Authentication Middleware

package httpmw

import (
	"context"
	"net/http"
	"strings"
	"time"
)

type ctxKey string

const claimsKey ctxKey = "hoa-claims"

type Claims struct {
	Subject        string
	OrganizationID string
	Role           string
	TokenID        string
	IssuedAt       time.Time
	IsPlatformAdmin bool
}

// Verifier is implemented by auth-service's token verifier adapter.
// The shared package owns policy; auth-service retains key and JWT details.
type Verifier interface {
	Verify(raw string) (Claims, error)
}

// RequireAuth extracts a bearer token, verifies its signature and
// expiration, and injects the resulting claims into the request context.
// A missing, malformed, or invalid token always produces 401 — there is no
// code path that treats an unverifiable token as an anonymous request.
func RequireAuth(verifier Verifier) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			header := r.Header.Get("Authorization")
			raw, ok := strings.CutPrefix(header, "Bearer ")
			if !ok || raw == "" {
				unauthorized(w, "missing bearer token")
				return
			}

			claims, err := verifier.Verify(raw)
			if err != nil {
				unauthorized(w, "invalid or expired token")
				return
			}

			ctx := context.WithValue(r.Context(), claimsKey, claims)
			next.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}

func unauthorized(w http.ResponseWriter, reason string) {
	w.Header().Set("WWW-Authenticate", `Bearer error="invalid_token"`)
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusUnauthorized)
	w.Write([]byte(`{"error":"unauthorized","message":"` + reason + `"}`))
}

// ClaimsFromContext retrieves the verified claims injected by RequireAuth.
// Called by a handler that never ran behind RequireAuth, it returns false —
// handlers must check ok, never assume claims are always present.
func ClaimsFromContext(ctx context.Context) (Claims, bool) {
	claims, ok := ctx.Value(claimsKey).(Claims)
	return claims, ok
}

package httpmw

import (
	"net/http"
	"time"

	"github.com/gin-gonic/gin"
	"github.com/google/uuid"
	"github.com/rs/zerolog"
)

// Adapt lets this package's net/http-shaped middleware run inside a Gin
// engine. Gin still resolves the route; Adapt only bridges the two handler
// signatures, threading the same *http.Request — and any context values a
// wrapped middleware attaches to it, like verified claims — back into c so
// every Gin handler downstream sees them.
func Adapt(mw func(http.Handler) http.Handler) gin.HandlerFunc {
	return func(c *gin.Context) {
		reached := false
		mw(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			reached = true
			c.Request = r
			c.Next()
		})).ServeHTTP(c.Writer, c.Request)
		if !reached {
			// The wrapped middleware already wrote its own rejection body
			// (a 401 or 403) and never called next — stop the Gin chain here
			// too, instead of falling through to a handler that expects one.
			c.Abort()
		}
	}
}

const requestIDKey = "request_id"

// RequestID assigns an identifier scoped to this one process's handling of
// a single request. It is never sent to another service — the API Gateway
// module's correlation-id lesson introduces the header that is.
func RequestID() gin.HandlerFunc {
	return func(c *gin.Context) {
		if id, err := uuid.NewV7(); err == nil {
			c.Set(requestIDKey, id.String())
			c.Writer.Header().Set("X-Request-Id", id.String())
		}
		c.Next()
	}
}

// AccessLog is the baseline structured request log every backend service
// mounts right after RequestID. gateway-service's own richer
// internal/httpmw.AccessLog (API Gateway module) extends this same idea
// with upstream-routing and correlation-id fields a single backend has no
// need for.
func AccessLog(logger zerolog.Logger) gin.HandlerFunc {
	return func(c *gin.Context) {
		start := time.Now()
		c.Next()

		logger.Info().
			Str("method", c.Request.Method).
			Str("path", c.Request.URL.Path).
			Int("status", c.Writer.Status()).
			Int64("duration_ms", time.Since(start).Milliseconds()).
			Str("request_id", c.GetString(requestIDKey)).
			Msg("request")
	}
}

package jwtverify

import (
	"crypto/ed25519"
	"fmt"
	"time"

	"github.com/golang-jwt/jwt/v5"
	"github.com/hoa-platform/backend/pkg/httpmw"
)

type Claims struct {
	jwt.RegisteredClaims
	OrgID           string `json:"org_id"`
	Role            string `json:"role"`
	IsPlatformAdmin bool   `json:"is_platform_admin,omitempty"`
}

type Verifier struct {
	publicKeys map[string]ed25519.PublicKey
}

func New(publicKeys map[string]ed25519.PublicKey) Verifier {
	return Verifier{publicKeys: publicKeys}
}

func (v Verifier) Verify(raw string) (httpmw.Claims, error) {
	claims := &Claims{}
	parsed, err := jwt.ParseWithClaims(raw, claims, func(token *jwt.Token) (any, error) {
		kid, _ := token.Header["kid"].(string)
		key, ok := v.publicKeys[kid]
		if !ok {
			return nil, fmt.Errorf("unknown signing key %q", kid)
		}
		return key, nil
	}, jwt.WithValidMethods([]string{jwt.SigningMethodEdDSA.Alg()}))
	if err != nil || !parsed.Valid || claims.IssuedAt == nil {
		return httpmw.Claims{}, fmt.Errorf("invalid access token")
	}
	return httpmw.Claims{
		Subject: claims.Subject, OrganizationID: claims.OrgID, Role: claims.Role,
		TokenID: claims.ID, IssuedAt: claims.IssuedAt.Time,
		IsPlatformAdmin: claims.IsPlatformAdmin,
	}, nil
}

var _ httpmw.Verifier = Verifier{}

tokenVerifier := jwtverify.New(authPublicKeys)

engine := gin.New()
engine.Use(gin.Recovery())
engine.Use(httpmw.RequestID())
engine.Use(httpmw.AccessLog(logger))

protected := engine.Group("/api/v1")
protected.Use(httpmw.Adapt(httpmw.RequireAuth(tokenVerifier)))
membershipRoutes(protected.Group("/memberships"))
meRoutes(protected.Group("/users/me"))

// Deliberately outside the authenticated group: health checks must remain
// reachable by a load balancer or kubelet that never holds a bearer token.
engine.GET("/healthz", healthHandler)