@johnnyboy11234/esg-idea-contest 0.2.0 → 0.2.1

package/backend/internal/account/service.go

@@ -0,0 +1,153 @@
+// Package account owns app_user: registration today; profile, password change
+// and admin sync land with their own PRs. Backend.md §2.
+package account
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/netip"
+	"strings"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/text"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// bcryptCost is the only cost the table accepts (PRD §6.4, OI-13).
+const bcryptCost = 10
+
+// Recorder writes the success audit row in the registration transaction.
+// *audit.Service implements it.
+type Recorder interface {
+	Record(ctx context.Context, tx *sql.Tx, e audit.Event) error
+}
+
+// Service implements the account use cases.
+type Service struct {
+	DB     *sql.DB
+	Audit  Recorder
+	Policy PasswordPolicy
+}
+
+// RegisterCommand is the raw, unvalidated input.
+type RegisterCommand struct {
+	EmpNo, Name, Email, Password string
+}
+
+// Request is the transport facts the audit row needs.
+type Request struct {
+	Method, Route, UserAgent string
+	IP                       netip.Addr
+}
+
+// Registered is the stored account (never the hash).
+type Registered struct {
+	ID                 uuid.UUID
+	EmpNo, Name, Email string
+}
+
+// Register creates a USER. Order (PRD §6.3): format → password policy →
+// uniqueness. Every failure is a *web.Error carrying the AUTH_REGISTER FAILED
+// audit fields, so the central adapter writes the track-B row; a success
+// writes its SUCCESS row in the same transaction as the INSERT (fail-closed).
+func (s *Service) Register(ctx context.Context, cmd RegisterCommand, req Request) (Registered, error) {
+	empNoOK := checkEmpNo(cmd.EmpNo) == text.None
+
+	var fields []web.FieldError
+	add := func(field string, p text.Problem) {
+		if p != text.None {
+			fields = append(fields, web.FieldError{Field: field, Code: web.ErrorCode(p)})
+		}
+	}
+	add(fieldEmpNo, checkEmpNo(cmd.EmpNo))
+	name, p := text.CheckName(cmd.Name, maxNameLen)
+	add(fieldName, p)
+	email, p := checkEmail(cmd.Email)
+	add(fieldEmail, p)
+
+	policyEmpNo := ""
+	if empNoOK {
+		policyEmpNo = cmd.EmpNo
+	}
+	fields = append(fields, s.Policy.Check(cmd.Password, policyEmpNo)...)
+
+	if len(fields) > 0 {
+		e := web.NewError(topCode(fields), "the request has invalid fields")
+		e.Fields = fields
+		return Registered{}, failed(e, "validation", cmd.EmpNo, empNoOK)
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(cmd.Password), bcryptCost)
+	if err != nil {
+		return Registered{}, fmt.Errorf("hash password: %w", err)
+	}
+
+	u := Registered{ID: uuid.New(), EmpNo: cmd.EmpNo, Name: name, Email: email}
+	after, _ := json.Marshal(map[string]string{"empNo": u.EmpNo, "name": u.Name}) // no email (PRD §6.11)
+
+	_, err = db.InTx(ctx, s.DB, func(ctx context.Context, tx *sql.Tx) error {
+		if err := store.InsertUser(ctx, tx, store.NewUser{
+			ID: u.ID, EmpNo: u.EmpNo, Name: u.Name, Email: u.Email, PasswordHash: string(hash),
+		}); err != nil {
+			return err
+		}
+		return s.Audit.Record(ctx, tx, audit.Event{
+			Action: audit.AuthRegister, Outcome: audit.Success,
+			TargetType: audit.TargetUser, TargetID: u.ID,
+			Method: req.Method, Route: req.Route, Status: http.StatusCreated,
+			IP: req.IP, UserAgent: req.UserAgent,
+			After: after,
+		})
+	})
+	if err != nil {
+		if e := duplicate(err); e != nil {
+			return Registered{}, failed(e, e.AuditReason, cmd.EmpNo, true)
+		}
+		return Registered{}, err
+	}
+	return u, nil
+}
+
+// duplicate maps a unique-key violation to 409. emp_no is checked first by the
+// server (it is the first unique key), so a row clashing on both says EMP_NO_TAKEN.
+func duplicate(err error) *web.Error {
+	key, ok := db.DuplicateKey(err)
+	if !ok {
+		return nil
+	}
+	var e *web.Error
+	switch {
+	case strings.Contains(key, "emp_no"):
+		e = web.NewError(web.CodeEmpNoTaken, "employee ID is already registered")
+		e.AuditReason = "emp_no_taken"
+	case strings.Contains(key, "email"):
+		e = web.NewError(web.CodeEmailTaken, "email is already registered")
+		e.AuditReason = "email_taken"
+	default:
+		return nil
+	}
+	e.Cause = err
+	return e
+}
+
+// failed marks e as an AUTH_REGISTER FAILED attempt (PRD §6.11): the typed
+// employee ID goes into the dedicated column (sanitized by audit), and into
+// after_json only when well-formed.
+func failed(e *web.Error, reason, empNo string, wellFormed bool) *web.Error {
+	e.AuditReason = reason
+	e.AuditAction = string(audit.AuthRegister)
+	e.AuditOutcome = string(audit.Failed)
+	e.AuditSubmittedEmpNo = empNo
+	if wellFormed {
+		e.AuditDetail = map[string]string{"empNo": empNo}
+	}
+	return e
+}

