@johnnyboy11234/esg-idea-contest 0.2.2 → 0.2.3

package/backend/api/openapi.yaml

@@ -29,6 +29,49 @@ paths:
               schema: { $ref: '#/components/schemas/CsrfTokenResponse' }
         '429': { $ref: '#/components/responses/Problem' }
         '500': { $ref: '#/components/responses/Problem' }
+  /auth/login:
+    post:
+      operationId: login
+      tags: [auth]
+      summary: Log in with employee ID and password (issues a new session)
+      description: >
+        Sets the session cookie and returns the caller. Unknown, malformed and disabled
+        accounts and wrong passwords all answer the same 401. The CSRF token changes
+        with the session, so the client refetches it.
+      security: []
+      parameters:
+        - $ref: '#/components/parameters/CsrfToken'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/LoginRequest' }
+      responses:
+        '200':
+          description: Logged in
+          headers:
+            Set-Cookie:
+              description: __Host-session=<opaque ID>; HttpOnly; Secure; SameSite=Lax; Path=/
+              schema: { type: string }
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/LoginResponse' }
+        '400': { $ref: '#/components/responses/Problem' }
+        '401': { $ref: '#/components/responses/Problem' }
+        '403': { $ref: '#/components/responses/Problem' }
+        '413': { $ref: '#/components/responses/Problem' }
+        '415': { $ref: '#/components/responses/Problem' }
+        '429':
+          description: Throttled (LOGIN_THROTTLED)
+          headers:
+            Retry-After:
+              description: Seconds until a new attempt may succeed
+              schema: { type: integer, minimum: 1 }
+          content:
+            application/problem+json:
+              schema: { $ref: '#/components/schemas/Problem' }
+        '500': { $ref: '#/components/responses/Problem' }
+        '503': { $ref: '#/components/responses/Problem' }
   /auth/logout:
     post:
       operationId: logout
@@ -41,6 +84,19 @@ paths:
         '204': { description: Logged out }
         '403': { $ref: '#/components/responses/Problem' }
         '500': { $ref: '#/components/responses/Problem' }
+  /auth/me:
+    get:
+      operationId: getMe
+      tags: [auth]
+      summary: The caller (also the idle-timeout "continue" call)
+      responses:
+        '200':
+          description: The authenticated caller
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/LoginResponse' }
+        '401': { $ref: '#/components/responses/Problem' }
+        '500': { $ref: '#/components/responses/Problem' }
   /auth/register:
     post:
       operationId: register
@@ -154,6 +210,20 @@ components:
       required: [token]
       properties:
         token: { type: string }
+    LoginRequest:
+      type: object
+      required: [empNo, password]
+      properties:
+        empNo: { type: string, description: 'Any string; a badly formatted ID is an ordinary login failure' }
+        password: { type: string, format: password }
+    LoginResponse:
+      type: object
+      required: [empNo, name, email, role]
+      properties:
+        empNo: { type: string }
+        name: { type: string }
+        email: { type: string, nullable: true, description: null for Admin }
+        role: { type: string, enum: [USER, ADMIN] }
     RegisterRequest:
       type: object
       required: [empNo, name, email, password]

package/backend/cmd/server/main.go

@@ -51,8 +51,16 @@ func run() error {
 	if err != nil {
 		return err
 	}
+	sessions := auth.New(db)
+	logins, err := auth.NewLogins(sessions, auditSvc, auth.NoThrottle{}) // B1b-04 wires the real throttle
+	if err != nil {
+		return err
+	}
 	si := server.API{
-		Auth: auth.Handler{CSRF: csrf, Log: log},
+		Auth:    auth.Handler{CSRF: csrf, Log: log},
+		Logins:  auth.LoginHandler{Logins: logins, Fail: errs.Write},
+		Logouts: auth.LogoutHandler{Logouts: &auth.Logouts{Sessions: sessions, Audit: auditSvc}, Fail: errs.Write},
+		Me:      auth.MeHandler{Sessions: sessions, Fail: errs.Write},
 		Account: account.Handler{
 			Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
 			Fail:    errs.Write,
@@ -62,6 +70,6 @@ func run() error {
 
