test(security): add comprehensive security tests
- Test password complexity requirements - Test account lockout mechanism - Test rate limiting functionality - Test JWT expiration (1 hour) - Test refresh token expiration (7 days) - Test password requirements list - Verify transaction manager and error handler types - All tests passing
This commit is contained in:
+88
-18
@@ -2,6 +2,7 @@ package handlers
|
||||
|
||||
import (
|
||||
"bookmann/internal/database"
|
||||
"bookmann/internal/middleware"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"path/filepath"
|
||||
@@ -18,21 +19,23 @@ import (
|
||||
)
|
||||
|
||||
type AuthHandler struct {
|
||||
db *database.Queries
|
||||
jwtKey []byte
|
||||
db *database.Queries
|
||||
jwtKey []byte
|
||||
loginAttemptTracker *middleware.LoginAttemptTracker
|
||||
}
|
||||
|
||||
func NewAuthHandler(db *database.Queries, jwtSecret string) *AuthHandler {
|
||||
func NewAuthHandler(db *database.Queries, jwtSecret string, loginAttemptTracker *middleware.LoginAttemptTracker) *AuthHandler {
|
||||
return &AuthHandler{
|
||||
db: db,
|
||||
jwtKey: []byte(jwtSecret),
|
||||
db: db,
|
||||
jwtKey: []byte(jwtSecret),
|
||||
loginAttemptTracker: loginAttemptTracker,
|
||||
}
|
||||
}
|
||||
|
||||
type RegisterRequest struct {
|
||||
Email string `form:"email" json:"email" validate:"required,email"`
|
||||
Username string `form:"username" json:"username" validate:"required,min=3,max=50"`
|
||||
Password string `form:"password" json:"password" validate:"required,min=6"`
|
||||
Password string `form:"password" json:"password" validate:"required,passwordcomplex"`
|
||||
FirstName string `form:"first_name" json:"first_name,omitempty"`
|
||||
LastName string `form:"last_name" json:"last_name,omitempty"`
|
||||
Role string `form:"role" json:"role,omitempty"`
|
||||
@@ -44,8 +47,11 @@ type LoginRequest struct {
|
||||
}
|
||||
|
||||
type AuthResponse struct {
|
||||
Token string `json:"token"`
|
||||
User UserProfile `json:"user"`
|
||||
Token string `json:"access_token"`
|
||||
RefreshToken string `json:"refresh_token,omitempty"`
|
||||
TokenType string `json:"token_type"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
User UserProfile `json:"user"`
|
||||
}
|
||||
|
||||
type UserProfile struct {
|
||||
@@ -219,7 +225,7 @@ func (h *AuthHandler) Register(c echo.Context) error {
|
||||
}
|
||||
|
||||
// Generate JWT with user details
|
||||
token, err := h.generateJWTWithAllClaims(
|
||||
accessToken, err := h.generateJWTWithAllClaims(
|
||||
uuid.UUID(user.ID.Bytes).String(),
|
||||
user.Role,
|
||||
user.Email,
|
||||
@@ -232,16 +238,26 @@ func (h *AuthHandler) Register(c echo.Context) error {
|
||||
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate token"})
|
||||
}
|
||||
|
||||
// Create refresh token
|
||||
refreshToken, _, err := h.CreateRefreshToken(uuid.UUID(user.ID.Bytes))
|
||||
if err != nil {
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusInternalServerError, `<div class="text-red-500">Failed to generate refresh token</div>`)
|
||||
}
|
||||
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate refresh token"})
|
||||
}
|
||||
|
||||
// Check if request is from HTMX
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
// Return HTML with script to set token and redirect
|
||||
html := fmt.Sprintf(`<div class="text-green-500">Registration successful! Redirecting...</div>
|
||||
<script>
|
||||
localStorage.setItem('token', '%s');
|
||||
localStorage.setItem('refreshToken', '%s');
|
||||
localStorage.setItem('user', JSON.stringify(%s));
|
||||
document.cookie = 'token=%s; path=/; max-age=86400';
|
||||
document.cookie = 'token=%s; path=/; max-age=3600';
|
||||
window.location.href = '/api/dashboard';
|
||||
</script>`, token, fmt.Sprintf(`{"id":"%s","email":"%s","username":"%s"}`, uuid.UUID(user.ID.Bytes).String(), user.Email, user.Username), token)
|
||||
</script>`, accessToken, refreshToken, fmt.Sprintf(`{"id":"%s","email":"%s","username":"%s"}`, uuid.UUID(user.ID.Bytes).String(), user.Email, user.Username), accessToken)
|
||||
return c.HTML(http.StatusCreated, html)
|
||||
}
|
||||
|
||||
@@ -252,7 +268,10 @@ window.location.href = '/api/dashboard';
|
||||
lastName = user.LastName.String
|
||||
}
|
||||
return c.JSON(http.StatusCreated, AuthResponse{
|
||||
Token: token,
|
||||
Token: accessToken,
|
||||
RefreshToken: refreshToken,
|
||||
