Mazyar
698 lines
19 KiB
Go
698 lines
19 KiB
Go
package authorization
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"encoding/hex"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"strconv"
|
|
"time"
|
|
|
|
"tm/pkg/logger"
|
|
"tm/pkg/redis"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
redisv9 "github.com/redis/go-redis/v9"
|
|
)
|
|
|
|
// TokenType represents the type of token
|
|
type TokenType string
|
|
|
|
const (
|
|
AccessToken TokenType = "access"
|
|
RefreshToken TokenType = "refresh"
|
|
)
|
|
|
|
// TokenClaims represents the JWT claims structure
|
|
type TokenClaims struct {
|
|
UserID string `json:"user_id"`
|
|
Email string `json:"email"`
|
|
Role string `json:"role"`
|
|
CompanyID string `json:"company_id,omitempty"`
|
|
TokenType TokenType `json:"token_type"`
|
|
jwt.RegisteredClaims
|
|
}
|
|
|
|
// TokenPair represents a pair of access and refresh tokens
|
|
type TokenPair struct {
|
|
AccessToken string `json:"access_token"`
|
|
RefreshToken string `json:"refresh_token"`
|
|
ExpiresIn int64 `json:"expires_in"`
|
|
}
|
|
|
|
// TokenValidationResult represents the result of token validation
|
|
type TokenValidationResult struct {
|
|
Valid bool
|
|
Claims *TokenClaims
|
|
Error string
|
|
Expired bool
|
|
}
|
|
|
|
// AuthorizationService defines the interface for authorization operations
|
|
type AuthorizationService interface {
|
|
// GenerateTokenPair generates both access and refresh tokens
|
|
GenerateTokenPair(userID, email, role, companyID string) (*TokenPair, error)
|
|
|
|
// GenerateAccessToken generates only an access token
|
|
GenerateAccessToken(userID, email, role, companyID string) (string, error)
|
|
|
|
// GenerateRefreshToken generates only a refresh token
|
|
GenerateRefreshToken(userID, email, role, companyID string) (string, error)
|
|
|
|
// ValidateToken validates a token and returns the claims
|
|
ValidateToken(tokenString string) (*TokenValidationResult, error)
|
|
|
|
// ValidateAccessToken validates specifically an access token
|
|
ValidateAccessToken(tokenString string) (*TokenValidationResult, error)
|
|
|
|
// ValidateRefreshToken validates specifically a refresh token
|
|
ValidateRefreshToken(tokenString string) (*TokenValidationResult, error)
|
|
|
|
// RefreshAccessToken generates a new access token using a valid refresh token
|
|
RefreshAccessToken(refreshToken string) (string, error)
|
|
|
|
// InvalidateToken adds a token to the blacklist (if using Redis)
|
|
InvalidateToken(tokenString string) error
|
|
|
|
// IsTokenBlacklisted checks if a token is blacklisted
|
|
IsTokenBlacklisted(tokenString string) (bool, error)
|
|
|
|
// ClearExpiredTokens removes expired tokens from the blacklist
|
|
ClearExpiredTokens() error
|
|
|
|
// GetBlacklistStats returns statistics about the blacklist
|
|
GetBlacklistStats(ctx context.Context) (map[string]interface{}, error)
|
|
|
|
// InvalidateUserSessions marks all tokens issued before now as invalid for the user.
