@johnnyboy11234/esg-idea-contest 0.1.0 → 0.2.1

package/backend/internal/audit/service.go

@@ -0,0 +1,157 @@
+package audit
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+	"sync/atomic"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Service writes audit rows.
+type Service struct {
+	db  *sql.DB
+	log *slog.Logger
+
+	rejectedFailures atomic.Uint64
+}
+
+// New returns a Service. log may be nil.
+func New(database *sql.DB, log *slog.Logger) *Service {
+	if log == nil {
+		log = slog.New(slog.DiscardHandler)
+	}
+	return &Service{db: database, log: log}
+}
+
+// RejectedFailures counts track-B rows that could not be written (the
+// audit-write-failures metric of PRD §10 reads this).
+func (s *Service) RejectedFailures() uint64 { return s.rejectedFailures.Load() }
+
+// Record is track A: it inserts the row in the caller's transaction, so the row
+// commits or rolls back with the business write. An error must make the caller
+// roll back (fail-closed). Any outcome is allowed.
+func (s *Service) Record(ctx context.Context, tx *sql.Tx, e Event) error {
+	if tx == nil {
+		return errors.New("audit: Record needs the caller's transaction")
+	}
+	return insert(ctx, tx, e)
+}
+
+// RecordRejected is track B: it writes a rejected attempt (DENIED, FAILED or
+// THROTTLED) in its own transaction. It is best effort: a failure is logged and
+// counted, never returned, and a client disconnect does not drop the row (the
+// transaction runs on a context detached from ctx, as db.InTx does). Only the
+// central error adapter calls it (Backend.md §7).
+func (s *Service) RecordRejected(ctx context.Context, e Event) {
+	if e.Outcome == Success {
+		s.rejectedFailed(ctx, e, errors.New("audit: RecordRejected called with outcome SUCCESS"))
+		return
+	}
+	_, err := db.InTx(ctx, s.db, func(ctx context.Context, tx *sql.Tx) error {
+		return insert(ctx, tx, e)
+	})
+	if err != nil {
+		s.rejectedFailed(ctx, e, err)
+	}
+}
+
+func (s *Service) rejectedFailed(ctx context.Context, e Event, err error) {
+	s.rejectedFailures.Add(1)
+	s.log.ErrorContext(ctx, "audit: rejected attempt not recorded",
+		"action", string(e.Action), "outcome", string(e.Outcome), "error", err)
+}
+
+type execer interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
+const insertSQL = `INSERT INTO audit_log
+ (request_id, actor_emp_no, actor_role, action, outcome, target_type, target_id,
+  method, route, status, error_code, ip, user_agent, submitted_emp_no, before_json, after_json)
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+
+// insert validates and sanitizes e, then writes it. occurred_at is the column
+// default, i.e. database time.
+func insert(ctx context.Context, x execer, e Event) error {
+	if !e.Action.Valid() {
+		return fmt.Errorf("audit: unknown action %q", e.Action)
+	}
+	if !e.Outcome.Valid() {
+		return fmt.Errorf("audit: unknown outcome %q", e.Outcome)
+	}
+	if e.TargetType != "" && !e.TargetType.Valid() {
+		return fmt.Errorf("audit: unknown target type %q", e.TargetType)
+	}
+	if e.TargetID != uuid.Nil && e.TargetType == "" {
+		return errors.New("audit: target ID without target type")
+	}
+
+	role, empNo := e.ActorRole, e.ActorEmpNo
+	if role == "" {
+		role, empNo = security.ActorRoleFrom(ctx), security.ActorEmpNo(ctx)
+	}
+	switch role {
+	case security.ActorUser, security.ActorAdmin, security.ActorAnonymous, security.ActorSystem:
+	default:
+		return fmt.Errorf("audit: unknown actor role %q", role)
+	}
+
+	before, err := cleanJSON(e.Before)
+	if err != nil {
+		return fmt.Errorf("before: %w", err)
+	}
+	after, err := cleanJSON(e.After)
+	if err != nil {
+		return fmt.Errorf("after: %w", err)
+	}
+
+	var reqID any
+	if id, err := uuid.Parse(web.RequestIDFrom(ctx)); err == nil {
+		reqID = id.String()
+	}
+	var targetID any
+	if e.TargetID != uuid.Nil {
+		targetID = e.TargetID.String()
+	}
+	var status any
+	if e.Status > 0 {
+		status = e.Status
+	}
+	var ip any
+	if e.IP.IsValid() {
+		ip = e.IP.WithZone("").String() // INET6 has no zone
+	}
+
+	_, err = x.ExecContext(ctx, insertSQL,
+		reqID, nullStr(clean(empNo, maxEmpNo)), string(role), string(e.Action), string(e.Outcome),
+		nullStr(string(e.TargetType)), targetID,
+		nullStr(clean(e.Method, maxMethod)), nullStr(clean(e.Route, maxRoute)), status,
+		nullStr(clean(e.ErrorCode, maxErrorCode)), ip, nullStr(clean(e.UserAgent, maxUserAgent)),
+		nullStr(clean(e.SubmittedEmpNo, maxEmpNo)), nullBytes(before), nullBytes(after))
+	if err != nil {
+		return fmt.Errorf("audit: insert: %w", err)
+	}
+	return nil
+}
+
+func nullStr(s string) any {
+	if s == "" {
+		return nil
+	}
+	return s
+}
+
+func nullBytes(b []byte) any {
+	if b == nil {
+		return nil
+	}
+	return string(b) // JSON column: send text, not a binary blob
+}

