@johnnyboy11234/esg-idea-contest 0.2.1 → 0.2.3

package/backend/api/openapi.yaml

@@ -29,6 +29,49 @@ paths:
               schema: { $ref: '#/components/schemas/CsrfTokenResponse' }
         '429': { $ref: '#/components/responses/Problem' }
         '500': { $ref: '#/components/responses/Problem' }
+  /auth/login:
+    post:
+      operationId: login
+      tags: [auth]
+      summary: Log in with employee ID and password (issues a new session)
+      description: >
+        Sets the session cookie and returns the caller. Unknown, malformed and disabled
+        accounts and wrong passwords all answer the same 401. The CSRF token changes
+        with the session, so the client refetches it.
+      security: []
+      parameters:
+        - $ref: '#/components/parameters/CsrfToken'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/LoginRequest' }
+      responses:
+        '200':
+          description: Logged in
+          headers:
+            Set-Cookie:
+              description: __Host-session=<opaque ID>; HttpOnly; Secure; SameSite=Lax; Path=/
+              schema: { type: string }
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/LoginResponse' }
+        '400': { $ref: '#/components/responses/Problem' }
+        '401': { $ref: '#/components/responses/Problem' }
+        '403': { $ref: '#/components/responses/Problem' }
+        '413': { $ref: '#/components/responses/Problem' }
+        '415': { $ref: '#/components/responses/Problem' }
+        '429':
+          description: Throttled (LOGIN_THROTTLED)
+          headers:
+            Retry-After:
+              description: Seconds until a new attempt may succeed
+              schema: { type: integer, minimum: 1 }
+          content:
+            application/problem+json:
+              schema: { $ref: '#/components/schemas/Problem' }
+        '500': { $ref: '#/components/responses/Problem' }
+        '503': { $ref: '#/components/responses/Problem' }
   /auth/logout:
     post:
       operationId: logout
@@ -41,6 +84,19 @@ paths:
         '204': { description: Logged out }
         '403': { $ref: '#/components/responses/Problem' }
         '500': { $ref: '#/components/responses/Problem' }
+  /auth/me:
+    get:
+      operationId: getMe
+      tags: [auth]
+      summary: The caller (also the idle-timeout "continue" call)
+      responses:
+        '200':
+          description: The authenticated caller
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/LoginResponse' }
+        '401': { $ref: '#/components/responses/Problem' }
+        '500': { $ref: '#/components/responses/Problem' }
   /auth/register:
     post:
       operationId: register
@@ -154,6 +210,20 @@ components:
       required: [token]
       properties:
         token: { type: string }
+    LoginRequest:
+      type: object
+      required: [empNo, password]
+      properties:
+        empNo: { type: string, description: 'Any string; a badly formatted ID is an ordinary login failure' }
+        password: { type: string, format: password }
+    LoginResponse:
+      type: object
+      required: [empNo, name, email, role]
+      properties:
+        empNo: { type: string }
+        name: { type: string }
+        email: { type: string, nullable: true, description: null for Admin }
+        role: { type: string, enum: [USER, ADMIN] }
     RegisterRequest:
       type: object
       required: [empNo, name, email, password]

package/backend/cmd/server/main.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/config"
@@ -46,7 +47,20 @@ func run() error {
 
 	auditSvc := audit.New(db, log)
 	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
+	csrf, err := auth.NewCSRF(cfg.CSRFKey, cfg.CSRFKeyPrevious)
+	if err != nil {
+		return err
+	}
+	sessions := auth.New(db)
+	logins, err := auth.NewLogins(sessions, auditSvc, auth.NoThrottle{}) // B1b-04 wires the real throttle
+	if err != nil {
+		return err
+	}
 	si := server.API{
+		Auth:    auth.Handler{CSRF: csrf, Log: log},
+		Logins:  auth.LoginHandler{Logins: logins, Fail: errs.Write},
+		Logouts: auth.LogoutHandler{Logouts: &auth.Logouts{Sessions: sessions, Audit: auditSvc}, Fail: errs.Write},
+		Me:      auth.MeHandler{Sessions: sessions, Fail: errs.Write},
 		Account: account.Handler{
 			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
 			Fail:    errs.Write,
@@ -55,5 +69,7 @@ func run() error {
 	}
 
