token.go

// Package auth provides utility functions for password authentication
// and JWT access control.
package auth

import (
	"errors"
	"time"

	"github.com/dgrijalva/jwt-go"
	"github.com/flick-web/dispatch"
)

// TokenSigner is an object providing methods for creating and validating JWTs.
type TokenSigner struct {
	secret []byte
	// Issuer is the value of the issuer field in the standard claims attached
	// to tokens generated by this signer.
	Issuer string
}

// NewTokenSigner generates a new TokenSigner object with the specified issuer
// and secret token.
func NewTokenSigner(issuer string, secret []byte) *TokenSigner {
	return &TokenSigner{
		secret: secret,
		Issuer: issuer,
	}
}

// CreateToken creates a JWT token for a user to use for authentication.
func (ts *TokenSigner) CreateToken(username string) (string, error) {
	claims := dispatch.Claims{
		StandardClaims: jwt.StandardClaims{
			ExpiresAt: time.Now().Add(time.Hour * 24).Unix(),
			NotBefore: time.Now().Unix(),
			Issuer:    ts.Issuer,
			Subject:   username,
		},
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString([]byte(ts.secret))
}

// ParseToken verifies a token and returns its claims.
func (ts *TokenSigner) ParseToken(tokenStr string) (*dispatch.Claims, error) {
	token, err := jwt.ParseWithClaims(tokenStr, &dispatch.Claims{}, func(t *jwt.Token) (interface{}, error) {
		return []byte(ts.secret), nil
	})
	if err != nil {
		return nil, err
	}

	claims, ok := token.Claims.(*dispatch.Claims)
	if !ok {
		return nil, errors.New("Incorrect claims type")
	}
	return claims, nil
}