broad-announce/cmd/authd/main.go

// Command authd is the in-house multi-tenant auth IdP that powers
// the M13 admin UI. It exposes:
//
//	POST /v1/auth/login        — email + password → access JWT + refresh token
//	POST /v1/auth/refresh      — refresh token → new pair
//	POST /v1/auth/logout       — refresh token → revoke
//	POST /v1/auth/magic        — magic-link token + new password → session
//	POST /v1/users/invite      — super/tenant-admin → magic link (email side-effect lives in the caller)
//	GET  /v1/users/me          — current user info
//	GET  /health, /metrics     — observability
//
// All endpoints are unauthenticated except /v1/users/me and
// /v1/users/invite (which require a valid access JWT). The auth
// path is /v1/auth/* (no JWT required to log in, naturally).
//
// Configuration: env vars only. See authdEnv() below.
package main

import (
	"context"
	cryptorand "crypto/rand"
	"encoding/json"
	"errors"
	"log/slog"
	"net/http"
	"os"
	"os/signal"
	"strconv"
	"syscall"
	"time"

	"git3.techno-world.net/lrosales/broad-announce/internal/authd"
	"git3.techno-world.net/lrosales/broad-announce/internal/httpserver"
	"git3.techno-world.net/lrosales/broad-announce/internal/observability"
	"git3.techno-world.net/lrosales/broad-announce/internal/postgres"
)

func main() {
	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
	if err := run(logger); err != nil {
		logger.Error("authd exited with error", "err", err)
		os.Exit(1)
	}
}

func run(logger *slog.Logger) error {
	cfg, err := authdEnv()
	if err != nil {
		return err
	}
	logger.Info("authd starting",
		"env", cfg.Env, "addr", cfg.HTTPAddr,
		"issuer", cfg.Issuer, "access_ttl", cfg.AuthdConfig.AccessTokenTTL)

	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
	defer stop()

	pool, err := postgres.Connect(ctx, cfg.PostgresDSN)
	if err != nil {
		return err
	}
	defer pool.Close()

	// Verify the migration is applied (graceful if not — first boot
	// may need to run `go run ./cmd/seed` first).
	if err := pingSchema(ctx, pool); err != nil {
		logger.Warn("auth schema not yet present, login will fail", "err", err)
	}

	// Generate a JWT secret if not provided. The first-run case
	// (no env) gets a random secret written to a file so restarts
	// produce the same tokens. This is dev-only behavior; in
	// production the secret comes from K8s sealed-secrets.
	if len(cfg.JWTSecret) < 32 {
		if !cfg.AllowGeneratedSecret {
			return errors.New("BA_AUTHD_JWT_SECRET must be at least 32 bytes (set in env or sealed-secret)")
		}
		sec, err := loadOrCreateSecret(cfg.SecretFile, logger)
		if err != nil {
			return err
		}
		cfg.JWTSecret = sec
	}

	ad, err := authd.New(pool, cfg.AuthdConfig)
	if err != nil {
		return err
	}

	reg, _ := observability.NewRegistry("authd")
	srv := httpserver.New(httpserver.Config{
		Addr:        cfg.HTTPAddr,
		ServiceName: "authd",
	}, logger, observability.MetricsHandler(reg))

	mux := srv.Mux()
	mux.HandleFunc("POST /v1/auth/login", loginHandler(ad, logger))
	mux.HandleFunc("POST /v1/auth/refresh", refreshHandler(ad, logger))
	mux.HandleFunc("POST /v1/auth/logout", logoutHandler(ad, logger))
	mux.HandleFunc("POST /v1/auth/magic", magicConsumeHandler(ad, logger))
	mux.HandleFunc("POST /v1/users/invite", inviteHandler(ad, logger))
	mux.HandleFunc("GET /v1/users/me", meHandler(ad, logger))