package/backend/internal/auth/internal/store/session.go

@@ -0,0 +1,111 @@
+// Package store holds the SQL of the auth module. Only the auth module may
+// import it (Go's internal rule); no other module touches the session table.
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+// Limits are the session timeouts in seconds (PRD §6.5).
+type Limits struct {
+	IdleSeconds     int
+	AbsoluteSeconds int
+	RefreshSeconds  int
+}
+
+// Insert stores a new session row. hash is SHA-256 of the session ID.
+func Insert(ctx context.Context, db *sql.DB, hash []byte, userID uuid.UUID) error {
+	_, err := db.ExecContext(ctx,
+		`INSERT INTO session (id_hash, user_id) VALUES (?, ?)`, hash, userID.String())
+	if err != nil {
+		return fmt.Errorf("insert session: %w", err)
+	}
+	return nil
+}
+
+// Touch validates and refreshes a session in ONE statement on database time.
+// It reports true when the row matched: the session exists, is inside both
+// timeouts and its account is enabled. RowsAffected counts matched rows
+// (clientFoundRows=true in the DSN), so a row that needs no refresh still
+// counts; a test locks this. last_access_at is written only when older than
+// the refresh interval (OI-11).
+func Touch(ctx context.Context, db *sql.DB, hash []byte, l Limits) (bool, error) {
+	res, err := db.ExecContext(ctx,
+		`UPDATE session s JOIN app_user u ON u.id = s.user_id
+		    SET s.last_access_at = IF(s.last_access_at < NOW(6) - INTERVAL ? SECOND, NOW(6), s.last_access_at)
+		  WHERE s.id_hash = ?
+		    AND u.enabled
+		    AND s.last_access_at > NOW(6) - INTERVAL ? SECOND
+		    AND s.created_at     > NOW(6) - INTERVAL ? SECOND`,
+		l.RefreshSeconds, hash, l.IdleSeconds, l.AbsoluteSeconds)
+	if err != nil {
+		return false, fmt.Errorf("touch session: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("touch session rows: %w", err)
+	}
+	return n == 1, nil
+}
+
+// Principal reads the caller behind a session. The role comes from app_user,
+// never from the session. found is false when the session vanished between
+// Touch and this read (logout, revoke, purge).
+func Principal(ctx context.Context, db *sql.DB, hash []byte) (p security.Principal, found bool, err error) {
+	var id, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT u.id, u.emp_no, u.role
+		   FROM session s JOIN app_user u ON u.id = s.user_id
+		  WHERE s.id_hash = ? AND u.enabled`, hash).Scan(&id, &p.EmpNo, &role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return security.Principal{}, false, nil
+	}
+	if err != nil {
+		return security.Principal{}, false, fmt.Errorf("read session principal: %w", err)
+	}
+	if p.UserID, err = uuid.Parse(id); err != nil {
+		return security.Principal{}, false, fmt.Errorf("parse user id %q: %w", id, err)
+	}
+	p.Role = security.Role(role)
+	return p, true, nil
+}
+
+// Delete removes one session; deleting a missing one is not an error.
+func Delete(ctx context.Context, db *sql.DB, hash []byte) error {
+	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
+		return fmt.Errorf("delete session: %w", err)
+	}
+	return nil
+}
+
+// DeleteByUser removes every session of one account.
+func DeleteByUser(ctx context.Context, db *sql.DB, userID uuid.UUID) error {
+	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE user_id = ?`, userID.String()); err != nil {
+		return fmt.Errorf("delete sessions of user: %w", err)
+	}
+	return nil
+}
+
+// DeleteExpired removes sessions past either timeout and returns how many.
+func DeleteExpired(ctx context.Context, db *sql.DB, l Limits) (int64, error) {
+	res, err := db.ExecContext(ctx,
+		`DELETE FROM session
+		  WHERE last_access_at <= NOW(6) - INTERVAL ? SECOND
+		     OR created_at     <= NOW(6) - INTERVAL ? SECOND`,
+		l.IdleSeconds, l.AbsoluteSeconds)
+	if err != nil {
+		return 0, fmt.Errorf("purge sessions: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("purge sessions rows: %w", err)
+	}
+	return n, nil
+}

