Haelnorr
1b25e2f0a5
Simplified the database layer by removing custom interface wrappers and using standard library *sql.DB and *sql.Tx types directly. Changes: - Removed DBConnection and DBTransaction interfaces from database.go - Removed NewDBConnection() wrapper function - Updated TokenGenerator to use *sql.DB instead of DBConnection - Updated all validation and revocation methods to accept *sql.Tx - Updated TableManager to work with *sql.DB directly - Updated all tests to use db.Begin() instead of custom wrappers - Fixed GeneratorConfig.DB field (was DBConn) - Updated documentation in doc.go with correct API usage Benefits: - Simpler API with fewer abstractions - Works directly with database/sql standard library - Compatible with GORM (via gormDB.DB()) and Bun (share same *sql.DB) - Easier to understand and maintain - No unnecessary wrapper layers Breaking changes: - GeneratorConfig.DBConn renamed to GeneratorConfig.DB - Removed NewDBConnection() function - pass *sql.DB directly - ValidateAccess/ValidateRefresh now accept *sql.Tx instead of DBTransaction - Token.Revoke/CheckNotRevoked now accept *sql.Tx instead of DBTransaction 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
106 lines
3.0 KiB
Go
106 lines
3.0 KiB
Go
package jwt
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt"
|
|
"github.com/google/uuid"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
// NewAccess generates a new JWT access token for the specified subject (user).
|
|
//
|
|
// Parameters:
|
|
// - subjectID: The user ID or subject identifier to associate with the token
|
|
// - fresh: If true, marks the token as "fresh" for sensitive operations.
|
|
// Fresh tokens are typically required for actions like changing passwords
|
|
// or email addresses. The token remains fresh until FreshExpireAfter minutes.
|
|
// - rememberMe: If true, the token is persistent (TTL="exp") and will be stored
|
|
// with an expiration date. If false, it's session-only (TTL="session") and
|
|
// expires when the browser closes.
|
|
//
|
|
// Returns:
|
|
// - tokenString: The signed JWT token string
|
|
// - expiresIn: Unix timestamp when the token expires
|
|
// - err: Any error encountered during token generation
|
|
func (gen *TokenGenerator) NewAccess(
|
|
subjectID int,
|
|
fresh bool,
|
|
rememberMe bool,
|
|
) (tokenString string, expiresIn int64, err error) {
|
|
issuedAt := time.Now().Unix()
|
|
expiresAt := issuedAt + (gen.accessExpireAfter * 60)
|
|
var freshExpiresAt int64
|
|
if fresh {
|
|
freshExpiresAt = issuedAt + (gen.freshExpireAfter * 60)
|
|
} else {
|
|
freshExpiresAt = issuedAt
|
|
}
|
|
var ttl string
|
|
if rememberMe {
|
|
ttl = "exp"
|
|
} else {
|
|
ttl = "session"
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256,
|
|
jwt.MapClaims{
|
|
"iss": gen.trustedHost,
|
|
"scope": "access",
|
|
"ttl": ttl,
|
|
"jti": uuid.New(),
|
|
"iat": issuedAt,
|
|
"exp": expiresAt,
|
|
"fresh": freshExpiresAt,
|
|
"sub": subjectID,
|
|
})
|
|
|
|
signedToken, err := token.SignedString([]byte(gen.secretKey))
|
|
if err != nil {
|
|
return "", 0, errors.Wrap(err, "token.SignedString")
|
|
}
|
|
return signedToken, expiresAt, nil
|
|
}
|
|
|
|
// NewRefresh generates a new JWT refresh token for the specified subject (user).
|
|
// Refresh tokens are used to obtain new access tokens without re-authentication.
|
|
//
|
|
// Parameters:
|
|
// - subjectID: The user ID or subject identifier to associate with the token
|
|
// - rememberMe: If true, the token is persistent (TTL="exp") and will be stored
|
|
// with an expiration date. If false, it's session-only (TTL="session") and
|
|
// expires when the browser closes.
|
|
//
|
|
// Returns:
|
|
// - tokenStr: The signed JWT token string
|
|
// - exp: Unix timestamp when the token expires
|
|
// - err: Any error encountered during token generation
|
|
func (gen *TokenGenerator) NewRefresh(
|
|
subjectID int,
|
|
rememberMe bool,
|
|
) (tokenStr string, exp int64, err error) {
|
|
issuedAt := time.Now().Unix()
|
|
expiresAt := issuedAt + (gen.refreshExpireAfter * 60)
|
|
var ttl string
|
|
if rememberMe {
|
|
ttl = "exp"
|
|
} else {
|
|
ttl = "session"
|
|
}
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256,
|
|
jwt.MapClaims{
|
|
"iss": gen.trustedHost,
|
|
"scope": "refresh",
|
|
"ttl": ttl,
|
|
"jti": uuid.New(),
|
|
"iat": issuedAt,
|
|
"exp": expiresAt,
|
|
"sub": subjectID,
|
|
})
|
|
|
|
signedToken, err := token.SignedString([]byte(gen.secretKey))
|
|
if err != nil {
|
|
return "", 0, errors.Wrap(err, "token.SignedString")
|
|
}
|
|
return signedToken, expiresAt, nil
|
|
}
|