|
|
InvalidateUserSessions(userID string) error
|
|
}
|
|
|
|
// AuthorizationConfig holds the configuration for the authorization service
|
|
type AuthorizationConfig struct {
|
|
AccessTokenSecret string `json:"access_token_secret"`
|
|
RefreshTokenSecret string `json:"refresh_token_secret"`
|
|
AccessTokenExpiry time.Duration `json:"access_token_expiry"`
|
|
RefreshTokenExpiry time.Duration `json:"refresh_token_expiry"`
|
|
Issuer string `json:"issuer"`
|
|
Audience string `json:"audience"`
|
|
}
|
|
|
|
// DefaultConfig returns a default configuration
|
|
func DefaultConfig() *AuthorizationConfig {
|
|
return &AuthorizationConfig{
|
|
AccessTokenSecret: "your-access-token-secret-key-here",
|
|
RefreshTokenSecret: "your-refresh-token-secret-key-here",
|
|
AccessTokenExpiry: 15 * time.Minute, // 15 minutes
|
|
RefreshTokenExpiry: 7 * 24 * time.Hour, // 7 days
|
|
Issuer: "tender-management",
|
|
Audience: "tender-management-api",
|
|
}
|
|
}
|
|
|
|
// Service implements the AuthorizationService interface
|
|
type Service struct {
|
|
config *AuthorizationConfig
|
|
logger logger.Logger
|
|
redis redis.Client
|
|
}
|
|
|
|
// NewAuthorizationService creates a new authorization service
|
|
func NewAuthorizationService(config *AuthorizationConfig, logger logger.Logger, redis redis.Client) AuthorizationService {
|
|
if config == nil {
|
|
config = DefaultConfig()
|
|
}
|
|
|
|
return &Service{
|
|
config: config,
|
|
logger: logger,
|
|
redis: redis,
|
|
}
|
|
}
|
|
|
|
// GenerateTokenPair generates both access and refresh tokens
|
|
func (s *Service) GenerateTokenPair(userID, email, role, companyID string) (*TokenPair, error) {
|
|
s.logger.Info("Generating token pair", map[string]interface{}{
|
|
"user_id": userID,
|
|
"email": email,
|
|
"role": role,
|
|
})
|
|
|
|
accessToken, err := s.GenerateAccessToken(userID, email, role, companyID)
|
|
if err != nil {
|
|
s.logger.Error("Failed to generate access token", map[string]interface{}{
|
|
"user_id": userID,
|
|
"error": err.Error(),
|
|
})
|
|
return nil, fmt.Errorf("failed to generate access token: %w", err)
|
|
}
|
|
|
|
refreshToken, err := s.GenerateRefreshToken(userID, email, role, companyID)
|
|
if err != nil {
|
|
s.logger.Error("Failed to generate refresh token", map[string]interface{}{
|
|
"user_id": userID,
|
|
"error": err.Error(),
|
|
})
|
|
return nil, fmt.Errorf("failed to generate refresh token: %w", err)
|
|
}
|
|
|
|
tokenPair := &TokenPair{
|
|
AccessToken: accessToken,
|
|
RefreshToken: refreshToken,
|
|
ExpiresIn: int64(s.config.AccessTokenExpiry.Seconds()),
|
|
}
|
|
|
|
s.logger.Info("Token pair generated successfully", map[string]interface{}{
|
|
"user_id": userID,
|
|
"expires_in": tokenPair.ExpiresIn,
|
|
})
|
|
|
|
return tokenPair, nil
|
|
}
|
|
|
|
// GenerateAccessToken generates only an access token
|
|
func (s *Service) GenerateAccessToken(userID, email, role, companyID string) (string, error) {
|
|
now := time.Now()
|
|
expiresAt := now.Add(s.config.AccessTokenExpiry)
|
|
|
|
claims := &TokenClaims{
|
|
UserID: userID,
|
|
Email: email,
|
|
Role: role,
|
|
CompanyID: companyID,
|
|
TokenType: AccessToken,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Issuer: s.config.Issuer,
|
|
Subject: userID,
|
|
Audience: []string{s.config.Audience},
|
|
ExpiresAt: jwt.NewNumericDate(expiresAt),
|
|
NotBefore: jwt.NewNumericDate(now),
|
|
IssuedAt: jwt.NewNumericDate(now),
|
|
},
|
|
}
|
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
tokenString, err := token.SignedString([]byte(s.config.AccessTokenSecret))