package/backend/internal/auth/session.go

@@ -0,0 +1,113 @@
+// Package auth owns login, sessions, CSRF and throttling (Backend.md §6).
+// This file is the session store (B1-07); the middleware (B1-08) builds on it.
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/base64"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+// Session timeouts (PRD §6.5). Refresh is written at most once per 60 s
+// (OI-11), so the effective idle timeout is 29-30 minutes.
+const (
+	IdleTimeoutSeconds     = 30 * 60
+	AbsoluteTimeoutSeconds = 8 * 60 * 60
+	RefreshSeconds         = 60
+
+	idBytes = 32
+)
+
+var limits = store.Limits{
+	IdleSeconds:     IdleTimeoutSeconds,
+	AbsoluteSeconds: AbsoluteTimeoutSeconds,
+	RefreshSeconds:  RefreshSeconds,
+}
+
+// Sessions is the server-side session store. It never sees or stores a raw
+// session ID beyond the call that receives it; the table holds SHA-256 only.
+type Sessions struct {
+	DB *sql.DB
+}
+
+// New returns a session store on db.
+func New(db *sql.DB) *Sessions { return &Sessions{DB: db} }
+
+// Create issues a new session for the user and returns the ID for the cookie
+// (32 random bytes, base64url without padding). Every login calls it, so an ID
+// is never reused (no fixation).
+func (s *Sessions) Create(ctx context.Context, userID uuid.UUID) (string, error) {
+	raw := make([]byte, idBytes)
+	if _, err := rand.Read(raw); err != nil {
+		return "", fmt.Errorf("session id: %w", err)
+	}
+	if err := store.Insert(ctx, s.DB, hash(raw), userID); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(raw), nil
+}
+
+// Validate checks the cookie value and refreshes the session in one atomic
+// statement, then returns the caller. ok is false for anything that is not a
+// live session of an enabled account: malformed, unknown, idle or absolutely
+// expired, disabled user, or removed meanwhile. err is for database failures
+// only.
+func (s *Sessions) Validate(ctx context.Context, id string) (p security.Principal, ok bool, err error) {
+	h, valid := parse(id)
+	if !valid {
+		return security.Principal{}, false, nil
+	}
+	if ok, err = store.Touch(ctx, s.DB, h, limits); err != nil || !ok {
+		return security.Principal{}, false, err
+	}
+	return store.Principal(ctx, s.DB, h)
+}
+
+// Revoke deletes one session. It is idempotent: an unknown or malformed ID is
+// not an error (logout returns 204 either way).
+func (s *Sessions) Revoke(ctx context.Context, id string) error {
+	h, valid := parse(id)
+	if !valid {
+		return nil
+	}
+	return store.Delete(ctx, s.DB, h)
+}
+
+// RevokeAll deletes every session of the user. It implements
+// account.SessionRevoker (wired in main.go; account never imports auth).
+func (s *Sessions) RevokeAll(ctx context.Context, userID uuid.UUID) error {
+	return store.DeleteByUser(ctx, s.DB, userID)
+}
+
+// Purge deletes expired sessions and returns how many; a background ticker
+// calls it. Validation never depends on it: expired rows already fail Touch.
+func (s *Sessions) Purge(ctx context.Context) (int64, error) {
+	return store.DeleteExpired(ctx, s.DB, limits)
+}
+
+// Binding returns SHA-256 of the session ID, the value the CSRF token is bound
+// to (D40). ok is false for a malformed ID.
+func Binding(id string) (b []byte, ok bool) { return parse(id) }
+
+// parse decodes a cookie value and returns its SHA-256. Anything that is not
+// exactly 32 bytes of base64url is rejected without a database call.
+func parse(id string) ([]byte, bool) {
+	raw, err := base64.RawURLEncoding.DecodeString(id)
+	if err != nil || len(raw) != idBytes {
+		return nil, false
+	}
+	return hash(raw), true
+}
+
+func hash(raw []byte) []byte {
+	sum := sha256.Sum256(raw)
+	return sum[:]
+}