package/backend/internal/account/validate.go

@@ -0,0 +1,100 @@
+package account
+
+import (
+	"strings"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/text"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Field limits (PRD §6.3).
+const (
+	empNoLen     = 6
+	maxNameLen   = 50
+	maxEmailLen  = 254
+	maxPassBytes = 72 // bcrypt silently ignores (x/crypto: rejects) anything longer
+)
+
+// Field names as they appear in errors[]; the order is the form order.
+const (
+	fieldEmpNo    = "empNo"
+	fieldName     = "name"
+	fieldEmail    = "email"
+	fieldPassword = "password"
+)
+
+// checkEmpNo: exactly six ASCII digits, nothing is trimmed (PRD §6.3).
+// Empty is REQUIRED, anything else wrong is INVALID_FORMAT.
+func checkEmpNo(s string) text.Problem {
+	if text.Trim(s) == "" {
+		return text.Required
+	}
+	if len(s) != empNoLen {
+		return text.InvalidFormat
+	}
+	for i := range len(s) {
+		if s[i] < '0' || s[i] > '9' {
+			return text.InvalidFormat
+		}
+	}
+	return text.None
+}
+
+// checkEmail trims, then requires printable ASCII with no whitespace, exactly
+// one '@' with non-empty sides and at most 254 characters; the result is
+// lower-cased (PRD §6.3, OI-14). Report order: REQUIRED, INVALID_FORMAT,
+// OUT_OF_RANGE.
+func checkEmail(s string) (string, text.Problem) {
+	e := text.Trim(s)
+	if e == "" {
+		return "", text.Required
+	}
+	for _, r := range e {
+		if r < 0x21 || r > 0x7E { // also rejects whitespace and control characters
+			return e, text.InvalidFormat
+		}
+	}
+	local, domain, ok := strings.Cut(e, "@")
+	if !ok || local == "" || domain == "" || strings.Contains(domain, "@") {
+		return e, text.InvalidFormat
+	}
+	if len(e) > maxEmailLen { // ASCII only, so bytes = code points
+		return e, text.OutOfRange
+	}
+	return strings.ToLower(e), text.None
+}
+
+// PasswordPolicy checks a candidate password and lists every violation, in
+// PRD §6.4 table order. empNo is the submitted employee ID when it is
+// well-formed and "" otherwise (the CONTAINS_EMP_NO rule is then skipped).
+type PasswordPolicy interface {
+	Check(password, empNo string) []web.FieldError
+}
+
+// StubPolicy is the placeholder until B1b-01 delivers the §6.4 rules. It only
+// refuses what the account cannot store: an empty password and one bcrypt
+// cannot hash (longer than 72 bytes). Everything else is accepted.
+type StubPolicy struct{}
+
+// Check implements PasswordPolicy.
+func (StubPolicy) Check(password, _ string) []web.FieldError {
+	switch {
+	case password == "":
+		return []web.FieldError{{Field: fieldPassword, Code: web.CodeRequired}}
+	case len(password) > maxPassBytes:
+		return []web.FieldError{{Field: fieldPassword, Code: web.CodeOutOfRange}}
+	}
+	return nil
+}
+
+// topCode is the response code of a 422: the first field error's code when it
+// is a specific registered code, else VALIDATION_FAILED (error-codes.md §2).
+func topCode(fields []web.FieldError) web.ErrorCode {
+	if len(fields) > 0 {
+		switch c := fields[0].Code; c {
+		case web.CodeInvalidNameChars, web.CodePasswordPolicy:
+			return c
+		}
+	}
+	return web.CodeValidationFailed
+}

