internal/api/auth_handler.go - master - t3/gateway-server

internal/api/auth_handler.go
82 строки2 KB
Ivan
end-to-end logging
25 июл 2026, 00:10
25 июл 2026, 00:10663e207
package api

import (
	"encoding/json"
	"log/slog"
	"net/http"
	"time"

	"gitverse.ru/t3/gateway-server/internal/auth"
	"gitverse.ru/t3/gateway-server/internal/client"
	"gitverse.ru/t3/gateway-server/internal/config"
)

type AuthHandler struct {
	iamClient *client.IAMClient
	jwtSecret []byte
	jwtTTL    time.Duration
	logger    *slog.Logger
}

func NewAuthHandler(iamClient *client.IAMClient, cfg *config.ServerConfig, logger *slog.Logger) *AuthHandler {
	return &AuthHandler{
		iamClient: iamClient,
		jwtSecret: []byte(cfg.JWTSecret),
		jwtTTL:    cfg.JWTTTL,
		logger:    logger,
	}
}

func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
	var req LoginRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, http.StatusBadRequest, "bad_request", "invalid JSON body")
		return
	}
	if req.AccessKey == "" || req.AccessSecret == "" {
		writeError(w, http.StatusBadRequest, "bad_request", "access_key and access_secret required")
		return
	}

	// Authenticate + authorize via IAM.
	result, err := h.iamClient.AuthCheck(r.Context(), req.AccessKey, req.AccessSecret, "iam:auth", "*")
	if err != nil {
		h.logger.Error("iam auth check failed", "error", err)
		writeError(w, http.StatusUnauthorized, "unauthorized", "invalid credentials")
		return
	}
	if !result.Allowed {
		writeError(w, http.StatusForbidden, "forbidden", "access denied")
		return
	}

	// Issue JWT.
	token, err := auth.IssueJWT(h.jwtSecret, h.jwtTTL, result.UserID, req.AccessKey, result.DisplayName, req.AccessSecret)
	if err != nil {
		h.logger.Error("jwt issue failed", "error", err)
		writeError(w, http.StatusInternalServerError, "internal_error", "failed to create session")
		return
	}

	writeJSON(w, http.StatusOK, LoginResponse{
		Token: token,
		User: UserInfo{
			ID:          result.UserID,
			DisplayName: result.DisplayName,
		},
	})
}

func (h *AuthHandler) Me(w http.ResponseWriter, r *http.Request) {
	claims := auth.ClaimsFromContext(r.Context())
	if claims == nil {
		writeError(w, http.StatusUnauthorized, "unauthorized", "no session")
		return
	}
	writeJSON(w, http.StatusOK, MeResponse{
		User: UserInfo{
			ID:          claims.UserID,
			DisplayName: claims.DisplayName,
		},
	})
}