feat(backend): Discord OAuth login with DB-backed sessions (#23) (#31)

Implements #23 per ADR-0002. - Discord authorization code grant (identify + guilds.members.read), form-encoded token exchange - Guild membership gate via the single-guild endpoint; optional DISCORD_REQUIRED_ROLE (empty default) - Owner Discord ID is the only identity allowed to sign in - Sessions are DB rows with opaque random ids; cookie carries only the id; expiry enforced; delete = revoke - HMAC session signing, derived key, and WEB_PASSWORD removed; no replacement signing secret - Login rate limiting preserved on the callback - Full flow tested through the real router against a local Discord stub (DISCORD_API_BASE) - Env: DISCORD_CLIENT_ID/_CLIENT_SECRET/_GUILD_ID/_REQUIRED_ROLE/_API_BASE/_REDIRECT_URI; docs updated go test ./... passes. Reviewed-on: #31 Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com> Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>
2026-08-08 08:51:22 +07:00
parent 8cebb94b92
commit bcc6b45515
20 changed files with 1280 additions and 363 deletions
@@ -1,13 +1,10 @@
 package session

 import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"crypto/subtle"
-	"encoding/base64"
+	"crypto/rand"
+	"encoding/hex"
 	"net"
 	"net/http"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -16,49 +13,18 @@ import (
 const (
 	CookieName = "bmgr_session"
 	// 60 days: long enough that a phone stays logged in between reading spells.
-	sessionTTL = 60 * 24 * time.Hour
-	// Domain separation, so the session key can never collide with any other
-	// use of the secrets it is derived from. Changing this string logs
-	// everyone out.
-	sessionKeyPurpose = "bmgr-web-session-v1"
+	SessionTTL = 60 * 24 * time.Hour
 )

-// Key derives the cookie-signing key from both secrets. Sessions are
-// stateless — there is no session table — so rotating either API_TOKEN or
-// WEB_PASSWORD invalidates every outstanding cookie at once. The \x00
-// separator prevents the concatenation ambiguity a bare apiToken+webPassword
-// would have (e.g. "ab"+"c" colliding with "a"+"bc").
-func Key(apiToken, webPassword string) []byte {
-	sum := sha256.Sum256([]byte(apiToken + "\x00" + webPassword + sessionKeyPurpose))
-	return sum[:]
-}
-
-// Sign encodes "<expiryMs>.<base64url HMAC(expiryMs)>".
-func Sign(key []byte, expiryMs int64) string {
-	payload := strconv.FormatInt(expiryMs, 10)
-	return payload + "." + sessionMAC(key, payload)
-}
-
-func sessionMAC(key []byte, payload string) string {
-	mac := hmac.New(sha256.New, key)
-	mac.Write([]byte(payload))
-	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
-}
-
-// Verify checks shape, then expiry, then the signature — in that order.
-// The signature comparison is constant-time; the checks before it only look at
-// data the holder already supplied, so their timing leaks nothing.
-func Verify(key []byte, value string, nowMs int64) bool {
-	payload, sig, ok := strings.Cut(value, ".")
-	if !ok {
-		return false
+// NewID returns an opaque session id: 32 random bytes, hex-encoded. The id is
+// all the cookie carries and all the sessions table keys on, so its entropy is
+// what stops a guessed id from being someone else's session.
+func NewID() string {
+	var b [32]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		panic("session id: " + err.Error())
 	}
-	expiry, err := strconv.ParseInt(payload, 10, 64)
-	if err != nil || expiry <= nowMs {
-		return false
-	}
-	want := sessionMAC(key, payload)
-	return subtle.ConstantTimeCompare([]byte(sig), []byte(want)) == 1
+	return hex.EncodeToString(b[:])
 }

 // isHTTPS reports whether the browser's connection is encrypted. Behind Traefik
@@ -69,12 +35,14 @@ func isHTTPS(r *http.Request) bool {
 	return r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https"
 }

-func SetCookie(w http.ResponseWriter, r *http.Request, key []byte) {
+// SetCookie writes the session cookie. The value is the session id and nothing
+// else; the row behind it is looked up on every request.
+func SetCookie(w http.ResponseWriter, r *http.Request, id string) {
 	http.SetCookie(w, &http.Cookie{
 		Name:     CookieName,
-		Value:    Sign(key, time.Now().Add(sessionTTL).UnixMilli()),
+		Value:    id,
 		Path:     "/",
-		MaxAge:   int(sessionTTL / time.Second),
+		MaxAge:   int(SessionTTL / time.Second),
 		HttpOnly: true,
 		Secure:   isHTTPS(r),
 		SameSite: http.SameSiteLaxMode,
@@ -120,14 +88,14 @@ func ClientIP(r *http.Request) string {
 	return host
 }

