61 lines
2.4 KiB
Go
61 lines
2.4 KiB
Go
package authorized
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"git.sendico.io/tech/sxchnge/product/auth/config"
|
|
re "git.sendico.io/tech/sxchnge/product/auth/http/endpoint"
|
|
emodel "git.sendico.io/tech/sxchnge/product/auth/model"
|
|
"git.sendico.io/tech/sxchnge/product/customers/store"
|
|
"git.sendico.io/tech/sxchnge/product/sessions/metrics"
|
|
"git.sendico.io/tech/sxchnge/product/sessions/store"
|
|
api "git.sendico.io/tech/sxchnge/shared/http"
|
|
"git.sendico.io/tech/sxchnge/shared/http/response"
|
|
"git.sendico.io/tech/sxchnge/shared/logging"
|
|
"git.sendico.io/tech/sxchnge/shared/logging/fields"
|
|
"git.sendico.io/tech/sxchnge/shared/service"
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/go-chi/jwtauth/v5"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
type AuthorizedRouter struct {
|
|
logger mlogger.Logger
|
|
db account.DB
|
|
rtdb refreshtokens.DB
|
|
imp *re.HttpEndpointRouter
|
|
service mservice.Type
|
|
}
|
|
|
|
func NewRouter(logger mlogger.Logger, apiEndpoint string, router chi.Router, db account.DB, rtdb refreshtokens.DB, config *middleware.TokenConfig, signature *middleware.Signature) *AuthorizedRouter {
|
|
ja := jwtauth.New(signature.Algorithm, signature.PrivateKey, signature.PublicKey)
|
|
router.Use(jwtauth.Verifier(ja))
|
|
router.Use(jwtauth.Authenticator(ja))
|
|
l := logger.Named("authorized")
|
|
ar := AuthorizedRouter{
|
|
logger: l,
|
|
db: db,
|
|
rtdb: rtdb,
|
|
imp: re.NewHttpEndpointRouter(l, apiEndpoint, router, config, signature),
|
|
service: mservice.Accounts,
|
|
}
|
|
ar.tokenHandlerWithSessionCheck(mservice.Accounts, "/logout/all", api.Post, false, ar.logoutAll)
|
|
|
|
return &ar
|
|
}
|
|
|
|
func (ar *AuthorizedRouter) logoutAll(r *http.Request, token *emodel.AccountToken) http.HandlerFunc {
|
|
if token.ClientID == "" || token.DeviceID == "" || token.SessionVersion == "" {
|
|
sessionmetrics.Observe(sessionmetrics.AllLogout, sessionmetrics.MissingIdentity)
|
|
return response.Unauthorized(ar.logger, ar.service, "session identifier is required")
|
|
}
|
|
if err := ar.rtdb.RevokeAll(r.Context(), token.AccountRef, ""); err != nil {
|
|
sessionmetrics.Observe(sessionmetrics.AllLogout, sessionmetrics.StorageError)
|
|
ar.logger.Warn("Failed to revoke all account sessions", zap.Error(err), mzap.AccRef(token.AccountRef))
|
|
return response.Internal(ar.logger, ar.service, err)
|
|
}
|
|
sessionmetrics.Observe(sessionmetrics.AllLogout, sessionmetrics.Succeeded)
|
|
ar.logger.Info("All account sessions revoked", mzap.AccRef(token.AccountRef))
|
|
return response.Success(ar.logger)
|
|
}
|