package/backend/internal/api/api.gen.go

@@ -160,6 +160,26 @@ type Problem struct {
 	Type string `json:"type"`
 }
 
+// RegisterRequest defines model for RegisterRequest.
+type RegisterRequest struct {
+	// Email Printable ASCII with exactly one @, at most 254 characters; stored lower-cased
+	Email string `json:"email"`
+
+	// EmpNo Exactly 6 ASCII digits
+	EmpNo string `json:"empNo"`
+
+	// Name 1-50 code points after clean-up
+	Name     string `json:"name"`
+	Password string `json:"password"`
+}
+
+// RegisterResponse defines model for RegisterResponse.
+type RegisterResponse struct {
+	Email string `json:"email"`
+	EmpNo string `json:"empNo"`
+	Name  string `json:"name"`
+}
+
 // CsrfToken defines model for CsrfToken.
 type CsrfToken = string
 
@@ -172,12 +192,21 @@ type LogoutParams struct {
 	XCSRFToken *CsrfToken `json:"X-CSRF-Token,omitempty"`
 }
 
+// RegisterParams defines parameters for Register.
+type RegisterParams struct {
+	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
+	XCSRFToken *CsrfToken `json:"X-CSRF-Token,omitempty"`
+}
+
 // ListIdeasParams defines parameters for ListIdeas.
 type ListIdeasParams struct {
 	Page *int `form:"page,omitempty" json:"page,omitempty"`
 	Size *int `form:"size,omitempty" json:"size,omitempty"`
 }
 
+// RegisterJSONRequestBody defines body for Register for application/json ContentType.
+type RegisterJSONRequestBody = RegisterRequest
+
 // ServerInterface represents all server handlers.
 type ServerInterface interface {
 	// GetCsrfToken Session-bound CSRF token (anonymous before login)
@@ -186,6 +215,9 @@ type ServerInterface interface {
 	// Logout End the session
 	// (POST /auth/logout)
 	Logout(w http.ResponseWriter, r *http.Request, params LogoutParams)
+	// Register Self-service registration (no session is created)
+	// (POST /auth/register)
+	Register(w http.ResponseWriter, r *http.Request, params RegisterParams)
 	// GetDeadline Submission deadline, state and database server time
 	// (GET /deadline)
 	GetDeadline(w http.ResponseWriter, r *http.Request)
@@ -213,6 +245,12 @@ func (_ Unimplemented) Logout(w http.ResponseWriter, r *http.Request, params Log
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// Register Self-service registration (no session is created)
+// (POST /auth/register)
+func (_ Unimplemented) Register(w http.ResponseWriter, r *http.Request, params RegisterParams) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // GetDeadline Submission deadline, state and database server time
 // (GET /deadline)
 func (_ Unimplemented) GetDeadline(w http.ResponseWriter, r *http.Request) {
@@ -295,6 +333,47 @@ func (siw *ServerInterfaceWrapper) Logout(w http.ResponseWriter, r *http.Request
 	handler.ServeHTTP(w, r)
 }
 
+// Register operation middleware
+func (siw *ServerInterfaceWrapper) Register(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// Parameter object where we will unmarshal all parameters from the context
+	var params RegisterParams
+
+	headers := r.Header
+
+	// ------------- Optional header parameter "X-CSRF-Token" -------------
+	if valueList, found := headers[http.CanonicalHeaderKey("X-CSRF-Token")]; found {
+		var XCSRFToken CsrfToken
+		n := len(valueList)
+		if n != 1 {
+			siw.ErrorHandlerFunc(w, r, &TooManyValuesForParamError{ParamName: "X-CSRF-Token", Count: n})
+			return
+		}
+
+		err = runtime.BindStyledParameterWithOptions("simple", "X-CSRF-Token", valueList[0], &XCSRFToken, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationHeader, Explode: false, Required: false, Type: "string", Format: ""})
+		if err != nil {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "X-CSRF-Token", Err: err})
+			return
+		}
+
+		params.XCSRFToken = &XCSRFToken
+
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.Register(w, r, params)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // GetDeadline operation middleware
 func (siw *ServerInterfaceWrapper) GetDeadline(w http.ResponseWriter, r *http.Request) {
 