	// Start in background, wait for signal, then graceful shutdown.
	errCh := make(chan error, 1)
	go func() { errCh <- srv.Start() }()

	select {
	case err := <-errCh:
		return err
	case <-ctx.Done():
		logger.Info("shutdown signal received")
		shutdownCtx, cancel := context.WithTimeout(context.Background(), cfg.ShutdownGrace)
		defer cancel()
		return srv.Shutdown(shutdownCtx)
	}
}

// ---------------------------------------------------------------------------
// Env loading
// ---------------------------------------------------------------------------

type env struct {
	Env       string
	HTTPAddr  string
	Issuer    string
	AuthdConfig authd.Config

	PostgresDSN  string
	ShutdownGrace time.Duration

	// JWT secret
	JWTSecret         []byte
	AllowGeneratedSecret bool
	SecretFile        string
}

func authdEnv() (env, error) {
	e := env{
		Env:        getenvDefault("BA_ENV", "dev"),
		HTTPAddr:   getenvDefault("BA_AUTHD_HTTP_ADDR", ":8804"),
		Issuer:     getenvDefault("BA_AUTHD_ISSUER", "broad-announce"),
		PostgresDSN: os.Getenv("BA_POSTGRES_DSN"),
	}
	if s := os.Getenv("BA_AUTHD_JWT_SECRET"); s != "" {
		e.JWTSecret = []byte(s)
	}
	e.AllowGeneratedSecret = getenvDefault("BA_AUTHD_ALLOW_GENERATED_SECRET", "") == "1" ||
		os.Getenv("BA_ENV") == "dev"
	e.SecretFile = getenvDefault("BA_AUTHD_SECRET_FILE", "/var/run/broad-announce/authd.jwt")
	if t := os.Getenv("BA_AUTHD_ACCESS_TTL"); t != "" {
		d, err := time.ParseDuration(t)
		if err != nil {
			return e, err
		}
		e.AuthdConfig.AccessTokenTTL = d
	}
	if t := os.Getenv("BA_AUTHD_REFRESH_TTL"); t != "" {
		d, err := time.ParseDuration(t)
		if err != nil {
			return e, err
		}
		e.AuthdConfig.RefreshTokenTTL = d
	}
	if c := os.Getenv("BA_AUTHD_BCRYPT_COST"); c != "" {
		n, err := strconv.Atoi(c)
		if err != nil {
			return e, err
		}
		e.AuthdConfig.BcryptCost = n
	}
	e.AuthdConfig.JWTSecret = e.JWTSecret // may be empty; New() will reject
	e.AuthdConfig.Issuer = e.Issuer
	if e.PostgresDSN == "" {
		return e, errors.New("BA_POSTGRES_DSN must be set")
	}
	grace := 10 * time.Second
	if g := os.Getenv("BA_AUTHD_SHUTDOWN_GRACE"); g != "" {
		d, err := time.ParseDuration(g)
		if err != nil {
			return e, err
		}
		grace = d
	}
	e.ShutdownGrace = grace
	return e, nil
}

func getenvDefault(k, def string) string {
	if v := os.Getenv(k); v != "" {
		return v
	}
	return def
}

// pingSchema is a best-effort check that the auth schema is migrated.
// Returns nil if the audit_log table exists, an error otherwise.
func pingSchema(ctx context.Context, pool *postgres.Pool) error {
	row := pool.QueryRow(ctx,
		`SELECT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema='auth' AND table_name='users')`)
	var ok bool
	if err := row.Scan(&ok); err != nil {
		return err
	}
	if !ok {
		return errors.New("auth.users not found; run migrations first")
	}
	return nil
}

