diff --git a/server/internal/auth/cookies.go b/server/internal/auth/cookies.go index 7249bad..3eb3fbb 100644 --- a/server/internal/auth/cookies.go +++ b/server/internal/auth/cookies.go @@ -3,8 +3,22 @@ package auth import ( "net/http" + "novamd/internal/logging" ) +var logger logging.Logger + +func getAuthLogger() logging.Logger { + if logger == nil { + logger = logging.WithGroup("auth") + } + return logger +} + +func getCookieLogger() logging.Logger { + return getAuthLogger().WithGroup("cookie") +} + // CookieManager interface defines methods for generating cookies type CookieManager interface { GenerateAccessTokenCookie(token string) *http.Cookie @@ -22,6 +36,8 @@ type cookieManager struct { // NewCookieService creates a new cookie service func NewCookieService(isDevelopment bool, domain string) CookieManager { + log := getCookieLogger() + secure := !isDevelopment var sameSite http.SameSite @@ -31,6 +47,11 @@ func NewCookieService(isDevelopment bool, domain string) CookieManager { sameSite = http.SameSiteStrictMode } + log.Debug("creating cookie service", + "secure", secure, + "sameSite", sameSite, + "domain", domain) + return &cookieManager{ Domain: domain, Secure: secure, @@ -40,6 +61,12 @@ func NewCookieService(isDevelopment bool, domain string) CookieManager { // GenerateAccessTokenCookie creates a new cookie for the access token func (c *cookieManager) GenerateAccessTokenCookie(token string) *http.Cookie { + log := getCookieLogger() + log.Debug("generating access token cookie", + "secure", c.Secure, + "sameSite", c.SameSite, + "maxAge", 900) + return &http.Cookie{ Name: "access_token", Value: token, @@ -53,6 +80,12 @@ func (c *cookieManager) GenerateAccessTokenCookie(token string) *http.Cookie { // GenerateRefreshTokenCookie creates a new cookie for the refresh token func (c *cookieManager) GenerateRefreshTokenCookie(token string) *http.Cookie { + log := getCookieLogger() + log.Debug("generating refresh token cookie", + "secure", c.Secure, + "sameSite", c.SameSite, + "maxAge", 604800) + return &http.Cookie{ Name: "refresh_token", Value: token, @@ -66,6 +99,13 @@ func (c *cookieManager) GenerateRefreshTokenCookie(token string) *http.Cookie { // GenerateCSRFCookie creates a new cookie for the CSRF token func (c *cookieManager) GenerateCSRFCookie(token string) *http.Cookie { + log := getCookieLogger() + log.Debug("generating CSRF cookie", + "secure", c.Secure, + "sameSite", c.SameSite, + "maxAge", 900, + "httpOnly", false) + return &http.Cookie{ Name: "csrf_token", Value: token, @@ -79,6 +119,12 @@ func (c *cookieManager) GenerateCSRFCookie(token string) *http.Cookie { // InvalidateCookie creates a new cookie with a MaxAge of -1 to invalidate the cookie func (c *cookieManager) InvalidateCookie(cookieType string) *http.Cookie { + log := getCookieLogger() + log.Debug("invalidating cookie", + "type", cookieType, + "secure", c.Secure, + "sameSite", c.SameSite) + return &http.Cookie{ Name: cookieType, Value: "", diff --git a/server/internal/auth/jwt.go b/server/internal/auth/jwt.go index 9df0de0..7746b6c 100644 --- a/server/internal/auth/jwt.go +++ b/server/internal/auth/jwt.go @@ -4,11 +4,16 @@ package auth import ( "crypto/rand" "fmt" + "novamd/internal/logging" "time" "github.com/golang-jwt/jwt/v5" ) +func getJWTLogger() logging.Logger { + return getAuthLogger().WithGroup("jwt") +} + // TokenType represents the type of JWT token (access or refresh) type TokenType string @@ -47,16 +52,26 @@ type jwtService struct { // NewJWTService creates a new JWT service with the provided configuration // Returns an error if the signing key is missing func NewJWTService(config JWTConfig) (JWTManager, error) { + log := getJWTLogger() + if config.SigningKey == "" { return nil, fmt.Errorf("signing key is required") } + // Set default expiry times if not provided if config.AccessTokenExpiry == 0 { - config.AccessTokenExpiry = 15 * time.Minute // Default to 15 minutes + config.AccessTokenExpiry = 15 * time.Minute + log.Debug("using default access token expiry", "expiry", config.AccessTokenExpiry) } if config.RefreshTokenExpiry == 0 { - config.RefreshTokenExpiry = 7 * 24 * time.Hour // Default to 7 days + config.RefreshTokenExpiry = 7 * 24 * time.Hour + log.Debug("using default refresh token expiry", "expiry", config.RefreshTokenExpiry) } + + log.Info("initialized JWT service", + "accessExpiry", config.AccessTokenExpiry, + "refreshExpiry", config.RefreshTokenExpiry) + return &jwtService{config: