@nakedev/go-scaffold 0.3.3 → 0.4.3

package/templates/add/auth/internal/app/user/errors.go.hbs

@@ -1,6 +1,7 @@
 package user
 
 import (
+	"fmt"
 	"net/http"
 
 	"{{goModule}}/internal/shared/apperror"
@@ -40,4 +41,28 @@ func errAlreadyVerified() *apperror.AppError {
 	return apperror.New(http.StatusConflict, "AUTH_ALREADY_VERIFIED", "email is already verified")
 }
 
+func errMFAUnavailable() *apperror.AppError {
+	return apperror.New(http.StatusServiceUnavailable, "AUTH_MFA_UNAVAILABLE", "multi-factor authentication is not enabled")
+}
+
+func errMFAInvalid() *apperror.AppError {
+	return apperror.New(http.StatusUnauthorized, "AUTH_MFA_INVALID", "invalid or expired multi-factor authentication code")
+}
+
+func errMFAAlreadyEnabled() *apperror.AppError {
+	return apperror.New(http.StatusConflict, "AUTH_MFA_ALREADY_ENABLED", "multi-factor authentication is already enabled")
+}
+
+func errMFANotEnrolled() *apperror.AppError {
+	return apperror.New(http.StatusConflict, "AUTH_MFA_NOT_ENROLLED", "multi-factor authentication is not enabled for this user")
+}
+
+func errMFASetupRequired() *apperror.AppError {
+	return apperror.New(http.StatusConflict, "AUTH_MFA_SETUP_REQUIRED", "complete multi-factor authentication setup first")
+}
+
+func errMFAConfig() *apperror.AppError {
+	return apperror.NewInternal(fmt.Errorf("multi-factor authentication encryption key is invalid"))
+}
+
 // go-scaffold:user-errors

