Reapply "Build post chat and attachment workflows"

This reverts commit 5bc4a551af.

backend/internal/auth/routes.go

@@ -4,35 +4,40 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+	"time"
 
 	"mira/backend/internal/users"
 
 	"github.com/gin-gonic/gin"
 )
 
+const refreshCookieName = "mira_refresh_token"
+
 type Routes struct {
-	users  users.Store
-	tokens TokenService
+	users            users.Store
+	sessions         SessionStore
+	tokens           TokenService
+	refreshTTL       time.Duration
+	secureCookies    bool
+	loginRateLimiter *LoginRateLimiter
 }
 
-func NewRoutes(users users.Store, tokens TokenService) Routes {
+func NewRoutes(users users.Store, sessions SessionStore, tokens TokenService, refreshTTL time.Duration, secureCookies bool) Routes {
 	return Routes{
-		users:  users,
-		tokens: tokens,
+		users:            users,
+		sessions:         sessions,
+		tokens:           tokens,
+		refreshTTL:       refreshTTL,
+		secureCookies:    secureCookies,
+		loginRateLimiter: NewLoginRateLimiter(5, 15*time.Minute),
 	}
 }
 
 func (r Routes) Register(router *gin.RouterGroup) {
 	router.POST("/login", r.login)
 	router.POST("/invitations/accept", r.acceptInvitation)
-
-	router.POST("/logout", func(c *gin.Context) {
-		c.JSON(http.StatusOK, gin.H{"message": "Sessao encerrada."})
-	})
-
-	router.POST("/refresh", func(c *gin.Context) {
-		c.JSON(http.StatusNotImplemented, gin.H{"message": "Renovacao de sessao ainda nao implementada."})
-	})
+	router.POST("/logout", r.logout)
+	router.POST("/refresh", r.refresh)
 }
 
 type loginRequest struct {
@@ -47,8 +52,16 @@ func (r Routes) login(c *gin.Context) {
 		return
 	}
 
-	user, err := r.users.FindByEmail(c.Request.Context(), strings.TrimSpace(input.Email))
+	email := strings.TrimSpace(input.Email)
+	rateLimitKey := LoginRateLimitKey(c.ClientIP(), email)
+	if r.loginRateLimiter.IsBlocked(rateLimitKey) {
+		c.JSON(http.StatusTooManyRequests, gin.H{"message": "Muitas tentativas de login. Tente novamente em alguns minutos."})
+		return
+	}
+
+	user, err := r.users.FindByEmail(c.Request.Context(), email)
 	if errors.Is(err, users.ErrNotFound) {
+		r.loginRateLimiter.RecordFailure(rateLimitKey)
 		c.JSON(http.StatusUnauthorized, gin.H{"message": "E-mail ou senha invalidos."})
 		return
 	}
@@ -57,15 +70,17 @@ func (r Routes) login(c *gin.Context) {
 		return
 	}
 	if !CheckPassword(input.Password, user.PasswordHash) || user.Status != "active" {
+		r.loginRateLimiter.RecordFailure(rateLimitKey)
 		c.JSON(http.StatusUnauthorized, gin.H{"message": "E-mail ou senha invalidos."})
 		return
 	}
 
-	token, err := r.tokens.IssueAccessToken(user.ID, user.Email, user.Role)
+	token, err := r.createSession(c, user)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel criar a sessao."})
 		return
 	}
+	r.loginRateLimiter.Clear(rateLimitKey)
 
 	c.JSON(http.StatusOK, gin.H{
 		"access_token": token,
@@ -114,15 +129,8 @@ func (r Routes) acceptInvitation(c *gin.Context) {
 		return
 	}
 
-	token, err := r.tokens.IssueAccessToken(user.ID, user.Email, user.Role)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel criar a sessao."})
-		return
-	}
-
 	c.JSON(http.StatusOK, gin.H{
-		"access_token": token,
-		"token_type":   "Bearer",
+		"message": "Senha criada com sucesso. Faca login para acessar o Mira.",
 		"user": gin.H{
 			"id":     user.ID,
 			"email":  user.Email,
@@ -132,3 +140,84 @@ func (r Routes) acceptInvitation(c *gin.Context) {
 		},
 	})
 }
+
+func (r Routes) refresh(c *gin.Context) {
+	refreshToken, err := c.Cookie(refreshCookieName)
+	if err != nil || strings.TrimSpace(refreshToken) == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Sessao expirada."})
+		return
+	}
+
+	tokenHash := HashRefreshToken(refreshToken)
+	session, err := r.sessions.FindValidRefreshSession(c.Request.Context(), tokenHash)
+	if errors.Is(err, ErrRefreshTokenNotFound) {
+		r.clearRefreshCookie(c)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "Sessao expirada."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel renovar a sessao."})
+		return
+	}
+
+	if err := r.sessions.RevokeRefreshSession(c.Request.Context(), tokenHash); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel renovar a sessao."})
+		return
+	}
+
+	accessToken, err := r.createSession(c, session.User)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel renovar a sessao."})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"access_token": accessToken,
+		"token_type":   "Bearer",
+		"user": gin.H{
+			"id":     session.User.ID,
+			"email":  session.User.Email,
+			"name":   session.User.Name,
+			"role":   session.User.Role,
+			"status": session.User.Status,
+		},
+	})
+}
+
+func (r Routes) logout(c *gin.Context) {
+	refreshToken, err := c.Cookie(refreshCookieName)
+	if err == nil && strings.TrimSpace(refreshToken) != "" {
+		_ = r.sessions.RevokeRefreshSession(c.Request.Context(), HashRefreshToken(refreshToken))
+	}
+	r.clearRefreshCookie(c)
+	c.JSON(http.StatusOK, gin.H{"message": "Sessao encerrada."})
+}
+
+func (r Routes) createSession(c *gin.Context, user users.User) (string, error) {
+	refreshToken, err := GenerateRefreshToken()
+	if err != nil {
+		return "", err
+	}
+
+	if err := r.sessions.CreateRefreshSession(
+		c.Request.Context(),
+		user.ID,
+		HashRefreshToken(refreshToken),
+		time.Now().Add(r.refreshTTL),
+	); err != nil {
+		return "", err
+	}
+
+	r.setRefreshCookie(c, refreshToken)
+	return r.tokens.IssueAccessToken(user.ID, user.Email, user.Role)
+}
+
+func (r Routes) setRefreshCookie(c *gin.Context, token string) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(refreshCookieName, token, int(r.refreshTTL.Seconds()), "/api/v1/auth", "", r.secureCookies, true)
+}
+
+func (r Routes) clearRefreshCookie(c *gin.Context) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(refreshCookieName, "", 0, "/api/v1/auth", "", r.secureCookies, true)
+}