Refactor authentication handler

Signed-off-by: gearnode <bryan@frimin.fr>

pkg/probod/auth_config.go

@@ -21,53 +21,57 @@ import (
 
 type (
 	authConfig struct {
-		// Pepper is a secret key used for password hashing
-		// It should be at least 32 bytes long
-		Pepper          string `json:"pepper"`
-		SessionDuration int    `json:"session-duration"`
-		CookieName      string `json:"cookie-name"`
-		CookieSecure    bool   `json:"cookie-secure"`
-		CookieHTTPOnly  bool   `json:"cookie-http-only"`
-		CookieDomain    string `json:"cookie-domain"`
-		CookiePath      string `json:"cookie-path"`
-		CookieSecret string `json:"cookie-secret"`
+		Cookie   cookieConfig   `json:"cookie"`
+		Password passwordConfig `json:"password"`
+	}
+
+	cookieConfig struct {
+		Domain   string `json:"domain"`
+		Secret   string `json:"secret"`
+		Duration int    `json:"duration"`
+		Name     string `json:"name"`
+	}
+
+	passwordConfig struct {
+		Iterations uint32 `json:"iterations"`
+		Pepper     string `json:"pepper"`
 	}
 )
 
 func (c authConfig) GetPepperBytes() ([]byte, error) {
-	if c.Pepper == "" {
+	if c.Password.Pepper == "" {
 		return nil, fmt.Errorf("pepper cannot be empty")
 	}
 
-	if decoded, err := base64.StdEncoding.DecodeString(c.Pepper); err == nil {
+	if decoded, err := base64.StdEncoding.DecodeString(c.Password.Pepper); err == nil {
 		if len(decoded) < 32 {
 			return nil, fmt.Errorf("decoded pepper must be at least 32 bytes long")
 		}
 		return decoded, nil
 	}
 
-	if len(c.Pepper) < 32 {
+	if len(c.Password.Pepper) < 32 {
 		return nil, fmt.Errorf("pepper must be at least 32 bytes long")
 	}
 
-	return []byte(c.Pepper), nil
+	return []byte(c.Password.Pepper), nil
 }
 
 func (c authConfig) GetCookieSecretBytes() ([]byte, error) {
-	if c.CookieSecret == "" {
+	if c.Cookie.Secret == "" {
 		return nil, fmt.Errorf("cookie secret cannot be empty")
 	}
 
-	if decoded, err := base64.StdEncoding.DecodeString(c.CookieSecret); err == nil {
+	if decoded, err := base64.StdEncoding.DecodeString(c.Cookie.Secret); err == nil {
 		if len(decoded) < 32 {
 			return nil, fmt.Errorf("decoded cookie secret must be at least 32 bytes long")
 		}
 		return decoded, nil
 	}
 
-	if len(c.CookieSecret) < 32 {
+	if len(c.Cookie.Secret) < 32 {
 		return nil, fmt.Errorf("cookie secret must be at least 32 bytes long")
 	}
 
-	return []byte(c.CookieSecret), nil
+	return []byte(c.Cookie.Secret), nil
 }

pkg/probod/probod.go

@@ -26,6 +26,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/getprobo/probo/pkg/awsconfig"
 	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/crypto/passwdhash"
 	"github.com/getprobo/probo/pkg/probo"
 	"github.com/getprobo/probo/pkg/server"
 	console_v1 "github.com/getprobo/probo/pkg/server/api/console/v1"
@@ -75,14 +76,16 @@ func New() *Implm {
 				PoolSize: 100,
 			},
 			Auth: authConfig{
-				Pepper:          "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes",
-				SessionDuration: 24,
-				CookieName:      "SSID",
-				CookieSecure:    false,
-				CookieHTTPOnly:  true,
-				CookieDomain:    "localhost",
-				CookiePath:      "/",
-				CookieSecret:    "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes",
+				Password: passwordConfig{
+					Pepper:     "this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes",
+					Iterations: 1000000,
+				},
+				Cookie: cookieConfig{
+					Name:     "SSID",
+					Secret:   "this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes",
+					Duration: 24,
+					Domain:   "localhost",
+				},
 			},
 			AWS: awsConfig{
 				Region:          "us-east-1",
@@ -153,7 +156,12 @@ func (impl *Implm) Run(
 		return fmt.Errorf("cannot migrate database schema: %w", err)
 	}
 
-	usrmgrService, err := usrmgr.NewService(ctx, pgClient, pepper)
+	hp, err := passwdhash.NewProfile(pepper, uint32(impl.cfg.Auth.Password.Iterations))
+	if err != nil {
+		return fmt.Errorf("cannot create hashing profile: %w", err)
+	}
+
+	usrmgrService, err := usrmgr.NewService(ctx, pgClient, hp)
 	if err != nil {
 		return fmt.Errorf("cannot create usrmgr service: %w", err)
 	}
@@ -169,13 +177,10 @@ func (impl *Implm) Run(
 			Probo:          proboService,
 			Usrmgr:         usrmgrService,
 			Auth: console_v1.AuthConfig{
-				CookieName:      impl.cfg.Auth.CookieName,
-				CookieSecure:    impl.cfg.Auth.CookieSecure,
-				CookieHTTPOnly:  impl.cfg.Auth.CookieHTTPOnly,
-				CookieDomain:    impl.cfg.Auth.CookieDomain,
-				CookiePath:      impl.cfg.Auth.CookiePath,
-				SessionDuration: time.Duration(impl.cfg.Auth.SessionDuration) * time.Hour,
-				CookieSecret:    impl.cfg.Auth.CookieSecret,
+				CookieName:      impl.cfg.Auth.Cookie.Name,
+				CookieDomain:    impl.cfg.Auth.Cookie.Domain,
+				SessionDuration: time.Duration(impl.cfg.Auth.Cookie.Duration) * time.Hour,
+				CookieSecret:    impl.cfg.Auth.Cookie.Secret,
 			},
 		},
 	)