@johnnyboy11234/esg-idea-contest 0.2.2 → 0.2.3

package/backend/internal/auth/login_test.go

@@ -0,0 +1,68 @@
+package auth
+
+import (
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func median(ds []time.Duration) time.Duration {
+	slices.Sort(ds)
+	return ds[len(ds)/2]
+}
+
+func timeCompare(hash []byte, pw string) time.Duration {
+	const n = 7
+	ds := make([]time.Duration, n)
+	for i := range ds {
+		start := time.Now()
+		comparePassword(hash, pw)
+		ds[i] = time.Since(start)
+	}
+	return median(ds)
+}
+
+// Unknown vs wrong password (B1-10 acceptance): one cost-10 comparison either
+// way, so the medians are close. The bound is loose on purpose: bcrypt takes
+// tens of milliseconds, a skipped comparison would be ~1000x off.
+func TestComparePasswordTimingSimilar(t *testing.T) {
+	l, err := NewLogins(nil, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	real, err := bcrypt.GenerateFromPassword([]byte("Correct-Horse-1"), bcryptCost)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wrong := timeCompare(real, "Wrong-Horse-99")
+	dummy := timeCompare(l.dummyHash, "Wrong-Horse-99")
+	long := timeCompare(l.dummyHash, strings.Repeat("x", 100)) // > 72 bytes
+
+	for name, d := range map[string]time.Duration{"dummy": dummy, "over 72 bytes": long} {
+		if d < wrong/2 || d > wrong*2 {
+			t.Errorf("%s comparison %v vs wrong-password %v: not similar (a comparison was skipped?)", name, d, wrong)
+		}
+	}
+}
+
+func TestComparePassword(t *testing.T) {
+	pw72 := strings.Repeat("a", 72)
+	h72, _ := bcrypt.GenerateFromPassword([]byte(pw72), bcryptCost)
+	tests := []struct {
+		name, pw string
+		want     bool
+	}{
+		{"exact 72 bytes", pw72, true},
+		{"73 bytes never matches, even with a matching 72-byte prefix", pw72 + "b", false},
+		{"wrong", "nope", false},
+		{"empty", "", false},
+	}
+	for _, tc := range tests {
+		if got := comparePassword(h72, tc.pw); got != tc.want {
+			t.Errorf("%s: got %v", tc.name, got)
+		}
+	}
+}

package/backend/internal/auth/logout.go

@@ -0,0 +1,68 @@
+package auth
+
+import (
+	"context"
+	"database/sql"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Logouts implements POST /auth/logout.
+type Logouts struct {
+	Sessions *Sessions
+	Audit    Recorder
+}
+
+// Logout deletes the caller's session and writes AUTH_LOGOUT in the same
+// transaction (fail-closed). Without a session there is nothing to end and no
+// actor to record: it succeeds silently (PRD §6.5, idempotent 204). A session
+// that vanished meanwhile (concurrent logout) is not an error either.
+func (l *Logouts) Logout(ctx context.Context, sessionID string, p security.Principal, has bool, req Request) error {
+	if !has {
+		return nil
+	}
+	_, err := db.InTx(ctx, l.Sessions.DB, func(ctx context.Context, tx *sql.Tx) error {
+		if err := l.Sessions.RevokeIn(ctx, tx, sessionID); err != nil {
+			return err
+		}
+		return l.Audit.Record(ctx, tx, audit.Event{
+			Action: audit.AuthLogout, Outcome: audit.Success,
+			ActorRole: p.ActorRole(), ActorEmpNo: p.EmpNo,
+			TargetType: audit.TargetUser, TargetID: p.UserID,
+			Method: req.Method, Route: req.Route, Status: http.StatusNoContent,
+			IP: req.IP, UserAgent: req.UserAgent,
+		})
+	})
+	return err
+}
+
+// LogoutHandler is the HTTP adapter of Logouts.
+type LogoutHandler struct {
+	Logouts *Logouts
+	Fail    func(w http.ResponseWriter, r *http.Request, err error)
+}
+
+// Logout serves POST /auth/logout: 204 and an expired session cookie, with or
+// without a session. The CSRF check has already run in the middleware.
+func (h LogoutHandler) Logout(w http.ResponseWriter, r *http.Request) {
+	p, has := security.PrincipalFrom(r.Context())
+	var sid string
+	if c, err := r.Cookie(SessionCookie); err == nil {
+		sid = c.Value
+	}
+	if err := h.Logouts.Logout(r.Context(), sid, p, has, Request{
+		Method: r.Method, Route: web.RoutePattern(r), UserAgent: r.UserAgent(), IP: web.ClientIP(r),
+	}); err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name: SessionCookie, Value: "", Path: "/", MaxAge: -1,
+		Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode,
+	})
+	w.WriteHeader(http.StatusNoContent)
+}

