第1章：认证与授权基础

package session

import (
	"crypto/rand"
	"encoding/hex"
	"sync"
	"time"
)

// Session结构
type Session struct {
	ID        string
	UserID    int
	CreatedAt time.Time
	ExpiresAt time.Time
}

// SessionManager Session管理器
type SessionManager struct {
	sessions map[string]*Session
	mu       sync.RWMutex
}

// NewSessionManager 创建Session管理器
func NewSessionManager() *SessionManager {
	sm := &SessionManager{
		sessions: make(map[string]*Session),
	}

	// 定期清理过期Session
	go sm.cleanupExpiredSessions()

	return sm
}

// CreateSession 创建Session
func (sm *SessionManager) CreateSession(userID int, duration time.Duration) (*Session, error) {
	// 生成随机SessionID
	sessionID, err := generateSessionID()
	if err != nil {
		return nil, err
	}

	session := &Session{
		ID:        sessionID,
		UserID:    userID,
		CreatedAt: time.Now(),
		ExpiresAt: time.Now().Add(duration),
	}

	sm.mu.Lock()
	sm.sessions[sessionID] = session
	sm.mu.Unlock()

	return session, nil
}

// GetSession 获取Session
func (sm *SessionManager) GetSession(sessionID string) (*Session, bool) {
	sm.mu.RLock()
	defer sm.mu.RUnlock()

	session, exists := sm.sessions[sessionID]
	if !exists {
		return nil, false
	}

	// 检查是否过期
	if time.Now().After(session.ExpiresAt) {
		return nil, false
	}

	return session, true
}

// DeleteSession 删除Session
func (sm *SessionManager) DeleteSession(sessionID string) {
	sm.mu.Lock()
	delete(sm.sessions, sessionID)
	sm.mu.Unlock()
}

// 生成SessionID
func generateSessionID() (string, error) {
	bytes := make([]byte, 32)
	if _, err := rand.Read(bytes); err != nil {
		return "", err
	}
	return hex.EncodeToString(bytes), nil
}

// 清理过期Session
func (sm *SessionManager) cleanupExpiredSessions() {
	ticker := time.NewTicker(10 * time.Minute)
	defer ticker.Stop()

	for range ticker.C {
		sm.mu.Lock()
		for id, session := range sm.sessions {
			if time.Now().After(session.ExpiresAt) {
				delete(sm.sessions, id)
			}
		}
		sm.mu.Unlock()
	}
}

package handler

import (
	"encoding/json"
	"net/http"
	"time"
)

type AuthHandler struct {
	sessionManager *session.SessionManager
	userService    *service.UserService
}

func NewAuthHandler(sm *session.SessionManager, us *service.UserService) *AuthHandler {
	return &AuthHandler{
		sessionManager: sm,
		userService:    us,
	}
}

// Login 登录
func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Username string `json:"username"`
		Password string `json:"password"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "Invalid request", http.StatusBadRequest)
		return
	}

	// 1. 验证用户名密码
	user, err := h.userService.Authenticate(req.Username, req.Password)
	if err != nil {
		http.Error(w, "Invalid credentials", http.StatusUnauthorized)
		return
	}

	// 2. 创建Session（7天有效期）
	sess, err := h.sessionManager.CreateSession(user.ID, 7*24*time.Hour)
	if err != nil {
		http.Error(w, "Failed to create session", http.StatusInternalServerError)
		return
	}

	// 3. 设置Cookie
	http.SetCookie(w, &http.Cookie{
		Name:     "sessionid",
		Value:    sess.ID,
		Path:     "/",
		HttpOnly: true,  // 防止XSS
		Secure:   true,  // 仅HTTPS传输
		SameSite: http.SameSiteStrictMode,  // 防止CSRF
		MaxAge:   7 * 24 * 3600,
	})

	// 4. 返回成功
	json.NewEncoder(w).Encode(map[string]interface{}{
		"message": "Login successful",
		"user": map[string]interface{}{
			"id":       user.ID,
			"username": user.Username,
		},
	})
}

// Logout 登出
func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) {
	// 1. 获取SessionID
	cookie, err := r.Cookie("sessionid")
	if err != nil {
		http.Error(w, "Not logged in", http.StatusUnauthorized)
		return
	}