package/templates/add/auth/internal/app/user/external_login.go.hbs

@@ -0,0 +1,208 @@
+package user
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"{{goModule}}/internal/app/user/application"
+	"{{goModule}}/internal/app/user/model"
+	"{{goModule}}/internal/shared/dberr"
+	"{{goModule}}/internal/shared/id"
+
+	"gorm.io/gorm"
+)
+
+// BeginLogin accepts the browser client's state and S256 PKCE challenge and
+// asks the registered provider adapter to construct its authorization URL.
+// The server persists a hashed state transaction binding provider, challenge,
+// and OIDC nonce before the callback reaches ExchangeLogin.
+func (s *Service) BeginLogin(ctx context.Context, providerName string, in application.LoginStartInput) (*application.Authorization, error) {
+	provider, ok := s.providers.Lookup(providerName)
+	if !ok {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
+	}
+	// OAuth values are opaque: validate their wire-safe shape without trimming
+	// or rewriting what the frontend and provider saw.
+	if !validOAuthValue(in.State) || !validPKCEChallenge(in.CodeChallenge) || in.CodeChallengeMethod != "S256" {
+		return nil, application.NewOAuthError(application.OAuthStateInvalid, fmt.Errorf("state and S256 code challenge are required"))
+	}
+	nonce, err := randomToken()
+	if err != nil {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("create oauth transaction: %w", err))
+	}
+	in.Nonce = nonce
+	authorization, err := provider.Begin(ctx, in)
+	if err != nil {
+		return nil, mapProviderError(err)
+	}
+	if strings.TrimSpace(authorization.URL) == "" {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("provider returned an empty authorization URL"))
+	}
+	clock := s.now
+	if clock == nil {
+		clock = time.Now
+	}
+	if err := s.oauthTransactions.SetLoginTransaction(ctx, hashToken(in.State), loginTransaction{
+		Provider:      providerName,
+		CodeChallenge: in.CodeChallenge,
+		Nonce:         nonce,
+		ExpiresAt:     clock().Add(s.config.OAuthStateTTL),
+	}); err != nil {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("store oauth transaction: %w", err))
+	}
+	return &authorization, nil
+}
+
+type loginExchangeInput struct {
+	Code         string `json:"code"`
+	State        string `json:"state"`
+	CodeVerifier string `json:"code_verifier"`
+}
+
+func (s *Service) ExchangeLogin(ctx context.Context, providerName string, in loginExchangeInput) (*authResult, error) {
+	provider, ok := s.providers.Lookup(providerName)
+	if !ok {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("provider %q is not configured", providerName))
+	}
+	if !validOAuthValue(in.State) || !validPKCEValue(in.CodeVerifier) {
+		return nil, application.NewOAuthError(application.OAuthStateInvalid, fmt.Errorf("state and code verifier are required"))
+	}
+	if !validOAuthValue(in.Code) {
+		return nil, application.NewOAuthError(application.OAuthFailed, fmt.Errorf("authorization code is missing"))
+	}
+
+	transaction, ok, err := s.oauthTransactions.ConsumeLoginTransaction(ctx, hashToken(in.State))
+	if err != nil {
+		return nil, application.NewOAuthError(application.OAuthProviderUnavailable, fmt.Errorf("consume oauth transaction: %w", err))
+	}
+	if !ok || transaction.Provider != providerName || !validPKCEVerifier(in.CodeVerifier, transaction.CodeChallenge) {
+		return nil, application.NewOAuthError(application.OAuthStateInvalid, fmt.Errorf("oauth state or PKCE verifier is invalid"))
+	}
+
+	identity, err := provider.Complete(ctx, application.LoginCompleteInput{Code: in.Code, CodeVerifier: in.CodeVerifier, Nonce: transaction.Nonce})
+	if err != nil {
+		return nil, mapProviderError(err)
+	}
+	if identity.Provider != providerName {
+		return nil, application.NewOAuthError(application.OAuthFailed, fmt.Errorf("provider identity name does not match the requested provider"))
+	}
+	u, err := s.findOrCreateExternalUser(ctx, identity)
+	if err != nil {
+		return nil, application.NewOAuthError(application.OAuthFailed, fmt.Errorf("resolve external identity: %w", err))
+	}
+	return s.completeLogin(ctx, u)
+}
+
+func validPKCEVerifier(verifier, challenge string) bool {
+	if !validPKCEValue(verifier) || !validPKCEValue(challenge) {
+		return false
+	}
+	computed := pkceChallenge(verifier)
+	return subtle.ConstantTimeCompare([]byte(computed), []byte(challenge)) == 1
+}
+
+// OAuth state and authorization codes use the RFC 6749 VSCHAR shape.
+func validOAuthValue(value string) bool {
+	if value == "" {
+		return false
+	}
+	for i := 0; i < len(value); i++ {
+		if value[i] < 0x20 || value[i] > 0x7e {
+			return false
+		}
+	}
+	return true
+}
+
+// RFC 7636 defines code_verifier/code_challenge as 43–128 unreserved ASCII
+// characters. S256 is the only method accepted by this scaffold.
+func validPKCEValue(value string) bool {
+	if len(value) < 43 || len(value) > 128 {
+		return false
+	}
+	for i := 0; i < len(value); i++ {
+		c := value[i]
+		switch {
+		case c >= 'A' && c <= 'Z':
+		case c >= 'a' && c <= 'z':
+		case c >= '0' && c <= '9':
+		case c == '-' || c == '.' || c == '_' || c == '~':
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+func validPKCEChallenge(challenge string) bool {
+	return validPKCEValue(challenge)
+}
+
+func pkceChallenge(verifier string) string {
+	sum := sha256.Sum256([]byte(verifier))
+	return base64.RawURLEncoding.EncodeToString(sum[:])
+}
+
+func mapProviderError(err error) error {
+	var oauthErr *application.OAuthError
+	if errors.As(err, &oauthErr) {
+		return oauthErr
+	}
+	if application.IsProviderUnavailable(err) {
+		return application.NewOAuthError(application.OAuthProviderUnavailable, err)
+	}
+	return application.NewOAuthError(application.OAuthFailed, err)
+}
+
+// findOrCreateExternalUser is provider-neutral identity resolution. A stable
+// provider subject wins; only a verified external email may link to an
+// existing account.
+func (s *Service) findOrCreateExternalUser(ctx context.Context, info application.ExternalIdentity) (*model.User, error) {
+	if strings.TrimSpace(info.Provider) == "" || strings.TrimSpace(info.Subject) == "" || strings.TrimSpace(info.Email) == "" {
+		return nil, fmt.Errorf("external identity is missing provider, subject, or email")
+	}
+	if len(info.Provider) > 20 {
+		return nil, fmt.Errorf("external identity provider name is too long")
+	}
+
+	provider := model.Provider(info.Provider)
+	if ident, err := s.repo.FindIdentityByProviderUID(ctx, provider, info.Subject); err == nil {
+		user, findErr := s.repo.FindByID(ctx, ident.UserID)
+		if findErr != nil {
+			return nil, fmt.Errorf("find user for existing identity: %w", findErr)
+		}
+		return user, nil
+	} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, fmt.Errorf("find external identity: %w", err)
+	}
+
+	providerUID := info.Subject
+	email := normalizeEmail(info.Email)
+	if info.EmailVerified {
+		if u, err := s.repo.FindByEmail(ctx, email); err == nil {
+			ident := &model.Identity{ID: id.New(), UserID: u.ID, Provider: provider, ProviderUID: &providerUID}
+			if err := s.repo.CreateIdentity(ctx, ident); err != nil {
+				return nil, fmt.Errorf("link external identity: %w", err)
+			}
+			return u, nil
+		} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, fmt.Errorf("find user by verified external email: %w", err)
+		}
+	}
+
+	u := &model.User{ID: id.New(), Email: email, Name: info.Name, AvatarURL: info.AvatarURL, EmailVerified: info.EmailVerified}
+	ident := &model.Identity{ID: id.New(), Provider: provider, ProviderUID: &providerUID}
+	if err := s.repo.CreateUserWithIdentity(ctx, u, ident); err != nil {
+		if dberr.IsDuplicate(err) {
+			return nil, errEmailTaken()
+		}
+		return nil, fmt.Errorf("create external user: %w", err)
+	}
+	return u, nil
+}