package/backend/internal/auth/logout_integration_test.go

@@ -0,0 +1,124 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+func (e loginEnv) logout(tok string, ck *http.Cookie, extra ...*http.Cookie) *httptest.ResponseRecorder {
+	req := httptest.NewRequest("POST", "/api/v1/auth/logout", nil)
+	req.Header.Set("X-CSRF-Token", tok)
+	req.Header.Set("User-Agent", "it/1")
+	req.RemoteAddr = "192.0.2.9:4000"
+	if ck != nil {
+		req.AddCookie(ck)
+	}
+	for _, c := range extra {
+		req.AddCookie(c)
+	}
+	return e.do(req)
+}
+
+func (e loginEnv) logoutAudits(t *testing.T) (n int, actor, empNo string, status int) {
+	t.Helper()
+	if err := e.db.QueryRow(`SELECT COUNT(*) FROM audit_log WHERE action='AUTH_LOGOUT' AND outcome='SUCCESS'`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n > 0 {
+		if err := e.db.QueryRow(`SELECT actor_role, actor_emp_no, status FROM audit_log WHERE action='AUTH_LOGOUT' LIMIT 1`).
+			Scan(&actor, &empNo, &status); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return
+}
+
+func TestLogoutEndsSession(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	sess := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+
+	tok, ck := e.csrf(t, sess) // token bound to the session
+	rec := e.logout(tok, ck, sess)
+	if rec.Code != 204 || rec.Body.Len() != 0 {
+		t.Fatalf("status %d body %q", rec.Code, rec.Body)
+	}
+	if c := findCookie(rec, auth.SessionCookie); c == nil || c.MaxAge >= 0 || c.Value != "" || !c.Secure || !c.HttpOnly || c.Path != "/" {
+		t.Errorf("cookie not cleared: %+v", c)
+	}
+	if e.sessions(t) != 0 {
+		t.Error("session row still present")
+	}
+	if n, actor, empNo, status := e.logoutAudits(t); n != 1 || actor != "USER" || empNo != "123456" || status != 204 {
+		t.Errorf("audit n=%d actor=%s emp=%s status=%d", n, actor, empNo, status)
+	}
+
+	// The old cookie no longer authenticates.
+	req := httptest.NewRequest("GET", "/api/v1/auth/me", nil)
+	req.AddCookie(sess)
+	if rec := e.do(req); rec.Code != 401 {
+		t.Errorf("after logout: %d, want 401", rec.Code)
+	}
+	// The session-bound token is useless now: replaying logout is a 403 only
+	// because the anonymous binding differs.
+	if rec := e.logout(tok, ck, sess); rec.Code != 403 {
+		t.Errorf("replay with old token: %d, want 403", rec.Code)
+	}
+}
+
+func TestLogoutWithoutSessionIsIdempotent(t *testing.T) {
+	e := newLoginEnv(t)
+	tok, ck := e.csrf(t, nil)
+	rec := e.logout(tok, ck)
+	if rec.Code != 204 {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body)
+	}
+	if n, _, _, _ := e.logoutAudits(t); n != 0 {
+		t.Errorf("anonymous logout wrote %d audit rows", n)
+	}
+	// Expired or junk session cookie behaves the same.
+	if rec := e.logout(tok, ck, &http.Cookie{Name: auth.SessionCookie, Value: "junk"}); rec.Code != 204 {
+		t.Errorf("junk cookie: %d", rec.Code)
+	}
+}
+
+func TestLogoutRequiresCSRF(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	sess := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+
+	anonTok, anonCk := e.csrf(t, nil) // wrong binding for this session
+	for name, rec := range map[string]*httptest.ResponseRecorder{
+		"no token":      e.logout("", nil, sess),
+		"anonymous tok": e.logout(anonTok, anonCk, sess),
+	} {
+		if rec.Code != 403 || code(t, rec) != "CSRF_INVALID" {
+			t.Errorf("%s: %d %s", name, rec.Code, rec.Body)
+		}
+	}
+	if e.sessions(t) != 1 {
+		t.Error("a rejected logout must not end the session")
+	}
+	if n, _, _, _ := e.logoutAudits(t); n != 0 {
+		t.Error("no SUCCESS row for a rejected logout")
+	}
+}
+
+func TestLogoutOtherSessionsSurvive(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	a := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+	e.login(t, creds("123456", password))
+	tok, ck := e.csrf(t, a)
+	if rec := e.logout(tok, ck, a); rec.Code != 204 {
+		t.Fatal(rec.Code)
+	}
+	if e.sessions(t) != 1 {
+		t.Errorf("want 1 remaining session, got %d", e.sessions(t))
+	}
+}