-// LoginLimiter throttles password guessing: MaxFailures failures inside a
-// rolling Window blocks further attempts from that IP until the oldest one
+// LoginLimiter throttles failed sign-in attempts: MaxFailures failures inside
+// a rolling Window blocks further attempts from that IP until the oldest one
 // ages out. There is no permanent ban and no unlock step.
 //
 // Behind carrier-grade NAT this budget is shared with every other subscriber on
 // the same public address, so a stranger can lock the owner out for up to one
 // window. That is accepted: the block self-heals, and ten attempts is generous
-// for a mistyped password.
+// for the occasional fumbled sign-in.
 //
 // State is in memory and per-process, so a restart clears it. Entries are
 // pruned lazily on access; for a single-user deployment the map cannot grow
@@ -9,66 +9,19 @@ import (
 	"time"
 )

-func TestSessionRoundTrip(t *testing.T) {
-	key := Key("token-abc", "pw-abc")
-	now := time.Now().UnixMilli()
-	value := Sign(key, now+60_000)
-	if !Verify(key, value, now) {
-		t.Fatal("Verify = false for a freshly signed cookie, want true")
+func TestNewID(t *testing.T) {
+	a := NewID()
+	b := NewID()
+	if a == b {
+		t.Fatal("NewID returned the same value twice")
 	}
-}
-
-func TestSessionRejects(t *testing.T) {
-	key := Key("token-abc", "pw-abc")
-	now := time.Now().UnixMilli()
-	valid := Sign(key, now+60_000)
-	payload, sig, _ := strings.Cut(valid, ".")
-
-	cases := []struct {
-		name  string
-		value string
-	}{
-		{"empty", ""},
-		{"no separator", payload + sig},
-		{"unparseable expiry", "notanumber." + sig},
-		{"expired", Sign(key, now-1)},
-		{"tampered signature", payload + "." + flipLastChar(sig)},
-		{"tampered expiry", "99999999999999." + sig},
-		{"signed with another key", Sign(Key("other-token", "pw-abc"), now+60_000)},
+	if len(a) != 64 { // 32 random bytes, hex
+		t.Fatalf("NewID() length = %d, want 64", len(a))
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if Verify(key, tc.value, now) {
-				t.Fatalf("Verify(%q) = true, want false", tc.value)
-			}
-		})
-	}
-}
-
-func flipLastChar(s string) string {
-	if s == "" {
-		return "x"
-	}
-	last := s[len(s)-1]
-	if last == 'A' {
-		return s[:len(s)-1] + "B"
-	}
-	return s[:len(s)-1] + "A"
-}
-
-func TestSessionKeyDependsOnToken(t *testing.T) {
-	a := Key("token-a", "pw-abc")
-	b := Key("token-b", "pw-abc")
-	if string(a) == string(b) {
-		t.Fatal("Key collided for different API tokens")
-	}
-}
-
-func TestSessionKeyDependsOnWebPassword(t *testing.T) {
-	a := Key("token-abc", "pw-a")
-	b := Key("token-abc", "pw-b")
-	if string(a) == string(b) {
-		t.Fatal("Key collided for different web passwords with the same API token")
+	for _, r := range a {
+		if !strings.ContainsRune("0123456789abcdef", r) {
+			t.Fatalf("NewID() = %q, want hex", a)
+		}
 	}
 }

@@ -86,7 +39,7 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			r := httptest.NewRequest(http.MethodPost, "/login", nil)
+			r := httptest.NewRequest(http.MethodPost, "/", nil)
 			if tc.tls {
 				r.TLS = &tls.ConnectionState{}
 			}
@@ -94,7 +47,7 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 				r.Header.Set("X-Forwarded-Proto", tc.forwarded)
 			}
 			rr := httptest.NewRecorder()
-			SetCookie(rr, r, Key("token-abc", "pw-abc"))
+			SetCookie(rr, r, "abc123")

 			cookies := rr.Result().Cookies()
 			if len(cookies) != 1 {
@@ -104,6 +57,9 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 			if c.Name != CookieName {
 				t.Fatalf("cookie name = %q, want %q", c.Name, CookieName)
 			}
+			if c.Value != "abc123" {
+				t.Fatalf("cookie value = %q, want the session id verbatim", c.Value)
+			}
 			if !c.HttpOnly {
 				t.Fatal("cookie HttpOnly = false, want true")
 			}
@@ -116,8 +72,8 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 			if c.Secure != tc.wantSecure {
 				t.Fatalf("cookie Secure = %v, want %v", c.Secure, tc.wantSecure)
 			}
-			if c.MaxAge != int(sessionTTL/time.Second) {
-				t.Fatalf("cookie MaxAge = %d, want %d", c.MaxAge, int(sessionTTL/time.Second))
+			if c.MaxAge != int(SessionTTL/time.Second) {
+				t.Fatalf("cookie MaxAge = %d, want %d", c.MaxAge, int(SessionTTL/time.Second))
 			}
 		})
 	}
@@ -163,7 +119,7 @@ func TestClientIP(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			r := httptest.NewRequest(http.MethodPost, "/login", nil)
+			r := httptest.NewRequest(http.MethodPost, "/", nil)
 			r.RemoteAddr = tc.remoteAddr
 			for _, v := range tc.xff {
 				r.Header.Add("X-Forwarded-For", v)