Janady13/missionmatch / internal/modules/auth/dto.go

1// Package auth is the first party authentication and accounts module. It produces a verified 2// (org_id, user_id, role) from an opaque server side session and feeds that, and only that, into the 3// tenant resolver, replacing the dev X-Org-ID header. The cryptographic primitives live in 4// internal/platform/security; this package wires them to the database (through the SECURITY DEFINER 5// functions in migration 0009) and to HTTP. 6package auth 7 8import ( 9 "github.com/missionworkforce/missionmatch/internal/platform/audit" 10 "github.com/missionworkforce/missionmatch/internal/platform/security" 11 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 12) 13 14// Cookie names. The session cookie uses the __Host- prefix, which a browser only accepts when the 15// cookie is Secure, Path=/, and has no Domain, so it cannot be planted by a sibling subdomain. The 16// prefix and the Secure attribute must agree: a __Host- cookie without Secure is silently dropped by 17// the browser. So the name is chosen to match the Secure flag (the secure name in production, a plain 18// name only for plain http local dev). Production config requires CookieSecure true. 19const ( 20 SessionCookie = "__Host-mm_session" 21 CSRFCookie = "__Host-mm_csrf" 22 CSRFHeader = "X-CSRF-Token" 23 sessionCookieInsecure = "mm_session" 24 csrfCookieInsecure = "mm_csrf" 25) 26 27// Deps is everything the service needs, assembled in cmd/api from config. Keys never have defaults; 28// they come from the secrets file through config. 29type Deps struct { 30 DB *tenant.DB 31 Audit *audit.Writer 32 Hasher *security.Hasher 33 Tagger *security.Tagger 34 TOTP security.TOTP 35 TOTPKEKs map[int][]byte // key_version to AES 256 key, for decrypt 36 TOTPKEKActive int // version new secrets are sealed under 37 TOTPIssuer string 38 IdleSeconds int 39 AbsoluteSeconds int 40 PendingSeconds int 41 InviteSeconds int 42 CookieSecure bool 43 MFADisabled bool // pilot only: when true, login and invite accept mint an active session with no TOTP step. The zero value (false) keeps MFA mandatory, so a Deps built without setting it is secure by default. 44} 45 46// LoginInput is a password login attempt. 47type LoginInput struct { 48 Email string `json:"email"` 49 Password string `json:"password"` 50} 51 52// LoginResult tells the SPA whether to show the enroll or the verify step. Token is set as the 53// session cookie by the handler, never returned in the body. When MFARequired is false the issued 54// session is already active, so the SPA skips the MFA step and goes straight to the app. 55type LoginResult struct { 56 Token string `json:"-"` 57 MFAEnrolled bool `json:"mfa_enrolled"` 58 MFARequired bool `json:"mfa_required"` 59} 60 61// CodeInput carries a submitted six digit TOTP code or a recovery code. 62type CodeInput struct { 63 Code string `json:"code"` 64} 65 66// EnrollResult returns the provisioning material shown once during enrollment. 67type EnrollResult struct { 68 OTPAuthURI string `json:"otpauth_uri"` 69 Secret string `json:"secret"` 70} 71 72// ActivateResult returns the recovery codes shown exactly once on activation. Token is the new active 73// session cookie. 74type ActivateResult struct { 75 Token string `json:"-"` 76 RecoveryCodes []string `json:"recovery_codes"` 77} 78 79// TokenResult is a bare new session token for the handler to set as a cookie. 80type TokenResult struct { 81 Token string `json:"-"` 82} 83 84// InviteInput is an owner or admin inviting a user into their org. 85type InviteInput struct { 86 Email string `json:"email"` 87 FullName string `json:"full_name"` 88 Role string `json:"role"` 89 // Tools is the product set the new account starts with. Carried on the invite so creating an account 90 // and granting its access are ONE operation: entitlement fails closed, so an account created without 91 // this would exist but see nothing, and the operator would have to notice and fix it in a second step. 92 // Bounded by the same rule as a later change: the inviter may only confer tools they hold themselves. 93 Tools []string `json:"tools"` 94} 95 96// InviteResult returns the one time activation link token for manual delivery at pilot. 97type InviteResult struct { 98 Token string `json:"token"` 99 UserID string `json:"user_id"` 100} 101 102// AcceptInput redeems an invite or activation link and sets the password. 103type AcceptInput struct { 104 Token string `json:"token"` 105 Password string `json:"password"` 106} 107 108// ChangePasswordInput changes the authenticated user's password. 109type ChangePasswordInput struct { 110 OldPassword string `json:"old_password"` 111 NewPassword string `json:"new_password"` 112} 113 114// RoleChangeInput sets a target user's role. 115type RoleChangeInput struct { 116 Role string `json:"role"` 117} 118 119// StatusChangeInput enables or disables a target user. 120type StatusChangeInput struct { 121 Status string `json:"status"` 122} 123 124// SessionInfo is the SPA view of the current session. No secrets. 125type SessionInfo struct { 126 UserID string `json:"user_id"` 127 OrgID string `json:"org_id"` 128 Role string `json:"role"` 129 MFAEnrolled bool `json:"mfa_enrolled"` 130 // Capabilities is the caller's resolved permission list, computed from the same matrix the server 131 // enforces. It exists so the interface stops gating on role name comparisons, which duplicate the 132 // matrix in TypeScript where it drifts, and cannot express a permission that does not map cleanly 133 // onto one role. 134 // 135 // The server remains the only authority. This list decides what is OFFERED, never what is allowed, 136 // and every endpoint keeps its own gate. 137 Capabilities []string `json:"capabilities"` 138 139 // Tools is the caller's granted product set: which of missionMATCH, screenMATCH, slateMATCH, and 140 // recruitMATCH exist for them at all. Separate from Capabilities because role answers what a person 141 // may DO and this answers what they may SEE, and the two vary independently between clients. 142 // 143 // Like Capabilities this decides what is OFFERED, never what is allowed: each tool's route group 144 // carries its own server side gate, so a hidden tool is refused at the API even if the interface is 145 // bypassed entirely. 146 Tools []string `json:"tools"` 147} 148 149// UserSummary is one row of the org user list. No secrets. 150type UserSummary struct { 151 ID string `json:"id"` 152 Email string `json:"email"` 153 FullName string `json:"full_name"` 154 Role string `json:"role"` 155 Status string `json:"status"` 156 MFAEnrolled bool `json:"mfa_enrolled"` 157 // Tools is this user's granted product set, so the People screen can show and edit what they SEE 158 // alongside what they may do. Always present, empty rather than null, so the client can iterate. 159 Tools []string `json:"tools"` 160 // LastLoginAt was the other half of a two part defect. The column was never written, and it was also 161 // never returned, so fixing only the write would have left the People screen still showing "never 162 // signed in" for everyone and the fix would have looked like it failed. 163 LastLoginAt *string `json:"last_login_at,omitempty"` 164} 165 166// ToolsChangeInput replaces a user's tool entitlement. The field is the COMPLETE intended set, not a 167// delta: the result is exactly these tools, so one request can express "these and no others" and a client 168// that has drifted from the server cannot re grant something it believed was already absent. 169type ToolsChangeInput struct { 170 Tools []string `json:"tools"` 171} 172