Add Go rewrite with Postgres 17 and Dokploy Docker Compose

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-27 08:21:21 +03:00
parent bac78dd3fc
commit 99a27f00be
67 changed files with 17864 additions and 0 deletions
@@ -0,0 +1,289 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"amnezia-share/internal/models"
+)
+
+// OIDCConfig holds the Pocket ID SSO settings (see settings.KeyPocketURL /
+// KeyPocketClientID / KeyPocketSecret in internal/settings).
+type OIDCConfig struct {
+	URL          string
+	ClientID     string
+	ClientSecret string
+}
+
+// Configured reports whether all three OIDC settings are present.
+func (c OIDCConfig) Configured() bool {
+	return strings.TrimSpace(c.URL) != "" && strings.TrimSpace(c.ClientID) != "" && strings.TrimSpace(c.ClientSecret) != ""
+}
+
+func (c OIDCConfig) baseURL() string {
+	return strings.TrimRight(strings.TrimSpace(c.URL), "/")
+}
+
+// GenerateState returns a random hex CSRF state value for the OIDC authorize
+// request.
+func GenerateState() (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%x", b), nil
+}
+
+// GeneratePKCE returns a PKCE code_verifier and its S256 code_challenge
+// (RFC 7636), both base64url-encoded without padding.
+func GeneratePKCE() (verifier, challenge string, err error) {
+	raw := make([]byte, 32)
+	if _, err = rand.Read(raw); err != nil {
+		return "", "", err
+	}
+	verifier = base64.RawURLEncoding.EncodeToString(raw)
+	sum := sha256.Sum256([]byte(verifier))
+	challenge = base64.RawURLEncoding.EncodeToString(sum[:])
+	return verifier, challenge, nil
+}
+
+// AuthURL builds the Pocket ID /authorize URL for the PKCE S256 authorization-code
+// flow.
+func AuthURL(cfg OIDCConfig, redirectURI, state, codeChallenge string) string {
+	q := url.Values{}
+	q.Set("response_type", "code")
+	q.Set("client_id", cfg.ClientID)
+	q.Set("redirect_uri", redirectURI)
+	q.Set("scope", "openid profile email")
+	q.Set("state", state)
+	q.Set("code_challenge", codeChallenge)
+	q.Set("code_challenge_method", "S256")
+	return cfg.baseURL() + "/authorize?" + q.Encode()
+}
+
+// UserInfo is the subset of the OIDC userinfo response we care about.
+type UserInfo struct {
+	PreferredUsername string
+	Name              string
+	Email             string
+	Sub               string
+}
+
+// LookupName picks the identifier used to match against the local users table:
+// preferred_username, then name, then email, then sub.
+func (u UserInfo) LookupName() string {
+	switch {
+	case u.PreferredUsername != "":
+		return u.PreferredUsername
+	case u.Name != "":
+		return u.Name
+	case u.Email != "":
+		return u.Email
+	default:
+		return u.Sub
+	}
+}
+
+var httpClientOIDC = &http.Client{Timeout: 15 * time.Second}
+
+// ExchangeAndUserinfo exchanges an authorization code for an access token and
+// fetches the user profile. It mirrors the Pocket ID quirks handled by the PHP
+// implementation:
+//   - token endpoint tried at /api/oidc/token first, then /token,
+//   - for each endpoint, Basic auth (client_id:client_secret) is tried first, then
+//     falls back to client_id/client_secret in the POST body,
+//   - userinfo endpoint tried at /api/oidc/userinfo first, then /userinfo.
+func ExchangeAndUserinfo(ctx context.Context, cfg OIDCConfig, code, redirectURI, codeVerifier string) (UserInfo, error) {
+	base := cfg.baseURL()
+	tokenEndpoints := []string{base + "/api/oidc/token", base + "/token"}
+	basicAuth := base64.StdEncoding.EncodeToString([]byte(cfg.ClientID + ":" + cfg.ClientSecret))
+
+	var accessToken string
+	var lastTokenErr error
+	for _, endpoint := range tokenEndpoints {
+		fields := url.Values{
+			"grant_type":   {"authorization_code"},
+			"code":         {code},
+			"redirect_uri": {redirectURI},
+		}
+		if codeVerifier != "" {
+			fields.Set("code_verifier", codeVerifier)
+		}
+		if tok, err := postTokenRequest(ctx, endpoint, fields, map[string]string{"Authorization": "Basic " + basicAuth}); err == nil && tok != "" {
+			accessToken = tok
+			break
+		} else if err != nil {
+			lastTokenErr = err
+		}
+
+		fieldsSecret := url.Values{
+			"grant_type":    {"authorization_code"},
+			"code":          {code},
+			"redirect_uri":  {redirectURI},
+			"client_id":     {cfg.ClientID},
+			"client_secret": {cfg.ClientSecret},
+		}
+		if codeVerifier != "" {
+			fieldsSecret.Set("code_verifier", codeVerifier)
+		}
+		if tok, err := postTokenRequest(ctx, endpoint, fieldsSecret, nil); err == nil && tok != "" {
+			accessToken = tok
+			break
+		} else if err != nil {
+			lastTokenErr = err
+		}
+	}
+	if accessToken == "" {
+		if lastTokenErr != nil {
+			return UserInfo{}, fmt.Errorf("Pocket ID не вернул access_token: %w", lastTokenErr)
+		}
+		return UserInfo{}, errors.New("Pocket ID не вернул access_token.")