	// 2. 删除Session
	h.sessionManager.DeleteSession(cookie.Value)

	// 3. 清除Cookie
	http.SetCookie(w, &http.Cookie{
		Name:     "sessionid",
		Value:    "",
		Path:     "/",
		MaxAge:   -1,  // 立即过期
		HttpOnly: true,
		Secure:   true,
	})

	json.NewEncoder(w).Encode(map[string]string{
		"message": "Logout successful",
	})
}

// AuthMiddleware 认证中间件
func (h *AuthHandler) AuthMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// 1. 获取SessionID
		cookie, err := r.Cookie("sessionid")
		if err != nil {
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}

		// 2. 验证Session
		session, exists := h.sessionManager.GetSession(cookie.Value)
		if !exists {
			http.Error(w, "Invalid or expired session", http.StatusUnauthorized)
			return
		}

		// 3. 将用户信息存入Context
		ctx := context.WithValue(r.Context(), "userID", session.UserID)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

package jwt

import (
	"errors"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

var (
	// JWT密钥（生产环境从环境变量读取）
	jwtSecret = []byte("your-secret-key-change-in-production")

	ErrInvalidToken = errors.New("invalid token")
	ErrExpiredToken = errors.New("token has expired")
)

// Claims JWT声明
type Claims struct {
	UserID   int    `json:"userId"`
	Username string `json:"username"`
	jwt.RegisteredClaims
}

// GenerateToken 生成JWT Token
func GenerateToken(userID int, username string, duration time.Duration) (string, error) {
	now := time.Now()
	expiresAt := now.Add(duration)

	claims := Claims{
		UserID:   userID,
		Username: username,
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(expiresAt),
			IssuedAt:  jwt.NewNumericDate(now),
			NotBefore: jwt.NewNumericDate(now),
			Issuer:    "myapp",
		},
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(jwtSecret)
}

// ParseToken 解析JWT Token
func ParseToken(tokenString string) (*Claims, error) {
	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
		return jwtSecret, nil
	})

	if err != nil {
		if errors.Is(err, jwt.ErrTokenExpired) {
			return nil, ErrExpiredToken
		}
		return nil, ErrInvalidToken
	}

	if claims, ok := token.Claims.(*Claims); ok && token.Valid {
		return claims, nil
	}

	return nil, ErrInvalidToken
}

// RefreshToken 刷新Token
func RefreshToken(tokenString string, duration time.Duration) (string, error) {
	claims, err := ParseToken(tokenString)
	if err != nil && !errors.Is(err, ErrExpiredToken) {
		return "", err
	}

	// 重新生成Token
	return GenerateToken(claims.UserID, claims.Username, duration)
}

package handler

import (
	"encoding/json"
	"net/http"
	"strings"
	"time"
)

type JWTAuthHandler struct {
	userService *service.UserService
}

func NewJWTAuthHandler(us *service.UserService) *JWTAuthHandler {
	return &JWTAuthHandler{
		userService: us,
	}
}

// Login JWT登录
func (h *JWTAuthHandler) Login(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Username string `json:"username"`
		Password string `json:"password"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "Invalid request", http.StatusBadRequest)
		return
	}

	// 1. 验证用户名密码
	user, err := h.userService.Authenticate(req.Username, req.Password)
	if err != nil {
		http.Error(w, "Invalid credentials", http.StatusUnauthorized)
		return
	}

	// 2. 生成Access Token（1小时）
	accessToken, err := jwt.GenerateToken(user.ID, user.Username, 1*time.Hour)
	if err != nil {
		http.Error(w, "Failed to generate token", http.StatusInternalServerError)
		return
	}

	// 3. 生成Refresh Token（7天）
	refreshToken, err := jwt.GenerateToken(user.ID, user.Username, 7*24*time.Hour)
	if err != nil {
		http.Error(w, "Failed to generate refresh token", http.StatusInternalServerError)
		return
	}

	// 4. 返回Token
	json.NewEncoder(w).Encode(map[string]interface{}{
		"accessToken":  accessToken,
		"refreshToken": refreshToken,
		"expiresIn":    3600,  // 1小时
		"tokenType":    "Bearer",
		"user": map[string]interface{}{
			"id":       user.ID,
			"username": user.Username,
		},
	})
}

