Add user auth, cart, checkout and personal account for guests and registered users

internal/auth/session.go

@@ -9,27 +9,33 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/google/uuid"
 )
 
-const (
-	cookieName = "shop_session"
-	sessionTTL = 24 * time.Hour
-)
+const defaultTTL = 7 * 24 * time.Hour
 
 type Session struct {
-	secret []byte
+	secret     []byte
+	cookieName string
+	path       string
+	ttl        time.Duration
 }
 
-func NewSession(secret string) *Session {
-	return &Session{secret: []byte(secret)}
+func NewSession(secret, cookieName, path string) *Session {
+	return &Session{
+		secret:     []byte(secret),
+		cookieName: cookieName,
+		path:       path,
+		ttl:        defaultTTL,
+	}
 }
 
-func (s *Session) Create(email string) (string, error) {
-	exp := time.Now().Add(sessionTTL).Unix()
-	payload := fmt.Sprintf("%s|%d", email, exp)
+func (s *Session) Create(value string) (string, error) {
+	exp := time.Now().Add(s.ttl).Unix()
+	payload := fmt.Sprintf("%s|%d", value, exp)
 	sig := s.sign(payload)
-	token := base64.URLEncoding.EncodeToString([]byte(payload + "|" + sig))
-	return token, nil
+	return base64.URLEncoding.EncodeToString([]byte(payload + "|" + sig)), nil
 }
 
 func (s *Session) Validate(token string) (string, bool) {
@@ -37,67 +43,93 @@ func (s *Session) Validate(token string) (string, bool) {
 	if err != nil {
 		return "", false
 	}
-
 	parts := strings.Split(string(raw), "|")
 	if len(parts) != 3 {
 		return "", false
 	}
-
-	email, expStr, sig := parts[0], parts[1], parts[2]
-	payload := email + "|" + expStr
-
+	value, expStr, sig := parts[0], parts[1], parts[2]
+	payload := value + "|" + expStr
 	if !hmac.Equal([]byte(sig), []byte(s.sign(payload))) {
 		return "", false
 	}
-
 	exp, err := strconv.ParseInt(expStr, 10, 64)
 	if err != nil || time.Now().Unix() > exp {
 		return "", false
 	}
-
-	return email, true
+	return value, true
 }
 
 func (s *Session) SetCookie(w http.ResponseWriter, r *http.Request, token string) {
 	http.SetCookie(w, &http.Cookie{
-		Name:     cookieName,
+		Name:     s.cookieName,
 		Value:    token,
-		Path:     "/admin",
+		Path:     s.path,
 		HttpOnly: true,
-		Secure:   s.isSecure(r),
+		Secure:   isSecure(r),
 		SameSite: http.SameSiteLaxMode,
-		MaxAge:   int(sessionTTL.Seconds()),
+		MaxAge:   int(s.ttl.Seconds()),
 	})
 }
 
 func (s *Session) ClearCookie(w http.ResponseWriter, r *http.Request) {
 	http.SetCookie(w, &http.Cookie{
-		Name:     cookieName,
+		Name:     s.cookieName,
 		Value:    "",
-		Path:     "/admin",
+		Path:     s.path,
 		HttpOnly: true,
-		Secure:   s.isSecure(r),
+		Secure:   isSecure(r),
 		MaxAge:   -1,
 	})
 }
 
-func (s *Session) isSecure(r *http.Request) bool {
-	if r.TLS != nil {
-		return true
-	}
-	return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
-}
-
 func (s *Session) FromRequest(r *http.Request) (string, bool) {
-	c, err := r.Cookie(cookieName)
+	c, err := r.Cookie(s.cookieName)
 	if err != nil {
 		return "", false
 	}
 	return s.Validate(c.Value)
 }
 
+func (s *Session) EnsureKey(w http.ResponseWriter, r *http.Request) string {
+	if key, ok := s.FromRequest(r); ok && key != "" {
+		return key
+	}
+	key := uuid.New().String()
+	token, _ := s.Create(key)
+	s.SetCookie(w, r, token)
+	return key
+}
+
 func (s *Session) sign(payload string) string {
 	mac := hmac.New(sha256.New, s.secret)
 	mac.Write([]byte(payload))
 	return base64.URLEncoding.EncodeToString(mac.Sum(nil))
 }
+
+func isSecure(r *http.Request) bool {
+	if r.TLS != nil {
+		return true
+	}
+	return strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https")
+}
+
+func UserIDFromSession(s *Session, r *http.Request) (int, bool) {
+	val, ok := s.FromRequest(r)
+	if !ok {
+		return 0, false
+	}
+	if !strings.HasPrefix(val, "user:") {
+		return 0, false
+	}
+	id, err := strconv.Atoi(strings.TrimPrefix(val, "user:"))
+	return id, err == nil && id > 0
+}
+
+func SetUserSession(s *Session, w http.ResponseWriter, r *http.Request, userID int) error {
+	token, err := s.Create(fmt.Sprintf("user:%d", userID))
+	if err != nil {
+		return err
+	}
+	s.SetCookie(w, r, token)
+	return nil
+}