Janady13/missionmatch / internal/modules/auth/handler.go

1package auth 2 3import ( 4 "encoding/json" 5 "errors" 6 "log/slog" 7 "net/http" 8 "strings" 9 10 "github.com/go-chi/chi/v5" 11 12 "github.com/missionworkforce/missionmatch/internal/platform/security" 13 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 14) 15 16// Handler is the HTTP surface for auth. It owns cookie issuance and the public/tenant route split. 17type Handler struct { 18 svc *Service 19 csrf *security.CSRF 20 cookieSecure bool 21 allowedOrigins []string 22 trustedProxyHeader string 23} 24 25// NewHandler builds the auth handler. trustedProxyHeader names the header carrying the real client IP 26// when the app sits behind a trusted reverse proxy (the app must not be directly exposed); empty uses 27// the TCP peer address. 28func NewHandler(svc *Service, csrf *security.CSRF, cookieSecure bool, allowedOrigins []string, trustedProxyHeader string) *Handler { 29 return &Handler{svc: svc, csrf: csrf, cookieSecure: cookieSecure, allowedOrigins: allowedOrigins, trustedProxyHeader: trustedProxyHeader} 30} 31 32// SessionCookieName and CSRFCookieName return the cookie names that match the Secure flag, so the 33// __Host- prefix is only used when Secure is set (the prefix requires it). 34func (h *Handler) SessionCookieName() string { 35 if h.cookieSecure { 36 return SessionCookie 37 } 38 return sessionCookieInsecure 39} 40 41// CSRFCookieName returns the CSRF cookie name; the CSRF middleware must be built with the same value. 42func (h *Handler) CSRFCookieName() string { 43 if h.cookieSecure { 44 return CSRFCookie 45 } 46 return csrfCookieInsecure 47} 48 49// PublicRoutes mounts the pre tenant endpoints. They run OUTSIDE the session middleware (they operate 50// on a pre MFA session or no session) but the caller wraps them in the CSRF Origin allowlist. The 51// login, mfa, and accept handlers read the session cookie directly where they need a pending session. 52func (h *Handler) PublicRoutes(r chi.Router) { 53 r.Get("/auth/csrf", h.issueCSRF) 54 r.Post("/auth/login", h.login) 55 r.Post("/auth/mfa/enroll", h.mfaEnroll) 56 r.Post("/auth/mfa/activate", h.mfaActivate) 57 r.Post("/auth/mfa/verify", h.mfaVerify) 58 r.Post("/auth/mfa/recover", h.mfaRecover) 59 r.Post("/auth/invite/accept", h.inviteAccept) 60 r.Post("/auth/logout", h.logout) 61} 62 63// TenantRoutes mounts the authenticated endpoints. The caller mounts these INSIDE the session 64// middleware and the CSRF middleware; per route capabilities are applied here. 65func (h *Handler) TenantRoutes(r chi.Router) { 66 r.Get("/auth/session", h.session) 67 r.Post("/auth/logout-all", h.logoutAll) 68 r.Post("/auth/password/change", h.passwordChange) 69 70 r.With(security.RequireRole(security.RoleAdmin)).Get("/users", h.listUsers) 71 r.With(security.RequireCapability(security.CapUserInvite)).Post("/users/invite", h.invite) 72 r.With(security.RequireCapability(security.CapUserRoleChange)).Patch("/users/{id}/role", h.changeRole) 73 r.With(security.RequireCapability(security.CapUserDisable)).Patch("/users/{id}/status", h.changeStatus) 74 r.With(security.RequireCapability(security.CapUserDisable)).Post("/users/{id}/mfa/reset", h.resetMFA) 75 r.With(security.RequireCapability(security.CapUserInvite)).Post("/users/{id}/recovery", h.reissueRecovery) 76} 77 78// SessionMiddleware resolves a validated active session into tenant context, replacing the dev header 79// resolver. It reads the __Host- session cookie, requires an active MFA satisfied session, and stashes 80// the authoritative org and the principal. Any failure is 403 before a handler runs (fail closed). 