@@ -500,6 +579,9 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Post(options.BaseURL+"/auth/logout", wrapper.Logout)
 	})
+	r.Group(func(r chi.Router) {
+		r.Post(options.BaseURL+"/auth/register", wrapper.Register)
+	})
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/deadline", wrapper.GetDeadline)
 	})

package/backend/internal/audit/integration_test.go

@@ -84,7 +84,7 @@ func TestAudit(t *testing.T) {
 
 	t.Run("track A is written in the caller's transaction and carries every field", func(t *testing.T) {
 		reset(t, d)
-		ctx := ctxWithReq(&security.Principal{UserID: 7, EmpNo: "E0001", Role: security.RoleUser})
+		ctx := ctxWithReq(&security.Principal{UserID: uuid.New(), EmpNo: "E0001", Role: security.RoleUser})
 		target := uuid.New()
 		out, err := db.InTx(ctx, d, func(ctx context.Context, tx *sql.Tx) error {
 			return svc.Record(ctx, tx, audit.Event{

package/backend/internal/auth/internal/store/session.go

@@ -0,0 +1,111 @@
+// Package store holds the SQL of the auth module. Only the auth module may
+// import it (Go's internal rule); no other module touches the session table.
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+// Limits are the session timeouts in seconds (PRD §6.5).
+type Limits struct {
+	IdleSeconds     int
+	AbsoluteSeconds int
+	RefreshSeconds  int
+}
+
+// Insert stores a new session row. hash is SHA-256 of the session ID.
+func Insert(ctx context.Context, db *sql.DB, hash []byte, userID uuid.UUID) error {
+	_, err := db.ExecContext(ctx,
+		`INSERT INTO session (id_hash, user_id) VALUES (?, ?)`, hash, userID.String())
+	if err != nil {
+		return fmt.Errorf("insert session: %w", err)
+	}
+	return nil
+}
+
+// Touch validates and refreshes a session in ONE statement on database time.
+// It reports true when the row matched: the session exists, is inside both
+// timeouts and its account is enabled. RowsAffected counts matched rows
+// (clientFoundRows=true in the DSN), so a row that needs no refresh still
+// counts; a test locks this. last_access_at is written only when older than
+// the refresh interval (OI-11).
+func Touch(ctx context.Context, db *sql.DB, hash []byte, l Limits) (bool, error) {
+	res, err := db.ExecContext(ctx,
+		`UPDATE session s JOIN app_user u ON u.id = s.user_id
+		    SET s.last_access_at = IF(s.last_access_at < NOW(6) - INTERVAL ? SECOND, NOW(6), s.last_access_at)
+		  WHERE s.id_hash = ?
+		    AND u.enabled
+		    AND s.last_access_at > NOW(6) - INTERVAL ? SECOND
+		    AND s.created_at     > NOW(6) - INTERVAL ? SECOND`,
+		l.RefreshSeconds, hash, l.IdleSeconds, l.AbsoluteSeconds)
+	if err != nil {
+		return false, fmt.Errorf("touch session: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("touch session rows: %w", err)
+	}
+	return n == 1, nil
+}
+
+// Principal reads the caller behind a session. The role comes from app_user,
+// never from the session. found is false when the session vanished between
+// Touch and this read (logout, revoke, purge).
+func Principal(ctx context.Context, db *sql.DB, hash []byte) (p security.Principal, found bool, err error) {
+	var id, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT u.id, u.emp_no, u.role
+		   FROM session s JOIN app_user u ON u.id = s.user_id
+		  WHERE s.id_hash = ? AND u.enabled`, hash).Scan(&id, &p.EmpNo, &role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return security.Principal{}, false, nil
+	}
+	if err != nil {
+		return security.Principal{}, false, fmt.Errorf("read session principal: %w", err)
+	}
+	if p.UserID, err = uuid.Parse(id); err != nil {
+		return security.Principal{}, false, fmt.Errorf("parse user id %q: %w", id, err)
+	}
+	p.Role = security.Role(role)
+	return p, true, nil
+}
+
+// Delete removes one session; deleting a missing one is not an error.
+func Delete(ctx context.Context, db *sql.DB, hash []byte) error {
+	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
+		return fmt.Errorf("delete session: %w", err)
+	}
+	return nil
+}
+
+// DeleteByUser removes every session of one account.
+func DeleteByUser(ctx context.Context, db *sql.DB, userID uuid.UUID) error {
+	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE user_id = ?`, userID.String()); err != nil {
+		return fmt.Errorf("delete sessions of user: %w", err)
+	}
+	return nil
+}
+
+// DeleteExpired removes sessions past either timeout and returns how many.
+func DeleteExpired(ctx context.Context, db *sql.DB, l Limits) (int64, error) {
+	res, err := db.ExecContext(ctx,
+		`DELETE FROM session
+		  WHERE last_access_at <= NOW(6) - INTERVAL ? SECOND
+		     OR created_at     <= NOW(6) - INTERVAL ? SECOND`,
+		l.IdleSeconds, l.AbsoluteSeconds)
+	if err != nil {
+		return 0, fmt.Errorf("purge sessions: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("purge sessions rows: %w", err)
+	}
+	return n, nil
+}

