first commit

2026-04-26 21:43:40 +03:00
commit f34e54c5a5
100 changed files with 27342 additions and 0 deletions
--- a/app/settings/services/jwt_service.go
+++ b/app/settings/services/jwt_service.go
@@ -0,0 +1,173 @@
+package services
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"gobeyhan/config"
+	"gobeyhan/database/models"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type JWTClaim struct {
+	UserID      string   `json:"user_id"`
+	Email       string   `json:"email"`
+	Permissions []string `json:"permissions,omitempty"`
+	jwt.RegisteredClaims
+}
+
+type JWTService struct{}
+
+func NewJWTService() *JWTService {
+	return &JWTService{}
+}
+
+func (s *JWTService) GenerateToken(user models.User) (string, error) {
+	if config.AppConfig == nil || config.AppConfig.JWTSecret == "" {
+		return "", errors.New("jwt secret not configured")
+	}
+
+	expirationTime := time.Now().Add(24 * time.Hour)
+	claims := &JWTClaim{
+		UserID: fmt.Sprintf("%d", user.ID),
+		Email:  user.Email,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expirationTime),
+			Issuer:    "gauth-central",
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(config.AppConfig.JWTSecret))
+}
+
+func (s *JWTService) GenerateTokenPair(user models.User) (string, string, error) {
+	if config.AppConfig == nil || config.AppConfig.JWTSecret == "" {
+		return "", "", errors.New("jwt secret not configured")
+	}
+
+	// Extract permissions
+	permissionMap := make(map[string]bool)
+	for _, role := range user.Roles {
+		for _, perm := range role.Permissions {
+			permissionMap[perm.Name] = true
+		}
+	}
+	var permissions []string
+	for p := range permissionMap {
+		permissions = append(permissions, p)
+	}
+
+	// Access Token
+	expirationMinutes := 120 // Default fallback
+	if config.AppConfig.AccessTokenExpireMinutes > 0 {
+		expirationMinutes = config.AppConfig.AccessTokenExpireMinutes
+	}
+	accessTokenExp := time.Now().Add(time.Duration(expirationMinutes) * time.Minute)
+	accessClaims := &JWTClaim{
+		UserID:      fmt.Sprintf("%d", user.ID),
+		Email:       user.Email,
+		Permissions: permissions,
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   fmt.Sprintf("%d", user.ID), // CRITICAL: Standard "sub" claim
+			ExpiresAt: jwt.NewNumericDate(accessTokenExp),
+			Issuer:    "gauth-central",
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
+	signedAccessToken, err := accessToken.SignedString([]byte(config.AppConfig.JWTSecret))
+	if err != nil {
+		return "", "", err
+	}
+
+	// Refresh Token
+	expirationDays := 30 // Default fallback
+	if config.AppConfig.RefreshTokenExpireDays > 0 {
+		expirationDays = config.AppConfig.RefreshTokenExpireDays
+	}
+	refreshTokenExp := time.Now().Add(time.Duration(expirationDays) * 24 * time.Hour)
+	refreshClaims := &JWTClaim{
+		UserID:      fmt.Sprintf("%d", user.ID),
+		Email:       user.Email,
+		Permissions: nil, // Refresh token doesn't need permissions usually, or keep them if needed
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   fmt.Sprintf("%d", user.ID), // CRITICAL: Standard "sub" claim
+			ExpiresAt: jwt.NewNumericDate(refreshTokenExp),
+			Issuer:    "gauth-central",
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
+	signedRefreshToken, err := refreshToken.SignedString([]byte(config.AppConfig.JWTSecret))
+	if err != nil {
+		return "", "", err
+	}
+
+	return signedAccessToken, signedRefreshToken, nil
+}
+
+func (s *JWTService) ValidateToken(signedToken string) (*JWTClaim, error) {
+	if config.AppConfig == nil || config.AppConfig.JWTSecret == "" {
+		return nil, errors.New("jwt secret not configured")
+	}
+
+	token, err := jwt.ParseWithClaims(
+		signedToken,
+		&JWTClaim{},
+		func(token *jwt.Token) (interface{}, error) {
+			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+				return nil, errors.New("unexpected signing method")
+			}
+			return []byte(config.AppConfig.JWTSecret), nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	claims, ok := token.Claims.(*JWTClaim)
+	if !ok {
+		return nil, errors.New("could not parse claims")
+	}
+
+	if claims.ExpiresAt.Time.Before(time.Now()) {
+		return nil, errors.New("token expired")
+	}
+
+	return claims, nil
+}
+
+// GenerateVerificationToken generates a JWT token for email verification (24 hours expiry)
+func (s *JWTService) GenerateVerificationToken(userID, email string) (string, error) {
+	if config.AppConfig == nil || config.AppConfig.JWTSecret == "" {
+		return "", errors.New("jwt secret not configured")
+	}
+
+	expirationTime := time.Now().Add(24 * time.Hour)
+	claims := &JWTClaim{
+		UserID: userID,
+		Email:  email,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expirationTime),
+			Issuer:    "gauth-central",
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(config.AppConfig.JWTSecret))
+}
+
+// ValidateVerificationToken validates a verification token and returns user ID and email
+func (s *JWTService) ValidateVerificationToken(tokenString string) (string, string, error) {
+	claims, err := s.ValidateToken(tokenString)
+	if err != nil {
+		return "", "", err
+	}
+	return claims.UserID, claims.Email, nil
+}