+	}
+
+	userinfoEndpoints := []string{base + "/api/oidc/userinfo", base + "/userinfo"}
+	var raw map[string]any
+	var lastErr error
+	for _, endpoint := range userinfoEndpoints {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		req.Header.Set("Authorization", "Bearer "+accessToken)
+		req.Header.Set("Accept", "application/json")
+		resp, err := httpClientOIDC.Do(req)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		_ = resp.Body.Close()
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			lastErr = fmt.Errorf("userinfo HTTP %d", resp.StatusCode)
+			continue
+		}
+		if err := json.Unmarshal(body, &raw); err != nil {
+			lastErr = err
+			continue
+		}
+		lastErr = nil
+		break
+	}
+	if raw == nil {
+		if lastErr == nil {
+			lastErr = errors.New("нет ответа")
+		}
+		return UserInfo{}, fmt.Errorf("не удалось получить профиль от Pocket ID: %w", lastErr)
+	}
+
+	info := UserInfo{
+		PreferredUsername: strings.TrimSpace(stringAny(raw["preferred_username"])),
+		Name:              strings.TrimSpace(stringAny(raw["name"])),
+		Email:             strings.TrimSpace(stringAny(raw["email"])),
+		Sub:               strings.TrimSpace(stringAny(raw["sub"])),
+	}
+	if info.Sub == "" && info.PreferredUsername == "" && info.Name == "" && info.Email == "" {
+		return UserInfo{}, errors.New("Pocket ID не вернул идентификатор пользователя.")
+	}
+	return info, nil
+}
+
+func stringAny(v any) string {
+	if s, ok := v.(string); ok {
+		return s
+	}
+	return ""
+}
+
+func postTokenRequest(ctx context.Context, endpoint string, fields url.Values, headers map[string]string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, strings.NewReader(fields.Encode()))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+
+	resp, err := httpClientOIDC.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("token HTTP %d", resp.StatusCode)
+	}
+	var dec map[string]any
+	if err := json.Unmarshal(body, &dec); err != nil {
+		return "", err
+	}
+	tok, _ := dec["access_token"].(string)
+	tok = strings.TrimSpace(tok)
+	if tok == "" {
+		return "", errors.New("нет access_token в ответе")
+	}
+	return tok, nil
+}
+
+// FindOrCreateAdminFromOIDC matches the Pocket ID profile to an existing admin by
+// username (preferred_username/name/email/sub, in that priority) or by e-mail.
+// If no admin exists yet at all, the very first successful OIDC login
+// auto-provisions the sole admin account (with a random, never-used local
+// password). Otherwise, an unmatched profile is rejected.
+func (r *Repo) FindOrCreateAdminFromOIDC(ctx context.Context, info UserInfo) (*models.User, error) {
+	lookupName := info.LookupName()
+	if lookupName == "" {
+		return nil, errors.New("Pocket ID не вернул идентификатор пользователя.")
+	}
+
+	admin, err := r.GetAdminByUsername(ctx, lookupName)
+	if err != nil {
+		return nil, err
+	}
+	if admin == nil && info.Email != "" {
+		admin, err = r.GetAdminByUsername(ctx, info.Email)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if admin == nil {
+		count, err := r.AdminCount(ctx)
+		if err != nil {
+			return nil, err
+		}
+		if count != 0 {
+			return nil, fmt.Errorf("пользователь %q не зарегистрирован как администратор", lookupName)
+		}
+
+		randomPass := make([]byte, 32)
+		if _, err := rand.Read(randomPass); err != nil {
+			return nil, err
+		}
+		hash, err := HashPassword(fmt.Sprintf("%x", randomPass))
+		if err != nil {
+			return nil, err
+		}
+		admin, err = r.registerAdminWithHash(ctx, lookupName, hash)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if admin.Role != "admin" {
+		return nil, errors.New("Учётная запись не является администратором.")
+	}
+	return admin, nil
+}