sm-user-plugin/classes/api_tokens.go

package classes

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"slices"
	"strings"
	"time"

	"git.golem15.com/golem15/sm-user-plugin/models"
	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/lagoon"
	"gorm.io/gorm"
)

const DefaultAPITokenPrefix = "usr_"

// DefaultAPITokenScopes is what a token minted without scopes carries, and
// AllowedAPITokenScopes are the built-in member token scopes. Plugins add
// their own through pact.HasFrontendTokenScopes (APITokenScopeCatalog).
var (
	DefaultAPITokenScopes = []string{"read"}
	AllowedAPITokenScopes = []string{"read", "write", "ai"}
)

// APITokenPrefix returns the configured on-wire prefix. Applications may keep
// a legacy prefix while every plugin still consumes the same token table.
func APITokenPrefix(app *backpack.App) (string, error) {
	prefix := DefaultAPITokenPrefix
	if app != nil && app.Config != nil {
		if configured := strings.TrimSpace(app.Config.String("golem15.user.api_tokens.prefix")); configured != "" {
			prefix = configured
		}
	}
	if len(prefix) < 2 || len(prefix) > 16 {
		return "", fmt.Errorf("golem15.user: api_tokens.prefix must contain 2 to 16 safe characters")
	}
	for _, r := range prefix {
		if !(r == '_' || r == '-' || r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9') {
			return "", fmt.Errorf("golem15.user: api_tokens.prefix contains an unsafe character")
		}
	}
	return prefix, nil
}

// MintAPIToken builds a token record and returns its one-time clear-text
// secret. A nil scopes slice receives DefaultAPITokenScopes. It accepts the
// built-in scopes (AllowedAPITokenScopes) and, as a fallback for existing
// callers, every member token scope a catalog compiled in this process
// declared (CompileAPITokenScopes). New code calls MintAPITokenFor, which
// checks the scopes against the application's own catalog.
//
// Deprecated: the declared-scope fallback is process-wide, so in a process
// that boots several applications it accepts another application's scopes.
// Use MintAPITokenFor.
func MintAPIToken(prefix string, userID uint, name string, scopes []string, expiresAt *time.Time, collectionIDs []uint) (string, *models.APIToken, error) {
	return mintAPIToken(prefix, userID, name, scopes, expiresAt, collectionIDs, func(scope string) bool {
		return slices.Contains(AllowedAPITokenScopes, scope) || declaredScopes.has(scope)
	})
}

// MintAPITokenFor is MintAPIToken with the scopes checked against app's
// member token scope catalog (APITokenScopesFor): the built-ins and the
// scopes app's activated plugins declared through
// pact.HasFrontendTokenScopes. A scope another application in the same
// process declared is refused.
func MintAPITokenFor(app *backpack.App, prefix string, userID uint, name string, scopes []string, expiresAt *time.Time, collectionIDs []uint) (string, *models.APIToken, error) {
	return mintAPIToken(prefix, userID, name, scopes, expiresAt, collectionIDs, APITokenScopesFor(app).Allowed)
}

func mintAPIToken(prefix string, userID uint, name string, scopes []string, expiresAt *time.Time, collectionIDs []uint, allowed func(string) bool) (string, *models.APIToken, error) {
	name = strings.TrimSpace(name)
	if userID == 0 || name == "" || len(name) > 255 {
		return "", nil, fmt.Errorf("a user and token name of 1 to 255 characters are required")
	}
	if prefix == "" {
		prefix = DefaultAPITokenPrefix
	}
	if scopes == nil {
		scopes = slices.Clone(DefaultAPITokenScopes)
	} else {
		scopes = slices.Clone(scopes)
	}
	for _, scope := range scopes {
		if !allowed(scope) {
			return "", nil, fmt.Errorf("scope %q is not allowed", scope)
		}
	}
	seenScopes := make(map[string]bool, len(scopes))
	uniqueScopes := make([]string, 0, len(scopes))
	for _, scope := range scopes {
		if !seenScopes[scope] {
			seenScopes[scope] = true
			uniqueScopes = append(uniqueScopes, scope)
		}
	}
	scopes = uniqueScopes
	raw := make([]byte, 32)
	if _, err := rand.Read(raw); err != nil {
		return "", nil, err
	}
	secret := prefix + base64.RawURLEncoding.EncodeToString(raw)
	token := &models.APIToken{
		UserID:    userID,
		Name:      &name,
		TokenHash: HashAPIToken(secret),
		Scopes:    lagoon.Jsonable[[]string]{Data: scopes, Valid: true},
		ExpiresAt: expiresAt,
	}
	if len(collectionIDs) > 0 {
		collectionIDs = slices.Compact(slices.Sorted(slices.Values(collectionIDs)))
		token.CollectionIDs = lagoon.Jsonable[[]uint]{Data: collectionIDs, Valid: true}
	}
	return secret, token, nil
}

// HashAPIToken returns the only representation of a token secret stored in
// the database.
func HashAPIToken(secret string) string {
	sum := sha256.Sum256([]byte(secret))
	return hex.EncodeToString(sum[:])
}

// RevokeAPIToken invalidates token immediately.
func RevokeAPIToken(db *gorm.DB, token *models.APIToken) error {
	if db == nil || token == nil {
		return fmt.Errorf("golem15.user: token is missing")
	}
	now := time.Now()
	if err := db.Model(token).Update("revoked_at", now).Error; err != nil {
		return err
	}
	token.RevokedAt = &now
	return nil
}