 	var ready atomic.Bool
-	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si)), &ready, server.DBCheck(db))
+	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si),
+		auth.Middleware(sessions, server.IsPublic, log),
+		csrf.Middleware(errs.Write, server.ActionFor)), &ready, server.DBCheck(db))
 }

package/backend/internal/account/logging_integration_test.go

@@ -0,0 +1,70 @@
+//go:build integration
+
+package account_test
+
+import (
+	"bytes"
+	"log/slog"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/test/apispec"
+)
+
+type syncBuf struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (s *syncBuf) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.Write(p)
+}
+
+func (s *syncBuf) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.String()
+}
+
+// TestRegisterLogsNeverContainPassword drives register (created, duplicate,
+// weak password, malformed JSON) at DEBUG level and asserts the submitted
+// password never reaches a log line (PRD §6.5 / §8.2).
+func TestRegisterLogsNeverContainPassword(t *testing.T) {
+	buf := &syncBuf{}
+	log := slog.New(slog.NewJSONHandler(buf, &slog.HandlerOptions{Level: slog.LevelDebug}))
+	db := dbtest.New(t)
+	auditSvc := audit.New(db, log)
+	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
+	api := server.API{Account: account.Handler{
+		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+		Fail:    errs.Write,
+	}}
+	e := env{db: db, h: apispec.Load(t).Validate(t, server.NewPublic(log, server.Mount(api)))}
+
+	const (
+		pw1 = "Sup3r-Secret-Horse-1"
+		pw2 = "An0ther-Secret-Horse-2"
+		pw3 = "Dup-Secret-Horse-3"
+	)
+	e.register(reg("089290", "Wang", "wang@example.com", pw1))                              // 201
+	e.register(reg("089290", "Wang", "wang2@example.com", pw2))                             // duplicate
+	e.register(reg("089291", "Lee", "lee@example.com", "short"))                            // weak
+	e.register(`{"empNo":"089292","name":"X","email":"x@example.com","password":"` + pw3 + `"`) // malformed
+
+	out := buf.String()
+	if strings.TrimSpace(out) == "" {
+		t.Fatal("no log output captured; the test would prove nothing")
+	}
+	for _, s := range []string{pw1, pw2, pw3} {
+		if strings.Contains(out, s) {
+			t.Errorf("log contains password %q", s)
+		}
+	}
+}

package/backend/internal/api/api.gen.go

@@ -53,6 +53,24 @@ func (e IdeaSummaryMyRelation) Valid() bool {
 	}
 }
 
+// Defines values for LoginResponseRole.
+const (
+	ADMIN LoginResponseRole = "ADMIN"
+	USER  LoginResponseRole = "USER"
+)
+
+// Valid indicates whether the value is a known member of the LoginResponseRole enum.
+func (e LoginResponseRole) Valid() bool {
+	switch e {
+	case ADMIN:
+		return true
+	case USER:
+		return true
+	default:
+		return false
+	}
+}
+
 // CsrfTokenResponse defines model for CsrfTokenResponse.
 type CsrfTokenResponse struct {
 	Token string `json:"token"`
@@ -140,6 +158,25 @@ type IdeaSummary struct {
 // IdeaSummaryMyRelation null for Admin
 type IdeaSummaryMyRelation string
 
+// LoginRequest defines model for LoginRequest.
+type LoginRequest struct {
+	// EmpNo Any string; a badly formatted ID is an ordinary login failure
+	EmpNo    string `json:"empNo"`
+	Password string `json:"password"`
+}
+
+// LoginResponse defines model for LoginResponse.
+type LoginResponse struct {
+	// Email null for Admin
+	Email *string           `json:"email"`
+	EmpNo string            `json:"empNo"`
+	Name  string            `json:"name"`
+	Role  LoginResponseRole `json:"role"`
+}
+
+// LoginResponseRole defines model for LoginResponse.Role.
+type LoginResponseRole string
+
 // PersonRef defines model for PersonRef.
 type PersonRef struct {
 	EmpNo string `json:"empNo"`
@@ -186,6 +223,12 @@ type CsrfToken = string
 // IdeaId defines model for IdeaId.
 type IdeaId = openapi_types.UUID
 