// RefreshToken 刷新Token
func (h *JWTAuthHandler) RefreshToken(w http.ResponseWriter, r *http.Request) {
	var req struct {
		RefreshToken string `json:"refreshToken"`
	}

	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "Invalid request", http.StatusBadRequest)
		return
	}

	// 刷新Access Token
	accessToken, err := jwt.RefreshToken(req.RefreshToken, 1*time.Hour)
	if err != nil {
		http.Error(w, "Invalid or expired refresh token", http.StatusUnauthorized)
		return
	}

	json.NewEncoder(w).Encode(map[string]interface{}{
		"accessToken": accessToken,
		"expiresIn":   3600,
		"tokenType":   "Bearer",
	})
}

// JWTMiddleware JWT认证中间件
func (h *JWTAuthHandler) JWTMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// 1. 获取Authorization Header
		authHeader := r.Header.Get("Authorization")
		if authHeader == "" {
			http.Error(w, "Missing authorization header", http.StatusUnauthorized)
			return
		}

		// 2. 解析Bearer Token
		parts := strings.SplitN(authHeader, " ", 2)
		if len(parts) != 2 || parts[0] != "Bearer" {
			http.Error(w, "Invalid authorization header", http.StatusUnauthorized)
			return
		}

		// 3. 验证Token
		claims, err := jwt.ParseToken(parts[1])
		if err != nil {
			http.Error(w, err.Error(), http.StatusUnauthorized)
			return
		}

		// 4. 将用户信息存入Context
		ctx := context.WithValue(r.Context(), "userID", claims.UserID)
		ctx = context.WithValue(ctx, "username", claims.Username)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

package rbac

type Permission string

const (
	UserRead   Permission = "user:read"
	UserWrite  Permission = "user:write"
	UserDelete Permission = "user:delete"
	PostRead   Permission = "post:read"
	PostWrite  Permission = "post:write"
)

// Role 角色
type Role struct {
	Name        string
	Permissions []Permission
}

// User 用户
type User struct {
	ID    int
	Name  string
	Roles []Role
}

// RBAC权限检查器
type RBAC struct {
	roles map[string]*Role
}

func NewRBAC() *RBAC {
	return &RBAC{
		roles: make(map[string]*Role),
	}
}

// 添加角色
func (r *RBAC) AddRole(name string, permissions []Permission) {
	r.roles[name] = &Role{
		Name:        name,
		Permissions: permissions,
	}
}

// 检查用户是否有权限
func (r *RBAC) HasPermission(user *User, permission Permission) bool {
	for _, role := range user.Roles {
		for _, perm := range role.Permissions {
			if perm == permission {
				return true
			}
		}
	}
	return false
}

// RBAC中间件
func (r *RBAC) RequirePermission(permission Permission) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
			// 从Context获取用户
			user, ok := req.Context().Value("user").(*User)
			if !ok {
				http.Error(w, "Unauthorized", http.StatusUnauthorized)
				return
			}

			// 检查权限
			if !r.HasPermission(user, permission) {
				http.Error(w, "Forbidden", http.StatusForbidden)
				return
			}

			next.ServeHTTP(w, req)
		})
	}
}

// 初始化RBAC
rbac := rbac.NewRBAC()

// 定义角色
rbac.AddRole("admin", []rbac.Permission{
	rbac.UserRead,
	rbac.UserWrite,
	rbac.UserDelete,
	rbac.PostRead,
	rbac.PostWrite,
})

rbac.AddRole("user", []rbac.Permission{
	rbac.UserRead,
	rbac.PostRead,
})

// 使用权限中间件
http.Handle("/users",
	rbac.RequirePermission(rbac.UserRead)(
		http.HandlerFunc(handleGetUsers),
	),
)

http.Handle("/users/delete",
	rbac.RequirePermission(rbac.UserDelete)(
		http.HandlerFunc(handleDeleteUser),
	),
)

//  错误：明文存储
password := "123456"
db.Save(password)

//  错误：MD5/SHA1（已不安全）
hash := md5.Sum([]byte(password))

//  正确：bcrypt
package auth

import (
	"golang.org/x/crypto/bcrypt"
)

