Merge pull request #39 from Dragon-Rage/master

feat: access and refresh token

Author: Soham-Maha

database/queries/users.sql

@@ -113,4 +113,7 @@ UPDATE users
 SET team_id = $1
 WHERE email = $2;
 
-
+-- name: MarkUserAsVerified :exec
+UPDATE users
+SET is_verified = TRUE
+WHERE email = $1;

go.mod

@@ -43,5 +43,4 @@ require (
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.39.0 // indirect
 	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
 )

pkg/controllers/auth.go

@@ -58,27 +58,45 @@ func SendOTP(email string) error {
 	return nil
 }
 
-func VerifyOTP(email, otp string) (string, error) {
+func VerifyOTP(email, otp string) (accessToken string, refreshToken string, err error) {
 	key := "otp:" + email
 
 	storedHash, err := redis.Client.Get(redis.Ctx, key).Result()
 	if err != nil {
 		if redis.IsKeyMissing(err) {
-			return "", errors.New("otp expired or invalid")
+			return "", "",errors.New("otp expired or invalid")
 		}
-		return "", err
+		return "", "",err
 	}
 
 	if utils.HashOTP(otp) != storedHash {
-		return "", errors.New("invalid otp")
+		return "", "", errors.New("invalid otp")
 	}
 
 	redis.Client.Del(redis.Ctx, key)
 
 	userID, err := db.Queries.GetUserIDByEmail(context.Background(), email)
 	if err != nil {
-		return "", err
+		return "", "",err
 	}
 
-	return utils.CreateJWT(userID.String(), email)
+	// dB fnc - Marks user as verified in dB
+	err = db.Queries.MarkUserAsVerified(context.Background(), email)
+	if err != nil {
+		return "", "", err
+	}
+
+	// Access Token generation (1 hR)
+	accessToken, err = utils.CreateJWT(userID.String(), email, "access", 1*time.Hour)
+	if err != nil {
+		return "", "", err
+	}
+
+	// Refresh Token generation (2 hR)
+	refreshToken, err = utils.CreateJWT(userID.String(), email, "refresh", 2*time.Hour)
+	if err != nil {
+		return "", "", err
+	}
+
+	return accessToken, refreshToken, nil
 }

pkg/db/sqlc/users.sql.go

@@ -2,10 +2,15 @@ package handlers
 
 import (
 	"net/http"
+	"time"
 
 	"github.com/labstack/echo/v4"
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwt"
 
 	"github.com/CodeChefVIT/devsoc-backend-26/pkg/controllers"
+	"github.com/CodeChefVIT/devsoc-backend-26/pkg/utils"
+	"os"
 )
 
 func RequestOTP(c echo.Context) error {
@@ -42,12 +47,89 @@ func VerifyOTP(c echo.Context) error {
 		return c.JSON(http.StatusBadRequest, "invalid request")
 	}
 
-	token, err := controllers.VerifyOTP(req.Email, req.OTP)
+	accessToken, refreshToken, err := controllers.VerifyOTP(req.Email, req.OTP)
 	if err != nil {
 		return c.JSON(http.StatusUnauthorized, "invalid or expired otp")
 	}
 
+	// access token in pookie
+	c.SetCookie(&http.Cookie{
+		Name:     "access_token",
+		Value:    accessToken,
+		Path:     "/",
+		MaxAge:   3600, // 1 ghanta
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	// refresh token in pookie
+	c.SetCookie(&http.Cookie{
+		Name:     "refresh_token",
+		Value:    refreshToken,
+		Path:     "/",
+		MaxAge:   7200, // 2 ghante
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
 	return c.JSON(http.StatusOK, map[string]string{
-		"token": token,
+		"message": "user verified and logged in",
 	})
 }
+
+func Refresh(c echo.Context) error {
+	// Reading refresh token from pookie
+	cookie, err := c.Cookie("refresh_token")
+	if err != nil || cookie.Value == "" {
+		return c.JSON(http.StatusUnauthorized, "missing refresh token")
+	}
+
+	jwtKey := []byte(os.Getenv("JWT_SECRET"))
+
+	// Parsing and validatng refresh token
+	tok, err := jwt.Parse(
+		[]byte(cookie.Value),
+		jwt.WithKey(jwa.HS256, jwtKey),
+	)
+	if err != nil {
+		return c.JSON(http.StatusUnauthorized, "invalid or expired refresh token")
+	}
+
+	// Verify token_type is "refresh"
+	tokenType, ok := tok.Get("token_type")
+	if !ok || tokenType != "refresh" {
+		return c.JSON(http.StatusUnauthorized, "invalid token type")
+	}
+
+	// Extracting ujer info
+	userID := tok.Subject()
+	emailVal, ok := tok.Get("email")
+	if !ok {
+		return c.JSON(http.StatusUnauthorized, "invalid token claims")
+	}
+
+	email, ok := emailVal.(string)
+	if !ok {
+		return c.JSON(http.StatusUnauthorized, "invalid email claim")
+	}
+
+	// Issuing new access token (1 hour)
+	newAccessToken, err := utils.CreateJWT(userID, email, "access", 1*time.Hour)
+	if err != nil {
+		return c.JSON(http.StatusInternalServerError, "failed to create token")
+	}
+
+	// Setting that new access token pookie
+	c.SetCookie(&http.Cookie{
+		Name:     "access_token",
+		Value:    newAccessToken,
+		Path:     "/",
+		MaxAge:   3600, // 1 hour
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	return c.JSON(http.StatusOK, map[string]string{
+		"message": "accesstoken refreshed",
+	})
+}

