backup: pre-hardening baseline

backend/internal/auth/session.go

@@ -0,0 +1,88 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+var (
+	ErrInvalidCredentials = errors.New("invalid username or password")
+	ErrSessionExpired     = errors.New("session expired")
+	ErrInvalidCSRF        = errors.New("invalid CSRF token")
+)
+
+const (
+	SessionDuration    = 24 * time.Hour
+	SessionCleanupInterval = 1 * time.Hour
+	CSRFTokenLength    = 32
+	SessionIDLength    = 32
+)
+
+func HashPassword(password string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	return string(hash), err
+}
+
+func CheckPassword(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}
+
+func GenerateSessionID() (string, error) {
+	return generateRandomString(SessionIDLength)
+}
+
+func GenerateCSRFToken() (string, error) {
+	return generateRandomString(CSRFTokenLength)
+}
+
+func generateRandomString(length int) (string, error) {
+	bytes := make([]byte, length)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(bytes)[:length], nil
+}
+
+type SessionData struct {
+	UserID    string
+	CSRFToken string
+	CreatedAt time.Time
+	ExpiresAt time.Time
+}
+
+func NewSessionData(userID string) (*SessionData, error) {
+	now := time.Now()
+	csrfToken, err := GenerateCSRFToken()
+	if err != nil {
+		return nil, err
+	}
+
+	return &SessionData{
+		UserID:    userID,
+		CSRFToken: csrfToken,
+		CreatedAt: now,
+		ExpiresAt: now.Add(SessionDuration),
+	}, nil
+}
+
+func (s *SessionData) IsExpired() bool {
+	return time.Now().After(s.ExpiresAt)
+}
+
+func (s *SessionData) Extend() {
+	s.ExpiresAt = time.Now().Add(SessionDuration)
+}
+
+func (s *SessionData) RotateCSRF() error {
+	token, err := GenerateCSRFToken()
+	if err != nil {
+		return err
+	}
+	s.CSRFToken = token
+	return nil
+}