authkit/service_session.go

package authkit

import (
	"context"
	"net/http"
	"net/netip"
	"time"

	"git.juancwu.dev/juancwu/errx"
	"github.com/google/uuid"
)

// IssueSession mints an opaque session ID, persists the session record, and
// returns the plaintext (for the cookie) plus the stored Session.
func (a *Auth) IssueSession(ctx context.Context, userID uuid.UUID, userAgent string, ip netip.Addr) (string, *Session, error) {
	const op = "authkit.Auth.IssueSession"
	plaintext, hash, err := MintOpaqueSecret(a.cfg.Random, prefixSession)
	if err != nil {
		return "", nil, errx.Wrap(op, err)
	}
	now := a.now()
	expires := now.Add(a.cfg.SessionIdleTTL)
	if cap := now.Add(a.cfg.SessionAbsoluteTTL); expires.After(cap) {
		expires = cap
	}
	s := &Session{
		IDHash:     hash,
		UserID:     userID,
		UserAgent:  userAgent,
		IP:         ip,
		CreatedAt:  now,
		LastSeenAt: now,
		ExpiresAt:  expires,
	}
	if err := a.storeCreateSession(ctx, s); err != nil {
		return "", nil, errx.Wrap(op, err)
	}
	return plaintext, s, nil
}

// AuthenticateSession validates an opaque session string, slides the TTL,
// resolves the user's roles+permissions, and returns a Principal.
func (a *Auth) AuthenticateSession(ctx context.Context, plaintext string) (*Principal, error) {
	const op = "authkit.Auth.AuthenticateSession"
	hash, ok := ParseOpaqueSecret(prefixSession, plaintext)
	if !ok {
		return nil, errx.Wrap(op, ErrSessionInvalid)
	}
	s, err := a.storeGetSession(ctx, hash)
	if err != nil {
		return nil, errx.Wrap(op, err)
	}
	now := a.now()
	if !s.ExpiresAt.After(now) {
		_ = a.storeDeleteSession(ctx, hash)
		return nil, errx.Wrap(op, ErrSessionInvalid)
	}

	newExpires := now.Add(a.cfg.SessionIdleTTL)
	if cap := s.CreatedAt.Add(a.cfg.SessionAbsoluteTTL); newExpires.After(cap) {
		newExpires = cap
	}
	if err := a.storeTouchSession(ctx, hash, now, newExpires); err != nil {
		return nil, errx.Wrap(op, err)
	}

	roles, perms, err := a.resolveRolesAndPermissions(ctx, s.UserID)
	if err != nil {
		return nil, errx.Wrap(op, err)
	}
	return &Principal{
		UserID:      s.UserID,
		Method:      AuthMethodSession,
		SessionID:   hash,
		Roles:       roles,
		Permissions: perms,
		IssuedAt:    s.CreatedAt,
		ExpiresAt:   newExpires,
	}, nil
}

// RevokeSession deletes a single session by its plaintext id. Idempotent —
// missing sessions are not an error.
func (a *Auth) RevokeSession(ctx context.Context, plaintext string) error {
	const op = "authkit.Auth.RevokeSession"
	hash, ok := ParseOpaqueSecret(prefixSession, plaintext)
	if !ok {
		return nil
	}
	if err := a.storeDeleteSession(ctx, hash); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// RevokeAllUserSessions kills every active session for the user and bumps
// session_version (invalidating outstanding JWT access tokens).
func (a *Auth) RevokeAllUserSessions(ctx context.Context, userID uuid.UUID) error {
	const op = "authkit.Auth.RevokeAllUserSessions"
	if err := a.storeDeleteUserSessions(ctx, userID); err != nil {
		return errx.Wrap(op, err)
	}
	if _, err := a.storeBumpSessionVersion(ctx, userID); err != nil {
		return errx.Wrap(op, err)
	}
	return nil
}

// SessionCookie builds an *http.Cookie pre-configured from Config. Pass the
// plaintext returned by IssueSession and the matching ExpiresAt from the
// returned *Session.
func (a *Auth) SessionCookie(plaintext string, expires time.Time) *http.Cookie {
	return &http.Cookie{
		Name:     a.cfg.SessionCookieName,
		Value:    plaintext,
		Path:     a.cfg.SessionCookiePath,
		Domain:   a.cfg.SessionCookieDomain,
		Secure:   *a.cfg.SessionCookieSecure,
		HttpOnly: *a.cfg.SessionCookieHTTPOnly,
		SameSite: a.cfg.SessionCookieSameSite,
		Expires:  expires,
	}
}

// ClearSessionCookie returns a cookie that, when set on the response, tells
// the browser to delete the session cookie. Use on logout.
func (a *Auth) ClearSessionCookie() *http.Cookie {
	return &http.Cookie{
		Name:     a.cfg.SessionCookieName,
		Value:    "",
		Path:     a.cfg.SessionCookiePath,
		Domain:   a.cfg.SessionCookieDomain,
		Secure:   *a.cfg.SessionCookieSecure,
		HttpOnly: *a.cfg.SessionCookieHTTPOnly,
		SameSite: a.cfg.SessionCookieSameSite,
		MaxAge:   -1,
	}
}

// SessionCookieName returns the configured cookie name. Useful for callers
// wiring extractors without reaching into Config.
func (a *Auth) SessionCookieName() string { return a.cfg.SessionCookieName }

// resolveRolesAndPermissions fetches the user's role and permission slugs.
func (a *Auth) resolveRolesAndPermissions(ctx context.Context, userID uuid.UUID) ([]string, []string, error) {
	roles, err := a.storeGetUserRoles(ctx, userID)
	if err != nil {
		return nil, nil, err
	}
	perms, err := a.storeGetUserPermissions(ctx, userID)
	if err != nil {
		return nil, nil, err
	}
	rSlugs := make([]string, len(roles))
	for i, r := range roles {
		rSlugs[i] = r.Slug
	}
	pSlugs := make([]string, len(perms))
	for i, p := range perms {
		pSlugs[i] = p.Slug
	}
	return rSlugs, pSlugs, nil
}