From 6651daca670664f3de8af9c7bcb74b1e7c6c6be9 Mon Sep 17 00:00:00 2001
From: Zach Berwaldt <zberwaldt@tutamail.com>
Date: Thu, 7 Mar 2024 19:16:07 -0500
Subject: Add CORS middleware and authentication middleware to the API server.

The `setupRouter` function in `main.go` now includes a CORS middleware and a token authentication middleware. The CORS middleware allows cross-origin resource sharing by setting the appropriate response headers. The token authentication middleware checks for the presence of an `Authorization` header with a valid bearer token. If the token is missing or invalid, an unauthorized response is returned.

In addition to these changes, a new test file `main_test.go` has been added to test the `/api/v1/auth` route. This test suite includes two test cases: one for successful authentication and one for failed authentication.

Update go.mod to include new dependencies.

The `go.mod` file has been modified to include two new dependencies: `github.com/spf13/viper` and `github.com/stretchr/testify`.

Ignore go.sum changes.

Ignore changes in the `go.sum` file, as they only include updates to existing dependencies.
---
 api/internal/controllers/auth.go | 66 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 api/internal/controllers/auth.go

(limited to 'api/internal/controllers/auth.go')

diff --git a/api/internal/controllers/auth.go b/api/internal/controllers/auth.go
new file mode 100644
index 0000000..744a884
--- /dev/null
+++ b/api/internal/controllers/auth.go
@@ -0,0 +1,66 @@
+package controllers
+
+import (
+	"encoding/base64"
+	"net/http"
+	"github.com/gin-gonic/gin"
+	"water/api/database"
+	"errors"
+	"crypto/rand"
+	"database/sql"
+	
+	"water/api/models"
+	_ "github.com/mattn/go-sqlite3"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func AuthHandler (c *gin.Context) {
+	username, password, ok := c.Request.BasicAuth()
+	if !ok {
+		c.Header("WWW-Authenticate", `Basic realm="Please enter your username and password."`)
+		c.AbortWithStatus(http.StatusUnauthorized)
+		return
+	}
+
+	db := database.EstablishDBConnection()
+	defer func(db *sql.DB) {
+		err := db.Close()
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+	}(db)
+
+	var user models.User
+	var preference models.Preference
+	var size models.Size
+
+	row := db.QueryRow("SELECT name, uuid, password, color, size, unit FROM Users u INNER JOIN Preferences p ON p.user_id = u.id INNER JOIN Sizes s ON p.size_id = s.id WHERE u.name = ?", username)
+	if err := row.Scan(&user.Name, &user.UUID, &user.Password, &preference.Color, &size.Size, &size.Unit); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			c.AbortWithStatus(http.StatusUnauthorized)
+			return
+		}
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
+		c.AbortWithStatus(http.StatusUnauthorized)
+		return
+	}
+
+	preference.Size = size
+
+	// Generate a simple API token
+	apiToken := generateToken()
+	c.JSON(http.StatusOK, gin.H{"token": apiToken, "user": user, "preferences": preference})
+}
+
+// generatToken will g
+func generateToken() string {
+	token := make([]byte, 32)
+	_, err := rand.Read(token)
+	if err != nil {
+		return ""
+	}
+	return base64.StdEncoding.EncodeToString(token)
+}
\ No newline at end of file
-- 
cgit v1.1