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to sign access token: %w", err)
|
|
}
|
|
|
|
return tokenString, nil
|
|
}
|
|
|
|
// GenerateRefreshToken generates only a refresh token
|
|
func (s *Service) GenerateRefreshToken(userID, email, role, companyID string) (string, error) {
|
|
now := time.Now()
|
|
expiresAt := now.Add(s.config.RefreshTokenExpiry)
|
|
|
|
claims := &TokenClaims{
|
|
UserID: userID,
|
|
Email: email,
|
|
Role: role,
|
|
CompanyID: companyID,
|
|
TokenType: RefreshToken,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Issuer: s.config.Issuer,
|
|
Subject: userID,
|
|
Audience: []string{s.config.Audience},
|
|
ExpiresAt: jwt.NewNumericDate(expiresAt),
|
|
NotBefore: jwt.NewNumericDate(now),
|
|
IssuedAt: jwt.NewNumericDate(now),
|
|
},
|
|
}
|
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
tokenString, err := token.SignedString([]byte(s.config.RefreshTokenSecret))
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to sign refresh token: %w", err)
|
|
}
|
|
|
|
return tokenString, nil
|
|
}
|
|
|
|
// ValidateToken validates a token and returns the claims
|
|
func (s *Service) ValidateToken(tokenString string) (*TokenValidationResult, error) {
|
|
// First check if token is blacklisted
|
|
isBlacklisted, err := s.IsTokenBlacklisted(tokenString)
|
|
if err != nil {
|
|
s.logger.Error("Failed to check token blacklist", map[string]interface{}{
|
|
"error": err.Error(),
|
|
})
|
|
// Continue with validation even if blacklist check fails
|
|
}
|
|
|
|
if isBlacklisted {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "token is blacklisted",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
// Parse the token
|
|
token, err := jwt.ParseWithClaims(tokenString, &TokenClaims{}, func(token *jwt.Token) (interface{}, error) {
|
|
// Validate the signing method
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
|
}
|
|
|
|
// Determine which secret to use based on token type
|
|
claims, ok := token.Claims.(*TokenClaims)
|
|
if !ok {
|
|
return nil, fmt.Errorf("invalid token claims")
|
|
}
|
|
|
|
switch claims.TokenType {
|
|
case AccessToken:
|
|
return []byte(s.config.AccessTokenSecret), nil
|
|
case RefreshToken:
|
|
return []byte(s.config.RefreshTokenSecret), nil
|
|
default:
|
|
return nil, fmt.Errorf("invalid token type")
|
|
}
|
|
})
|
|
|
|
if err != nil {
|
|
if jwt.ErrTokenExpired.Error() == err.Error() {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "token expired",
|
|
Expired: true,
|
|
}, nil
|
|
}
|
|
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: fmt.Sprintf("token validation failed: %s", err.Error()),
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
if !token.Valid {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "invalid token",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
claims, ok := token.Claims.(*TokenClaims)
|
|
if !ok {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "invalid token claims",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
if invalidated, err := s.isSessionInvalidated(claims.UserID, claims.IssuedAt); err != nil {
|
|
s.logger.Error("Failed to check session invalidation", map[string]interface{}{
|
|
"user_id": claims.UserID,
|
|
"error": err.Error(),
|
|
})
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "session validation unavailable",
|
|
Expired: false,
|
|
}, nil
|
|
} else if invalidated {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "session invalidated",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
return &TokenValidationResult{
|
|
Valid: true,
|
|
Claims: claims,
|
|