// loadOrCreateSecret reads the JWT secret from disk, or generates a
// random one and writes it. The file is chmod 600.
func loadOrCreateSecret(path string, logger *slog.Logger) ([]byte, error) {
	if data, err := os.ReadFile(path); err == nil && len(data) >= 32 {
		return data, nil
	}
	logger.Warn("generating new JWT secret (dev-only)", "file", path)
	if err := os.MkdirAll(parentDir(path), 0o700); err != nil {
		return nil, err
	}
	secret := make([]byte, 48)
	if _, err := readFull(secret); err != nil {
		return nil, err
	}
	if err := os.WriteFile(path, secret, 0o600); err != nil {
		return nil, err
	}
	return secret, nil
}

// readFull fills b with cryptographically random bytes.
func readFull(b []byte) (int, error) {
	return randomRead(b)
}

func parentDir(p string) string {
	for i := len(p) - 1; i >= 0; i-- {
		if p[i] == '/' {
			return p[:i]
		}
	}
	return "."
}

// randomRead is split out so tests can stub it; default uses crypto/rand.
var randomRead = func(b []byte) (int, error) {
	return cryptorand.Read(b)
}

// ---------------------------------------------------------------------------
// HTTP handlers
// ---------------------------------------------------------------------------

// clientIP pulls the IP from r.RemoteAddr, respecting X-Forwarded-For
// when BA_AUTHD_TRUST_FORWARDED=1. Returns the bare IP (no port)
// because the audit_log columns are INET.
func clientIP(r *http.Request) string {
	raw := r.RemoteAddr
	if os.Getenv("BA_AUTHD_TRUST_FORWARDED") == "1" {
		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
			// X-Forwarded-For is a list; first is the client
			if i := indexByte(xff, ','); i >= 0 {
				raw = xff[:i]
			} else {
				raw = xff
			}
		}
	}
	// Strip :port if present (host:port)
	if i := lastByte(raw, ':'); i >= 0 {
		// Make sure it's not part of an IPv6 address
		if !containsByte(raw, ']') || i > indexByte(raw, ']') {
			raw = raw[:i]
		}
	}
	return raw
}

func indexByte(s string, c byte) int {
	for i := 0; i < len(s); i++ {
		if s[i] == c {
			return i
		}
	}
	return -1
}

func lastByte(s string, c byte) int {
	for i := len(s) - 1; i >= 0; i-- {
		if s[i] == c {
			return i
		}
	}
	return -1
}

func containsByte(s string, c byte) bool {
	return indexByte(s, c) >= 0
}

// writeJSON writes status + JSON body. Sets Content-Type.
func writeJSON(w http.ResponseWriter, status int, body any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(body)
}

// writeErr writes a JSON error response.
func writeErr(w http.ResponseWriter, status int, code, msg string) {
	writeJSON(w, status, map[string]string{"error": code, "message": msg})
}

// --- /v1/auth/login -------------------------------------------------------

type loginReq struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

type loginResp struct {
	AccessToken  string    `json:"access_token"`
	RefreshToken string    `json:"refresh_token"`
	TokenType    string    `json:"token_type"`
	ExpiresAt    time.Time `json:"expires_at"`
	UserID       string    `json:"user_id"`
	TenantID     string    `json:"tenant_id,omitempty"`
	Role         string    `json:"role"`
}

func loginHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var req loginReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeErr(w, http.StatusBadRequest, "bad_request", "invalid json")
			return
		}
		if req.Email == "" || req.Password == "" {
			writeErr(w, http.StatusBadRequest, "bad_request", "email and password required")
			return
		}
		res, err := ad.Login(r.Context(), req.Email, req.Password, clientIP(r), r.UserAgent())
		if err != nil {
			if errors.Is(err, authd.ErrInvalidCredentials) || errors.Is(err, authd.ErrUserDisabled) {
				writeErr(w, http.StatusUnauthorized, "unauthorized", "invalid credentials")
				return
			}
			logger.Error("login internal error", "err", err)
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		writeJSON(w, http.StatusOK, loginResp{
			AccessToken:  res.AccessToken,
			RefreshToken: res.RefreshToken,
			TokenType:    "Bearer",
			ExpiresAt:    res.ExpiresAt,
			UserID:       res.UserID,
			TenantID:     res.TenantID,
			Role:         res.Role,
		})
	}
}

