@johnnyboy11234/esg-idea-contest 0.2.1 → 0.2.3

package/backend/internal/auth/login_test.go

@@ -0,0 +1,68 @@
+package auth
+
+import (
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func median(ds []time.Duration) time.Duration {
+	slices.Sort(ds)
+	return ds[len(ds)/2]
+}
+
+func timeCompare(hash []byte, pw string) time.Duration {
+	const n = 7
+	ds := make([]time.Duration, n)
+	for i := range ds {
+		start := time.Now()
+		comparePassword(hash, pw)
+		ds[i] = time.Since(start)
+	}
+	return median(ds)
+}
+
+// Unknown vs wrong password (B1-10 acceptance): one cost-10 comparison either
+// way, so the medians are close. The bound is loose on purpose: bcrypt takes
+// tens of milliseconds, a skipped comparison would be ~1000x off.
+func TestComparePasswordTimingSimilar(t *testing.T) {
+	l, err := NewLogins(nil, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	real, err := bcrypt.GenerateFromPassword([]byte("Correct-Horse-1"), bcryptCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wrong := timeCompare(real, "Wrong-Horse-99")
+	dummy := timeCompare(l.dummyHash, "Wrong-Horse-99")
+	long := timeCompare(l.dummyHash, strings.Repeat("x", 100)) // > 72 bytes
+
+	for name, d := range map[string]time.Duration{"dummy": dummy, "over 72 bytes": long} {
+		if d < wrong/2 || d > wrong*2 {
+			t.Errorf("%s comparison %v vs wrong-password %v: not similar (a comparison was skipped?)", name, d, wrong)
+		}
+	}
+}
+
+func TestComparePassword(t *testing.T) {
+	pw72 := strings.Repeat("a", 72)
+	h72, _ := bcrypt.GenerateFromPassword([]byte(pw72), bcryptCost)
+	tests := []struct {
+		name, pw string
+		want     bool
+	}{
+		{"exact 72 bytes", pw72, true},
+		{"73 bytes never matches, even with a matching 72-byte prefix", pw72 + "b", false},
+		{"wrong", "nope", false},
+		{"empty", "", false},
+	}
+	for _, tc := range tests {
+		if got := comparePassword(h72, tc.pw); got != tc.want {
+			t.Errorf("%s: got %v", tc.name, got)
+		}
+	}
+}

package/backend/internal/auth/logout.go

@@ -0,0 +1,68 @@
+package auth
+
+import (
+	"context"
+	"database/sql"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Logouts implements POST /auth/logout.
+type Logouts struct {
+	Sessions *Sessions
+	Audit    Recorder
+}
+
+// Logout deletes the caller's session and writes AUTH_LOGOUT in the same
+// transaction (fail-closed). Without a session there is nothing to end and no
+// actor to record: it succeeds silently (PRD §6.5, idempotent 204). A session
+// that vanished meanwhile (concurrent logout) is not an error either.
+func (l *Logouts) Logout(ctx context.Context, sessionID string, p security.Principal, has bool, req Request) error {
+	if !has {
+		return nil
+	}
+	_, err := db.InTx(ctx, l.Sessions.DB, func(ctx context.Context, tx *sql.Tx) error {
+		if err := l.Sessions.RevokeIn(ctx, tx, sessionID); err != nil {
+			return err
+		}
+		return l.Audit.Record(ctx, tx, audit.Event{
+			Action: audit.AuthLogout, Outcome: audit.Success,
+			ActorRole: p.ActorRole(), ActorEmpNo: p.EmpNo,
+			TargetType: audit.TargetUser, TargetID: p.UserID,
+			Method: req.Method, Route: req.Route, Status: http.StatusNoContent,
+			IP: req.IP, UserAgent: req.UserAgent,
+		})
+	})
+	return err
+}
+
+// LogoutHandler is the HTTP adapter of Logouts.
+type LogoutHandler struct {
+	Logouts *Logouts
+	Fail    func(w http.ResponseWriter, r *http.Request, err error)
+}
+
+// Logout serves POST /auth/logout: 204 and an expired session cookie, with or
+// without a session. The CSRF check has already run in the middleware.
+func (h LogoutHandler) Logout(w http.ResponseWriter, r *http.Request) {
+	p, has := security.PrincipalFrom(r.Context())
+	var sid string
+	if c, err := r.Cookie(SessionCookie); err == nil {
+		sid = c.Value
+	}
+	if err := h.Logouts.Logout(r.Context(), sid, p, has, Request{
+		Method: r.Method, Route: web.RoutePattern(r), UserAgent: r.UserAgent(), IP: web.ClientIP(r),
+	}); err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name: SessionCookie, Value: "", Path: "/", MaxAge: -1,
+		Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+	w.WriteHeader(http.StatusNoContent)
+}