 	var ready atomic.Bool
 	return server.Run(ctx, cfg, log, server.NewPublic(log, server.Mount(si),
-		auth.Middleware(auth.New(db), server.IsPublic, log),
+		auth.Middleware(sessions, server.IsPublic, log),
 		csrf.Middleware(errs.Write, server.ActionFor)), &ready, server.DBCheck(db))
 }

package/backend/internal/account/logging_integration_test.go

@@ -0,0 +1,70 @@
+//go:build integration
+
+package account_test
+
+import (
+	"bytes"
+	"log/slog"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+	"github.com/brian-huanggg/AwardRegistration/backend/test/apispec"
+)
+
+type syncBuf struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (s *syncBuf) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.Write(p)
+}
+
+func (s *syncBuf) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.String()
+}
+
+// TestRegisterLogsNeverContainPassword drives register (created, duplicate,
+// weak password, malformed JSON) at DEBUG level and asserts the submitted
+// password never reaches a log line (PRD §6.5 / §8.2).
+func TestRegisterLogsNeverContainPassword(t *testing.T) {
+	buf := &syncBuf{}
+	log := slog.New(slog.NewJSONHandler(buf, &slog.HandlerOptions{Level: slog.LevelDebug}))
+	db := dbtest.New(t)
+	auditSvc := audit.New(db, log)
+	errs := server.ErrorAdapter{Audit: auditSvc, Log: log}
+	api := server.API{Account: account.Handler{
+		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+		Fail:    errs.Write,
+	}}
+	e := env{db: db, h: apispec.Load(t).Validate(t, server.NewPublic(log, server.Mount(api)))}
+
+	const (
+		pw1 = "Sup3r-Secret-Horse-1"
+		pw2 = "An0ther-Secret-Horse-2"
+		pw3 = "Dup-Secret-Horse-3"
+	)
+	e.register(reg("089290", "Wang", "wang@example.com", pw1))                              // 201
+	e.register(reg("089290", "Wang", "wang2@example.com", pw2))                             // duplicate
+	e.register(reg("089291", "Lee", "lee@example.com", "short"))                            // weak
+	e.register(`{"empNo":"089292","name":"X","email":"x@example.com","password":"` + pw3 + `"`) // malformed
+
+	out := buf.String()
+	if strings.TrimSpace(out) == "" {
+		t.Fatal("no log output captured; the test would prove nothing")
+	}
+	for _, s := range []string{pw1, pw2, pw3} {
+		if strings.Contains(out, s) {
+			t.Errorf("log contains password %q", s)
+		}
+	}
+}

package/backend/internal/api/api.gen.go

@@ -53,6 +53,24 @@ func (e IdeaSummaryMyRelation) Valid() bool {
 	}
 }
 
+// Defines values for LoginResponseRole.
+const (
+	ADMIN LoginResponseRole = "ADMIN"
+	USER  LoginResponseRole = "USER"
+)
+
+// Valid indicates whether the value is a known member of the LoginResponseRole enum.
+func (e LoginResponseRole) Valid() bool {
+	switch e {
+	case ADMIN:
+		return true
+	case USER:
+		return true
+	default:
+		return false
+	}
+}
+
 // CsrfTokenResponse defines model for CsrfTokenResponse.
 type CsrfTokenResponse struct {
 	Token string `json:"token"`
@@ -140,6 +158,25 @@ type IdeaSummary struct {
 // IdeaSummaryMyRelation null for Admin
 type IdeaSummaryMyRelation string
 
+// LoginRequest defines model for LoginRequest.
+type LoginRequest struct {
+	// EmpNo Any string; a badly formatted ID is an ordinary login failure
+	EmpNo    string `json:"empNo"`
+	Password string `json:"password"`
+}
+
+// LoginResponse defines model for LoginResponse.
+type LoginResponse struct {
+	// Email null for Admin
+	Email *string           `json:"email"`
+	EmpNo string            `json:"empNo"`
+	Name  string            `json:"name"`
+	Role  LoginResponseRole `json:"role"`
+}
+
+// LoginResponseRole defines model for LoginResponse.Role.
+type LoginResponseRole string
+
 // PersonRef defines model for PersonRef.
 type PersonRef struct {
 	EmpNo string `json:"empNo"`
@@ -186,6 +223,12 @@ type CsrfToken = string
 // IdeaId defines model for IdeaId.
 type IdeaId = openapi_types.UUID
 
