Refresh Tokens

internal/auth/auth.go

@@ -1,6 +1,8 @@
 package auth
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"github.com/golang-jwt/jwt/v5"
@@ -84,3 +86,13 @@ func GetBearerToken(headers http.Header) (string, error) {
 
 	return auth, nil
 }
+
+func MakeRefreshToken() (string, error) {
+	key := make([]byte, 32)
+	_, err := rand.Read(key)
+	if err != nil {
+		return "", err
+	}
+	token := hex.EncodeToString(key)
+	return token, nil
+}

internal/dataMaps/maps.go

@@ -21,9 +21,10 @@ type User struct {
 }
 
 type UserWithToken struct {
-	ID        uuid.UUID `json:"id"`
+	ID           uuid.UUID `json:"id"`
-	CreatedAt time.Time `json:"created_at"`
+	CreatedAt    time.Time `json:"created_at"`
-	UpdatedAt time.Time `json:"updated_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
-	Email     string    `json:"email"`
+	Email        string    `json:"email"`
-	Token     string    `json:"token"`
+	Token        string    `json:"token"`
+	RefreshToken string    `json:"refresh_token"`
 }

internal/database/CreateRefreshToken.sql.go

@@ -0,0 +1,39 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.28.0
+// source: CreateRefreshToken.sql
+
+package database
+
+import (
+	"context"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const createRefreshToken = `-- name: CreateRefreshToken :one
+INSERT INTO refresh_tokens (token, created_at, updated_at, user_id, expires_at, revoked_at)
+VALUES ($1, NOW(), NOW(), $2, $3, null)
+RETURNING token, created_at, updated_at, user_id, expires_at, revoked_at
+`
+
+type CreateRefreshTokenParams struct {
+	Token     string
+	UserID    uuid.UUID
+	ExpiresAt time.Time
+}
+
+func (q *Queries) CreateRefreshToken(ctx context.Context, arg CreateRefreshTokenParams) (RefreshToken, error) {
+	row := q.db.QueryRowContext(ctx, createRefreshToken, arg.Token, arg.UserID, arg.ExpiresAt)
+	var i RefreshToken
+	err := row.Scan(
+		&i.Token,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.UserID,
+		&i.ExpiresAt,
+		&i.RevokedAt,
+	)
+	return i, err
+}

internal/database/GetRefreshTokenByToken.sql.go

@@ -0,0 +1,28 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.28.0
+// source: GetRefreshTokenByToken.sql
+
+package database
+
+import (
+	"context"
+)
+
+const getRefreshTokenByToken = `-- name: GetRefreshTokenByToken :one
+SELECT token, created_at, updated_at, user_id, expires_at, revoked_at FROM refresh_tokens WHERE token = $1 AND revoked_at is null
+`
+
+func (q *Queries) GetRefreshTokenByToken(ctx context.Context, token string) (RefreshToken, error) {
+	row := q.db.QueryRowContext(ctx, getRefreshTokenByToken, token)
+	var i RefreshToken
+	err := row.Scan(
+		&i.Token,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.UserID,
+		&i.ExpiresAt,
+		&i.RevokedAt,
+	)
+	return i, err
+}

internal/database/GetUserByID.sql.go

@@ -0,0 +1,29 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.28.0
+// source: GetUserByID.sql
+
+package database
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+const getUserByID = `-- name: GetUserByID :one
+SELECT id, created_at, updated_at, email, hashed_password FROM users WHERE id = $1
+`
+
+func (q *Queries) GetUserByID(ctx context.Context, id uuid.UUID) (User, error) {
+	row := q.db.QueryRowContext(ctx, getUserByID, id)
+	var i User
+	err := row.Scan(
+		&i.ID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Email,
+		&i.HashedPassword,
+	)
+	return i, err
+}

internal/database/RevokeRefreshTokenByToken.sql.go

@@ -0,0 +1,19 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.28.0
+// source: RevokeRefreshTokenByToken.sql
+
+package database
+
+import (
+	"context"
+)
+
+const revokeRefreshTokenByToken = `-- name: RevokeRefreshTokenByToken :exec
+UPDATE refresh_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE token = $1
+`
+
+func (q *Queries) RevokeRefreshTokenByToken(ctx context.Context, token string) error {
+	_, err := q.db.ExecContext(ctx, revokeRefreshTokenByToken, token)
+	return err
+}

internal/database/models.go

@@ -5,6 +5,7 @@
 package database
 
 import (
+	"database/sql"
 	"time"
 
