From d440e55f05e3172c3816e072f27de75c8a2ecba4 Mon Sep 17 00:00:00 2001
From: John O'Keefe <jrokeefe@protonmail.com>
Date: Sat, 31 Jan 2026 11:44:35 -0500
Subject: [PATCH] Update handlers to work with UUID refresh tokens

- Add parseTokenUUID() helper to convert string to pgtype.UUID
- Update RefreshAccessToken to parse token string to UUID before validation
- Update Logout to parse token string to UUID before revoking
- Update CreateRefreshToken to pass UUID directly to database
- Update auth.go: fix return value order from CreateRefreshToken
- Remove unnecessary comments for cleaner code
---
 internal/handlers/auth.go          |  4 ++--
 internal/handlers/refresh_token.go | 36 +++++++++++++++++++++---------
 2 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go
index 806f83d..7387cc0 100644
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -229,7 +229,7 @@ func (h *AuthHandler) Register(c echo.Context) error {
 	}
 
 	// Create refresh token
-	refreshToken, _, err := h.CreateRefreshToken(uuid.UUID(user.ID.Bytes))
+	_, refreshToken, err := h.CreateRefreshToken(uuid.UUID(user.ID.Bytes))
 	if err != nil {
 		if c.Request().Header.Get("HX-Request") == "true" {
 			return c.HTML(http.StatusInternalServerError, `<div class="text-red-500">Failed to generate refresh token</div>`)
@@ -376,7 +376,7 @@ func (h *AuthHandler) Login(c echo.Context) error {
 	}
 
 	// Create refresh token
-	refreshToken, _, err := h.CreateRefreshToken(uuid.UUID(user.ID.Bytes))
+	_, refreshToken, err := h.CreateRefreshToken(uuid.UUID(user.ID.Bytes))
 	if err != nil {
 		if c.Request().Header.Get("HX-Request") == "true" {
 			return c.HTML(http.StatusInternalServerError, `<div class="text-red-500">Failed to generate refresh token</div>`)
diff --git a/internal/handlers/refresh_token.go b/internal/handlers/refresh_token.go
index 95be0f7..bd24a6c 100644
--- a/internal/handlers/refresh_token.go
+++ b/internal/handlers/refresh_token.go
@@ -3,6 +3,7 @@ package handlers
 import (
 	"bookmann/internal/database"
 	"context"
+	"fmt"
 	"net/http"
 	"time"
 
@@ -20,6 +21,14 @@ type RefreshTokenRequest struct {
 	RefreshToken string `json:"refresh_token" validate:"required"`
 }
 
+func parseTokenUUID(tokenStr string) (pgtype.UUID, error) {
+	tokenUUID, err := uuid.Parse(tokenStr)
+	if err != nil {
+		return pgtype.UUID{}, err
+	}
+	return pgtype.UUID{Bytes: [16]byte(tokenUUID), Valid: true}, nil
+}
+
 type RefreshTokenResponse struct {
 	AccessToken string `json:"access_token"`
 	TokenType   string `json:"token_type"`
@@ -36,8 +45,12 @@ func (h *AuthHandler) RefreshAccessToken(c echo.Context) error {
 		return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()})
 	}
 
-	// Get refresh token from database
-	tokenInfo, err := h.db.GetRefreshToken(c.Request().Context(), req.RefreshToken)
+	tokenUUID, err := parseTokenUUID(req.RefreshToken)
+	if err != nil {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid refresh token format"})
+	}
+
+	tokenInfo, err := h.db.GetRefreshToken(c.Request().Context(), tokenUUID)
 	if err != nil {
 		if err == pgx.ErrNoRows {
 			return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid or expired refresh token"})
@@ -45,7 +58,6 @@ func (h *AuthHandler) RefreshAccessToken(c echo.Context) error {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to validate refresh token"})
 	}
 
-	// Generate new access token
 	accessToken, err := h.generateJWTWithAllClaims(
 		uuid.UUID(tokenInfo.UserID.Bytes).String(),
 		tokenInfo.Role,
@@ -59,7 +71,7 @@ func (h *AuthHandler) RefreshAccessToken(c echo.Context) error {
 	return c.JSON(http.StatusOK, RefreshTokenResponse{
 		AccessToken: accessToken,
 		TokenType:   "Bearer",
-		ExpiresIn:   3600, // 1 hour in seconds
+		ExpiresIn:   3600,
 	})
 }
 
@@ -67,12 +79,15 @@ func (h *AuthHandler) RefreshAccessToken(c echo.Context) error {
 func (h *AuthHandler) Logout(c echo.Context) error {
 	var req RefreshTokenRequest
 	if err := c.Bind(&req); err != nil {
-		// If no refresh token provided, just return success
 		return c.JSON(http.StatusOK, map[string]string{"message": "logged out successfully"})
 	}
 
-	// Revoke the refresh token if provided
-	err := h.db.RevokeRefreshToken(c.Request().Context(), req.RefreshToken)
+	tokenUUID, err := parseTokenUUID(req.RefreshToken)
+	if err != nil {
+		return c.JSON(http.StatusOK, map[string]string{"message": "logged out successfully"})
+	}
+
+	err = h.db.RevokeRefreshToken(c.Request().Context(), tokenUUID)
 	if err != nil && err != pgx.ErrNoRows {
 		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to revoke refresh token"})
 	}
@@ -82,22 +97,21 @@ func (h *AuthHandler) Logout(c echo.Context) error {
 
 // CreateRefreshToken creates a new refresh token for a user
 func (h *AuthHandler) CreateRefreshToken(userID uuid.UUID) (string, string, error) {
-	// Generate refresh token
 	tokenUUID := uuid.New()
 	refreshToken := tokenUUID.String()
 
-	// Store in database (plain text for simplicity - tokens are already random UUIDs)
 	expiresAt := time.Now().Add(refreshTokenExpiration)
 	_, err := h.db.CreateRefreshToken(context.Background(), database.CreateRefreshTokenParams{
 		UserID:    pgtype.UUID{Bytes: [16]byte(userID), Valid: true},
-		Token:     refreshToken,
+		Token:     pgtype.UUID{Bytes: [16]byte(tokenUUID), Valid: true},
 		ExpiresAt: pgtype.Timestamptz{Time: expiresAt, Valid: true},
 	})
 	if err != nil {
+		fmt.Printf("ERROR storing refresh token: %v\n", err)
 		return "", "", err
 	}
+	fmt.Printf("DEBUG: refreshToken generated: '%s'\n", refreshToken)
 
-	// Generate new access token
 	accessToken, err := h.generateJWT(userID.String())
 	if err != nil {
 		return "", "", err