Error: "",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
// ValidateAccessToken validates specifically an access token
|
|
func (s *Service) ValidateAccessToken(tokenString string) (*TokenValidationResult, error) {
|
|
result, err := s.ValidateToken(tokenString)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if !result.Valid {
|
|
return result, nil
|
|
}
|
|
|
|
// Check if it's actually an access token
|
|
if result.Claims.TokenType != AccessToken {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "token is not an access token",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
return result, nil
|
|
}
|
|
|
|
// ValidateRefreshToken validates specifically a refresh token
|
|
func (s *Service) ValidateRefreshToken(tokenString string) (*TokenValidationResult, error) {
|
|
result, err := s.ValidateToken(tokenString)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if !result.Valid {
|
|
return result, nil
|
|
}
|
|
|
|
// Check if it's actually a refresh token
|
|
if result.Claims.TokenType != RefreshToken {
|
|
return &TokenValidationResult{
|
|
Valid: false,
|
|
Claims: nil,
|
|
Error: "token is not a refresh token",
|
|
Expired: false,
|
|
}, nil
|
|
}
|
|
|
|
return result, nil
|
|
}
|
|
|
|
// RefreshAccessToken generates a new access token using a valid refresh token
|
|
func (s *Service) RefreshAccessToken(refreshToken string) (string, error) {
|
|
s.logger.Info("Refreshing access token", map[string]interface{}{
|
|
"refresh_token_length": len(refreshToken),
|
|
})
|
|
|
|
// Validate the refresh token
|
|
result, err := s.ValidateRefreshToken(refreshToken)
|
|
if err != nil {
|
|
s.logger.Error("Failed to validate refresh token", map[string]interface{}{
|
|
"error": err.Error(),
|
|
})
|
|
return "", fmt.Errorf("failed to validate refresh token: %w", err)
|
|
}
|
|
|
|
if !result.Valid {
|
|
s.logger.Warn("Invalid refresh token provided", map[string]interface{}{
|
|
"error": result.Error,
|
|
})
|
|
return "", fmt.Errorf("invalid refresh token: %s", result.Error)
|
|
}
|
|
|
|
// Generate new access token
|
|
newAccessToken, err := s.GenerateAccessToken(
|
|
result.Claims.UserID,
|
|
result.Claims.Email,
|
|
result.Claims.Role,
|
|
result.Claims.CompanyID,
|
|
)
|
|
if err != nil {
|
|
s.logger.Error("Failed to generate new access token", map[string]interface{}{
|
|
"user_id": result.Claims.UserID,
|
|
"error": err.Error(),
|
|
})
|
|
return "", fmt.Errorf("failed to generate new access token: %w", err)
|
|
}
|
|
|
|
s.logger.Info("Access token refreshed successfully", map[string]interface{}{
|
|
"user_id": result.Claims.UserID,
|
|
})
|
|
|
|
return newAccessToken, nil
|
|
}
|
|
|
|
func sessionInvalidationKey(userID string) string {
|
|
return "sessions:invalidated_at:" + userID
|
|
}
|
|
|
|
// InvalidateUserSessions marks tokens issued before now as invalid for the given user.
|
|
func (s *Service) InvalidateUserSessions(userID string) error {
|
|
if s.redis == nil {
|
|
s.logger.Warn("Redis client not available, session invalidation skipped", map[string]interface{}{
|
|
"user_id": userID,
|
|
})
|
|
return nil
|
|
}
|
|
|
|
now := time.Now().Unix()
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
ttl := s.config.RefreshTokenExpiry + 5*time.Minute
|
|
if err := s.redis.Set(ctx, sessionInvalidationKey(userID), strconv.FormatInt(now, 10), ttl); err != nil {
|
|
return fmt.Errorf("failed to invalidate user sessions: %w", err)
|
|
}
|
|
|
|
s.logger.Info("User sessions invalidated", map[string]interface{}{
|
|
"user_id": userID,
|
|
})
|
|
return nil
|
|
}
|
|
|
|
