Michilis/Spanglish
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Migrate authentication to Better Auth

Browse Source 
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie
sessions, validated against the database on every request so revocation,
bans and role changes take effect immediately.

Backend:
- betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and
  the admin plugin; auth-schema.ts maps Better Auth's models onto the
  existing `users` table so user IDs and their foreign keys survive intact.
- routes/auth.ts is gone; Better Auth serves the standard endpoints and
  authExt.ts carries the flows it doesn't cover.
- auth.ts shrinks to session resolution and helpers; sessions/revocation in
  dashboard.ts now read and delete `auth_sessions` rows directly.
- Schema adds the Better Auth core + admin columns (email_verified, image,
  banned, ban_reason, ban_expires), with migrations and tests.
- rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only
  honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES.
- passwordPolicy.ts centralises password validation.
- Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible
  with Better Auth.

Frontend:
- auth-client.ts plus a reworked AuthContext and api/client.ts move to
  cookie-based sessions; no more bearer tokens in requests or middleware.

photo-api:
- Validate Better Auth session cookies against the shared auth_sessions
  table instead of verifying JWTs; JWT_SECRET is no longer needed for user
  auth, and PHOTO_VIEW_SECRET now signs gallery view tokens.

BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the
deprecated JWT_SECRET stays only as the photo-api view-token fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Michilis
2026-07-29 19:07:04 +00:00
co-authored by Claude Opus 5
parent 4afa5d6fa0
commit 733d2459df
47 changed files with 2430 additions and 1585 deletions
Download Patch File Download Diff File Expand all files Collapse all files
photo-api/internal/httpapi/access.go
+1 -1
View File
@@ -27,7 +27,7 @@ func (s *Server) authorize(r *http.Request, g store.Gallery, user *auth.User, to
// expires; it is only ever issued after a successful authorize, and it
// is what lets <img> requests (which cannot carry a Bearer header)
// through for non-public galleries.
if token != "" && verifyViewToken([]byte(s.cfg.JWTSecret), g.ID, token) {
if token != "" && verifyViewToken([]byte(s.cfg.ViewTokenSecret), g.ID, token) {
return nil
}
switch g.Visibility {
photo-api/internal/httpapi/api_test.go
+89 -34
View File
@@ -17,8 +17,6 @@ import (
"testing"
"time"
"github.com/golang-jwt/jwt/v5"
"git.azzamo.net/Michilis/Spanglish/photo-api/internal/auth"
"git.azzamo.net/Michilis/Spanglish/photo-api/internal/config"
"git.azzamo.net/Michilis/Spanglish/photo-api/internal/storage"
@@ -43,6 +41,7 @@ type testEnv struct {
handler http.Handler
db *store.DB
worker *worker.Worker
pg bool
}
// setup migrates a scratch DB (SQLite by default; Postgres when
@@ -55,7 +54,7 @@ func setup(t *testing.T) *testEnv {
Port: 0,
DBType: "sqlite",
DatabaseURL: filepath.Join(dir, "test.db"),
JWTSecret: testSecret,
ViewTokenSecret: testSecret,
StoragePath: filepath.Join(dir, "photos"),
MaxUploadMB: 5,
WorkerConcurrency: 1,
@@ -72,7 +71,7 @@ func setup(t *testing.T) *testEnv {
t.Cleanup(func() { db.Close() })
if cfg.DBType == "postgres" {
// The scratch Postgres DB persists across tests; start clean.
if _, err := db.Exec(`DROP TABLE IF EXISTS photos_photos, photos_galleries, photos_schema_migrations, users, events, tickets, payments CASCADE`); err != nil {
if _, err := db.Exec(`DROP TABLE IF EXISTS photos_photos, photos_galleries, photos_schema_migrations, users, events, tickets, payments, auth_sessions CASCADE`); err != nil {
t.Fatal(err)
}
}
@@ -81,20 +80,27 @@ func setup(t *testing.T) *testEnv {
}
idType := "text"
expiresType := "integer" // sqlite: Better Auth stores epoch-ms integers
boolType := "integer"
falseLit := "0"
if cfg.DBType == "postgres" {
idType = "uuid"
expiresType = "timestamp"
boolType = "boolean"
falseLit = "FALSE"
}
seed := []string{
`CREATE TABLE users (id ` + idType + ` PRIMARY KEY, email text, name text, role text, token_version integer NOT NULL DEFAULT 0, account_status text NOT NULL DEFAULT 'active')`,