config}, nil } @@ -72,6 +87,7 @@ func (s *jwtService) GenerateRefreshToken(userID int, role, sessionID string) (s // generateToken is an internal helper function that creates a new JWT token func (s *jwtService) generateToken(userID int, role string, sessionID string, tokenType TokenType, expiry time.Duration) (string, error) { + log := getJWTLogger() now := time.Now() // Add a random nonce to ensure uniqueness @@ -93,11 +109,24 @@ func (s *jwtService) generateToken(userID int, role string, sessionID string, to } token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) - return token.SignedString([]byte(s.config.SigningKey)) + signedToken, err := token.SignedString([]byte(s.config.SigningKey)) + if err != nil { + return "", err + } + + log.Debug("generated JWT token", + "userId", userID, + "role", role, + "tokenType", tokenType, + "expiresAt", claims.ExpiresAt) + + return signedToken, nil } // ValidateToken validates and parses a JWT token func (s *jwtService) ValidateToken(tokenString string) (*Claims, error) { + log := getJWTLogger() + token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) { // Validate the signing method if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok { @@ -110,9 +139,16 @@ func (s *jwtService) ValidateToken(tokenString string) (*Claims, error) { return nil, fmt.Errorf("invalid token: %w", err) } - if claims, ok := token.Claims.(*Claims); ok && token.Valid { - return claims, nil + claims, ok := token.Claims.(*Claims) + if !ok || !token.Valid { + return nil, fmt.Errorf("invalid token claims") } - return nil, fmt.Errorf("invalid token claims") + log.Debug("token validated", + "userId", claims.UserID, + "role", claims.Role, + "tokenType", claims.Type, + "expiresAt", claims.ExpiresAt) + + return claims, nil } diff --git a/server/internal/auth/jwt_test.go b/server/internal/auth/jwt_test.go index 14b1a50..57b9e7e 100644 --- a/server/internal/auth/jwt_test.go +++ b/server/internal/auth/jwt_test.go @@ -8,8 +8,6 @@ import ( "novamd/internal/auth" ) -// jwt_test.go tests - func TestNewJWTService(t *testing.T) { testCases := []struct { name string diff --git a/server/internal/auth/middleware.go b/server/internal/auth/middleware.go index 6748fa3..7e8809f 100644 --- a/server/internal/auth/middleware.go +++ b/server/internal/auth/middleware.go @@ -3,10 +3,14 @@ package auth import ( "crypto/subtle" "net/http" - "novamd/internal/context" + "novamd/internal/logging" ) +func getMiddlewareLogger() logging.Logger { + return getAuthLogger().WithGroup("middleware") +} + // Middleware handles JWT authentication for protected routes type Middleware struct { jwtManager JWTManager @@ -16,6 +20,9 @@ type Middleware struct { // NewMiddleware creates a new authentication middleware func NewMiddleware(jwtManager JWTManager, sessionManager SessionManager, cookieManager CookieManager) *Middleware { + log := getMiddlewareLogger() + log.Info("initialized auth middleware") + return &Middleware{ jwtManager: jwtManager, sessionManager: sessionManager, @@ -26,7 +33,9 @@ func NewMiddleware(jwtManager JWTManager, sessionManager SessionManager, cookieM // Authenticate middleware validates JWT tokens and sets user information in context func (m *Middleware) Authenticate(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - // Extract token from Authorization header + log := getMiddlewareLogger() + + // Extract token from cookie cookie, err := r.Cookie("access_token") if err != nil { http.Error(w, "Unauthorized", http.StatusUnauthorized) @@ -82,6 +91,12 @@ func (m *Middleware) Authenticate(next http.Handler) http.Handler { UserRole: claims.Role, } + log.Debug("authentication completed", + "userId", claims.UserID, + "role", claims.Role, + "method", r.Method, + "path", r.URL.Path) + // Add context to request and continue next.ServeHTTP(w, context.WithHandlerContext(r, hctx)) }) @@ -91,6 +106,8 @@ func (m *Middleware) Authenticate(next http.Handler) http.Handler { func (m *Middleware) RequireRole(role string) func(http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + log := getMiddlewareLogger() + ctx, ok := context.GetRequestContext(w, r) if !ok { return @@ -101,6 +118,11 @@ func (m *Middleware) RequireRole(role string) func(http.Handler) http.Handler { return } + log.Debug("role requirement satisfied", + "requiredRole", role, + "userRole", ctx.UserRole, + "path", r.URL.Path) + next.ServeHTTP(w, r) }) } @@ -109,6 +131,8 @@ func (m *Middleware) RequireRole(role