// --- /v1/auth/refresh -----------------------------------------------------

type refreshReq struct {
	RefreshToken string `json:"refresh_token"`
}

func refreshHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var req refreshReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeErr(w, http.StatusBadRequest, "bad_request", "invalid json")
			return
		}
		if req.RefreshToken == "" {
			writeErr(w, http.StatusBadRequest, "bad_request", "refresh_token required")
			return
		}
		res, err := ad.Refresh(r.Context(), req.RefreshToken, clientIP(r), r.UserAgent())
		if err != nil {
			if errors.Is(err, authd.ErrTokenReuse) {
				writeErr(w, http.StatusUnauthorized, "session_killed", "refresh token re-use detected, please log in again")
				return
			}
			if errors.Is(err, authd.ErrUserDisabled) {
				writeErr(w, http.StatusUnauthorized, "unauthorized", "user disabled")
				return
			}
			logger.Error("refresh internal error", "err", err)
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		writeJSON(w, http.StatusOK, loginResp{
			AccessToken:  res.AccessToken,
			RefreshToken: res.RefreshToken,
			TokenType:    "Bearer",
			ExpiresAt:    res.ExpiresAt,
			UserID:       res.UserID,
			TenantID:     res.TenantID,
			Role:         res.Role,
		})
	}
}

// --- /v1/auth/logout ------------------------------------------------------

type logoutReq struct {
	RefreshToken string `json:"refresh_token"`
}

func logoutHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var req logoutReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeErr(w, http.StatusBadRequest, "bad_request", "invalid json")
			return
		}
		// Resolve user id from the access JWT in the Authorization
		// header (best effort) so we can write the audit row.
		uid, _ := userIDFromAuthHeader(ad, r)
		if err := ad.Logout(r.Context(), req.RefreshToken, uid, clientIP(r), r.UserAgent()); err != nil {
			logger.Error("logout internal error", "err", err)
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
	}
}

// --- /v1/auth/magic -------------------------------------------------------

type magicReq struct {
	Token       string `json:"token"`
	NewPassword string `json:"new_password"`
}

func magicConsumeHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		var req magicReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeErr(w, http.StatusBadRequest, "bad_request", "invalid json")
			return
		}
		if req.Token == "" || req.NewPassword == "" {
			writeErr(w, http.StatusBadRequest, "bad_request", "token and new_password required")
			return
		}
		if len(req.NewPassword) < 12 {
			writeErr(w, http.StatusBadRequest, "weak_password", "password must be at least 12 characters")
			return
		}
		uid, err := ad.ConsumeMagicLink(r.Context(), req.Token, clientIP(r), r.UserAgent())
		if err != nil {
			if errors.Is(err, authd.ErrMagicLinkInvalid) {
				writeErr(w, http.StatusUnauthorized, "invalid_link", "magic link invalid or expired")
				return
			}
			logger.Error("magic consume error", "err", err)
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		if err := ad.SetPassword(r.Context(), uid, req.NewPassword); err != nil {
			logger.Error("set password error", "err", err)
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		// Auto-login: return a session so the user lands on the
		// dashboard without a separate login round-trip.
		user, err := ad.Store().GetUserByID(r.Context(), uid)
		if err != nil {
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		// We don't have the plaintext password to call Login(). The
		// simpler path: sign a session directly using a helper.
		// For now, return success and require the user to log in
		// normally — UX is one extra click, security is cleaner.
		_ = user
		writeJSON(w, http.StatusOK, map[string]any{
			"status":  "ok",
			"user_id": uid,
			"message": "password set. Please log in.",
		})
	}
}