`CREATE TABLE users (id ` + idType + ` PRIMARY KEY, email text, name text, role text, account_status text NOT NULL DEFAULT 'active', banned ` + boolType + ` NOT NULL DEFAULT ` + falseLit + `)`,
`CREATE TABLE auth_sessions (id text PRIMARY KEY, user_id ` + idType + `, token text NOT NULL UNIQUE, expires_at ` + expiresType + ` NOT NULL)`,
`CREATE TABLE events (id ` + idType + ` PRIMARY KEY, slug text, title text, title_es text, start_datetime text, status text, price real)`,
`CREATE TABLE tickets (id text PRIMARY KEY, user_id ` + idType + `, event_id ` + idType + `, status text)`,
`CREATE TABLE payments (id text PRIMARY KEY, ticket_id text, status text)`,
`INSERT INTO users VALUES ('` + uAdmin + `','a@x.py','Admin','admin',0,'active')`,
`INSERT INTO users VALUES ('` + uMember + `','m@x.py','Member','user',0,'active')`,
`INSERT INTO users VALUES ('` + uBuyer + `','b@x.py','Buyer','user',0,'active')`,
`INSERT INTO users VALUES ('` + uPending + `','p@x.py','Pending','user',0,'active')`,
`INSERT INTO users VALUES ('` + uFree + `','f@x.py','Free','user',0,'active')`,
`INSERT INTO users VALUES ('` + uAdmin + `','a@x.py','Admin','admin','active',` + falseLit + `)`,
`INSERT INTO users VALUES ('` + uMember + `','m@x.py','Member','user','active',` + falseLit + `)`,
`INSERT INTO users VALUES ('` + uBuyer + `','b@x.py','Buyer','user','active',` + falseLit + `)`,
`INSERT INTO users VALUES ('` + uPending + `','p@x.py','Pending','user','active',` + falseLit + `)`,
`INSERT INTO users VALUES ('` + uFree + `','f@x.py','Free','user','active',` + falseLit + `)`,
`INSERT INTO events VALUES ('` + evPaid + `','fiesta','Fiesta','Fiesta ES','2026-06-01T20:00:00.000Z','completed',50000)`,
`INSERT INTO events VALUES ('` + evFree + `','gratis','Gratis','Gratis ES','2026-06-02T20:00:00.000Z','completed',0)`,
@@ -116,23 +122,27 @@ func setup(t *testing.T) *testEnv {
t.Fatal(err)
}
wrk := worker.New(db, st, nil, cfg.StoragePath, 1)
srv := New(cfg, db, st, auth.NewVerifier(cfg.JWTSecret, db), wrk)
return &testEnv{handler: srv.Handler(), db: db, worker: wrk}
srv := New(cfg, db, st, auth.NewVerifier(db), wrk)
return &testEnv{handler: srv.Handler(), db: db, worker: wrk, pg: cfg.DBType == "postgres"}
}
func makeToken(t *testing.T, sub, email, role string) string {
// makeToken inserts a Better Auth session row for the user and returns a
// bearer value in the cookie's "token.signature" format (the verifier
// resolves the token part against auth_sessions; the signature is unused).
func (e *testEnv) makeToken(t *testing.T, sub string) string {
t.Helper()
tv := 0
claims := jwt.MapClaims{
"sub": sub, "email": email, "role": role, "tokenVersion": tv,
"iss": "spanglish", "aud": "spanglish-app",
"iat": time.Now().Unix(), "exp": time.Now().Add(time.Hour).Unix(),
token := "tok-" + newID()
expires := time.Now().Add(time.Hour)
var expiresVal any = expires.UnixMilli()
if e.pg {
expiresVal = expires
}
s, err := jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString([]byte(testSecret))
if err != nil {
if _, err := e.db.Exec(e.db.Rebind(
`INSERT INTO auth_sessions (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)`),
newID(), sub, token, expiresVal); err != nil {
t.Fatal(err)
}
return s
return token + ".testsig"
}
func (e *testEnv) request(t *testing.T, method, path, token string, body any) *httptest.ResponseRecorder {
@@ -193,16 +203,61 @@ func TestAdminGate(t *testing.T) {
if w := e.request(t, "POST", "/api/photos/galleries", "", body); w.Code != 401 {
t.Fatalf("anon create: want 401, got %d", w.Code)
}
member := makeToken(t, uMember, "m@x.py", "user")
member := e.makeToken(t, uMember)
if w := e.request(t, "POST", "/api/photos/galleries", member, body); w.Code != 403 {
t.Fatalf("member create: want 403, got %d", w.Code)
}
unknown := makeToken(t, newID(), "g@x.py", "admin")
unknown := e.makeToken(t, newID())
if w := e.request(t, "POST", "/api/photos/galleries", unknown, body); w.Code != 401 {
t.Fatalf("unknown-user token: want 401, got %d", w.Code)
}
}
func TestSessionValidation(t *testing.T) {
e := setup(t)
body := map[string]string{"title": "Test"}
// Expired session -> 401
expiredTok := "tok-" + newID()
var expiresVal any = time.Now().Add(-time.Hour).UnixMilli()
if e.pg {
expiresVal = time.Now().Add(-time.Hour)
}
if _, err := e.db.Exec(e.db.Rebind(