package/backend/internal/auth/session_integration_test.go

@@ -0,0 +1,245 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/base64"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+const bcryptHash = "$2a$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234" // shape only; satisfies ck_app_user_hash
+
+func addUser(t *testing.T, db *sql.DB, empNo, role string, enabled bool) uuid.UUID {
+	t.Helper()
+	id := uuid.New()
+	var email any = empNo + "@example.com"
+	if role == "ADMIN" {
+		email = nil
+	}
+	if _, err := db.Exec(`INSERT INTO app_user (id, emp_no, name, email, password_hash, role, enabled) VALUES (?,?,?,?,?,?,?)`,
+		id.String(), empNo, "N "+empNo, email, bcryptHash, role, enabled); err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+// age moves a session's timestamps into the past (DB time is the only clock,
+// so tests change the rows rather than the clock).
+func age(t *testing.T, db *sql.DB, id string, created, lastAccess time.Duration) {
+	t.Helper()
+	h, _ := auth.Binding(id)
+	if _, err := db.Exec(`UPDATE session SET created_at = NOW(6) - INTERVAL ? SECOND, last_access_at = NOW(6) - INTERVAL ? SECOND WHERE id_hash = ?`,
+		int(created.Seconds()), int(lastAccess.Seconds()), h); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func lastAccess(t *testing.T, db *sql.DB, id string) time.Time {
+	t.Helper()
+	h, _ := auth.Binding(id)
+	var ts time.Time
+	if err := db.QueryRow(`SELECT last_access_at FROM session WHERE id_hash = ?`, h).Scan(&ts); err != nil {
+		t.Fatal(err)
+	}
+	return ts
+}
+
+func TestSessions(t *testing.T) {
+	db := dbtest.New(t)
+	ctx := context.Background()
+	s := auth.New(db)
+	user := addUser(t, db, "100001", "USER", true)
+
+	create := func(t *testing.T, u uuid.UUID) string {
+		t.Helper()
+		id, err := s.Create(ctx, u)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	valid := func(t *testing.T, id string) bool {
+		t.Helper()
+		_, ok, err := s.Validate(ctx, id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return ok
+	}
+
+	t.Run("create stores only the SHA-256 and returns a 32-byte ID", func(t *testing.T) {
+		id := create(t, user)
+		raw, err := base64.RawURLEncoding.DecodeString(id)
+		if err != nil || len(raw) != 32 {
+			t.Fatalf("id %q: %d bytes, %v", id, len(raw), err)
+		}
+		sum := sha256.Sum256(raw)
+		var n int
+		if err := db.QueryRow(`SELECT COUNT(*) FROM session WHERE id_hash = ?`, sum[:]).Scan(&n); err != nil || n != 1 {
+			t.Fatalf("hash row count = %d, %v", n, err)
+		}
+		if err := db.QueryRow(`SELECT COUNT(*) FROM session WHERE id_hash = ?`, raw).Scan(&n); err != nil || n != 0 {
+			t.Fatalf("raw ID stored: %d, %v", n, err)
+		}
+	})
+
+	t.Run("every login gets a new ID", func(t *testing.T) {
+		if a, b := create(t, user), create(t, user); a == b {
+			t.Fatal("same ID twice")
+		}
+	})
+
+	t.Run("validate returns the principal with the role from app_user", func(t *testing.T) {
+		admin := addUser(t, db, "200001", "ADMIN", true)
+		p, ok, err := s.Validate(ctx, create(t, admin))
+		if err != nil || !ok {
+			t.Fatalf("validate: %v %v", ok, err)
+		}
+		want := security.Principal{UserID: admin, EmpNo: "200001", Role: security.RoleAdmin}
+		if p != want {
+			t.Fatalf("principal = %+v, want %+v", p, want)
+		}
+	})
+
+	t.Run("unknown and malformed IDs are not valid", func(t *testing.T) {
+		unknown := base64.RawURLEncoding.EncodeToString(make([]byte, 32))
+		for _, id := range []string{unknown, "", "garbage"} {
+			if valid(t, id) {
+				t.Errorf("%q accepted", id)
+			}
+		}
+	})
+
+	t.Run("matched rows count: a valid session that needs no refresh still validates", func(t *testing.T) {
+		id := create(t, user)
+		before := lastAccess(t, db, id)
+		for i := 0; i < 2; i++ {
+			if !valid(t, id) {
