Initialize CMS application scaffold

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/web/handlers.go

@@ -0,0 +1,163 @@
+package web
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"github.com/example/cms/internal/identity"
+	"github.com/example/cms/internal/service"
+	"github.com/example/cms/internal/web/mapping"
+	"net/http"
+	"strings"
+)
+
+type Handler struct {
+	auth   *service.AuthService
+	google identity.GoogleProvider
+}
+
+func NewHandler(a *service.AuthService, google identity.GoogleProvider) *Handler {
+	return &Handler{auth: a, google: google}
+}
+func (h *Handler) Routes(origins string) http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) { jsonWrite(w, 200, map[string]string{"status": "ok"}) })
+	mux.HandleFunc("/api/login", h.login)
+	mux.HandleFunc("/api/auth/google", h.googleLogin)
+	mux.HandleFunc("/api/auth/google/callback", h.googleCallback)
+	mux.HandleFunc("/api/auth/session", h.session)
+	mux.HandleFunc("/admin/login", h.adminLogin)
+	mux.HandleFunc("/api/test/protected", h.protected)
+	return cors(mux, origins)
+}
+func (h *Handler) googleLogin(w http.ResponseWriter, r *http.Request) {
+	if h.google.ClientID == "" {
+		jsonWrite(w, http.StatusServiceUnavailable, map[string]string{"error": "google identity provider is not configured"})
+		return
+	}
+	stateBytes := make([]byte, 32)
+	if _, err := rand.Read(stateBytes); err != nil {
+		jsonWrite(w, http.StatusInternalServerError, map[string]string{"error": "unable to create oauth state"})
+		return
+	}
+	state := base64.RawURLEncoding.EncodeToString(stateBytes)
+	http.SetCookie(w, &http.Cookie{Name: "oauth_state", Value: state, HttpOnly: true, Secure: r.TLS != nil, SameSite: http.SameSiteLaxMode, Path: "/", MaxAge: 600})
+	http.Redirect(w, r, h.google.OAuthConfig().AuthCodeURL(state), http.StatusFound)
+}
+func (h *Handler) googleCallback(w http.ResponseWriter, r *http.Request) {
+	stateCookie, err := r.Cookie("oauth_state")
+	if err != nil || stateCookie.Value == "" || stateCookie.Value != r.URL.Query().Get("state") {
+		http.Error(w, "invalid oauth state", http.StatusBadRequest)
+		return
+	}
+	id, err := h.google.FetchIdentity(r.Context(), r.URL.Query().Get("code"))
+	if err != nil {
+		http.Error(w, "google authentication failed", http.StatusUnauthorized)
+		return
+	}
+	user, token, err := h.auth.Login(r.Context(), id)
+	if err != nil {
+		http.Error(w, "unable to create session", http.StatusInternalServerError)
+		return
+	}
+	setSessionCookie(w, token, r.TLS != nil)
+	_ = user
+	http.Redirect(w, r, "/test", http.StatusFound)
+}
+func (h *Handler) session(w http.ResponseWriter, r *http.Request) {
+	token := bearerOrCookie(r)
+	if token == "" {
+		jsonWrite(w, http.StatusUnauthorized, map[string]string{"authenticated": "false"})
+		return
+	}
+	s, err := h.auth.Authenticate(r.Context(), token)
+	if err != nil || s.UserID == nil {
+		jsonWrite(w, http.StatusUnauthorized, map[string]string{"authenticated": "false"})
+		return
+	}
+	jsonWrite(w, http.StatusOK, map[string]bool{"authenticated": true})
+}
+func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
+	if r.Method != "POST" {
+		jsonWrite(w, 405, nil)
+		return
+	}
+	var req mapping.LoginRequest
+	if !decode(r, &req) {
+		jsonWrite(w, 400, map[string]string{"error": "invalid JSON"})
+		return
+	}
+	u, t, e := h.auth.Login(r.Context(), req.Identity())
+	if e != nil {
+		jsonWrite(w, 400, map[string]string{"error": e.Error()})
+		return
+	}
+	jsonWrite(w, 200, mapping.LoginResponse{Token: t, User: u})
+}
+func (h *Handler) adminLogin(w http.ResponseWriter, r *http.Request) {
+	if r.Method != "POST" {
+		jsonWrite(w, 405, nil)
+		return
+	}
+	var req struct {
+		Email string `json:"email"`
+	}
+	if !decode(r, &req) {
+		jsonWrite(w, 400, map[string]string{"error": "invalid JSON"})
+		return
+	}
+	a, t, e := h.auth.AdminLogin(r.Context(), req.Email)
+	if e != nil {
+		jsonWrite(w, 401, map[string]string{"error": e.Error()})
+		return
+	}
+	jsonWrite(w, 200, mapping.LoginResponse{Token: t, Admin: a})
+}
+func (h *Handler) protected(w http.ResponseWriter, r *http.Request) {
+	t := bearerOrCookie(r)
+	if t == "" {
+		jsonWrite(w, 401, map[string]string{"error": "missing bearer token"})
+		return
+	}
+	s, e := h.auth.Authenticate(r.Context(), t)
+	if e != nil || s.UserID == nil {
+		jsonWrite(w, 401, map[string]string{"error": "invalid session"})
+		return
+	}
+	jsonWrite(w, 200, map[string]string{"status": "authenticated"})
+}
+func bearerOrCookie(r *http.Request) string {
+	header := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
+	if header != "" {
+		return header
+	}
+	cookie, err := r.Cookie("cms_session")
+	if err != nil {
+		return ""
+	}
+	return cookie.Value
+}
+func setSessionCookie(w http.ResponseWriter, token string, secure bool) {
+	http.SetCookie(w, &http.Cookie{Name: "cms_session", Value: token, HttpOnly: true, Secure: secure, SameSite: http.SameSiteLaxMode, Path: "/", MaxAge: 86400})
+}
+func decode(r *http.Request, v any) bool { return json.NewDecoder(r.Body).Decode(v) == nil }
+func jsonWrite(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if v != nil {
+		_ = json.NewEncoder(w).Encode(v)
+	}
+}
+func cors(next http.Handler, origin string) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", origin)
+		w.Header().Set("Vary", "Origin")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+		if r.Method == "OPTIONS" {
+			w.WriteHeader(204)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}