pkg/handlers/auth.go

@@ -14,15 +14,23 @@ var jwtKey = []byte(os.Getenv("JWT_SECRET"))
 
 func JWTAuth(next echo.HandlerFunc) echo.HandlerFunc {
 	return func(c echo.Context) error {
-		auth := c.Request().Header.Get("Authorization")
-		if !strings.HasPrefix(auth, "Bearer ") {
-			return echo.ErrUnauthorized
+		var tokenString string
+
+		// Reading from access_token pookie (from handlers)
+		cookie, err := c.Cookie("access_token")
+		if err == nil && cookie.Value != "" {
+			tokenString = cookie.Value
+		} else {
+			// if that is not working, we use AuthZ: Bearer header
+			auth := c.Request().Header.Get("Authorization")
+			if !strings.HasPrefix(auth, "Bearer ") {
+				return echo.ErrUnauthorized
+			}
+			tokenString = strings.TrimPrefix(auth, "Bearer ")
 		}
 		//fmt.Println(auth)
 
-		tokenString := strings.TrimPrefix(auth, "Bearer ")
-		
-		
+		//parse and validate JWT		
 		tok, err := jwt.Parse(
 			[]byte(tokenString),
 			jwt.WithKey(jwa.HS256, jwtKey),
@@ -31,6 +39,11 @@ func JWTAuth(next echo.HandlerFunc) echo.HandlerFunc {
 		if err != nil {
 			return echo.ErrUnauthorized
 		}
+		// verifying token_type is "access"
+		tokenType, ok := tok.Get("token_type")
+		if !ok || tokenType != "access" {
+			return echo.ErrUnauthorized
+		}
 		userID := tok.Subject()
 		if userID == "" {
 			return echo.ErrUnauthorized

pkg/middlewares/jwt.go

@@ -9,5 +9,5 @@ func authRoutes(api *echo.Group) {
 	auth := api.Group("/auth")
 	auth.POST("/request-otp", handlers.RequestOTP)
 	auth.POST("/verify-otp", handlers.VerifyOTP)
-	
+	auth.POST("/refresh", handlers.Refresh) //added refresh funk, fnc, to test tokens
 }

pkg/router/auth.go

@@ -10,13 +10,14 @@ import (
 
 var jwtKey = []byte(os.Getenv("JWT_SECRET"))
 
-func CreateJWT(userID string, email string) (string, error) {
+func CreateJWT(userID string, email string, tokenType string, expiry time.Duration) (string, error) {
 	t := jwt.New()
 
 	t.Set(jwt.SubjectKey, userID)
 	t.Set("email", email)
+	t.Set("token_type", tokenType)
 	t.Set(jwt.IssuedAtKey, time.Now())
-	t.Set(jwt.ExpirationKey, time.Now().Add(24*time.Hour))
+	t.Set(jwt.ExpirationKey, time.Now().Add(expiry))
 
 	signed, err := jwt.Sign(t, jwt.WithKey(jwa.HS256, jwtKey))
 	return string(signed), err

pkg/utils/jwt.go

@@ -1,8 +1,8 @@
 package utils
 
 import (
-	//"errors"
 	"fmt"
+	//"errors"
 	//"net/smtp"
 )
 
@@ -29,6 +29,6 @@ func SendMail(email, otp string) error {
 	// 	[]string{email},
 	// 	msg,
 	// )
-	fmt .Println( otp)
+	fmt .Println("OTP for", email,":",otp)
 	return nil
 }