`INSERT INTO auth_sessions (id, user_id, token, expires_at) VALUES (?, ?, ?, ?)`),
newID(), uAdmin, expiredTok, expiresVal); err != nil {
t.Fatal(err)
}
if w := e.request(t, "POST", "/api/photos/galleries", expiredTok+".sig", body); w.Code != 401 {
t.Fatalf("expired session: want 401, got %d", w.Code)
}
// Banned (suspended) user -> 401 even with a live session
bannedTok := e.makeToken(t, uMember)
if _, err := e.db.Exec(e.db.Rebind(
`UPDATE users SET account_status = 'suspended' WHERE id = ?`), uMember); err != nil {
t.Fatal(err)
}
if w := e.request(t, "POST", "/api/photos/galleries", bannedTok, body); w.Code != 401 {
t.Fatalf("suspended user: want 401, got %d", w.Code)
}
if _, err := e.db.Exec(e.db.Rebind(
`UPDATE users SET account_status = 'active' WHERE id = ?`), uMember); err != nil {
t.Fatal(err)
}
// Session via the browser cookie (URL-encoded token.signature) -> works
adminTok := e.makeToken(t, uAdmin)
req := httptest.NewRequest("POST", "/api/photos/galleries", bytes.NewReader([]byte(`{"title":"Via cookie"}`)))
req.Header.Set("Content-Type", "application/json")
req.AddCookie(&http.Cookie{Name: "spanglish.session_token", Value: strings.ReplaceAll(adminTok, ".", "%2E")})
w := httptest.NewRecorder()
e.handler.ServeHTTP(w, req)
if w.Code != 200 && w.Code != 201 {
t.Fatalf("cookie auth: want 2xx, got %d: %s", w.Code, w.Body.String())
}
}
type galleryResp struct {
Gallery galleryJSON `json:"gallery"`
Photos []photoJSON `json:"photos"`
@@ -265,7 +320,7 @@ func processQueue(t *testing.T, e *testEnv, photoID string) store.Photo {
func TestUploadProcessAndServe(t *testing.T) {
e := setup(t)
admin := makeToken(t, uAdmin, "a@x.py", "admin")
admin := e.makeToken(t, uAdmin)
g := createGallery(t, e, admin, map[string]any{"title": "Fiesta de Junio", "visibility": "public"})
if g.Slug != "fiesta-de-junio" {
t.Fatalf("slug: %q", g.Slug)
@@ -325,11 +380,11 @@ func TestUploadProcessAndServe(t *testing.T) {
func TestAccessMatrix(t *testing.T) {
e := setup(t)
admin := makeToken(t, uAdmin, "a@x.py", "admin")
member := makeToken(t, uMember, "m@x.py", "user")
buyer := makeToken(t, uBuyer, "b@x.py", "user")
pending := makeToken(t, uPending, "p@x.py", "user")
freeguy := makeToken(t, uFree, "f@x.py", "user")
admin := e.makeToken(t, uAdmin)
member := e.makeToken(t, uMember)
buyer := e.makeToken(t, uBuyer)
pending := e.makeToken(t, uPending)
freeguy := e.makeToken(t, uFree)
get := func(slug, token, bearer string) int {
path := "/api/photos/public/galleries/" + slug
@@ -408,7 +463,7 @@ func TestAccessMatrix(t *testing.T) {
func TestReorderAndVisibilityUpdate(t *testing.T) {
e := setup(t)
admin := makeToken(t, uAdmin, "a@x.py", "admin")
admin := e.makeToken(t, uAdmin)
g := createGallery(t, e, admin, map[string]any{"title": "Orden", "visibility": "public"})
jpg := testJPEG(t)
p1 := uploadPhoto(t, e, admin, g.ID, jpg)
@@ -447,7 +502,7 @@ func TestReorderAndVisibilityUpdate(t *testing.T) {
// accepts anonymously.
func TestViewTokens(t *testing.T) {
e := setup(t)
admin := makeToken(t, uAdmin, "a@x.py", "admin")
admin := e.makeToken(t, uAdmin)
g := createGallery(t, e, admin, map[string]any{"title": "Privada Con Fotos", "visibility": "private"})
p := uploadPhoto(t, e, admin, g.ID, testJPEG(t))
@@ -499,8 +554,8 @@ func TestViewTokens(t *testing.T) {
func TestEventGalleryRoute(t *testing.T) {
e := setup(t)
admin := makeToken(t, uAdmin, "a@x.py", "admin")
buyer := makeToken(t, uBuyer, "b@x.py", "user")
admin := e.makeToken(t, uAdmin)
buyer := e.makeToken(t, uBuyer)
g := createGallery(t, e, admin, map[string]any{"title": "Del Evento", "visibility": "ticket", "eventId": evPaid})
@@ -546,7 +601,7 @@ func TestEventGalleryRoute(t *testing.T) {
func TestSlugCollision(t *testing.T) {
e := setup(t)
admin := makeToken(t, uAdmin, "a@x.py", "admin")
admin := e.makeToken(t, uAdmin)
a := createGallery(t, e, admin, map[string]any{"title": "Misma Fiesta"})
b := createGallery(t, e, admin, map[string]any{"title": "Misma Fiesta"})
if a.Slug == b.Slug {
photo-api/internal/httpapi/dto.go
+1 -1
View File
@@ -67,7 +67,7 @@ func (s *Server) viewTokenFor(g store.Gallery) string {
if g.Visibility == store.VisibilityPublic {
return ""
}
return mintViewToken([]byte(s.cfg.JWTSecret), g.ID)
return mintViewToken([]byte(s.cfg.ViewTokenSecret), g.ID)
}
func isoTime(t time.Time) string {