string) func(http.Handler) http.Handler { // RequireWorkspaceAccess returns a middleware that ensures the user has access to the workspace func (m *Middleware) RequireWorkspaceAccess(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + log := getMiddlewareLogger() + ctx, ok := context.GetRequestContext(w, r) if !ok { return @@ -126,6 +150,11 @@ func (m *Middleware) RequireWorkspaceAccess(next http.Handler) http.Handler { return } + log.Debug("workspace access granted", + "userId", ctx.UserID, + "workspaceId", ctx.Workspace.ID, + "path", r.URL.Path) + next.ServeHTTP(w, r) }) } diff --git a/server/internal/auth/session.go b/server/internal/auth/session.go index bb3df67..ca7e682 100644 --- a/server/internal/auth/session.go +++ b/server/internal/auth/session.go @@ -3,12 +3,17 @@ package auth import ( "fmt" "novamd/internal/db" + "novamd/internal/logging" "novamd/internal/models" "time" "github.com/google/uuid" ) +func getSessionLogger() logging.Logger { + return getAuthLogger().WithGroup("session") +} + // SessionManager is an interface for managing user sessions type SessionManager interface { CreateSession(userID int, role string) (*models.Session, string, error) @@ -27,6 +32,9 @@ type sessionManager struct { // NewSessionService creates a new session service with the given database and JWT manager // revive:disable:unexported-return func NewSessionService(db db.SessionStore, jwtManager JWTManager) *sessionManager { + log := getSessionLogger() + log.Info("initialized session manager") + return &sessionManager{ db: db, jwtManager: jwtManager, @@ -35,6 +43,7 @@ func NewSessionService(db db.SessionStore, jwtManager JWTManager) *sessionManage // CreateSession creates a new user session for a user with the given userID and role func (s *sessionManager) CreateSession(userID int, role string) (*models.Session, string, error) { + log := getSessionLogger() // Generate a new session ID sessionID := uuid.New().String() @@ -70,11 +79,19 @@ func (s *sessionManager) CreateSession(userID int, role string) (*models.Session return nil, "", err } + log.Debug("created new session", + "userId", userID, + "role", role, + "sessionId", sessionID, + "expiresAt", claims.ExpiresAt.Time) + return session, accessToken, nil } // RefreshSession creates a new access token using a refreshToken func (s *sessionManager) RefreshSession(refreshToken string) (string, error) { + log := getSessionLogger() + // Get session from database first session, err := s.db.GetSessionByRefreshToken(refreshToken) if err != nil { @@ -93,11 +110,22 @@ func (s *sessionManager) RefreshSession(refreshToken string) (string, error) { } // Generate a new access token - return s.jwtManager.GenerateAccessToken(claims.UserID, claims.Role, session.ID) + newToken, err := s.jwtManager.GenerateAccessToken(claims.UserID, claims.Role, session.ID) + if err != nil { + return "", err + } + + log.Debug("refreshed session", + "userId", claims.UserID, + "role", claims.Role, + "sessionId", session.ID) + + return newToken, nil } // ValidateSession checks if a session with the given sessionID is valid func (s *sessionManager) ValidateSession(sessionID string) (*models.Session, error) { + log := getSessionLogger() // Get the session from the database session, err := s.db.GetSessionByID(sessionID) @@ -105,21 +133,43 @@ func (s *sessionManager) ValidateSession(sessionID string) (*models.Session, err return nil, fmt.Errorf("failed to get session: %w", err) } + log.Debug("validated session", + "sessionId", sessionID, + "userId", session.UserID, + "expiresAt", session.ExpiresAt) + return session, nil } // InvalidateSession removes a session with the given sessionID from the database func (s *sessionManager) InvalidateSession(token string) error { + log := getSessionLogger() + // Parse the JWT to get the session info claims, err := s.jwtManager.ValidateToken(token) if err != nil { return fmt.Errorf("invalid token: %w", err) } - return s.db.DeleteSession(claims.ID) + if err := s.db.DeleteSession(claims.ID); err != nil { + return err + } + + log.Debug("invalidated session", + "sessionId", claims.ID, + "userId", claims.UserID) + + return nil } // CleanExpiredSessions removes all expired sessions from the database func (s *sessionManager) CleanExpiredSessions() error { - return s.db.CleanExpiredSessions() + log := getSessionLogger() + + if err := s.db.CleanExpiredSessions(); err != nil { + return err + } + + log.Info("cleaned expired sessions") + return nil }