// HashPassword 哈希密码
func HashPassword(password string) (string, error) {
	// bcrypt自动加盐，cost=12（计算成本）
	bytes, err := bcrypt.GenerateFromPassword([]byte(password), 12)
	return string(bytes), err
}

// CheckPassword 验证密码
func CheckPassword(password, hash string) bool {
	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
	return err == nil
}

// 注册时
hashedPassword, _ := auth.HashPassword("user_password")
db.Save(User{
	Username: "john",
	Password: hashedPassword,  // 存储哈希后的密码
})

// 登录时
user := db.FindByUsername("john")
if auth.CheckPassword("user_password", user.Password) {
	// 密码正确
}

package auth

import (
	"errors"
	"regexp"
	"unicode"
)

var (
	ErrPasswordTooShort  = errors.New("password must be at least 8 characters")
	ErrPasswordTooWeak   = errors.New("password must contain uppercase, lowercase, number and special char")
)

// ValidatePassword 验证密码强度
func ValidatePassword(password string) error {
	// 长度检查
	if len(password) < 8 {
		return ErrPasswordTooShort
	}

	var (
		hasUpper   = false
		hasLower   = false
		hasNumber  = false
		hasSpecial = false
	)

	for _, char := range password {
		switch {
		case unicode.IsUpper(char):
			hasUpper = true
		case unicode.IsLower(char):
			hasLower = true
		case unicode.IsNumber(char):
			hasNumber = true
		case unicode.IsPunct(char) || unicode.IsSymbol(char):
			hasSpecial = true
		}
	}

	if !hasUpper || !hasLower || !hasNumber || !hasSpecial {
		return ErrPasswordTooWeak
	}

	return nil
}

//  明文存储
password := "123456"

//  MD5/SHA1（彩虹表攻击）
md5Hash := md5.Sum([]byte(password))

//  简单加盐（盐值固定）
hash := sha256.Sum256([]byte(password + "salt"))

//  bcrypt（自动加盐，慢哈希）
import "golang.org/x/crypto/bcrypt"

// 存储
hashedPassword, _ := bcrypt.GenerateFromPassword([]byte(password), 12)

// 验证
err := bcrypt.CompareHashAndPassword(hashedPassword, []byte(password))

// 生成CSRF Token
func GenerateCSRFToken() string {
	bytes := make([]byte, 32)
	rand.Read(bytes)
	return hex.EncodeToString(bytes)
}

// 验证CSRF Token
func ValidateCSRFToken(token string, sessionToken string) bool {
	return token == sessionToken
}

// 使用
http.SetCookie(w, &http.Cookie{
	Name:     "csrf_token",
	Value:    GenerateCSRFToken(),
	HttpOnly: false,  // 允许JS读取
})

http.SetCookie(w, &http.Cookie{
	Name:     "sessionid",
	Value:    sessionID,
	SameSite: http.SameSiteStrictMode,  // 防止跨站请求
})

func validateOrigin(r *http.Request) bool {
	origin := r.Header.Get("Origin")
	return origin == "https://trusted-domain.com"
}

// 记住我：7天
duration := 7 * 24 * time.Hour

// 不记住：30分钟
if !rememberMe {
	duration = 30 * time.Minute
}

session, _ := sessionManager.CreateSession(userID, duration)

// Access Token：短期（1小时）
accessToken, _ := jwt.GenerateToken(userID, 1*time.Hour)

// Refresh Token：长期（7天）
refreshToken, _ := jwt.GenerateToken(userID, 7*24*time.Hour)

// 存储Refresh Token
http.SetCookie(w, &http.Cookie{
	Name:     "refresh_token",
	Value:    refreshToken,
	Path:     "/",
	HttpOnly: true,
	Secure:   true,
	MaxAge:   7 * 24 * 3600,
})

// 生成持久化Token
rememberToken := generateSecureToken()

// 存储到数据库
db.Save(RememberToken{
	UserID:    userID,
	Token:     hashToken(rememberToken),
	ExpiresAt: time.Now().Add(30 * 24 * time.Hour),
})

// 设置Cookie
http.SetCookie(w, &http.Cookie{
	Name:     "remember_token",
	Value:    rememberToken,
	MaxAge:   30 * 24 * 3600,
	HttpOnly: true,
	Secure:   true,
})