package/backend/internal/auth/session.go

@@ -0,0 +1,113 @@
+// Package auth owns login, sessions, CSRF and throttling (Backend.md §6).
+// This file is the session store (B1-07); the middleware (B1-08) builds on it.
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/base64"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+// Session timeouts (PRD §6.5). Refresh is written at most once per 60 s
+// (OI-11), so the effective idle timeout is 29-30 minutes.
+const (
+	IdleTimeoutSeconds     = 30 * 60
+	AbsoluteTimeoutSeconds = 8 * 60 * 60
+	RefreshSeconds         = 60
+
+	idBytes = 32
+)
+
+var limits = store.Limits{
+	IdleSeconds:     IdleTimeoutSeconds,
+	AbsoluteSeconds: AbsoluteTimeoutSeconds,
+	RefreshSeconds:  RefreshSeconds,
+}
+
+// Sessions is the server-side session store. It never sees or stores a raw
+// session ID beyond the call that receives it; the table holds SHA-256 only.
+type Sessions struct {
+	DB *sql.DB
+}
+
+// New returns a session store on db.
+func New(db *sql.DB) *Sessions { return &Sessions{DB: db} }
+
+// Create issues a new session for the user and returns the ID for the cookie
+// (32 random bytes, base64url without padding). Every login calls it, so an ID
+// is never reused (no fixation).
+func (s *Sessions) Create(ctx context.Context, userID uuid.UUID) (string, error) {
+	raw := make([]byte, idBytes)
+	if _, err := rand.Read(raw); err != nil {
+		return "", fmt.Errorf("session id: %w", err)
+	}
+	if err := store.Insert(ctx, s.DB, hash(raw), userID); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(raw), nil
+}
+
+// Validate checks the cookie value and refreshes the session in one atomic
+// statement, then returns the caller. ok is false for anything that is not a
+// live session of an enabled account: malformed, unknown, idle or absolutely
+// expired, disabled user, or removed meanwhile. err is for database failures
+// only.
+func (s *Sessions) Validate(ctx context.Context, id string) (p security.Principal, ok bool, err error) {
+	h, valid := parse(id)
+	if !valid {
+		return security.Principal{}, false, nil
+	}
+	if ok, err = store.Touch(ctx, s.DB, h, limits); err != nil || !ok {
+		return security.Principal{}, false, err
+	}
+	return store.Principal(ctx, s.DB, h)
+}
+
+// Revoke deletes one session. It is idempotent: an unknown or malformed ID is
+// not an error (logout returns 204 either way).
+func (s *Sessions) Revoke(ctx context.Context, id string) error {
+	h, valid := parse(id)
+	if !valid {
+		return nil
+	}
+	return store.Delete(ctx, s.DB, h)
+}
+
+// RevokeAll deletes every session of the user. It implements
+// account.SessionRevoker (wired in main.go; account never imports auth).
+func (s *Sessions) RevokeAll(ctx context.Context, userID uuid.UUID) error {
+	return store.DeleteByUser(ctx, s.DB, userID)
+}
+
+// Purge deletes expired sessions and returns how many; a background ticker
+// calls it. Validation never depends on it: expired rows already fail Touch.
+func (s *Sessions) Purge(ctx context.Context) (int64, error) {
+	return store.DeleteExpired(ctx, s.DB, limits)
+}
+
+// Binding returns SHA-256 of the session ID, the value the CSRF token is bound
+// to (D40). ok is false for a malformed ID.
+func Binding(id string) (b []byte, ok bool) { return parse(id) }
+
+// parse decodes a cookie value and returns its SHA-256. Anything that is not
+// exactly 32 bytes of base64url is rejected without a database call.
+func parse(id string) ([]byte, bool) {
+	raw, err := base64.RawURLEncoding.DecodeString(id)
+	if err != nil || len(raw) != idBytes {
+		return nil, false
+	}
+	return hash(raw), true
+}
+
+func hash(raw []byte) []byte {
+	sum := sha256.Sum256(raw)
+	return sum[:]
+}