(#2) finished user authentication with steam (probably)

1 files changed, 50 insertions, 23 deletions

diff --git a/backend/controllers/controllers.go b/backend/controllers/controllers.go
index 8ce4860..79fc223 100644
--- a/backend/controllers/controllers.go
+++ b/backend/controllers/controllers.go
@@ -8,6 +8,7 @@ import (
 
         "github.com/gin-contrib/sessions"
         "github.com/gin-gonic/gin"
+        "github.com/golang-jwt/jwt/v4"
         "github.com/pektezol/leastportals/backend/database"
         "github.com/solovev/steam_go"
 )
@@ -31,47 +32,73 @@ func Home(c *gin.Context) {
 }
 
 func Login(c *gin.Context) {
-        opId := steam_go.NewOpenId(c.Request)
-        switch opId.Mode() {
+        openID := steam_go.NewOpenId(c.Request)
+        switch openID.Mode() {
         case "":
-                http.Redirect(c.Writer, c.Request, opId.AuthUrl(), 301)
+                c.Redirect(http.StatusMovedPermanently, openID.AuthUrl())
         case "cancel":
-                c.Writer.Write([]byte("Authorization cancelled"))
+                c.Redirect(http.StatusMovedPermanently, "/")
         default:
-                steamId, err := opId.ValidateAndGetId()
+                steamID, err := openID.ValidateAndGetId()
                 if err != nil {
                         http.Error(c.Writer, err.Error(), http.StatusInternalServerError)
                 }
                 // Create user if new
                 var checkSteamID int64
-                database.DB.QueryRow("SELECT steam_id FROM users WHERE steamid = $1", steamId).Scan(&checkSteamID)
-                if checkSteamID == 0 { // User does not exist
-                        user, err := steam_go.GetPlayerSummaries(steamId, os.Getenv("API_KEY"))
+                database.DB.QueryRow("SELECT steam_id FROM users WHERE steamid = $1", steamID).Scan(&checkSteamID)
+                // User does not exist
+                if checkSteamID == 0 {
+                        user, err := steam_go.GetPlayerSummaries(steamID, os.Getenv("API_KEY"))
                         if err != nil {
                                 log.Panic(err)
                         }
+                        // Insert new user to database
                         database.DB.Exec(`INSERT INTO users (steam_id, username, avatar_link, country_code, created_at, updated_at, user_type)
-                        VALUES ($1, $2, $3, $4, $5, $6, $7)`, steamId, user.PersonaName, user.Avatar, user.LocCountryCode, time.Now().UTC(), time.Now().UTC(), 0)
+                        VALUES ($1, $2, $3, $4, $5, $6, $7)`, steamID, user.PersonaName, user.Avatar, user.LocCountryCode, time.Now().UTC(), time.Now().UTC(), 0)
+                }
+                // Update updated_at
+                database.DB.Exec(`UPDATE users SET updated_at = $1 WHERE steam_id = $2`, time.Now().UTC(), steamID)
+                // Generate JWT token
+                token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+                        "sub": steamID,
+                        "exp": time.Now().Add(time.Hour * 24 * 30).Unix(),
+                })
+                // Sign and get the complete encoded token as a string using the secret
+                tokenString, err := token.SignedString([]byte(os.Getenv("SECRET_KEY")))
+                if err != nil {
+                        c.JSON(http.StatusBadRequest, gin.H{
+                                "error": "failed to create token",
+                        })
+                        return
                 }
-                session := sessions.Default(c)
-                session.Set("id", steamId)
-                session.Save()
-                // Do whatever you want with steam id
+                // Create auth cookie
+                c.SetSameSite(http.SameSiteLaxMode)
+                c.SetCookie("auth", tokenString, 3600*24*30, "/", "", true, true)
                 c.Redirect(http.StatusMovedPermanently, "/")
-                c.Writer.Write([]byte(steamId))
         }
 }
 
 func Logout(c *gin.Context) {
-        session := sessions.Default(c)
-        if session.Get("id") == nil {
-                c.JSON(http.StatusBadRequest, "no id, not auth")
+        // Check if user exists
+        _, exists := c.Get("user")
+        if !exists {
+                c.JSON(http.StatusBadRequest, gin.H{
+                        "error": "not logged in",
+                })
         } else {
-                session.Set("id", "")
-                session.Clear()
-                session.Options(sessions.Options{Path: "/", MaxAge: -1})
-                session.Save()
-                log.Print("id", session.Get("id"))
-                c.Redirect(http.StatusPermanentRedirect, "/")
+                // Set auth cookie to die
+                tokenString, _ := c.Cookie("auth")
+                c.SetCookie("auth", tokenString, -1, "/", "", true, true)
+                c.JSON(http.StatusOK, gin.H{
+                        "output": "logout success",
+                })
+                //c.Redirect(http.StatusPermanentRedirect, "/")
         }
 }
+
+func Validate(c *gin.Context) {
+        user, _ := c.Get("user")
+        c.JSON(http.StatusOK, gin.H{
+                "output": user,
+        })
+}