81func (h *Handler) SessionMiddleware() func(http.Handler) http.Handler { 82 return func(next http.Handler) http.Handler { 83 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 84 cookie, err := r.Cookie(h.SessionCookieName()) 85 if err != nil || cookie.Value == "" { 86 http.Error(w, "forbidden", http.StatusForbidden) 87 return 88 } 89 principal, org, verr := h.svc.Validate(r.Context(), cookie.Value) 90 if verr != nil { 91 // The request is denied regardless, but the rejection audit must not vanish silently. 92 if aerr := h.svc.auditSessionRejected(r.Context(), h.clientIP(r), r.UserAgent()); aerr != nil { 93 slog.Error("auth: session rejection audit write failed", "error", aerr) 94 } 95 http.Error(w, "forbidden", http.StatusForbidden) 96 return 97 } 98 ctx := tenant.WithUser(tenant.WithOrg(r.Context(), org), principal) 99 next.ServeHTTP(w, r.WithContext(ctx)) 100 }) 101 } 102} 103 104// ---- public handlers ---- 105 106func (h *Handler) issueCSRF(w http.ResponseWriter, r *http.Request) { 107 token, err := h.csrf.Issue() 108 if err != nil { 109 writeError(w, http.StatusInternalServerError, "internal error") 110 return 111 } 112 h.setCSRFCookie(w, token) 113 writeJSON(w, http.StatusOK, map[string]string{"csrf_token": token}) 114} 115 116func (h *Handler) login(w http.ResponseWriter, r *http.Request) { 117 var in LoginInput 118 if !decode(w, r, &in) { 119 return 120 } 121 res, err := h.svc.Login(r.Context(), in, h.clientIP(r), r.UserAgent()) 122 if err != nil { 123 writeAuthError(w, err) 124 return 125 } 126 h.setSessionCookie(w, res.Token) 127 writeJSON(w, http.StatusOK, res) 128} 129 130func (h *Handler) mfaEnroll(w http.ResponseWriter, r *http.Request) { 131 token, ok := h.sessionToken(r) 132 if !ok { 133 writeError(w, http.StatusForbidden, "no session") 134 return 135 } 136 res, err := h.svc.EnrollMFA(r.Context(), token) 137 if err != nil { 138 writeAuthError(w, err) 139 return 140 } 141 writeJSON(w, http.StatusOK, res) 142} 143 144func (h *Handler) mfaActivate(w http.ResponseWriter, r *http.Request) { 145 token, ok := h.sessionToken(r) 146 if !ok { 147 writeError(w, http.StatusForbidden, "no session") 148 return 149 } 150 var in CodeInput 151 if !decode(w, r, &in) { 152 return 153 } 154 res, err := h.svc.ActivateMFA(r.Context(), token, in, h.clientIP(r), r.UserAgent()) 155 if err != nil { 156 writeAuthError(w, err) 157 return 158 } 159 h.setSessionCookie(w, res.Token) 160 writeJSON(w, http.StatusOK, res) 161} 162 163func (h *Handler) mfaVerify(w http.ResponseWriter, r *http.Request) { 164 token, ok := h.sessionToken(r) 165 if !ok { 166 writeError(w, http.StatusForbidden, "no session") 167 return 168 } 169 var in CodeInput 170 if !decode(w, r, &in) { 171 return 172 } 173 res, err := h.svc.VerifyTOTP(r.Context(), token, in, h.clientIP(r), r.UserAgent()) 174 if err != nil { 175 writeAuthError(w, err) 176 return 177 } 178 h.setSessionCookie(w, res.Token) 179 writeJSON(w, http.StatusOK, map[string]bool{"ok": true}) 180} 181 182func (h *Handler) mfaRecover(w http.ResponseWriter, r *http.Request) { 183 token, ok := h.sessionToken(r) 184 if !ok { 185 writeError(w, http.StatusForbidden, "no session") 186 return 187 } 188 var in CodeInput 189 if !decode(w, r, &in) { 190 return 191 } 192 res, err := h.svc.RecoverMFA(r.Context(), token, in, h.clientIP(r), r.UserAgent()) 193 if err != nil { 194 writeAuthError(w, err) 195 return 196 } 197 h.setSessionCookie(w, res.Token) 198 writeJSON(w, http.StatusOK, map[string]bool{"ok": true}) 199} 200 201func (h *Handler) inviteAccept(w http.ResponseWriter, r *http.Request) { 202 var in AcceptInput 203 if !decode(w, r, &in) { 204 return 205 } 206 res, err := h.svc.AcceptInvite(r.Context(), in, h.clientIP(r), r.UserAgent()) 207 if err != nil { 208 writeAuthError(w, err) 209 return 210 } 211 h.setSessionCookie(w, res.Token) 212 writeJSON(w, http.StatusOK, res) 213} 214 215func (h *Handler) logout(w http.ResponseWriter, r *http.Request) { 216 if token, ok := h.sessionToken(r); ok { 217 _ = h.svc.Logout(r.Context(), token, h.clientIP(r), r.UserAgent()) 218 } 219 h.clearSessionCookie(w) 220 writeJSON(w, http.StatusOK, map[string]string{"status": "logged out"}) 221} 222 223// ---- tenant handlers ---- 224 225func (h *Handler) session(w http.ResponseWriter, r *http.Request) { 226 info, err := h.svc.SessionInfo(r.Context()) 227 writeOrError(w, info, err) 228} 229 230func (h *Handler) logoutAll(w http.ResponseWriter, r *http.Request) { 231 token, _ := h.sessionToken(r) 232 if err := h.svc.LogoutAll(r.Context(), token); err != nil { 233 writeAuthError(w, err) 234 return 235 } 236 writeJSON(w, http.StatusOK, map[string]string{"status": "ok"}) 237} 238 239func (h *Handler) passwordChange(w http.ResponseWriter, r *http.Request) { 240 token, ok := h.sessionToken(r) 241 if !ok { 242 writeError(w, http.StatusForbidden, "no session") 243 return 244 } 245 var in ChangePasswordInput 246 if !decode(w, r, &in) { 247 return 248 } 249 res, err := h.svc.ChangePassword(r.Context(), token, in, h.clientIP(r), r.UserAgent()) 250 if err != nil { 251 writeAuthError(w, err) 252 return 253 } 254 h.setSessionCookie(w, res.Token) 255 writeJSON(w, http.StatusOK, map[string]string{"status": "ok"}) 256} 257 258func (h *Handler) listUsers(w http.ResponseWriter, r *http.Request) { 259 users, err := h.svc.ListUsers(r.Context()) 260 writeOrError(w, users, err) 261} 262 263func (h *Handler) invite(w http.ResponseWriter, r *http.Request) { 264 var in InviteInput 265 if !decode(w, r, &in) { 266 return 267 } 268 res, err := h.svc.Invite(r.Context(), in, h.clientIP(r), r.UserAgent()) 269 writeOrError(w, res, err) 270} 271 272func (h *Handler) changeRole(w http.ResponseWriter, r *http.Request) { 273 var in RoleChangeInput 274 if !decode(w, r, &in) { 275 return 276 } 277 err := h.svc.ChangeRole(r.Context(), chi.URLParam(r, "id"), in, h.clientIP(r), r.UserAgent()) 278 writeStatusOrError(w, err) 279} 280 281func (h *Handler) changeStatus(w http.ResponseWriter, r *http.Request) { 282 var in StatusChangeInput 283 if !decode(w, r, &in) { 284 return 285 } 286 err := h.svc.ChangeStatus(r.Context(), chi.URLParam(r, "id"), in, h.clientIP(r), r.UserAgent()) 287 writeStatusOrError(w, err) 288} 289 290func (h *Handler) resetMFA(w http.ResponseWriter, r *http.Request) { 291 err := h.svc.ResetMFA(r.Context(), chi.URLParam(r, "id"), h.clientIP(r), r.UserAgent()) 292 writeStatusOrError(w, err) 293} 294 295func (h *Handler) reissueRecovery(w http.ResponseWriter, r *http.Request) { 296 res, err := h.svc.ReissueRecovery(r.Context(), chi.URLParam(r, "id"), h.clientIP(r), r.UserAgent()) 297 writeOrError(w, res, err) 298} 299 300// ---- cookies ---- 301 302func (h *Handler) setSessionCookie(w http.ResponseWriter, token string) { 303 http.SetCookie(w, &http.Cookie{ 304 Name: h.SessionCookieName(), Value: token, Path: "/", HttpOnly: true, 305 Secure: h.cookieSecure, SameSite: http.SameSiteStrictMode, 306 }) 307} 308 309func (h *Handler) clearSessionCookie(w http.ResponseWriter) { 310 http.SetCookie(w, &http.Cookie{ 311 Name: h.SessionCookieName(), Value: "", Path: "/", HttpOnly: true, 312 Secure: h.cookieSecure, SameSite: http.SameSiteStrictMode, MaxAge: -1, 313 }) 314} 315 316// setCSRFCookie sets the companion CSRF cookie. It is NOT HttpOnly because the SPA reads it to echo 317// the token into the X-CSRF-Token header (the signed double submit pattern). 