first commit

backend/internal/auth/routes.go

@@ -0,0 +1,134 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"mira/backend/internal/users"
+
+	"github.com/gin-gonic/gin"
+)
+
+type Routes struct {
+	users  users.Store
+	tokens TokenService
+}
+
+func NewRoutes(users users.Store, tokens TokenService) Routes {
+	return Routes{
+		users:  users,
+		tokens: tokens,
+	}
+}
+
+func (r Routes) Register(router *gin.RouterGroup) {
+	router.POST("/login", r.login)
+	router.POST("/invitations/accept", r.acceptInvitation)
+
+	router.POST("/logout", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"message": "Sessao encerrada."})
+	})
+
+	router.POST("/refresh", func(c *gin.Context) {
+		c.JSON(http.StatusNotImplemented, gin.H{"message": "Renovacao de sessao ainda nao implementada."})
+	})
+}
+
+type loginRequest struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required"`
+}
+
+func (r Routes) login(c *gin.Context) {
+	var input loginRequest
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Informe e-mail e senha validos."})
+		return
+	}
+
+	user, err := r.users.FindByEmail(c.Request.Context(), strings.TrimSpace(input.Email))
+	if errors.Is(err, users.ErrNotFound) {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "E-mail ou senha invalidos."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel fazer login."})
+		return
+	}
+	if !CheckPassword(input.Password, user.PasswordHash) || user.Status != "active" {
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "E-mail ou senha invalidos."})
+		return
+	}
+
+	token, err := r.tokens.IssueAccessToken(user.ID, user.Email, user.Role)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel criar a sessao."})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"access_token": token,
+		"token_type":   "Bearer",
+		"user": gin.H{
+			"id":     user.ID,
+			"email":  user.Email,
+			"name":   user.Name,
+			"role":   user.Role,
+			"status": user.Status,
+		},
+	})
+}
+
+type acceptInvitationRequest struct {
+	Token    string `json:"token" binding:"required"`
+	Name     string `json:"name" binding:"required,min=2"`
+	Password string `json:"password" binding:"required,min=12"`
+}
+
+func (r Routes) acceptInvitation(c *gin.Context) {
+	var input acceptInvitationRequest
+	if err := c.ShouldBindJSON(&input); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Informe nome, senha e token validos."})
+		return
+	}
+
+	passwordHash, err := HashPassword(input.Password)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel proteger a senha."})
+		return
+	}
+
+	user, err := r.users.AcceptInvitation(
+		c.Request.Context(),
+		users.HashInvitationToken(strings.TrimSpace(input.Token)),
+		strings.TrimSpace(input.Name),
+		passwordHash,
+	)
+	if errors.Is(err, users.ErrInvitationNotFound) {
+		c.JSON(http.StatusBadRequest, gin.H{"message": "Convite invalido ou expirado."})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel aceitar o convite."})
+		return
+	}
+
+	token, err := r.tokens.IssueAccessToken(user.ID, user.Email, user.Role)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"message": "Nao foi possivel criar a sessao."})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"access_token": token,
+		"token_type":   "Bearer",
+		"user": gin.H{
+			"id":     user.ID,
+			"email":  user.Email,
+			"name":   user.Name,
+			"role":   user.Role,
+			"status": user.Status,
+		},
+	})
+}