TokenType: "Bearer",
|
||||
ExpiresIn: 3600,
|
||||
User: UserProfile{
|
||||
ID: uuid.UUID(user.ID.Bytes).String(),
|
||||
Email: user.Email,
|
||||
@@ -306,9 +325,34 @@ func (h *AuthHandler) Login(c echo.Context) error {
|
||||
return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
|
||||
}
|
||||
|
||||
// Check if user/IP is locked out
|
||||
ip := c.RealIP()
|
||||
if ip == "" {
|
||||
ip = c.Request().RemoteAddr
|
||||
}
|
||||
|
||||
locked, remainingTime := h.loginAttemptTracker.IsLocked(login)
|
||||
if locked {
|
||||
errMsg := fmt.Sprintf("Account locked. Try again in %d minutes", int(remainingTime.Minutes())+1)
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusTooManyRequests, `<div class="text-red-500">`+errMsg+`</div>`)
|
||||
}
|
||||
return c.JSON(http.StatusTooManyRequests, map[string]string{"error": errMsg})
|
||||
}
|
||||
|
||||
// Get user by email or username (includes password hash for verification)
|
||||
user, err := h.db.GetUserForLogin(c.Request().Context(), req.Login)
|
||||
if err != nil {
|
||||
// Record failed attempt
|
||||
locked, remainingTime := h.loginAttemptTracker.RecordFailedAttempt(login)
|
||||
if locked {
|
||||
errMsg := fmt.Sprintf("Too many failed attempts. Account locked for %d minutes", int(remainingTime.Minutes())+1)
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusTooManyRequests, `<div class="text-red-500">`+errMsg+`</div>`)
|
||||
}
|
||||
return c.JSON(http.StatusTooManyRequests, map[string]string{"error": errMsg})
|
||||
}
|
||||
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusUnauthorized, `<div class="text-red-500">Invalid credentials</div>`)
|
||||
}
|
||||
@@ -317,14 +361,27 @@ func (h *AuthHandler) Login(c echo.Context) error {
|
||||
|
||||
// Check password
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
|
||||
// Record failed attempt
|
||||
locked, remainingTime := h.loginAttemptTracker.RecordFailedAttempt(login)
|
||||
if locked {
|
||||
errMsg := fmt.Sprintf("Too many failed attempts. Account locked for %d minutes", int(remainingTime.Minutes())+1)
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusTooManyRequests, `<div class="text-red-500">`+errMsg+`</div>`)
|
||||
}
|
||||
return c.JSON(http.StatusTooManyRequests, map[string]string{"error": errMsg})
|
||||
}
|
||||
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusUnauthorized, `<div class="text-red-500">Invalid credentials</div>`)
|
||||
}
|
||||
return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
|
||||
}
|
||||
|
||||
// Clear failed attempts on successful login
|
||||
h.loginAttemptTracker.ClearAttempts(login)
|
||||
|
||||
// Generate JWT with user details
|
||||
token, err := h.generateJWTWithAllClaims(
|
||||
accessToken, err := h.generateJWTWithAllClaims(
|
||||
uuid.UUID(user.ID.Bytes).String(),
|
||||
user.Role,
|
||||
user.Email,
|
||||
@@ -337,16 +394,26 @@ func (h *AuthHandler) Login(c echo.Context) error {
|
||||
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate token"})
|
||||
}
|
||||
|
||||
// Create refresh token
|
||||
refreshToken, _, err := h.CreateRefreshToken(uuid.UUID(user.ID.Bytes))
|
||||
if err != nil {
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
return c.HTML(http.StatusInternalServerError, `<div class="text-red-500">Failed to generate refresh token</div>`)
|
||||
}
|
||||
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to generate refresh token"})
|
||||
}
|
||||
|
||||
// Check if request is from HTMX
|
||||
if c.Request().Header.Get("HX-Request") == "true" {
|
||||
// Return HTML with script to set token and redirect
|
||||
html := fmt.Sprintf(`<div class="text-green-500">Login successful! Redirecting...</div>
|
||||
<script>
|
||||
localStorage.setItem('token', '%s');
|
||||
localStorage.setItem('refreshToken', '%s');
|
||||
localStorage.setItem('user', JSON.stringify(%s));
|
||||
document.cookie = 'token=%s; path=/; max-age=86400';
|
||||
document.cookie = 'token=%s; path=/; max-age=3600';
|
||||
window.location.href = '/api/dashboard';
|
||||
</script>`, token, fmt.Sprintf(`{"id":"%s","email":"%s","username":"%s","first_name":"%s","last_name":"%s"}`, uuid.UUID(user.ID.Bytes).String(), user.Email, user.Username, user.FirstName.String, user.LastName.String), token)
|
||||
</script>`, accessToken, refreshToken, fmt.Sprintf(`{"id":"%s","email":"%s","username":"%s","first_name":"%s","last_name":"%s"}`, uuid.UUID(user.ID.Bytes).String(), user.Email, user.Username, user.FirstName.String, user.LastName.String), accessToken)
