}
@@ -18,17 +55,21 @@ func NewHandler(authService *Service) *Handler {
func (h *Handler) HandleLogin(w http.ResponseWriter, r *http.Request) {
if err := r.ParseForm(); err != nil {
http.Error(w, "invalid request", http.StatusBadRequest)
templates.Login("Something went wrong. Please try again.", "").Render(r.Context(), w)
return
}
username := r.FormValue("username")
password := r.FormValue("password")
if username == "" || password == "" {
templates.Login("The email or password is wrong.", username).Render(r.Context(), w)
return
}
session, err := h.authService.Login(r.Context(), username, password)
if err != nil {
// Just handle generically for now, perhaps via HTMX toast
http.Error(w, "invalid credentials", http.StatusUnauthorized)
templates.Login("The email or password is wrong.", username).Render(r.Context(), w)
return
}
@@ -41,7 +82,7 @@ func (h *Handler) HandleLogin(w http.ResponseWriter, r *http.Request) {
func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
if err := r.ParseForm(); err != nil {
http.Error(w, "invalid request", http.StatusBadRequest)
templates.Register("Something went wrong. Please try again.", "").Render(r.Context(), w)
return
}
@@ -49,21 +90,17 @@ func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
password := r.FormValue("password")
if username == "" || password == "" {
http.Error(w, "username and password are required", http.StatusBadRequest)
templates.Register("Please enter both email and password.", username).Render(r.Context(), w)
return
}
_, err := h.authService.RegisterUser(r.Context(), username, password)
_, recoveryKey, err := h.authService.RegisterUser(r.Context(), username, password)
if err != nil {
if err == ErrInvalidPassword {
http.Error(w, err.Error(), http.StatusBadRequest)
if errors.Is(err, ErrInvalidPassword) || errors.Is(err, ErrUserExists) {
templates.Register("Unable to create account with those details.", username).Render(r.Context(), w)
return
}
if err == ErrUserExists {
http.Error(w, "username already taken", http.StatusConflict)
return
}
http.Error(w, "registration failed", http.StatusInternalServerError)
templates.Register("Something went wrong. Please try again.", username).Render(r.Context(), w)
return
}
@@ -75,9 +112,7 @@ func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request) {
}
SetSessionCookie(w, session.ID, session.ExpiresAt)
w.Header().Set("HX-Redirect", "/")
http.Redirect(w, r, "/", http.StatusFound)
templates.RegistrationRecoveryKey(recoveryKey).Render(r.Context(), w)
}
func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
@@ -92,9 +127,148 @@ func (h *Handler) HandleLogout(w http.ResponseWriter, r *http.Request) {
}
func (h *Handler) HandleLoginPage(w http.ResponseWriter, r *http.Request) {
templates.Login().Render(r.Context(), w)
formError := ""
if r.URL.Query().Get("error") == "rate_limited" {
formError = rateLimitFormError
}
templates.Login(formError, "").Render(r.Context(), w)
}
func (h *Handler) HandleRegisterPage(w http.ResponseWriter, r *http.Request) {
templates.Register().Render(r.Context(), w)
formError := ""
if r.URL.Query().Get("error") == "rate_limited" {
formError = rateLimitFormError
}
templates.Register(formError, "").Render(r.Context(), w)
}
func (h *Handler) HandleRecoverPage(w http.ResponseWriter, r *http.Request) {
formError := ""
if r.URL.Query().Get("error") == "rate_limited" {
formError = rateLimitFormError
}
templates.Recover(formError, "", "").Render(r.Context(), w)
}
func (h *Handler) HandleRecover(w http.ResponseWriter, r *http.Request) {
if err := r.ParseForm(); err != nil {
templates.Recover("Something went wrong. Please try again.", "", "").Render(r.Context(), w)
return
}
username := r.FormValue("username")
recoveryKey := r.FormValue("recovery_key")
newPassword := r.FormValue("new_password")
if username == "" || recoveryKey == "" || newPassword == "" {
templates.Recover("Unable to recover account with those details.", username, recoveryKey).Render(r.Context(), w)
return
}
newRecoveryKey, err := h.authService.RecoverAccount(r.Context(), username, recoveryKey, newPassword)
if err != nil {
if errors.Is(err, ErrInvalidRecoveryKey) || errors.Is(err, ErrInvalidPassword) {
templates.Recover("Unable to recover account with those details.", username, recoveryKey).Render(r.Context(), w)
return
}
templates.Recover("Something went wrong. Please try again.", username, recoveryKey).Render(r.Context(), w)
return
}
templates.RecoveryComplete(newRecoveryKey).Render(r.Context(), w)
}
func (h *Handler) HandleAccountPage(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
user, ok := h.accountUserFromRequest(r)
if !ok {
http.Redirect(w, r, "/login", http.StatusFound)
return
}
renderAccountPage(w, r, user, "", "", "", "", "")
}
func (h *Handler) HandleAccountPassword(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
user, ok := h.accountUserFromRequest(r)
if !ok {
http.Redirect(w, r, "/login", http.StatusFound)
return
}
if err := r.ParseForm(); err != nil {
renderAccountPage(w, r, user, accountUnexpectedErrorMessage, "", "", "", "")
return
}
currentPassword := r.FormValue("current_password")
newPassword := r.FormValue("new_password")
confirmNewPassword := r.FormValue("confirm_new_password")
if currentPassword == "" || newPassword == "" || confirmNewPassword == "" {
renderAccountPage(w, r, user, accountMissingFieldsErrorMessage, "", "", "", "")
return
}
if newPassword != confirmNewPassword {
renderAccountPage(w, r, user, accountPasswordMismatchErrorMessage, "", "", "", "")
return
}
err := h.authService.ChangePassword(r.Context(), user.ID, currentPassword, newPassword)
if err != nil {
if errors.Is(err, ErrInvalidCredentials) || errors.Is(err, ErrInvalidPassword) {
renderAccountPage(w, r, user, accountPasswordErrorMessage, "", "", "", "")
return
}
renderAccountPage(w, r, user, accountUnexpectedErrorMessage, "", "", "", "")
return
}
renderAccountPage(w, r, user, "", accountPasswordChangedMessage, "", "", "")
}
func (h *Handler) HandleAccountRecoveryKey(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
return
}
user, ok := h.accountUserFromRequest(r)
if !ok {
http.Redirect(w, r, "/login", http.StatusFound)
return
}
if err := r.ParseForm(); err != nil {
renderAccountPage(w, r, user, "", "", accountUnexpectedErrorMessage, "", "")
return
}
password := r.FormValue("password")
if password == "" {
renderAccountPage(w, r, user, "", "", accountMissingFieldsErrorMessage, "", "")
return
}
newRecoveryKey, err := h.authService.RegenerateRecoveryKey(r.Context(), user.ID, password)
if err != nil {
if errors.Is(err, ErrInvalidCredentials) {
renderAccountPage(w, r, user, "", "", accountRecoveryErrorMessage, "", "")
return
}
renderAccountPage(w, r, user, "", "", accountUnexpectedErrorMessage, "", "")
return
}
renderAccountPage(w, r, user, "", "", "", accountRecoveryKeyRotatedMessage, newRecoveryKey)
}