+// LoginParams defines parameters for Login.
+type LoginParams struct {
+	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
+	XCSRFToken *CsrfToken `json:"X-CSRF-Token,omitempty"`
+}
+
 // LogoutParams defines parameters for Logout.
 type LogoutParams struct {
 	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
@@ -204,6 +247,9 @@ type ListIdeasParams struct {
 	Size *int `form:"size,omitempty" json:"size,omitempty"`
 }
 
+// LoginJSONRequestBody defines body for Login for application/json ContentType.
+type LoginJSONRequestBody = LoginRequest
+
 // RegisterJSONRequestBody defines body for Register for application/json ContentType.
 type RegisterJSONRequestBody = RegisterRequest
 
@@ -212,9 +258,15 @@ type ServerInterface interface {
 	// GetCsrfToken Session-bound CSRF token (anonymous before login)
 	// (GET /auth/csrf)
 	GetCsrfToken(w http.ResponseWriter, r *http.Request)
+	// Login Log in with employee ID and password (issues a new session)
+	// (POST /auth/login)
+	Login(w http.ResponseWriter, r *http.Request, params LoginParams)
 	// Logout End the session
 	// (POST /auth/logout)
 	Logout(w http.ResponseWriter, r *http.Request, params LogoutParams)
+	// GetMe The caller (also the idle-timeout "continue" call)
+	// (GET /auth/me)
+	GetMe(w http.ResponseWriter, r *http.Request)
 	// Register Self-service registration (no session is created)
 	// (POST /auth/register)
 	Register(w http.ResponseWriter, r *http.Request, params RegisterParams)
@@ -239,12 +291,24 @@ func (_ Unimplemented) GetCsrfToken(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// Login Log in with employee ID and password (issues a new session)
+// (POST /auth/login)
+func (_ Unimplemented) Login(w http.ResponseWriter, r *http.Request, params LoginParams) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // Logout End the session
 // (POST /auth/logout)
 func (_ Unimplemented) Logout(w http.ResponseWriter, r *http.Request, params LogoutParams) {
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// GetMe The caller (also the idle-timeout "continue" call)
+// (GET /auth/me)
+func (_ Unimplemented) GetMe(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // Register Self-service registration (no session is created)
 // (POST /auth/register)
 func (_ Unimplemented) Register(w http.ResponseWriter, r *http.Request, params RegisterParams) {
@@ -292,6 +356,47 @@ func (siw *ServerInterfaceWrapper) GetCsrfToken(w http.ResponseWriter, r *http.R
 	handler.ServeHTTP(w, r)
 }
 
+// Login operation middleware
+func (siw *ServerInterfaceWrapper) Login(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// Parameter object where we will unmarshal all parameters from the context
+	var params LoginParams
+
+	headers := r.Header
+
+	// ------------- Optional header parameter "X-CSRF-Token" -------------
+	if valueList, found := headers[http.CanonicalHeaderKey("X-CSRF-Token")]; found {
+		var XCSRFToken CsrfToken
+		n := len(valueList)
+		if n != 1 {
+			siw.ErrorHandlerFunc(w, r, &TooManyValuesForParamError{ParamName: "X-CSRF-Token", Count: n})
+			return
+		}
+
+		err = runtime.BindStyledParameterWithOptions("simple", "X-CSRF-Token", valueList[0], &XCSRFToken, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationHeader, Explode: false, Required: false, Type: "string", Format: ""})
+		if err != nil {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "X-CSRF-Token", Err: err})
+			return
+		}
+
+		params.XCSRFToken = &XCSRFToken
+
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.Login(w, r, params)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // Logout operation middleware
 func (siw *ServerInterfaceWrapper) Logout(w http.ResponseWriter, r *http.Request) {
 
@@ -333,6 +438,20 @@ func (siw *ServerInterfaceWrapper) Logout(w http.ResponseWriter, r *http.Request
 	handler.ServeHTTP(w, r)
 }
 