package/templates/add/auth/internal/app/user/handler.go.hbs

@@ -1,36 +1,37 @@
 package user
 
 import (
-	"net/http"
-	"strings"
 	"time"
 
-	"{{goModule}}/internal/shared/httpx"
 	"{{goModule}}/internal/shared/middleware"
-	// go-scaffold:user-handler-imports
 
 	"github.com/gin-gonic/gin"
-	"github.com/google/uuid"
+	// go-scaffold:user-handler-imports
 )
 
 const (
 	refreshCookieName = "refresh_token"
-	// oauthStateCookieName holds the nonce that binds a Google login to the
-	// browser that started it — see Service.GoogleLoginURL.
-	oauthStateCookieName = "oauth_state"
 )
 
 // go-scaffold:user-handler-consts
 
+// authorizer is the optional capability RBAC supplies to protect admin
+// routes. Auth itself does not import the RBAC middleware implementation.
+type authorizer interface {
+	Require(string) gin.HandlerFunc
+}
+
 type Handler struct {
 	svc            *Service
 	jwtSecret      string
 	refreshTTL     time.Duration
 	cookieSecure   bool
 	cookieSameSite string
+	allowedOrigins []string
 	// limiter, not a *redis.Client: which backing store counts the requests is
 	// decided by `add auth --store`, and this file must not care.
 	limiter middleware.Limiter
+	authz   authorizer
 	// go-scaffold:user-handler-fields
 }
 