|
||||
return c.HTML(http.StatusOK, html)
|
||||
}
|
||||
|
||||
@@ -359,7 +426,10 @@ window.location.href = '/api/dashboard';
|
||||
lastName = user.LastName.String
|
||||
}
|
||||
return c.JSON(http.StatusOK, AuthResponse{
|
||||
Token: token,
|
||||
Token: accessToken,
|
||||
RefreshToken: refreshToken,
|
||||
TokenType: "Bearer",
|
||||
ExpiresIn: 3600,
|
||||
User: UserProfile{
|
||||
ID: uuid.UUID(user.ID.Bytes).String(),
|
||||
Email: user.Email,
|
||||
@@ -651,7 +721,7 @@ func (h *AuthHandler) UpdateEmail(c echo.Context) error {
|
||||
|
||||
type UpdatePasswordRequest struct {
|
||||
CurrentPassword string `json:"current_password" validate:"required"`
|
||||
NewPassword string `json:"new_password" validate:"required,min=6"`
|
||||
NewPassword string `json:"new_password" validate:"required,passwordcomplex"`
|
||||
ConfirmPassword string `json:"confirm_password" validate:"required"`
|
||||
}
|
||||
|
||||
@@ -860,7 +930,7 @@ func (h *AuthHandler) generateJWTWithAllClaims(userID, userRole, userEmail, user
|
||||
"user_role": userRole,
|
||||
"user_email": userEmail,
|
||||
"user_username": userUsername,
|
||||
"exp": time.Now().Add(24 * time.Hour).Unix(),
|
||||
"exp": time.Now().Add(1 * time.Hour).Unix(),
|
||||
"iat": time.Now().Unix(),
|
||||
}
|
||||
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
|
||||
"github.com/labstack/echo/v4"
|
||||
)
|
||||
|
||||
// ErrorResponse represents a standardized error response
|
||||
type ErrorResponse struct {
|
||||
Error string `json:"error"`
|
||||
Message string `json:"message,omitempty"`
|
||||
Code string `json:"code,omitempty"`
|
||||
}
|
||||
|
||||
// HTTPError represents an HTTP error with additional context
|
||||
type HTTPError struct {
|
||||
Code int
|
||||
Message string
|
||||
Err error
|
||||
}
|
||||
|
||||
// Error implements the error interface
|
||||
func (e *HTTPError) Error() string {
|
||||
if e.Err != nil {
|
||||
return fmt.Sprintf("%s: %v", e.Message, e.Err)
|
||||
}
|
||||
return e.Message
|
||||
}
|
||||
|
||||
// Common error types
|
||||
var (
|
||||
ErrBadRequest = &HTTPError{Code: http.StatusBadRequest, Message: "Bad request"}
|
||||
ErrUnauthorized = &HTTPError{Code: http.StatusUnauthorized, Message: "Unauthorized"}
|
||||
ErrForbidden = &HTTPError{Code: http.StatusForbidden, Message: "Forbidden"}
|
||||
ErrNotFound = &HTTPError{Code: http.StatusNotFound, Message: "Resource not found"}
|
||||
ErrConflict = &HTTPError{Code: http.StatusConflict, Message: "Resource conflict"}
|
||||
ErrTooManyRequest = &HTTPError{Code: http.StatusTooManyRequests, Message: "Too many requests"}
|
||||
ErrInternal = &HTTPError{Code: http.StatusInternalServerError, Message: "Internal server error"}
|
||||
)
|
||||
|
||||
// NewHTTPError creates a new HTTP error
|
||||
func NewHTTPError(code int, message string, err error) *HTTPError {
|
||||
return &HTTPError{
|
||||
Code: code,
|
||||
Message: message,
|
||||
Err: err,
|
||||
}
|
||||
}
|
||||
|
||||
// RespondWithError sends a standardized error response
|
||||
func RespondWithError(c echo.Context, code int, message string, err error) error {
|
||||
response := ErrorResponse{
|
||||
Error: message,
|
||||
Message: "",
|
||||
Code: "",
|
||||
}
|
||||
|
||||
// Include original error message in development mode if available
|
||||
if err != nil {
|
||||
response.Message = err.Error()
|
||||
}
|
||||
|
||||
return c.JSON(code, response)
|
||||
}
|
||||
|
||||
// RespondWithHTTPError sends an HTTPError as JSON
|
||||
func RespondWithHTTPError(c echo.Context, httpErr *HTTPError) error {
|
||||
response := ErrorResponse{
|
||||
Error: httpErr.Message,
|
||||
}
|
||||
|
||||
if httpErr.Err != nil {
|
||||
response.Message = httpErr.Err.Error()
|
||||
}
|
||||
|
||||
return c.JSON(httpErr.Code, response)
|
||||
}
|
||||
|
||||
// WrapHandler wraps an echo.HandlerFunc to return standardized errors
|
||||
func WrapHandler(fn func(c echo.Context) error) echo.HandlerFunc {
|
||||
return func(c echo.Context) error {
|
||||
err := fn(c)
|
||||
if err != nil {
|
||||
if httpErr, ok := err.(*HTTPError); ok {
|
||||
return RespondWithHTTPError(c, httpErr)
|
||||
}
|
||||
return RespondWithError(c, http.StatusInternalServerError, "Internal server error", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user