Initial commit

internal/api/sessions.go

@@ -0,0 +1,97 @@
+package api
+
+import (
+	"crypto/rand"
+	"errors"
+	"net/http"
+	"time"
+
+	"gardomatic.kleiax.de/internal/auth"
+	"gardomatic.kleiax.de/internal/platform/validate"
+	"gardomatic.kleiax.de/internal/storage"
+)
+
+const authenticatedUserIDSessionKey = "authenticatedUserID"
+
+const (
+	accountSessionIDKey        = "accountSessionID"
+	accountSessionCreatedAtKey = "accountSessionCreatedAt"
+)
+
+func (app *application) createSessionHandler(w http.ResponseWriter, r *http.Request) {
+	var input struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+
+	err := app.readJSON(w, r, &input)
+	if err != nil {
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	v := validate.New()
+	storage.ValidateEmail(v, input.Email)
+	auth.ValidatePasswordPlaintext(v, input.Password)
+
+	if !v.Valid() {
+		app.failedValidationResponse(w, r, v.Errors)
+		return
+	}
+
+	user, err := app.models.Users.GetByEmail(input.Email)
+	if err != nil {
+		switch {
+		case errors.Is(err, storage.ErrRecordNotFound):
+			app.invalidCredentialsResponse(w, r)
+		default:
+			app.serverErrorResponse(w, r, err)
+		}
+		return
+	}
+
+	match, err := user.Password.Matches(input.Password)
+	if err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	if !match {
+		app.invalidCredentialsResponse(w, r)
+		return
+	}
+
+	if err := app.sessions.RenewToken(r.Context()); err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	app.sessions.Put(r.Context(), authenticatedUserIDSessionKey, user.ID)
+	app.sessions.Put(r.Context(), accountSessionIDKey, rand.Text())
+	app.sessions.Put(r.Context(), accountSessionCreatedAtKey, time.Now().UTC().Unix())
+
+	if err := app.writeJSON(w, http.StatusCreated, envelope{"user": user}, nil); err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) showSessionHandler(w http.ResponseWriter, r *http.Request) {
+	user, found := app.contextGetAuthenticatedUser(r)
+	if !found {
+		app.authenticationRequiredResponse(w, r)
+		return
+	}
+
+	if err := app.writeJSON(w, http.StatusOK, envelope{"user": user}, nil); err != nil {
+		app.serverErrorResponse(w, r, err)
+	}
+}
+
+func (app *application) deleteSessionHandler(w http.ResponseWriter, r *http.Request) {
+	if err := app.sessions.Destroy(r.Context()); err != nil {
+		app.serverErrorResponse(w, r, err)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}