package/backend/internal/auth/logout_integration_test.go

@@ -0,0 +1,124 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+func (e loginEnv) logout(tok string, ck *http.Cookie, extra ...*http.Cookie) *httptest.ResponseRecorder {
+	req := httptest.NewRequest("POST", "/api/v1/auth/logout", nil)
+	req.Header.Set("X-CSRF-Token", tok)
+	req.Header.Set("User-Agent", "it/1")
+	req.RemoteAddr = "192.0.2.9:4000"
+	if ck != nil {
+		req.AddCookie(ck)
+	}
+	for _, c := range extra {
+		req.AddCookie(c)
+	}
+	return e.do(req)
+}
+
+func (e loginEnv) logoutAudits(t *testing.T) (n int, actor, empNo string, status int) {
+	t.Helper()
+	if err := e.db.QueryRow(`SELECT COUNT(*) FROM audit_log WHERE action='AUTH_LOGOUT' AND outcome='SUCCESS'`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n > 0 {
+		if err := e.db.QueryRow(`SELECT actor_role, actor_emp_no, status FROM audit_log WHERE action='AUTH_LOGOUT' LIMIT 1`).
+			Scan(&actor, &empNo, &status); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return
+}
+
+func TestLogoutEndsSession(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	sess := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+
+	tok, ck := e.csrf(t, sess) // token bound to the session
+	rec := e.logout(tok, ck, sess)
+	if rec.Code != 204 || rec.Body.Len() != 0 {
+		t.Fatalf("status %d body %q", rec.Code, rec.Body)
+	}
+	if c := findCookie(rec, auth.SessionCookie); c == nil || c.MaxAge >= 0 || c.Value != "" || !c.Secure || !c.HttpOnly || c.Path != "/" {
+		t.Errorf("cookie not cleared: %+v", c)
+	}
+	if e.sessions(t) != 0 {
+		t.Error("session row still present")
+	}
+	if n, actor, empNo, status := e.logoutAudits(t); n != 1 || actor != "USER" || empNo != "123456" || status != 204 {
+		t.Errorf("audit n=%d actor=%s emp=%s status=%d", n, actor, empNo, status)
+	}
+
+	// The old cookie no longer authenticates.
+	req := httptest.NewRequest("GET", "/api/v1/auth/me", nil)
+	req.AddCookie(sess)
+	if rec := e.do(req); rec.Code != 401 {
+		t.Errorf("after logout: %d, want 401", rec.Code)
+	}
+	// The session-bound token is useless now: replaying logout is a 403 only
+	// because the anonymous binding differs.
+	if rec := e.logout(tok, ck, sess); rec.Code != 403 {
+		t.Errorf("replay with old token: %d, want 403", rec.Code)
+	}
+}
+
+func TestLogoutWithoutSessionIsIdempotent(t *testing.T) {
+	e := newLoginEnv(t)
+	tok, ck := e.csrf(t, nil)
+	rec := e.logout(tok, ck)
+	if rec.Code != 204 {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body)
+	}
+	if n, _, _, _ := e.logoutAudits(t); n != 0 {
+		t.Errorf("anonymous logout wrote %d audit rows", n)
+	}
+	// Expired or junk session cookie behaves the same.
+	if rec := e.logout(tok, ck, &http.Cookie{Name: auth.SessionCookie, Value: "junk"}); rec.Code != 204 {
+		t.Errorf("junk cookie: %d", rec.Code)
+	}
+}
+
+func TestLogoutRequiresCSRF(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	sess := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+
+	anonTok, anonCk := e.csrf(t, nil) // wrong binding for this session
+	for name, rec := range map[string]*httptest.ResponseRecorder{
+		"no token":      e.logout("", nil, sess),
+		"anonymous tok": e.logout(anonTok, anonCk, sess),
+	} {
+		if rec.Code != 403 || code(t, rec) != "CSRF_INVALID" {
+			t.Errorf("%s: %d %s", name, rec.Code, rec.Body)
+		}
+	}
+	if e.sessions(t) != 1 {
+		t.Error("a rejected logout must not end the session")
+	}
+	if n, _, _, _ := e.logoutAudits(t); n != 0 {
+		t.Error("no SUCCESS row for a rejected logout")
+	}
+}
+
+func TestLogoutOtherSessionsSurvive(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	a := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+	e.login(t, creds("123456", password))
+	tok, ck := e.csrf(t, a)
+	if rec := e.logout(tok, ck, a); rec.Code != 204 {
+		t.Fatal(rec.Code)
+	}
+	if e.sessions(t) != 1 {
+		t.Errorf("want 1 remaining session, got %d", e.sessions(t))
+	}
+}

