david
bbe0757ab6
Implement complete refresh token flow for improved security: - Short-lived access tokens (configurable, default 1h) - Long-lived refresh tokens (configurable, default 7d) - Automatic token rotation on refresh - Token revocation for proper logout Domain layer: - Add RefreshToken entity with validation and revocation - Add RefreshTokenRepository interface Application layer: - Add RefreshTokenHandler for token refresh operations - Add RevokeTokenHandler for single token revocation - Add RevokeAllTokensHandler for user-wide revocation Infrastructure layer: - Implement SQLite RefreshTokenRepository - Add refresh_tokens table migration with indexes - Add parseDuration helper for flexible time configuration HTTP layer: - Add POST /api/v1/auth/refresh endpoint - Add POST /api/v1/auth/logout endpoint - Update login/register to return refresh tokens - Improve Swagger documentation with clear descriptions Configuration: - Update .env.example with secure token expiry defaults - Add support for minute/hour/day duration formats Tests: - Fix test suite to work with new signatures - All existing tests passing
107 lines
3.6 KiB
Go
107 lines
3.6 KiB
Go
package http
|
|
|
|
import (
|
|
"bytes"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"apocapoc-api/internal/application/commands"
|
|
"apocapoc-api/internal/application/queries"
|
|
"apocapoc-api/internal/infrastructure/auth"
|
|
"apocapoc-api/internal/infrastructure/crypto"
|
|
"apocapoc-api/internal/infrastructure/persistence/sqlite"
|
|
|
|
_ "github.com/mattn/go-sqlite3"
|
|
)
|
|
|
|
type TestServer struct {
|
|
Router *http.Handler
|
|
DB *sql.DB
|
|
}
|
|
|
|
func setupTestServer(t *testing.T) *TestServer {
|
|
db, err := sql.Open("sqlite3", ":memory:")
|
|
if err != nil {
|
|
t.Fatalf("Failed to open test database: %v", err)
|
|
}
|
|
|
|
if err := sqlite.RunMigrations(db); err != nil {
|
|
t.Fatalf("Failed to run migrations: %v", err)
|
|
}
|
|
|
|
jwtService := auth.NewJWTService("test-secret", 24)
|
|
passwordHasher := crypto.NewBcryptHasher()
|
|
|
|
userRepo := sqlite.NewUserRepository(db)
|
|
habitRepo := sqlite.NewHabitRepository(db)
|
|
entryRepo := sqlite.NewHabitEntryRepository(db)
|
|
refreshTokenRepo := sqlite.NewRefreshTokenRepository(db)
|
|
|
|
registerHandler := commands.NewRegisterUserHandler(userRepo, passwordHasher)
|
|
loginHandler := queries.NewLoginUserHandler(userRepo, passwordHasher)
|
|
refreshTokenHandler := queries.NewRefreshTokenHandler(refreshTokenRepo, userRepo)
|
|
revokeTokenHandler := commands.NewRevokeTokenHandler(refreshTokenRepo)
|
|
revokeAllTokensHandler := commands.NewRevokeAllTokensHandler(refreshTokenRepo)
|
|
createHandler := commands.NewCreateHabitHandler(habitRepo)
|
|
getTodaysHandler := queries.NewGetTodaysHabitsHandler(habitRepo, entryRepo)
|
|
getUserHabitsHandler := queries.NewGetUserHabitsHandler(habitRepo)
|
|
getHabitByIDHandler := queries.NewGetHabitByIDHandler(habitRepo)
|
|
getHabitEntriesHandler := queries.NewGetHabitEntriesHandler(habitRepo, entryRepo)
|
|
getHabitStatsHandler := queries.NewGetHabitStatsHandler(habitRepo, entryRepo)
|
|
updateHandler := commands.NewUpdateHabitHandler(habitRepo)
|
|
archiveHandler := commands.NewArchiveHabitHandler(habitRepo)
|
|
markHandler := commands.NewMarkHabitHandler(entryRepo, habitRepo)
|
|
unmarkHandler := commands.NewUnmarkHabitHandler(habitRepo, entryRepo)
|
|
|
|
refreshTokenExpiry := 7 * 24 * time.Hour
|
|
|
|
authHandlers := NewAuthHandlers(registerHandler, loginHandler, refreshTokenHandler, revokeTokenHandler, revokeAllTokensHandler, jwtService, refreshTokenRepo, refreshTokenExpiry)
|
|
habitHandlers := NewHabitHandlers(createHandler, getTodaysHandler, getUserHabitsHandler, getHabitByIDHandler, getHabitEntriesHandler, updateHandler, archiveHandler, markHandler, unmarkHandler)
|
|
statsHandlers := NewStatsHandlers(getHabitStatsHandler)
|
|
healthHandlers := NewHealthHandlers(db)
|
|
|
|
router := NewRouter("*", habitHandlers, authHandlers, statsHandlers, healthHandlers, jwtService)
|
|
|
|
handler := http.Handler(router)
|
|
return &TestServer{
|
|
Router: &handler,
|
|
DB: db,
|
|
}
|
|
}
|
|
|
|
func (ts *TestServer) Close() {
|
|
ts.DB.Close()
|
|
}
|
|
|
|
func makeRequest(t *testing.T, handler http.Handler, method, path string, body interface{}, authToken string) *httptest.ResponseRecorder {
|
|
var bodyBytes []byte
|
|
if body != nil {
|
|
var err error
|
|
bodyBytes, err = json.Marshal(body)
|
|
if err != nil {
|
|
t.Fatalf("Failed to marshal request body: %v", err)
|
|
}
|
|
}
|
|
|
|
req := httptest.NewRequest(method, path, bytes.NewReader(bodyBytes))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
if authToken != "" {
|
|
req.Header.Set("Authorization", "Bearer "+authToken)
|
|
}
|
|
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
return rr
|
|
}
|
|
|
|
func decodeResponse(t *testing.T, rr *httptest.ResponseRecorder, target interface{}) {
|
|
if err := json.NewDecoder(rr.Body).Decode(target); err != nil {
|
|
t.Fatalf("Failed to decode response: %v", err)
|
|
}
|
|
}
|