 	"github.com/google/uuid"
@@ -18,6 +19,15 @@ type Chirp struct {
 	UserID    uuid.UUID
 }
 
+type RefreshToken struct {
+	Token     string
+	CreatedAt time.Time
+	UpdatedAt time.Time
+	UserID    uuid.UUID
+	ExpiresAt time.Time
+	RevokedAt sql.NullTime
+}
+
 type User struct {
 	ID             uuid.UUID
 	CreatedAt      time.Time

main.go

@@ -146,7 +146,7 @@ func postChirpsHandler(cfg *apiConfig) http.HandlerFunc {
 			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
 		}
 
-		uuid, err := auth.ValidateJWT(token, cfg.secret)
+		userId, err := auth.ValidateJWT(token, cfg.secret)
 
 		params := parameters{}
 		err = json.NewDecoder(r.Body).Decode(&params)
@@ -155,6 +155,12 @@ func postChirpsHandler(cfg *apiConfig) http.HandlerFunc {
 			return
 		}
 
+		_, err = cfg.db.GetUserByID(context.Background(), userId)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
 		chirp, err := validateChirp(params.Body)
 		if err != nil {
 			httpResponse.JSONHandler(w, http.StatusBadRequest, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
@@ -163,7 +169,7 @@ func postChirpsHandler(cfg *apiConfig) http.HandlerFunc {
 
 		newChirp, err := cfg.db.CreateChirp(context.Background(), database.CreateChirpParams{
 			Body:   chirp,
-			UserID: uuid,
+			UserID: userId,
 		})
 		if err != nil {
 			httpResponse.JSONHandler(w, http.StatusInternalServerError, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
@@ -186,12 +192,71 @@ func postChirpsHandler(cfg *apiConfig) http.HandlerFunc {
 		httpResponse.JSONHandler(w, http.StatusCreated, string(jsonData))
 	}
 }
+
+func refreshTokenHandler(cfg *apiConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		token, err := auth.GetBearerToken(r.Header)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
+		find, err := cfg.db.GetRefreshTokenByToken(context.Background(), token)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
+		_, err = cfg.db.GetUserByID(context.Background(), find.UserID)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
+		if find.RevokedAt.Valid {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
+		newToken, err := auth.MakeJWT(find.UserID, cfg.secret, time.Duration(3600)*time.Second)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusInternalServerError, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
+			return
+		}
+
+		httpResponse.JSONHandler(w, http.StatusOK, fmt.Sprintf(`{"token": "%s"}`, newToken))
+	}
+}
+
+func revokeRefreshTokenHandler(cfg *apiConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		token, err := auth.GetBearerToken(r.Header)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
+		find, err := cfg.db.GetRefreshTokenByToken(context.Background(), token)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusUnauthorized, `{"error": "Unauthorized"}`)
+			return
+		}
+
+		err = cfg.db.RevokeRefreshTokenByToken(context.Background(), find.Token)
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusInternalServerError, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
+			return
+		}
+
+		httpResponse.JSONHandler(w, http.StatusNoContent, "")
+	}
+}
+
 func loginHandler(cfg *apiConfig) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		type parameters struct {
-			Email            string `json:"email"`
+			Email    string `json:"email"`
-			Password         string `json:"password"`
+			Password string `json:"password"`
-			ExpiresInSeconds int    `json:"expires_in_seconds"`
 		}
 
 		params := parameters{}
@@ -213,10 +278,6 @@ func loginHandler(cfg *apiConfig) http.HandlerFunc {
 			return
 		}
 