package/backend/internal/auth/me.go

@@ -0,0 +1,40 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// MeHandler serves GET /auth/me. The session middleware has already answered
+// 401 without a valid session and touched the session (idle refresh, OI-11),
+// so this is also the idle-timeout "continue" call (OI-22).
+type MeHandler struct {
+	Sessions *Sessions
+	Fail     func(w http.ResponseWriter, r *http.Request, err error)
+}
+
+// GetMe answers the caller from the database (name and email are not in the
+// principal). An account that vanished since the middleware ran answers 401.
+func (h MeHandler) GetMe(w http.ResponseWriter, r *http.Request) {
+	p, ok := security.PrincipalFrom(r.Context())
+	if !ok {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	a, found, err := store.AccountByID(r.Context(), h.Sessions.DB, p.UserID)
+	if err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	if !found || !a.Enabled {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	web.WriteJSON(w, http.StatusOK, api.LoginResponse{
+		EmpNo: a.EmpNo, Name: a.Name, Email: a.Email, Role: api.LoginResponseRole(a.Role),
+	})
+}

package/backend/internal/auth/me_integration_test.go

@@ -0,0 +1,70 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+func (e loginEnv) me(t *testing.T, withSession bool, sid string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/v1/auth/me", nil)
+	if withSession {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: sid})
+	}
+	return e.do(req)
+}
+
+func TestMeReturnsCaller(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	e.addUser(t, "900001", "ADMIN", true)
+
+	for _, tc := range []struct {
+		emp, role string
+		email     any
+	}{{"123456", "USER", "123456@example.com"}, {"900001", "ADMIN", nil}} {
+		sess := findCookie(e.login(t, creds(tc.emp, password)), auth.SessionCookie)
+		rec := e.me(t, true, sess.Value)
+		if rec.Code != 200 {
+			t.Fatalf("%s: status %d", tc.emp, rec.Code)
+		}
+		var got map[string]any
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+			t.Fatal(err)
+		}
+		if got["empNo"] != tc.emp || got["role"] != tc.role || got["email"] != tc.email || got["name"] != "N "+tc.emp {
+			t.Errorf("%s: body %v", tc.emp, got)
+		}
+		if _, leaked := got["passwordHash"]; leaked || len(got) != 4 {
+			t.Errorf("%s: unexpected fields %v", tc.emp, got)
+		}
+	}
+}
+
+func TestMeWithoutValidSessionIs401(t *testing.T) {
+	e := newLoginEnv(t)
+	if rec := e.me(t, false, ""); rec.Code != 401 || code(t, rec) != "UNAUTHENTICATED" {
+		t.Errorf("no cookie: %d", rec.Code)
+	}
+	if rec := e.me(t, true, "not-a-session"); rec.Code != 401 {
+		t.Errorf("bad cookie: %d", rec.Code)
+	}
+}
+
+func TestMeAfterAccountDisabledIs401(t *testing.T) {
+	e := newLoginEnv(t)
+	id := e.addUser(t, "123456", "USER", true)
+	sess := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+	if _, err := e.db.Exec(`UPDATE app_user SET enabled = 0 WHERE id = ?`, id.String()); err != nil {
+		t.Fatal(err)
+	}
+	if rec := e.me(t, true, sess.Value); rec.Code != 401 {
+		t.Errorf("disabled: %d, want 401", rec.Code)
+	}
+}