+// GetMe operation middleware
+func (siw *ServerInterfaceWrapper) GetMe(w http.ResponseWriter, r *http.Request) {
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.GetMe(w, r)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // Register operation middleware
 func (siw *ServerInterfaceWrapper) Register(w http.ResponseWriter, r *http.Request) {
 
@@ -576,9 +695,15 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/auth/csrf", wrapper.GetCsrfToken)
 	})
+	r.Group(func(r chi.Router) {
+		r.Post(options.BaseURL+"/auth/login", wrapper.Login)
+	})
 	r.Group(func(r chi.Router) {
 		r.Post(options.BaseURL+"/auth/logout", wrapper.Logout)
 	})
+	r.Group(func(r chi.Router) {
+		r.Get(options.BaseURL+"/auth/me", wrapper.GetMe)
+	})
 	r.Group(func(r chi.Router) {
 		r.Post(options.BaseURL+"/auth/register", wrapper.Register)
 	})

package/backend/internal/auth/csrf.go

@@ -0,0 +1,212 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// CSRF names and sizes (PRD §6.5, Backend.md §6, D40).
+const (
+	// CSRFCookie is the double-submit cookie. The __Host- prefix forces Secure,
+	// Path=/ and no Domain; HttpOnly keeps it away from script, which reads the
+	// token from the GET /auth/csrf body instead.
+	CSRFCookie = "__Host-csrf"
+	// CSRFHeader carries the token on every write.
+	CSRFHeader = "X-CSRF-Token"
+
+	// MinCSRFKeyBytes is the shortest accepted HMAC key (the SHA-256 output size).
+	MinCSRFKeyBytes = 32
+
+	nonceBytes = 16
+)
+
+var anonymousBinding = []byte{0x00, 'a', 'n', 'o', 'n'}
+
+// CSRF signs and verifies session-bound double-submit tokens:
+//
+//	base64url(nonce) "." base64url(HMAC-SHA256(key, binding ‖ nonce))
+//
+// The binding is 0x01 ‖ SHA-256(session ID) with a session, a fixed anonymous
+// value without one. A token minted anonymously, or for another session,
+// therefore fails against a victim's session (D40).
+//
+// The first key signs; every key verifies. Rotation: make the new key current
+// and the old one previous, and drop the previous key after 8 h (Backend.md §6).
+// Tokens carry no expiry, so the operator's removal of the old key is the bound.
+type CSRF struct {
+	keys [][]byte
+}
+
+// NewCSRF returns a signer. current signs; previous (optional) only verifies.
+func NewCSRF(current string, previous ...string) (*CSRF, error) {
+	c := &CSRF{}
+	for i, k := range append([]string{current}, previous...) {
+		if i > 0 && k == "" {
+			continue // an unset previous key means "no rotation in progress"
+		}
+		if len(k) < MinCSRFKeyBytes {
+			return nil, fmt.Errorf("csrf key %d: need at least %d bytes", i, MinCSRFKeyBytes)
+		}
+		c.keys = append(c.keys, []byte(k))
+	}
+	return c, nil
+}
+
+// bindingFor returns the binding for a request: the session's when the session
+// middleware resolved one, else the anonymous value. ok is false only when a
+// validated session carries an ID that cannot be bound (cannot happen unless
+// the validator and Binding disagree).
+func bindingFor(r *http.Request) (b []byte, ok bool) {
+	if _, has := security.PrincipalFrom(r.Context()); !has {
+		return anonymousBinding, true
+	}
+	c, err := r.Cookie(SessionCookie)
+	if err != nil {
+		return nil, false
+	}
+	h, ok := Binding(c.Value)
+	if !ok {
+		return nil, false
+	}
+	return append([]byte{0x01}, h...), true
+}
+
+func mac(key, binding, nonce []byte) []byte {
+	m := hmac.New(sha256.New, key)
+	m.Write(binding)
+	m.Write(nonce)
+	return m.Sum(nil)
+}
+
+// Issue returns a fresh token for binding.
+func (c *CSRF) Issue(binding []byte) (string, error) {
+	nonce := make([]byte, nonceBytes)
+	if _, err := rand.Read(nonce); err != nil {
+		return "", err
+	}
+	return b64(nonce) + "." + b64(mac(c.keys[0], binding, nonce)), nil
+}
+