package/backend/internal/auth/me.go

@@ -0,0 +1,40 @@
+package auth
+
+import (
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// MeHandler serves GET /auth/me. The session middleware has already answered
+// 401 without a valid session and touched the session (idle refresh, OI-11),
+// so this is also the idle-timeout "continue" call (OI-22).
+type MeHandler struct {
+	Sessions *Sessions
+	Fail     func(w http.ResponseWriter, r *http.Request, err error)
+}
+
+// GetMe answers the caller from the database (name and email are not in the
+// principal). An account that vanished since the middleware ran answers 401.
+func (h MeHandler) GetMe(w http.ResponseWriter, r *http.Request) {
+	p, ok := security.PrincipalFrom(r.Context())
+	if !ok {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	a, found, err := store.AccountByID(r.Context(), h.Sessions.DB, p.UserID)
+	if err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	if !found || !a.Enabled {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	web.WriteJSON(w, http.StatusOK, api.LoginResponse{
+		EmpNo: a.EmpNo, Name: a.Name, Email: a.Email, Role: api.LoginResponseRole(a.Role),
+	})
+}

package/backend/internal/auth/me_integration_test.go

@@ -0,0 +1,70 @@
+//go:build integration
+
+package auth_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/auth"
+)
+
+func (e loginEnv) me(t *testing.T, withSession bool, sid string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest("GET", "/api/v1/auth/me", nil)
+	if withSession {
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: sid})
+	}
+	return e.do(req)
+}
+
+func TestMeReturnsCaller(t *testing.T) {
+	e := newLoginEnv(t)
+	e.addUser(t, "123456", "USER", true)
+	e.addUser(t, "900001", "ADMIN", true)
+
+	for _, tc := range []struct {
+		emp, role string
+		email     any
+	}{{"123456", "USER", "123456@example.com"}, {"900001", "ADMIN", nil}} {
+		sess := findCookie(e.login(t, creds(tc.emp, password)), auth.SessionCookie)
+		rec := e.me(t, true, sess.Value)
+		if rec.Code != 200 {
+			t.Fatalf("%s: status %d", tc.emp, rec.Code)
+		}
+		var got map[string]any
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+			t.Fatal(err)
+		}
+		if got["empNo"] != tc.emp || got["role"] != tc.role || got["email"] != tc.email || got["name"] != "N "+tc.emp {
+			t.Errorf("%s: body %v", tc.emp, got)
+		}
+		if _, leaked := got["passwordHash"]; leaked || len(got) != 4 {
+			t.Errorf("%s: unexpected fields %v", tc.emp, got)
+		}
+	}
+}
+
+func TestMeWithoutValidSessionIs401(t *testing.T) {
+	e := newLoginEnv(t)
+	if rec := e.me(t, false, ""); rec.Code != 401 || code(t, rec) != "UNAUTHENTICATED" {
+		t.Errorf("no cookie: %d", rec.Code)
+	}
+	if rec := e.me(t, true, "not-a-session"); rec.Code != 401 {
+		t.Errorf("bad cookie: %d", rec.Code)
+	}
+}
+
+func TestMeAfterAccountDisabledIs401(t *testing.T) {
+	e := newLoginEnv(t)
+	id := e.addUser(t, "123456", "USER", true)
+	sess := findCookie(e.login(t, creds("123456", password)), auth.SessionCookie)
+	if _, err := e.db.Exec(`UPDATE app_user SET enabled = 0 WHERE id = ?`, id.String()); err != nil {
+		t.Fatal(err)
+	}
+	if rec := e.me(t, true, sess.Value); rec.Code != 401 {
+		t.Errorf("disabled: %d, want 401", rec.Code)
+	}
+}