package/backend/internal/auth/middleware.go

@@ -0,0 +1,66 @@
+package auth
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// SessionCookie is the session cookie name (openapi sessionCookie). The
+// __Host- prefix forces Secure, Path=/ and no Domain.
+const SessionCookie = "__Host-session"
+
+// Validator resolves a cookie value to its caller. *Sessions implements it.
+type Validator interface {
+	Validate(ctx context.Context, id string) (p security.Principal, ok bool, err error)
+}
+
+// Public reports whether a request may be served without a session. It is
+// decided on method and path before routing, so unknown paths are not public.
+type Public func(r *http.Request) bool
+
+// Middleware is the session middleware (Backend.md §3, §6). It must wrap the
+// router, not sit inside it, so that an unknown path without a session answers
+// 401 and only a caller with a session learns it is a 404 (PRD §6.1).
+//
+//   - Public request: a valid session is still resolved (the principal is then
+//     in the context for the audit actor and the session-bound CSRF token); a
+//     missing or invalid one is simply anonymous.
+//   - Any other request: no valid session → 401 UNAUTHENTICATED. With a valid
+//     session the principal is stored in the context and routing continues, so
+//     404 and 405 come from the router.
+//
+// It never reads the body. A database failure answers 500, never a guess.
+func Middleware(v Validator, public Public, log *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			isPublic := public != nil && public(r)
+
+			var (
+				p  security.Principal
+				ok bool
+			)
+			if c, err := r.Cookie(SessionCookie); err == nil && c.Value != "" {
+				var verr error
+				if p, ok, verr = v.Validate(r.Context(), c.Value); verr != nil {
+					log.ErrorContext(r.Context(), "session validation failed",
+						"requestId", web.RequestIDFrom(r.Context()), "error", verr)
+					web.WriteProblem(w, r, web.NewError(web.CodeInternalError, ""))
+					return
+				}
+			}
+
+			switch {
+			case ok:
+				r = r.WithContext(security.WithPrincipal(r.Context(), p))
+			case !isPublic:
+				web.WriteProblem(w, r, web.NewError(web.CodeUnauthenticated, "Authentication required."))
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}