func (s *Service) isSessionInvalidated(userID string, issuedAt *jwt.NumericDate) (bool, error) {
|
|
if s.redis == nil || issuedAt == nil {
|
|
return false, nil
|
|
}
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
value, err := s.redis.Get(ctx, sessionInvalidationKey(userID))
|
|
if err != nil {
|
|
if err == redisv9.Nil {
|
|
return false, nil
|
|
}
|
|
return false, err
|
|
}
|
|
|
|
invalidatedAt, err := strconv.ParseInt(value, 10, 64)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
return issuedAt.Time.Unix() < invalidatedAt, nil
|
|
}
|
|
|
|
// generateTokenHash generates a SHA-256 hash of the token for storage
|
|
func (s *Service) generateTokenHash(tokenString string) string {
|
|
hash := sha256.Sum256([]byte(tokenString))
|
|
return hex.EncodeToString(hash[:])
|
|
}
|
|
|
|
// InvalidateToken adds a token to the blacklist
|
|
func (s *Service) InvalidateToken(tokenString string) error {
|
|
if s.redis == nil {
|
|
s.logger.Warn("Redis client not available, token blacklisting disabled", map[string]interface{}{
|
|
"token_length": len(tokenString),
|
|
})
|
|
return nil
|
|
}
|
|
|
|
// Generate hash of the token for storage
|
|
tokenHash := s.generateTokenHash(tokenString)
|
|
|
|
// Parse token to get expiration time for blacklist TTL
|
|
claims := &TokenClaims{}
|
|
_, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
|
|
// Determine which secret to use based on token type
|
|
claims, ok := token.Claims.(*TokenClaims)
|
|
if !ok {
|
|
return nil, fmt.Errorf("invalid token claims")
|
|
}
|
|
|
|
switch claims.TokenType {
|
|
case AccessToken:
|
|
return []byte(s.config.AccessTokenSecret), nil
|
|
case RefreshToken:
|
|
return []byte(s.config.RefreshTokenSecret), nil
|
|
default:
|
|
return nil, fmt.Errorf("invalid token type")
|
|
}
|
|
})
|
|
|
|
if err != nil {
|
|
s.logger.Error("Failed to parse token for blacklisting", map[string]interface{}{
|
|
"error": err.Error(),
|
|
})
|
|
// Still add to blacklist with default TTL even if parsing fails
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
// Use default TTL (24 hours) if we can't determine actual expiration
|
|
defaultTTL := 24 * time.Hour
|
|
err = s.redis.Set(ctx, "blacklist:"+tokenHash, "1", defaultTTL)
|
|
if err != nil {
|
|
s.logger.Error("Failed to add token to blacklist", map[string]interface{}{
|
|
"error": err.Error(),
|
|
})
|
|
return fmt.Errorf("failed to add token to blacklist: %w", err)
|
|
}
|
|
|
|
s.logger.Info("Token added to blacklist with default TTL", map[string]interface{}{
|
|
"token_hash": tokenHash,
|
|
"ttl": defaultTTL.String(),
|
|
})
|
|
return nil
|
|
}
|
|
|
|
// Calculate TTL based on token expiration
|
|
var ttl time.Duration
|
|
if claims.ExpiresAt != nil {
|
|
ttl = time.Until(claims.ExpiresAt.Time)
|
|
// Add some buffer time to ensure token is blacklisted until it would have expired
|
|
ttl += 5 * time.Minute
|
|
} else {
|
|
// Fallback to default TTL if no expiration
|
|
ttl = 24 * time.Hour
|
|
}
|
|
|
|
// Add token to blacklist with TTL
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
err = s.redis.Set(ctx, "blacklist:"+tokenHash, "1", ttl)
|
|
if err != nil {
|
|
s.logger.Error("Failed to add token to blacklist", map[string]interface{}{
|
|
"token_hash": tokenHash,
|
|
"error": err.Error(),
|
|
})
|
|
return fmt.Errorf("failed to add token to blacklist: %w", err)
|
|
}
|
|
|
|
s.logger.Info("Token successfully added to blacklist", map[string]interface{}{
|
|
"token_hash": tokenHash,
|
|
"ttl": ttl.String(),
|
|
})
|
|
|
|
return nil
|
|
}
|
|
|
|
// IsTokenBlacklisted checks if a token is blacklisted
|
|