@@ -41,33 +42,70 @@ func NewHandler(
 	cookieSecure bool,
 	cookieSameSite string,
 	limiter middleware.Limiter,
+	authz ...authorizer,
 	// go-scaffold:user-handler-params
 ) *Handler {
+	return newHandler(svc, jwtSecret, refreshTTL, cookieSecure, cookieSameSite, nil, limiter, authz...)
+}
+
+// NewHandlerWithOrigins is the current composition entry point. Keeping the
+// original NewHandler signature preserves source compatibility for projects
+// generated before the cross-site Origin guard was added.
+func NewHandlerWithOrigins(
+	svc *Service,
+	jwtSecret string,
+	refreshTTL time.Duration,
+	cookieSecure bool,
+	cookieSameSite string,
+	allowedOrigins []string,
+	limiter middleware.Limiter,
+	authz ...authorizer,
+	// go-scaffold:user-handler-with-origins-params
+) *Handler {
+	return newHandler(svc, jwtSecret, refreshTTL, cookieSecure, cookieSameSite, allowedOrigins, limiter, authz...)
+}
+
+func newHandler(
+	svc *Service,
+	jwtSecret string,
+	refreshTTL time.Duration,
+	cookieSecure bool,
+	cookieSameSite string,
+	allowedOrigins []string,
+	limiter middleware.Limiter,
+	authz ...authorizer,
+) *Handler {
+	var authzMiddleware authorizer
+	if len(authz) > 0 {
+		authzMiddleware = authz[0]
+	}
 	return &Handler{
 		svc:            svc,
 		jwtSecret:      jwtSecret,
 		refreshTTL:     refreshTTL,
 		cookieSecure:   cookieSecure,
 		cookieSameSite: cookieSameSite,
+		allowedOrigins: append([]string(nil), allowedOrigins...),
 		limiter:        limiter,
+		authz:          authzMiddleware,
 		// go-scaffold:user-handler-init
 	}
 }
 
-// Register wires both a public /auth group (register/login/refresh/logout)
-// and a /users group gated by RequireAuth — public vs protected is decided
-// here, per domain, not centrally in main.go.
+// Register owns the public/protected route split for the user feature. The
+// endpoint implementations live in focused handler files; this file remains
+// the single route/composition surface that generator patches can target.
 func (h *Handler) Register(rg gin.IRouter) {
-	// per-IP, per-route budgets — separate names so a burst on one endpoint
-	// doesn't spend another's budget. refresh/logout/google aren't limited:
-	// refresh/logout are gated by possessing a valid cookie already, and the
-	// Google flow's abuse surface lives on Google's side, not ours.
 	loginLimit := middleware.RateLimit(h.limiter, "login", 10, time.Minute)
 	registerLimit := middleware.RateLimit(h.limiter, "register", 5, time.Minute)
 	forgotPasswordLimit := middleware.RateLimit(h.limiter, "forgot-password", 5, time.Minute)
 	resetPasswordLimit := middleware.RateLimit(h.limiter, "reset-password", 10, time.Minute)
 	verifyEmailLimit := middleware.RateLimit(h.limiter, "verify-email", 10, time.Minute)
 	resendVerificationLimit := middleware.RateLimit(h.limiter, "resend-verification", 5, time.Minute)
+	mfaVerifyLimit := middleware.RateLimit(h.limiter, "mfa-verify", 5, time.Minute)
+	mfaSetupLimit := middleware.RateLimit(h.limiter, "mfa-setup", 5, time.Minute)
+	mfaConfirmLimit := middleware.RateLimit(h.limiter, "mfa-confirm", 5, time.Minute)
+	mfaDisableLimit := middleware.RateLimit(h.limiter, "mfa-disable", 5, time.Minute)
 
 	authGroup := rg.Group("/auth")
 	authGroup.POST("/register", registerLimit, h.register)
@@ -77,200 +115,19 @@ func (h *Handler) Register(rg gin.IRouter) {
 	authGroup.POST("/forgot-password", forgotPasswordLimit, h.forgotPassword)
 	authGroup.POST("/reset-password", resetPasswordLimit, h.resetPassword)
 	authGroup.POST("/verify-email", verifyEmailLimit, h.verifyEmail)
-	authGroup.GET("/google/login", h.googleLogin)
-	authGroup.GET("/google/callback", h.googleCallback)
+	authGroup.POST("/mfa/verify", mfaVerifyLimit, h.verifyMFA)
+	authGroup.GET("/:provider/login", h.providerLogin)
+	authGroup.POST("/:provider/exchange", h.providerExchange)
 