package/backend/internal/auth/session.go

@@ -45,11 +45,21 @@ func New(db *sql.DB) *Sessions { return &Sessions{DB: db} }
 // (32 random bytes, base64url without padding). Every login calls it, so an ID
 // is never reused (no fixation).
 func (s *Sessions) Create(ctx context.Context, userID uuid.UUID) (string, error) {
+	return s.create(ctx, s.DB, userID)
+}
+
+// CreateIn is Create inside the caller's transaction, so login commits the
+// session together with its audit row.
+func (s *Sessions) CreateIn(ctx context.Context, tx *sql.Tx, userID uuid.UUID) (string, error) {
+	return s.create(ctx, tx, userID)
+}
+
+func (s *Sessions) create(ctx context.Context, x store.Execer, userID uuid.UUID) (string, error) {
 	raw := make([]byte, idBytes)
 	if _, err := rand.Read(raw); err != nil {
 		return "", fmt.Errorf("session id: %w", err)
 	}
-	if err := store.Insert(ctx, s.DB, hash(raw), userID); err != nil {
+	if err := store.Insert(ctx, x, hash(raw), userID); err != nil {
 		return "", err
 	}
 	return base64.RawURLEncoding.EncodeToString(raw), nil
@@ -81,6 +91,15 @@ func (s *Sessions) Revoke(ctx context.Context, id string) error {
 	return store.Delete(ctx, s.DB, h)
 }
 
+// RevokeIn is Revoke inside the caller's transaction.
+func (s *Sessions) RevokeIn(ctx context.Context, tx *sql.Tx, id string) error {
+	h, valid := parse(id)
+	if !valid {
+		return nil
+	}
+	return store.Delete(ctx, tx, h)
+}
+
 // RevokeAll deletes every session of the user. It implements
 // account.SessionRevoker (wired in main.go; account never imports auth).
 func (s *Sessions) RevokeAll(ctx context.Context, userID uuid.UUID) error {

package/backend/internal/server/api.go

@@ -14,6 +14,9 @@ import (
 type API struct {
 	api.Unimplemented
 	Auth     auth.Handler
+	Logins   auth.LoginHandler
+	Logouts  auth.LogoutHandler
+	Me       auth.MeHandler
 	Account  account.Handler
 	Deadline deadline.Handler
 }
@@ -28,3 +31,14 @@ func (a API) Register(w http.ResponseWriter, r *http.Request, _ api.RegisterPara
 