+// Verify reports whether token was issued by one of the keys for binding.
+func (c *CSRF) Verify(token string, binding []byte) bool {
+	n, s, found := strings.Cut(token, ".")
+	if !found {
+		return false
+	}
+	nonce, err1 := base64.RawURLEncoding.DecodeString(n)
+	sig, err2 := base64.RawURLEncoding.DecodeString(s)
+	if err1 != nil || err2 != nil || len(nonce) != nonceBytes {
+		return false
+	}
+	ok := false
+	for _, k := range c.keys { // no early exit: time does not tell which key matched
+		if hmac.Equal(sig, mac(k, binding, nonce)) {
+			ok = true
+		}
+	}
+	return ok
+}
+
+func b64(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
+
+// safeMethod is the set that is never CSRF-checked (RFC 9110 §9.2.1).
+func safeMethod(m string) bool {
+	return m == http.MethodGet || m == http.MethodHead || m == http.MethodOptions
+}
+
+// ActionFor names the audit action of the write r attempts, or "" when it is
+// unknown (unrouted path). A rejected attempt is audited only with an action.
+type ActionFor func(r *http.Request) string
+
+// Middleware enforces the CSRF check on every non-safe method. It runs after
+// the session middleware (so 401 wins) and before routing (so 403 beats 404),
+// reads only the header and the cookie and never the body. Accepted only if
+// cookie and header are both present and equal, the signature verifies, and
+// the binding matches the request's session (or anonymous without one).
+//
+// fail is the central error adapter; it audits the denial when the *web.Error
+// carries an AuditReason and an action.
+func (c *CSRF) Middleware(fail func(http.ResponseWriter, *http.Request, error), action ActionFor) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if safeMethod(r.Method) {
+				next.ServeHTTP(w, r)
+				return
+			}
+			if reason := c.check(r); reason != "" {
+				e := web.NewError(web.CodeCSRFInvalid, "CSRF token missing or invalid.")
+				if action != nil {
+					if a := action(r); a != "" {
+						e.AuditAction, e.AuditReason = a, reason
+					}
+				}
+				fail(w, r, e)
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// check returns "" when r passes, else the audit reason (never sent to the client).
+func (c *CSRF) check(r *http.Request) string {
+	hdr := r.Header.Get(CSRFHeader)
+	ck, err := r.Cookie(CSRFCookie)
+	switch {
+	case hdr == "" || err != nil || ck.Value == "":
+		return "csrf_missing"
+	case subtle.ConstantTimeCompare([]byte(hdr), []byte(ck.Value)) != 1:
+		return "csrf_mismatch"
+	}
+	b, ok := bindingFor(r)
+	if !ok || !c.Verify(hdr, b) {
+		return "csrf_invalid_binding"
+	}
+	return ""
+}
+
+// Handler serves GET /auth/csrf: a token for the caller's current binding in
+// the body and in the cookie. It is public; with a session the token is bound
+// to it. Login and logout change the binding, so the client refetches then.
+type Handler struct {
+	CSRF *CSRF
+	Log  *slog.Logger
+}
+
+// GetCsrfToken serves GET /auth/csrf.
+func (h Handler) GetCsrfToken(w http.ResponseWriter, r *http.Request) {
+	b, ok := bindingFor(r)
+	if !ok {
+		h.fail(w, r, errors.New("session without bindable ID"))
+		return
+	}
+	tok, err := h.CSRF.Issue(b)
+	if err != nil {
+		h.fail(w, r, err)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name: CSRFCookie, Value: tok, Path: "/",
+		Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+	w.Header().Set("Cache-Control", "no-store")
+	web.WriteJSON(w, http.StatusOK, api.CsrfTokenResponse{Token: tok})
+}
+
+func (h Handler) fail(w http.ResponseWriter, r *http.Request, err error) {
+	h.Log.ErrorContext(r.Context(), "csrf token issue failed",
+		"requestId", web.RequestIDFrom(r.Context()), "error", err)
+	web.WriteProblem(w, r, web.NewError(web.CodeInternalError, ""))
+}