package/backend/internal/auth/middleware_test.go

@@ -0,0 +1,153 @@
+package auth_test
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+type fakeValidator struct {
+	live  map[string]security.Principal
+	err   error
+	calls int
+}
+
+func (f *fakeValidator) Validate(_ context.Context, id string) (security.Principal, bool, error) {
+	f.calls++
+	if f.err != nil {
+		return security.Principal{}, false, f.err
+	}
+	p, ok := f.live[id]
+	return p, ok, nil
+}
+
+func isPublic(r *http.Request) bool {
+	return r.Method == "GET" && r.URL.Path == "/open"
+}
+
+// chain mirrors production: middleware wraps the router, whose NotFound and
+// MethodNotAllowed hooks are the web ones.
+func chain(v auth.Validator, seen *security.Principal) http.Handler {
+	r := chi.NewRouter()
+	r.NotFound(web.NotFound)
+	r.MethodNotAllowed(web.MethodNotAllowed)
+	h := func(w http.ResponseWriter, req *http.Request) {
+		if p, ok := security.PrincipalFrom(req.Context()); ok && seen != nil {
+			*seen = p
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+	r.Get("/open", h)
+	r.Get("/closed", h)
+	return web.RequestID(auth.Middleware(v, isPublic, slog.New(slog.DiscardHandler))(r))
+}
+
+func request(method, path, cookie string) *http.Request {
+	req := httptest.NewRequest(method, path, nil)
+	if cookie != "" {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: cookie})
+	}
+	return req
+}
+
+func TestMiddlewareCombinations(t *testing.T) {
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	v := &fakeValidator{live: map[string]security.Principal{"good": user}}
+
+	tests := []struct {
+		name         string
+		method, path string
+		cookie       string
+		status       int
+		code         string
+		principal    bool
+	}{
+		{"public, no session", "GET", "/open", "", 204, "", false},
+		{"public, valid session", "GET", "/open", "good", 204, "", true},
+		{"public, invalid session is anonymous", "GET", "/open", "stale", 204, "", false},
+		{"public path, other method, no session", "POST", "/open", "", 401, "UNAUTHENTICATED", false},
+		{"public path, other method, session", "POST", "/open", "good", 405, "METHOD_NOT_ALLOWED", false},
+		{"protected, no session", "GET", "/closed", "", 401, "UNAUTHENTICATED", false},
+		{"protected, invalid session", "GET", "/closed", "stale", 401, "UNAUTHENTICATED", false},
+		{"protected, valid session", "GET", "/closed", "good", 204, "", true},
+		{"unknown path, no session", "GET", "/nope", "", 401, "UNAUTHENTICATED", false},
+		{"unknown path, invalid session", "GET", "/nope", "stale", 401, "UNAUTHENTICATED", false},
+		{"unknown path, session", "GET", "/nope", "good", 404, "NOT_FOUND", false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var seen security.Principal
+			rec := httptest.NewRecorder()
+			chain(v, &seen).ServeHTTP(rec, request(tc.method, tc.path, tc.cookie))
+			if rec.Code != tc.status {
+				t.Fatalf("status = %d, want %d (%s)", rec.Code, tc.status, rec.Body)
+			}
+			if tc.code != "" && !strings.Contains(rec.Body.String(), `"code":"`+tc.code+`"`) {
+				t.Errorf("body %s lacks code %s", rec.Body, tc.code)
+			}
+			if tc.code != "" && rec.Header().Get("Content-Type") != web.ProblemContentType {
+				t.Errorf("Content-Type = %q", rec.Header().Get("Content-Type"))
+			}
+			if got := seen == user; got != tc.principal {
+				t.Errorf("principal in context = %v, want %v", got, tc.principal)
+			}
+		})
+	}
+}
+
+func TestMiddlewareNoCookieSkipsStore(t *testing.T) {
+	v := &fakeValidator{}
+	chain(v, nil).ServeHTTP(httptest.NewRecorder(), request("GET", "/open", ""))
+	// An empty cookie value is the same as none.
+	req := httptest.NewRequest("GET", "/open", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: ""})
+	chain(v, nil).ServeHTTP(httptest.NewRecorder(), req)
+	if v.calls != 0 {
+		t.Errorf("store called %d times without a cookie value", v.calls)
+	}
+}
+
+func TestMiddlewareIgnoresOtherCookies(t *testing.T) {
+	v := &fakeValidator{live: map[string]security.Principal{"good": {Role: security.RoleUser}}}
+	req := httptest.NewRequest("GET", "/closed", nil)
+	req.AddCookie(&http.Cookie{Name: "session", Value: "good"})
+	rec := httptest.NewRecorder()
+	chain(v, nil).ServeHTTP(rec, req)
+	if rec.Code != 401 || v.calls != 0 {
+		t.Errorf("status %d, store calls %d", rec.Code, v.calls)
+	}
+}
+
+func TestMiddlewareStoreFailureIs500NotPublicFallthrough(t *testing.T) {
+	v := &fakeValidator{err: errors.New("db down")}
+	for _, path := range []string{"/open", "/closed", "/nope"} {
+		rec := httptest.NewRecorder()
+		chain(v, nil).ServeHTTP(rec, request("GET", path, "good"))
+		if rec.Code != 500 || !strings.Contains(rec.Body.String(), "INTERNAL_ERROR") {
+			t.Errorf("%s: status %d body %s", path, rec.Code, rec.Body)
+		}
+		if strings.Contains(rec.Body.String(), "db down") {
+			t.Errorf("%s: cause leaked: %s", path, rec.Body)
+		}
+	}
+}
+
+func TestMiddlewareNilPublicMeansAllProtected(t *testing.T) {
+	h := auth.Middleware(&fakeValidator{}, nil, slog.New(slog.DiscardHandler))(http.NotFoundHandler())
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, request("GET", "/open", ""))
+	if rec.Code != 401 {
+		t.Errorf("status = %d", rec.Code)
+	}
+}