 // GetCsrfToken serves GET /auth/csrf.
 func (a API) GetCsrfToken(w http.ResponseWriter, r *http.Request) { a.Auth.GetCsrfToken(w, r) }
+
+// Login serves POST /auth/login.
+func (a API) Login(w http.ResponseWriter, r *http.Request, _ api.LoginParams) { a.Logins.Login(w, r) }
+
+// Logout serves POST /auth/logout.
+func (a API) Logout(w http.ResponseWriter, r *http.Request, _ api.LogoutParams) {
+	a.Logouts.Logout(w, r)
+}
+
+// GetMe serves GET /auth/me.
+func (a API) GetMe(w http.ResponseWriter, r *http.Request) { a.Me.GetMe(w, r) }

package/backend/internal/server/public.go

@@ -4,9 +4,10 @@ import "net/http"
 
 // PublicRoutes is the explicit list of operations that need no session
 // (Backend.md §3). It must equal the operations marked `security: []` in
-// api/openapi.yaml; a test locks that. B1-10 adds POST /auth/login to both. Paths include the /api/v1 prefix.
+// api/openapi.yaml; a test locks that. Paths include the /api/v1 prefix.
 var PublicRoutes = []struct{ Method, Path string }{
 	{http.MethodGet, "/api/v1/auth/csrf"},
+	{http.MethodPost, "/api/v1/auth/login"},
 	{http.MethodPost, "/api/v1/auth/register"},
 	{http.MethodPost, "/api/v1/auth/logout"},
 	{http.MethodGet, "/api/v1/deadline"},
@@ -27,6 +28,7 @@ func IsPublic(r *http.Request) bool {
 // CSRF denial is recorded (PRD §6.11). Later PRs add their routes here, with
 // the same exact-path rule; a write on an unknown path is not audited.
 var WriteActions = map[string]string{
+	http.MethodPost + " /api/v1/auth/login":    "AUTH_LOGIN",
 	http.MethodPost + " /api/v1/auth/register": "AUTH_REGISTER",
 	http.MethodPost + " /api/v1/auth/logout":   "AUTH_LOGOUT",
 }

package/backend/internal/shared/web/problem.go

@@ -3,6 +3,8 @@ package web
 import (
 	"encoding/json"
 	"net/http"
+	"strconv"
+	"time"
 
 	"github.com/google/uuid"
 )
@@ -28,6 +30,9 @@ type Error struct {
 	Detail string
 	Fields []FieldError
 	Cause  error
+	// RetryAfter, when positive, is sent as Retry-After in whole seconds,
+	// rounded up (minimum 1; PRD §6.5 throttling).
+	RetryAfter time.Duration
 
 	// AuditReason is the real reason of a rejected attempt (CSRF, role, state,
 	// not-yours, not-found). It is stored in the row's after_json, never sent
@@ -94,6 +99,10 @@ func WriteProblem(w http.ResponseWriter, r *http.Request, e *Error) {
 	}
 	w.Header().Set("Content-Type", ProblemContentType)
 	w.Header().Set("Cache-Control", "no-store")
+	if e.RetryAfter > 0 {
+		secs := max(1, int64((e.RetryAfter+time.Second-1)/time.Second))
+		w.Header().Set("Retry-After", strconv.FormatInt(secs, 10))
+	}
 	w.WriteHeader(e.Status)
 	_ = json.NewEncoder(w).Encode(body)
 }

package/backend/internal/shared/web/retryafter_test.go

@@ -0,0 +1,31 @@
+package web_test
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+func TestRetryAfterWholeSecondsRoundedUpMinimumOne(t *testing.T) {
+	tests := []struct {
+		d    time.Duration
+		want string
+	}{
+		{0, ""},
+		{time.Millisecond, "1"},
+		{time.Second, "1"},
+		{1001 * time.Millisecond, "2"},
+		{15 * time.Minute, "900"},
+	}
+	for _, tc := range tests {
+		e := web.NewError(web.CodeLoginThrottled, "")
+		e.RetryAfter = tc.d
+		rec := httptest.NewRecorder()
+		web.WriteProblem(rec, httptest.NewRequest("POST", "/", nil), e)
+		if got := rec.Header().Get("Retry-After"); got != tc.want {
+			t.Errorf("%v: Retry-After = %q, want %q", tc.d, got, tc.want)
+		}
+	}
+}