+// LoginParams defines parameters for Login.
+type LoginParams struct {
+	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
+	XCSRFToken *CsrfToken `json:"X-CSRF-Token,omitempty"`
+}
+
 // LogoutParams defines parameters for Logout.
 type LogoutParams struct {
 	// XCSRFToken Session-bound token from GET /auth/csrf. Mandatory on every write, but enforced by the CSRF middleware (403 CSRF_INVALID), so the generated wrapper must not reject its absence first (400).
@@ -204,6 +247,9 @@ type ListIdeasParams struct {
 	Size *int `form:"size,omitempty" json:"size,omitempty"`
 }
 
+// LoginJSONRequestBody defines body for Login for application/json ContentType.
+type LoginJSONRequestBody = LoginRequest
+
 // RegisterJSONRequestBody defines body for Register for application/json ContentType.
 type RegisterJSONRequestBody = RegisterRequest
 
@@ -212,9 +258,15 @@ type ServerInterface interface {
 	// GetCsrfToken Session-bound CSRF token (anonymous before login)
 	// (GET /auth/csrf)
 	GetCsrfToken(w http.ResponseWriter, r *http.Request)
+	// Login Log in with employee ID and password (issues a new session)
+	// (POST /auth/login)
+	Login(w http.ResponseWriter, r *http.Request, params LoginParams)
 	// Logout End the session
 	// (POST /auth/logout)
 	Logout(w http.ResponseWriter, r *http.Request, params LogoutParams)
+	// GetMe The caller (also the idle-timeout "continue" call)
+	// (GET /auth/me)
+	GetMe(w http.ResponseWriter, r *http.Request)
 	// Register Self-service registration (no session is created)
 	// (POST /auth/register)
 	Register(w http.ResponseWriter, r *http.Request, params RegisterParams)
@@ -239,12 +291,24 @@ func (_ Unimplemented) GetCsrfToken(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// Login Log in with employee ID and password (issues a new session)
+// (POST /auth/login)
+func (_ Unimplemented) Login(w http.ResponseWriter, r *http.Request, params LoginParams) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // Logout End the session
 // (POST /auth/logout)
 func (_ Unimplemented) Logout(w http.ResponseWriter, r *http.Request, params LogoutParams) {
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// GetMe The caller (also the idle-timeout "continue" call)
+// (GET /auth/me)
+func (_ Unimplemented) GetMe(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // Register Self-service registration (no session is created)
 // (POST /auth/register)
 func (_ Unimplemented) Register(w http.ResponseWriter, r *http.Request, params RegisterParams) {
@@ -292,6 +356,47 @@ func (siw *ServerInterfaceWrapper) GetCsrfToken(w http.ResponseWriter, r *http.R
 	handler.ServeHTTP(w, r)
 }
 
+// Login operation middleware
+func (siw *ServerInterfaceWrapper) Login(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// Parameter object where we will unmarshal all parameters from the context
+	var params LoginParams
+
+	headers := r.Header
+
+	// ------------- Optional header parameter "X-CSRF-Token" -------------
+	if valueList, found := headers[http.CanonicalHeaderKey("X-CSRF-Token")]; found {
+		var XCSRFToken CsrfToken
+		n := len(valueList)
+		if n != 1 {
+			siw.ErrorHandlerFunc(w, r, &TooManyValuesForParamError{ParamName: "X-CSRF-Token", Count: n})
+			return
+		}
+
+		err = runtime.BindStyledParameterWithOptions("simple", "X-CSRF-Token", valueList[0], &XCSRFToken, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationHeader, Explode: false, Required: false, Type: "string", Format: ""})
+		if err != nil {
+			siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "X-CSRF-Token", Err: err})
+			return
+		}
+
+		params.XCSRFToken = &XCSRFToken
+
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.Login(w, r, params)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // Logout operation middleware
 func (siw *ServerInterfaceWrapper) Logout(w http.ResponseWriter, r *http.Request) {
 