// --- /v1/users/invite -----------------------------------------------------

type inviteReq struct {
	TenantSlug string `json:"tenant_slug"`
	Email      string `json:"email"`
	Role       string `json:"role"`
}

type inviteResp struct {
	UserID         string    `json:"user_id"`
	MagicLinkToken string    `json:"magic_link_token"`
	ExpiresAt      time.Time `json:"expires_at"`
}

func inviteHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		claims, err := userClaimsFromAuthHeader(ad, r)
		if err != nil {
			writeErr(w, http.StatusUnauthorized, "unauthorized", "valid access token required")
			return
		}
		if claims.Role != "super_admin" && claims.Role != "tenant_admin" {
			writeErr(w, http.StatusForbidden, "forbidden", "invite requires admin role")
			return
		}
		var req inviteReq
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeErr(w, http.StatusBadRequest, "bad_request", "invalid json")
			return
		}
		if req.Email == "" || req.Role == "" {
			writeErr(w, http.StatusBadRequest, "bad_request", "email and role required")
			return
		}
		// Resolve tenant: super_admin can target any tenant by slug;
		// tenant_admin can only target their own tenant.
		var tenantID string
		if claims.Role == "super_admin" {
			if req.TenantSlug == "" {
				writeErr(w, http.StatusBadRequest, "bad_request", "tenant_slug required for super_admin")
				return
			}
			tenantID, err = ad.Store().TenantIDBySlug(r.Context(), req.TenantSlug)
			if err != nil {
				writeErr(w, http.StatusBadRequest, "unknown_tenant", "tenant_slug not found")
				return
			}
		} else {
			tenantID = claims.TenantID
		}
		token, uid, err := ad.InviteUser(r.Context(), tenantID, req.Email, req.Role, claims.UserID, clientIP(r), r.UserAgent())
		if err != nil {
			logger.Error("invite error", "err", err)
			writeErr(w, http.StatusInternalServerError, "internal", "internal error")
			return
		}
		writeJSON(w, http.StatusOK, inviteResp{
			UserID:         uid,
			MagicLinkToken: token,
		})
	}
}

// --- /v1/users/me ---------------------------------------------------------

func meHandler(ad *authd.Authd, logger *slog.Logger) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		claims, err := userClaimsFromAuthHeader(ad, r)
		if err != nil {
			writeErr(w, http.StatusUnauthorized, "unauthorized", "valid access token required")
			return
		}
		u, err := ad.Store().GetUserByID(r.Context(), claims.UserID)
		if err != nil {
			writeErr(w, http.StatusInternalServerError, "internal", "user lookup failed")
			return
		}
		writeJSON(w, http.StatusOK, map[string]any{
			"user_id":     u.ID,
			"email":       u.Email,
			"role":        u.Role,
			"status":      u.Status,
			"tenant_id":   u.TenantID,
			"display_name": u.DisplayName,
		})
	}
}

// --- helpers for bearer auth ----------------------------------------------

// userIDFromAuthHeader extracts the user id from the access token in
// the Authorization header. Returns ("", err) if absent or invalid.
func userIDFromAuthHeader(ad *authd.Authd, r *http.Request) (string, error) {
	tok, err := bearerFromAuthHeader(r)
	if err != nil {
		return "", err
	}
	claims, err := ad.VerifyAccessToken(tok)
	if err != nil {
		return "", err
	}
	return claims.UserID, nil
}

func userClaimsFromAuthHeader(ad *authd.Authd, r *http.Request) (*authd.AccessClaims, error) {
	tok, err := bearerFromAuthHeader(r)
	if err != nil {
		return nil, err
	}
	return ad.VerifyAccessToken(tok)
}

func bearerFromAuthHeader(r *http.Request) (string, error) {
	h := r.Header.Get("Authorization")
	if h == "" {
		return "", errors.New("missing Authorization header")
	}
	const prefix = "Bearer "
	if len(h) <= len(prefix) || h[:len(prefix)] != prefix {
		return "", errors.New("Authorization must be 'Bearer <token>'")
	}
	return h[len(prefix):], nil
}