-		if params.ExpiresInSeconds == 0 || params.ExpiresInSeconds > 3600 {
-			params.ExpiresInSeconds = 3600
-		}
-
 		userJSON := dataMaps.UserWithToken{
 			ID:        user.ID,
 			CreatedAt: user.CreatedAt,
@@ -224,7 +285,7 @@ func loginHandler(cfg *apiConfig) http.HandlerFunc {
 			Email:     user.Email,
 		}
 
-		expiresIn := time.Duration(params.ExpiresInSeconds) * time.Second
+		expiresIn := time.Duration(3600) * time.Second
 
 		userJSON.Token, err = auth.MakeJWT(user.ID, cfg.secret, expiresIn)
 		if err != nil {
@@ -232,6 +293,22 @@ func loginHandler(cfg *apiConfig) http.HandlerFunc {
 			return
 		}
 
+		userJSON.RefreshToken, err = auth.MakeRefreshToken()
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusInternalServerError, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
+			return
+		}
+
+		_, err = cfg.db.CreateRefreshToken(context.Background(), database.CreateRefreshTokenParams{
+			Token:     userJSON.RefreshToken,
+			UserID:    userJSON.ID,
+			ExpiresAt: time.Now().UTC().Add(time.Duration(60*24*3600) * time.Second),
+		})
+		if err != nil {
+			httpResponse.JSONHandler(w, http.StatusInternalServerError, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
+			return
+		}
+
 		jsonData, err := json.Marshal(userJSON)
 		if err != nil {
 			httpResponse.JSONHandler(w, http.StatusInternalServerError, fmt.Sprintf(`{"error": "%s"}`, err.Error()))
@@ -327,6 +404,8 @@ func main() {
 	mux.HandleFunc("POST /api/reset", resetMetricsHandler(apiCfg))
 	mux.HandleFunc("POST /api/users", postUsersHandler(apiCfg))
 	mux.HandleFunc("POST /api/login", loginHandler(apiCfg))
+	mux.HandleFunc("POST /api/refresh", refreshTokenHandler(apiCfg))
+	mux.HandleFunc("POST /api/revoke", revokeRefreshTokenHandler(apiCfg))
 	mux.HandleFunc("POST /api/chirps", postChirpsHandler(apiCfg))
 	mux.HandleFunc("GET /api/chirps", getAllChirpsHandler(apiCfg))
 	mux.HandleFunc("GET /api/chirps/{chirpID}", getChirpByIDHandler(apiCfg))

sql/queries/CreateRefreshToken.sql

@@ -0,0 +1,4 @@
+-- name: CreateRefreshToken :one
+INSERT INTO refresh_tokens (token, created_at, updated_at, user_id, expires_at, revoked_at)
+VALUES ($1, NOW(), NOW(), $2, $3, null)
+RETURNING *;

sql/queries/GetRefreshTokenByToken.sql

@@ -0,0 +1,2 @@
+-- name: GetRefreshTokenByToken :one
+SELECT * FROM refresh_tokens WHERE token = $1 AND revoked_at is null;

sql/queries/GetUserByID.sql

@@ -0,0 +1,2 @@
+-- name: GetUserByID :one
+SELECT * FROM users WHERE id = $1;

sql/queries/RevokeRefreshTokenByToken.sql

@@ -0,0 +1,2 @@
+-- name: RevokeRefreshTokenByToken :exec
+UPDATE refresh_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE token = $1;

sql/schema/004_refresh_tokens.sql

@@ -0,0 +1,12 @@
+-- +goose Up
+CREATE TABLE refresh_tokens(
+    token TEXT PRIMARY KEY,
+    created_at TIMESTAMP not null DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP not null DEFAULT CURRENT_TIMESTAMP,
+    user_id UUID not null REFERENCES users(id) ON DELETE CASCADE,
+    expires_at timestamp not null,
+    revoked_at timestamp default null
+);
+
+-- +goose Down
+DROP TABLE refresh_tokens;