@@ -333,6 +438,20 @@ func (siw *ServerInterfaceWrapper) Logout(w http.ResponseWriter, r *http.Request
 	handler.ServeHTTP(w, r)
 }
 
+// GetMe operation middleware
+func (siw *ServerInterfaceWrapper) GetMe(w http.ResponseWriter, r *http.Request) {
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.GetMe(w, r)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 // Register operation middleware
 func (siw *ServerInterfaceWrapper) Register(w http.ResponseWriter, r *http.Request) {
 
@@ -576,9 +695,15 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/auth/csrf", wrapper.GetCsrfToken)
 	})
+	r.Group(func(r chi.Router) {
+		r.Post(options.BaseURL+"/auth/login", wrapper.Login)
+	})
 	r.Group(func(r chi.Router) {
 		r.Post(options.BaseURL+"/auth/logout", wrapper.Logout)
 	})
+	r.Group(func(r chi.Router) {
+		r.Get(options.BaseURL+"/auth/me", wrapper.GetMe)
+	})
 	r.Group(func(r chi.Router) {
 		r.Post(options.BaseURL+"/auth/register", wrapper.Register)
 	})

package/backend/internal/auth/internal/store/session.go

@@ -20,9 +20,14 @@ type Limits struct {
 	RefreshSeconds  int
 }
 
+// Execer is *sql.DB or *sql.Tx.
+type Execer interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
 // Insert stores a new session row. hash is SHA-256 of the session ID.
-func Insert(ctx context.Context, db *sql.DB, hash []byte, userID uuid.UUID) error {
-	_, err := db.ExecContext(ctx,
+func Insert(ctx context.Context, x Execer, hash []byte, userID uuid.UUID) error {
+	_, err := x.ExecContext(ctx,
 		`INSERT INTO session (id_hash, user_id) VALUES (?, ?)`, hash, userID.String())
 	if err != nil {
 		return fmt.Errorf("insert session: %w", err)
@@ -77,9 +82,10 @@ func Principal(ctx context.Context, db *sql.DB, hash []byte) (p security.Princip
 	return p, true, nil
 }
 
-// Delete removes one session; deleting a missing one is not an error.
-func Delete(ctx context.Context, db *sql.DB, hash []byte) error {
-	if _, err := db.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
+// Delete removes one session; deleting a missing one is not an error. x is the
+// *sql.DB, or the caller's *sql.Tx so logout commits with its audit row.
+func Delete(ctx context.Context, x Execer, hash []byte) error {
+	if _, err := x.ExecContext(ctx, `DELETE FROM session WHERE id_hash = ?`, hash); err != nil {
 		return fmt.Errorf("delete session: %w", err)
 	}
 	return nil
@@ -109,3 +115,55 @@ func DeleteExpired(ctx context.Context, db *sql.DB, l Limits) (int64, error) {
 	}
 	return n, nil
 }
+
+// Account is the login view of app_user: what is needed to check a password
+// and answer the login response. PasswordHash never leaves the auth module.
+type Account struct {
+	ID           uuid.UUID
+	EmpNo        string
+	Name         string
+	Email        *string // NULL for Admin
+	PasswordHash string
+	Role         security.Role
+	Enabled      bool
+}
+
+// AccountByEmpNo reads one account by employee ID; found is false when none
+// exists.
+func AccountByEmpNo(ctx context.Context, db *sql.DB, empNo string) (a Account, found bool, err error) {
+	var id, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT id, emp_no, name, email, password_hash, role, enabled
+		   FROM app_user WHERE emp_no = ?`, empNo).
+		Scan(&id, &a.EmpNo, &a.Name, &a.Email, &a.PasswordHash, &role, &a.Enabled)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Account{}, false, nil
+	}
+	if err != nil {
+		return Account{}, false, fmt.Errorf("read account: %w", err)
+	}
+	if a.ID, err = uuid.Parse(id); err != nil {
+		return Account{}, false, fmt.Errorf("parse user id %q: %w", id, err)
+	}
+	a.Role = security.Role(role)
+	return a, true, nil
+}
+
+// AccountByID reads one account by its user ID; found is false when none
+// exists.
+func AccountByID(ctx context.Context, db *sql.DB, id uuid.UUID) (a Account, found bool, err error) {
+	var sid, role string
+	err = db.QueryRowContext(ctx,
+		`SELECT id, emp_no, name, email, password_hash, role, enabled
+		   FROM app_user WHERE id = ?`, id.String()).
+		Scan(&sid, &a.EmpNo, &a.Name, &a.Email, &a.PasswordHash, &role, &a.Enabled)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Account{}, false, nil
+	}
+	if err != nil {
+		return Account{}, false, fmt.Errorf("read account by id: %w", err)
+	}
+	a.ID = id
+	a.Role = security.Role(role)
+	return a, true, nil
+}