func (s *Service) IsTokenBlacklisted(tokenString string) (bool, error) {
|
|
if s.redis == nil {
|
|
// If Redis is not available, assume token is not blacklisted
|
|
// This allows the system to continue functioning without Redis
|
|
return false, nil
|
|
}
|
|
|
|
// Generate hash of the token for lookup
|
|
tokenHash := s.generateTokenHash(tokenString)
|
|
|
|
// Check if token exists in blacklist
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
exists, err := s.redis.Exists(ctx, "blacklist:"+tokenHash)
|
|
if err != nil {
|
|
s.logger.Error("Failed to check token blacklist", map[string]interface{}{
|
|
"token_hash": tokenHash,
|
|
"error": err.Error(),
|
|
})
|
|
// If we can't check the blacklist, assume token is not blacklisted
|
|
// This prevents blocking legitimate requests due to Redis issues
|
|
return false, nil
|
|
}
|
|
|
|
isBlacklisted := exists > 0
|
|
|
|
if isBlacklisted {
|
|
s.logger.Debug("Token found in blacklist", map[string]interface{}{
|
|
"token_hash": tokenHash,
|
|
})
|
|
} else {
|
|
s.logger.Debug("Token not found in blacklist", map[string]interface{}{
|
|
"token_hash": tokenHash,
|
|
})
|
|
}
|
|
|
|
return isBlacklisted, nil
|
|
}
|
|
|
|
// ClearExpiredTokens removes expired tokens from the blacklist
|
|
// This is useful for cleanup operations
|
|
func (s *Service) ClearExpiredTokens() error {
|
|
if s.redis == nil {
|
|
return nil
|
|
}
|
|
|
|
s.logger.Info("Clearing expired tokens from blacklist", map[string]interface{}{})
|
|
|
|
// Note: Redis automatically expires keys based on TTL
|
|
// This method is provided for manual cleanup if needed
|
|
// In most cases, Redis TTL handling is sufficient
|
|
|
|
return nil
|
|
}
|
|
|
|
// GetBlacklistStats returns statistics about the blacklist
|
|
func (s *Service) GetBlacklistStats(ctx context.Context) (map[string]interface{}, error) {
|
|
if s.redis == nil {
|
|
return map[string]interface{}{
|
|
"redis_available": false,
|
|
"message": "Redis client not available",
|
|
}, nil
|
|
}
|
|
|
|
// This is a placeholder for future implementation
|
|
// Could return metrics like total blacklisted tokens, memory usage, etc.
|
|
return map[string]interface{}{
|
|
"redis_available": true,
|
|
"message": "Blacklist statistics not yet implemented",
|
|
}, nil
|
|
}
|
|
|
|
// GenerateRandomSecret generates a random secret key for JWT signing
|
|
func GenerateRandomSecret(length int) (string, error) {
|
|
if length < 32 {
|
|
length = 32 // Minimum recommended length
|
|
}
|
|
|
|
bytes := make([]byte, length)
|
|
_, err := rand.Read(bytes)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to generate random bytes: %w", err)
|
|
}
|
|
|
|
return fmt.Sprintf("%x", bytes), nil
|
|
}
|
|
|
|
// GenerateRSAKeyPair generates an RSA key pair for JWT signing
|
|
func GenerateRSAKeyPair(bits int) (privateKeyPEM, publicKeyPEM string, err error) {
|
|
if bits < 2048 {
|
|
bits = 2048 // Minimum recommended bits
|
|
}
|
|
|
|
privateKey, err := rsa.GenerateKey(rand.Reader, bits)
|
|
if err != nil {
|
|
return "", "", fmt.Errorf("failed to generate RSA key: %w", err)
|
|
}
|
|
|
|
// Encode private key
|
|
privateKeyBytes := x509.MarshalPKCS1PrivateKey(privateKey)
|
|
privateKeyPEM = string(pem.EncodeToMemory(&pem.Block{
|
|
Type: "RSA PRIVATE KEY",
|
|
Bytes: privateKeyBytes,
|
|
}))
|
|
|
|
// Encode public key
|
|
publicKeyBytes := x509.MarshalPKCS1PublicKey(&privateKey.PublicKey)
|
|
publicKeyPEM = string(pem.EncodeToMemory(&pem.Block{
|
|
Type: "RSA PUBLIC KEY",
|
|
Bytes: publicKeyBytes,
|
|
}))
|
|
|
|
return privateKeyPEM, publicKeyPEM, nil
|
|
}
|