package/backend/internal/auth/session.go

@@ -45,11 +45,21 @@ func New(db *sql.DB) *Sessions { return &Sessions{DB: db} }
 // (32 random bytes, base64url without padding). Every login calls it, so an ID
 // is never reused (no fixation).
 func (s *Sessions) Create(ctx context.Context, userID uuid.UUID) (string, error) {
+	return s.create(ctx, s.DB, userID)
+}
+
+// CreateIn is Create inside the caller's transaction, so login commits the
+// session together with its audit row.
+func (s *Sessions) CreateIn(ctx context.Context, tx *sql.Tx, userID uuid.UUID) (string, error) {
+	return s.create(ctx, tx, userID)
+}
+
+func (s *Sessions) create(ctx context.Context, x store.Execer, userID uuid.UUID) (string, error) {
 	raw := make([]byte, idBytes)
 	if _, err := rand.Read(raw); err != nil {
 		return "", fmt.Errorf("session id: %w", err)
 	}
-	if err := store.Insert(ctx, s.DB, hash(raw), userID); err != nil {
+	if err := store.Insert(ctx, x, hash(raw), userID); err != nil {
 		return "", err
 	}
 	return base64.RawURLEncoding.EncodeToString(raw), nil
@@ -81,6 +91,15 @@ func (s *Sessions) Revoke(ctx context.Context, id string) error {
 	return store.Delete(ctx, s.DB, h)
 }
 
+// RevokeIn is Revoke inside the caller's transaction.
+func (s *Sessions) RevokeIn(ctx context.Context, tx *sql.Tx, id string) error {
+	h, valid := parse(id)
+	if !valid {
+		return nil
+	}
+	return store.Delete(ctx, tx, h)
+}
+
 // RevokeAll deletes every session of the user. It implements
 // account.SessionRevoker (wired in main.go; account never imports auth).
 func (s *Sessions) RevokeAll(ctx context.Context, userID uuid.UUID) error {

package/backend/internal/server/api.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/deadline"
 )
 
@@ -12,6 +13,10 @@ import (
 // module has not landed yet stay api.Unimplemented (501).
 type API struct {
 	api.Unimplemented
+	Auth     auth.Handler
+	Logins   auth.LoginHandler
+	Logouts  auth.LogoutHandler
+	Me       auth.MeHandler
 	Account  account.Handler
 	Deadline deadline.Handler
 }
@@ -23,3 +28,17 @@ func (a API) GetDeadline(w http.ResponseWriter, r *http.Request) { a.Deadline.Ge
 func (a API) Register(w http.ResponseWriter, r *http.Request, _ api.RegisterParams) {
 	a.Account.Register(w, r)
 }
+
+// GetCsrfToken serves GET /auth/csrf.
+func (a API) GetCsrfToken(w http.ResponseWriter, r *http.Request) { a.Auth.GetCsrfToken(w, r) }
+
+// Login serves POST /auth/login.
+func (a API) Login(w http.ResponseWriter, r *http.Request, _ api.LoginParams) { a.Logins.Login(w, r) }
+
+// Logout serves POST /auth/logout.
+func (a API) Logout(w http.ResponseWriter, r *http.Request, _ api.LogoutParams) {
+	a.Logouts.Logout(w, r)
+}
+
+// GetMe serves GET /auth/me.
+func (a API) GetMe(w http.ResponseWriter, r *http.Request) { a.Me.GetMe(w, r) }