103 lines
No EOL
2.3 KiB
Go
103 lines
No EOL
2.3 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"errors"
|
|
"time"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
var (
|
|
ErrInvalidCredentials = errors.New("invalid username or password")
|
|
ErrSessionExpired = errors.New("session expired")
|
|
ErrInvalidCSRF = errors.New("invalid CSRF token")
|
|
)
|
|
|
|
const (
|
|
SessionDuration = 24 * time.Hour
|
|
SessionCleanupInterval = 1 * time.Hour
|
|
CSRFTokenLength = 32
|
|
SessionIDLength = 32
|
|
)
|
|
|
|
func HashPassword(password string) (string, error) {
|
|
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
|
return string(hash), err
|
|
}
|
|
|
|
func CheckPassword(password, hash string) bool {
|
|
err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
|
|
return err == nil
|
|
}
|
|
|
|
func GenerateSessionID() (string, error) {
|
|
return generateRandomString(SessionIDLength)
|
|
}
|
|
|
|
func GenerateCSRFToken() (string, error) {
|
|
return generateRandomString(CSRFTokenLength)
|
|
}
|
|
|
|
func generateRandomString(length int) (string, error) {
|
|
// Generate enough random bytes to produce `length` base64url chars without truncation loss.
|
|
// RawURLEncoding without padding: 3 bytes -> 4 chars. So ceil(length*3/4) bytes needed.
|
|
n := (length*3 + 3) / 4
|
|
b := make([]byte, n)
|
|
if _, err := rand.Read(b); err != nil {
|
|
return "", err
|
|
}
|
|
s := base64.RawURLEncoding.EncodeToString(b)
|
|
if len(s) > length {
|
|
s = s[:length]
|
|
}
|
|
// In the unlikely case s is shorter (rounding), pad by generating more - but n calculation guarantees >= length
|
|
if len(s) < length {
|
|
extra := make([]byte, length-len(s))
|
|
if _, err := rand.Read(extra); err != nil {
|
|
return "", err
|
|
}
|
|
s += base64.RawURLEncoding.EncodeToString(extra)[:length-len(s)]
|
|
}
|
|
return s, nil
|
|
}
|
|
|
|
type SessionData struct {
|
|
UserID string
|
|
CSRFToken string
|
|
CreatedAt time.Time
|
|
ExpiresAt time.Time
|
|
}
|
|
|
|
func NewSessionData(userID string) (*SessionData, error) {
|
|
now := time.Now()
|
|
csrfToken, err := GenerateCSRFToken()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &SessionData{
|
|
UserID: userID,
|
|
CSRFToken: csrfToken,
|
|
CreatedAt: now,
|
|
ExpiresAt: now.Add(SessionDuration),
|
|
}, nil
|
|
}
|
|
|
|
func (s *SessionData) IsExpired() bool {
|
|
return time.Now().After(s.ExpiresAt)
|
|
}
|
|
|
|
func (s *SessionData) Extend() {
|
|
s.ExpiresAt = time.Now().Add(SessionDuration)
|
|
}
|
|
|
|
func (s *SessionData) RotateCSRF() error {
|
|
token, err := GenerateCSRFToken()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
s.CSRFToken = token
|
|
return nil
|
|
} |