 	usersGroup := rg.Group("/users", middleware.RequireAuth(h.jwtSecret))
 	usersGroup.GET("/me", h.me)
 	usersGroup.POST("/me/resend-verification", resendVerificationLimit, h.resendVerification)
 	usersGroup.POST("/me/logout-all", h.logoutAll)
+	usersGroup.GET("/me/mfa", h.mfaStatus)
+	usersGroup.POST("/me/mfa/setup", mfaSetupLimit, h.setupMFA)
+	usersGroup.POST("/me/mfa/confirm", mfaConfirmLimit, h.confirmMFA)
+	usersGroup.POST("/me/mfa/disable", mfaDisableLimit, h.disableMFA)
 	// go-scaffold:user-routes
 }
 
-func (h *Handler) register(c *gin.Context) {
-	var in registerInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	auth, err := h.svc.Register(c.Request.Context(), in)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusCreated, toCookieResponse(auth))
-}
-
-func (h *Handler) login(c *gin.Context) {
-	var in loginInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	auth, err := h.svc.Login(c.Request.Context(), in)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusOK, toCookieResponse(auth))
-}
-
-func (h *Handler) refresh(c *gin.Context) {
-	raw, err := c.Cookie(refreshCookieName)
-	if err != nil || raw == "" {
-		c.Error(errInvalidToken())
-		return
-	}
-	auth, err := h.svc.Refresh(c.Request.Context(), raw)
-	if err != nil {
-		h.clearRefreshCookie(c)
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusOK, toCookieResponse(auth))
-}
-
-func (h *Handler) logout(c *gin.Context) {
-	raw, _ := c.Cookie(refreshCookieName)
-	_ = h.svc.Logout(c.Request.Context(), raw)
-	h.clearRefreshCookie(c)
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) forgotPassword(c *gin.Context) {
-	var in forgotPasswordInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	if err := h.svc.ForgotPassword(c.Request.Context(), in.Email); err != nil {
-		c.Error(err)
-		return
-	}
-	// always the same response, whether or not the email exists — see
-	// Service.ForgotPassword for why.
-	c.JSON(http.StatusOK, gin.H{"message": "if that email exists, a reset link has been sent"})
-}
-
-func (h *Handler) resetPassword(c *gin.Context) {
-	var in resetPasswordInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	if err := h.svc.ResetPassword(c.Request.Context(), in.Token, in.NewPassword); err != nil {
-		c.Error(err)
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) verifyEmail(c *gin.Context) {
-	var in verifyEmailInput
-	if err := c.ShouldBindJSON(&in); err != nil {
-		c.Error(httpx.BindErr(err))
-		return
-	}
-	if err := h.svc.VerifyEmail(c.Request.Context(), in.Token); err != nil {
-		c.Error(err)
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) resendVerification(c *gin.Context) {
-	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
-	if err := h.svc.ResendVerificationEmail(c.Request.Context(), userID); err != nil {
-		c.Error(err)
-		return
-	}
-	c.Status(http.StatusNoContent)
-}
-
-// logoutAll ends every session for the caller, not just the one making the
-// request — also clears this request's own cookie, since that session is
-// dead too now.
-func (h *Handler) logoutAll(c *gin.Context) {
-	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
-	if err := h.svc.LogoutAll(c.Request.Context(), userID); err != nil {
-		c.Error(err)
-		return
-	}
-	h.clearRefreshCookie(c)
-	c.Status(http.StatusNoContent)
-}
-
-func (h *Handler) googleLogin(c *gin.Context) {
-	url, nonce, err := h.svc.GoogleLoginURL()
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	// Lax, not Strict, and deliberately not h.cookieSameSite: the callback
-	// arrives as a top-level navigation from Google, i.e. cross-site, and a
-	// Strict cookie is not sent on one — the flow would fail every time.
-	c.SetSameSite(http.SameSiteLaxMode)
-	c.SetCookie(oauthStateCookieName, nonce, int(oauthStateTTL.Seconds()), "/", "", h.cookieSecure, true)
-	c.Redirect(http.StatusFound, url)
-}
-
-func (h *Handler) googleCallback(c *gin.Context) {
-	nonce, _ := c.Cookie(oauthStateCookieName)
-	// One shot, whatever happens next.
-	c.SetSameSite(http.SameSiteLaxMode)
-	c.SetCookie(oauthStateCookieName, "", -1, "/", "", h.cookieSecure, true)
-
-	auth, err := h.svc.GoogleCallback(c.Request.Context(), c.Query("code"), c.Query("state"), nonce)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	h.setRefreshCookie(c, auth.RefreshToken)
-	c.JSON(http.StatusOK, toCookieResponse(auth))
-}
-
-func (h *Handler) me(c *gin.Context) {
-	userID := c.MustGet(middleware.UserIDKey).(uuid.UUID)
-	u, err := h.svc.Get(c.Request.Context(), userID)
-	if err != nil {
-		c.Error(err)
-		return
-	}
-	c.JSON(http.StatusOK, toMeResponse(u))
-}
-
 // go-scaffold:user-handler-funcs
-
-func (h *Handler) setRefreshCookie(c *gin.Context, token string) {
-	c.SetSameSite(sameSiteFrom(h.cookieSameSite))
-	c.SetCookie(refreshCookieName, token, int(h.refreshTTL.Seconds()), "/", "", h.cookieSecure, true)
-}
-
-func (h *Handler) clearRefreshCookie(c *gin.Context) {
-	c.SetSameSite(sameSiteFrom(h.cookieSameSite))
-	c.SetCookie(refreshCookieName, "", -1, "/", "", h.cookieSecure, true)
-}
-
-// sameSiteFrom maps COOKIE_SAMESITE onto the http constant, defaulting to the
-// strictest option for anything it doesn't recognise.
-//
-// "strict" is right while the frontend and this API are the same site
-// (localhost:3000 -> localhost:8080 is, and so is app.example.com ->
-// api.example.com). A frontend on a genuinely different site — the usual
-// vercel.app-plus-own-API-domain split — needs "none", because the browser
-// will not attach a Strict or Lax cookie to the fetch that calls
-// /auth/refresh: sessions then die at every access-token expiry with no
-// error anywhere to explain it. "none" requires COOKIE_SECURE=true.
-func sameSiteFrom(mode string) http.SameSite {
-	switch strings.ToLower(mode) {
-	case "none":
-		return http.SameSiteNoneMode
-	case "lax":
-		return http.SameSiteLaxMode
-	default:
-		return http.SameSiteStrictMode
-	}
-}