+				t.Fatalf("validate #%d failed although the row matched", i+1)
+			}
+		}
+		if after := lastAccess(t, db, id); !after.Equal(before) {
+			t.Fatalf("last_access_at moved inside the 60 s window: %v -> %v", before, after)
+		}
+	})
+
+	t.Run("refresh happens only when last access is older than 60 s", func(t *testing.T) {
+		id := create(t, user)
+		age(t, db, id, 0, 59*time.Second)
+		before := lastAccess(t, db, id)
+		if !valid(t, id) || !lastAccess(t, db, id).Equal(before) {
+			t.Fatal("59 s old: must validate without writing")
+		}
+		age(t, db, id, 0, 61*time.Second)
+		before = lastAccess(t, db, id)
+		if !valid(t, id) || !lastAccess(t, db, id).After(before) {
+			t.Fatal("61 s old: must validate and refresh")
+		}
+	})
+
+	t.Run("idle timeout is 30 minutes", func(t *testing.T) {
+		id := create(t, user)
+		age(t, db, id, 0, 29*time.Minute+50*time.Second)
+		if !valid(t, id) {
+			t.Fatal("29m50s idle must still be valid")
+		}
+		age(t, db, id, 0, 30*time.Minute+5*time.Second)
+		if valid(t, id) {
+			t.Fatal("30m05s idle must be expired")
+		}
+	})
+
+	t.Run("absolute timeout is 8 hours, even for an active session", func(t *testing.T) {
+		id := create(t, user)
+		age(t, db, id, 7*time.Hour+59*time.Minute, 0)
+		if !valid(t, id) {
+			t.Fatal("7h59m old must still be valid")
+		}
+		age(t, db, id, 8*time.Hour+time.Minute, 0)
+		if valid(t, id) {
+			t.Fatal("8h01m old must be expired although just used")
+		}
+	})
+
+	t.Run("disabled user is rejected on the next request", func(t *testing.T) {
+		u := addUser(t, db, "100002", "USER", true)
+		id := create(t, u)
+		if !valid(t, id) {
+			t.Fatal("enabled user must validate")
+		}
+		if _, err := db.Exec(`UPDATE app_user SET enabled = FALSE WHERE id = ?`, u.String()); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, id) {
+			t.Fatal("disabled user must not validate")
+		}
+	})
+
+	t.Run("revoke is idempotent and ends only that session", func(t *testing.T) {
+		a, b := create(t, user), create(t, user)
+		for i := 0; i < 2; i++ {
+			if err := s.Revoke(ctx, a); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if err := s.Revoke(ctx, "garbage"); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, a) || !valid(t, b) {
+			t.Fatal("revoke must end a and leave b")
+		}
+	})
+
+	t.Run("revoke all ends every session of the user only", func(t *testing.T) {
+		u, other := addUser(t, db, "100003", "USER", true), addUser(t, db, "100004", "USER", true)
+		a, b, o := create(t, u), create(t, u), create(t, other)
+		if err := s.RevokeAll(ctx, u); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, a) || valid(t, b) || !valid(t, o) {
+			t.Fatal("RevokeAll must end the user's sessions and no others")
+		}
+	})
+
+	t.Run("purge removes expired sessions only", func(t *testing.T) {
+		u := addUser(t, db, "100005", "USER", true)
+		live, idle, old := create(t, u), create(t, u), create(t, u)
+		age(t, db, idle, time.Hour, time.Hour)
+		age(t, db, old, 9*time.Hour, 0)
+		n, err := s.Purge(ctx)
+		if err != nil || n < 2 {
+			t.Fatalf("purged %d, %v; want at least 2", n, err)
+		}
+		if !valid(t, live) {
+			t.Fatal("live session purged")
+		}
+		for _, id := range []string{idle, old} {
+			h, _ := auth.Binding(id)
+			var c int
+			if err := db.QueryRow(`SELECT COUNT(*) FROM session WHERE id_hash = ?`, h).Scan(&c); err != nil || c != 0 {
+				t.Fatalf("expired row still present: %d, %v", c, err)
+			}
+		}
+	})
+
+	t.Run("deleting a user deletes the sessions", func(t *testing.T) {
+		u := addUser(t, db, "100006", "USER", true)
+		id := create(t, u)
+		if _, err := db.Exec(`DELETE FROM app_user WHERE id = ?`, u.String()); err != nil {
+			t.Fatal(err)
+		}
+		if valid(t, id) {
+			t.Fatal("session survived its user")
+		}
+	})
+}