318func (h *Handler) setCSRFCookie(w http.ResponseWriter, token string) { 319 http.SetCookie(w, &http.Cookie{ 320 Name: h.CSRFCookieName(), Value: token, Path: "/", HttpOnly: false, 321 Secure: h.cookieSecure, SameSite: http.SameSiteStrictMode, 322 }) 323} 324 325// ---- helpers ---- 326 327func (h *Handler) sessionToken(r *http.Request) (string, bool) { 328 c, err := r.Cookie(h.SessionCookieName()) 329 if err != nil || c.Value == "" { 330 return "", false 331 } 332 return c.Value, true 333} 334 335func decode(w http.ResponseWriter, r *http.Request, v any) bool { 336 r.Body = http.MaxBytesReader(w, r.Body, 1<<20) 337 dec := json.NewDecoder(r.Body) 338 dec.DisallowUnknownFields() 339 if err := dec.Decode(v); err != nil { 340 writeError(w, http.StatusBadRequest, "invalid request body") 341 return false 342 } 343 return true 344} 345 346func writeOrError(w http.ResponseWriter, v any, err error) { 347 if err != nil { 348 writeAuthError(w, err) 349 return 350 } 351 writeJSON(w, http.StatusOK, v) 352} 353 354func writeStatusOrError(w http.ResponseWriter, err error) { 355 if err != nil { 356 writeAuthError(w, err) 357 return 358 } 359 writeJSON(w, http.StatusOK, map[string]string{"status": "ok"}) 360} 361 362// writeAuthError maps service errors to status codes. Credential and session failures are 401, never 363// leaking which factor failed; authorization failures are 403; missing tenant is 403; no database is 364// 503; bad input is 400. 365func writeAuthError(w http.ResponseWriter, err error) { 366 switch { 367 case errors.Is(err, ErrInvalidCredentials), errors.Is(err, ErrInvalidSession), errors.Is(err, ErrInvalidState): 368 writeError(w, http.StatusUnauthorized, "unauthorized") 369 case errors.Is(err, ErrAccountLocked): 370 writeError(w, http.StatusTooManyRequests, "account temporarily locked") 371 case errors.Is(err, ErrForbidden): 372 writeError(w, http.StatusForbidden, "forbidden") 373 case errors.Is(err, tenant.ErrNoTenant): 374 writeError(w, http.StatusForbidden, "no validated tenant") 375 case errors.Is(err, ErrNotFound): 376 writeError(w, http.StatusNotFound, "not found") 377 case errors.Is(err, ErrEmailInUse): 378 writeError(w, http.StatusConflict, "email already in use") 379 case errors.Is(err, security.ErrPasswordTooLong), errors.Is(err, ErrBadRequest): 380 writeError(w, http.StatusBadRequest, "bad request") 381 case errors.Is(err, ErrNoDatabase): 382 writeError(w, http.StatusServiceUnavailable, "database not configured") 383 default: 384 writeError(w, http.StatusInternalServerError, "internal error") 385 } 386} 387 388func writeError(w http.ResponseWriter, status int, msg string) { 389 writeJSON(w, status, map[string]string{"error": msg}) 390} 391 392func writeJSON(w http.ResponseWriter, status int, v any) { 393 w.Header().Set("Content-Type", "application/json") 394 w.WriteHeader(status) 395 _ = json.NewEncoder(w).Encode(v) 396} 397 398// clientIP returns the caller's IP for throttling and the audit trail. When trustedProxyHeader is set 399// (the app is behind a trusted reverse proxy that overwrites it, and is not directly exposed) it reads 400// that header, otherwise it uses the unspoofable TCP peer address. It does NOT trust the leftmost 401// X-Forwarded-For (the spoofable value chi RealIP used). 402func (h *Handler) clientIP(r *http.Request) string { 403 if h.trustedProxyHeader != "" { 404 if v := strings.TrimSpace(r.Header.Get(h.trustedProxyHeader)); v != "" { 405 return v 406 } 407 } 408 host := r.RemoteAddr 409 if i := strings.LastIndex(host, ":"); i >= 0 && !strings.Contains(host[i:], "]") { 410 host = host[:i] 411 } 412 return strings.Trim(host, "[]") 413} 414