package/backend/internal/auth/logging_integration_test.go

@@ -0,0 +1,88 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"bytes"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+type syncBuf struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (s *syncBuf) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.Write(p)
+}
+
+func (s *syncBuf) String() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.b.String()
+}
+
+// TestLogsNeverContainSecrets drives login (good and bad), csrf, me, logout and
+// a rejected write at DEBUG level and asserts no secret reaches any log line
+// (PRD §6.5 / §8.2: no password, session ID, CSRF token or Cookie in logs).
+func TestLogsNeverContainSecrets(t *testing.T) {
+	buf := &syncBuf{}
+	e := newLoginEnvLog(t, slog.New(slog.NewJSONHandler(buf, &slog.HandlerOptions{Level: slog.LevelDebug})))
+	e.addUser(t, "123456", "USER", true)
+
+	const wrongPW = "Wr0ng-Secret-Passw0rd!"
+	secrets := []string{password, wrongPW}
+
+	e.login(t, creds("123456", wrongPW))
+	e.login(t, creds("999999", wrongPW))
+	e.login(t, `{"empNo":"123456","password":"`+wrongPW+`"`) // malformed JSON echoing the password
+
+	rec := e.login(t, creds("123456", password))
+	sess := findCookie(rec, auth.SessionCookie)
+	if sess == nil {
+		t.Fatalf("login failed: %d", rec.Code)
+	}
+	secrets = append(secrets, sess.Value)
+
+	tok, ck := e.csrf(t, sess)
+	secrets = append(secrets, tok, ck.Value)
+
+	if rec := e.me(t, true, sess.Value); rec.Code != 200 {
+		t.Fatalf("me: %d", rec.Code)
+	}
+	// Write with a bad CSRF token: denied, and the submitted token must not be logged.
+	bad := httptest.NewRequest("POST", "/api/v1/auth/logout", nil)
+	bad.Header.Set("X-CSRF-Token", "forged-token-value-123")
+	bad.AddCookie(sess)
+	bad.AddCookie(&http.Cookie{Name: "__Host-csrf", Value: "forged-cookie-value-456"})
+	e.do(bad)
+	secrets = append(secrets, "forged-token-value-123", "forged-cookie-value-456")
+
+	if rec := e.logout(tok, ck, sess); rec.Code != 204 {
+		t.Fatalf("logout: %d", rec.Code)
+	}
+
+	out := buf.String()
+	if strings.TrimSpace(out) == "" {
+		t.Fatal("no log output captured; the test would prove nothing")
+	}
+	for _, s := range secrets {
+		if s != "" && strings.Contains(out, s) {
+			t.Errorf("log contains secret %q", s)
+		}
+	}
+	for _, name := range []string{"Set-Cookie", "set-cookie", "__Host-session=", "X-CSRF-Token"} {
+		if strings.Contains(out, name) {
+			t.Errorf("log contains header material %q", name)
+		}
+	}
+}