package/templates/add/auth/internal/app/user/handler_local.go.hbs

@@ -0,0 +1,75 @@
+package user
+
+import (
+	"net/http"
+
+	"{{goModule}}/internal/shared/httpx"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) register(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in registerInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.Register(c.Request.Context(), in)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	h.writeAuthResult(c, http.StatusCreated, auth)
+}
+
+func (h *Handler) login(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	var in loginInput
+	if err := c.ShouldBindJSON(&in); err != nil {
+		c.Error(httpx.BindErr(err))
+		return
+	}
+	auth, err := h.svc.Login(c.Request.Context(), in)
+	if err != nil {
+		c.Error(err)
+		return
+	}
+	h.writeAuthResult(c, http.StatusOK, auth)
+}
+
+func (h *Handler) refresh(c *gin.Context) {
+	setNoStoreHeaders(c)
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	raw, err := c.Cookie(refreshCookieName)
+	if err != nil || raw == "" {
+		c.Error(errInvalidToken())
+		return
+	}
+	auth, err := h.svc.Refresh(c.Request.Context(), raw)
+	if err != nil {
+		h.clearRefreshCookie(c)
+		c.Error(err)
+		return
+	}
+	h.setRefreshCookie(c, auth.RefreshToken)
+	c.JSON(http.StatusOK, toCookieResponse(auth))
+}
+
+func (h *Handler) logout(c *gin.Context) {
+	if !h.requireBrowserOrigin(c) {
+		return
+	}
+	raw, _ := c.Cookie(refreshCookieName)
+	_ = h.svc.Logout(c.Request.Context(), raw)
+	h.clearRefreshCookie(c)
+	c.Status(http.StatusNoContent)
+}