package/backend/internal/auth/session_test.go

@@ -0,0 +1,36 @@
+package auth_test
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+func TestBindingIsSHA256OfDecodedID(t *testing.T) {
+	raw := make([]byte, 32)
+	for i := range raw {
+		raw[i] = byte(i)
+	}
+	want := sha256.Sum256(raw)
+	got, ok := auth.Binding(base64.RawURLEncoding.EncodeToString(raw))
+	if !ok || string(got) != string(want[:]) {
+		t.Fatalf("Binding = %x, %v; want %x", got, ok, want)
+	}
+}
+
+func TestBindingRejectsMalformedIDs(t *testing.T) {
+	for name, id := range map[string]string{
+		"empty":      "",
+		"not base64": "!!!",
+		"too short":  base64.RawURLEncoding.EncodeToString(make([]byte, 31)),
+		"too long":   base64.RawURLEncoding.EncodeToString(make([]byte, 33)),
+		"padded":     base64.URLEncoding.EncodeToString(make([]byte, 32)),
+		"std alpha":  base64.StdEncoding.EncodeToString([]byte{0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff, 0xfe, 0xfb, 0xff}),
+	} {
+		if _, ok := auth.Binding(id); ok {
+			t.Errorf("%s: %q accepted", name, id)
+		}
+	}
+}

package/backend/internal/server/api.go

@@ -3,6 +3,7 @@ package server
 import (
 	"net/http"
 
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
 )
@@ -11,8 +12,14 @@ import (
 // module has not landed yet stay api.Unimplemented (501).
 type API struct {
 	api.Unimplemented
+	Account  account.Handler
 	Deadline deadline.Handler
 }
 
 // GetDeadline serves GET /deadline.
 func (a API) GetDeadline(w http.ResponseWriter, r *http.Request) { a.Deadline.GetDeadline(w, r) }
+
+// Register serves POST /auth/register.
+func (a API) Register(w http.ResponseWriter, r *http.Request, _ api.RegisterParams) {
+	a.Account.Register(w, r)
+}