feat/login crud in users sync with sso

internal/middleware/auth.go

@@ -5,7 +5,7 @@ import (
 
 	"gitlab.com/mbugroup/lti-api.git/internal/config"
 	service "gitlab.com/mbugroup/lti-api.git/internal/modules/users/services"
-	"gitlab.com/mbugroup/lti-api.git/internal/utils"
+	"gitlab.com/mbugroup/lti-api.git/internal/sso"
 
 	"github.com/gofiber/fiber/v2"
 )
@@ -15,21 +15,50 @@ func Auth(userService service.UserService, requiredRights ...string) fiber.Handl
 		authHeader := c.Get("Authorization")
 		token := strings.TrimSpace(strings.TrimPrefix(authHeader, "Bearer "))
 
+		if token == "" {
+			cookieName := config.SSOAccessCookieName
+			if cookieName == "" {
+				cookieName = "access"
+			}
+			token = strings.TrimSpace(c.Cookies(cookieName))
+		}
+
 		if token == "" {
 			return fiber.NewError(fiber.StatusUnauthorized, "Please authenticate")
 		}
 
-		userID, err := utils.VerifyToken(token, config.JWTSecret, config.TokenTypeAccess)
+		verification, err := sso.VerifyAccessToken(token)
 		if err != nil {
 			return fiber.NewError(fiber.StatusUnauthorized, "Please authenticate")
 		}
 
-		user, err := userService.GetOne(c, userID)
+		if len(config.SSOAllowedAudiences) > 0 {
+			allowed := make(map[string]struct{}, len(config.SSOAllowedAudiences))
+			for _, aud := range config.SSOAllowedAudiences {
+				aud = strings.TrimSpace(aud)
+				if aud != "" {
+					allowed[aud] = struct{}{}
+				}
+			}
+			audienceValid := false
+			for _, aud := range verification.Claims.Audience {
+				if _, ok := allowed[aud]; ok {
+					audienceValid = true
+					break
+				}
+			}
+			if !audienceValid {
+				return fiber.NewError(fiber.StatusUnauthorized, "invalid audience")
+			}
+		}
+
+		user, err := userService.GetBySSOUserID(c, verification.UserID)
 		if err != nil || user == nil {
 			return fiber.NewError(fiber.StatusUnauthorized, "Please authenticate")
 		}
 
 		c.Locals("user", user)
+		c.Locals("token_claims", verification.Claims)
 
 		// if len(requiredRights) > 0 {
 		// 	userRights, hasRights := config.RoleRights[user.Role]

internal/middleware/limiter.go

@@ -24,3 +24,24 @@ func LimiterConfig() fiber.Handler {
 		SkipSuccessfulRequests: true,
 	})
 }
+
+func NewLimiter(max int, expiration time.Duration) fiber.Handler {
+	if max <= 0 {
+		max = 10
+	}
+	if expiration <= 0 {
+		expiration = time.Minute
+	}
+	return limiter.New(limiter.Config{
+		Max:        max,
+		Expiration: expiration,
+		LimitReached: func(c *fiber.Ctx) error {
+			return c.Status(fiber.StatusTooManyRequests).
+				JSON(response.Common{
+					Code:    fiber.StatusTooManyRequests,
+					Status:  "error",
+					Message: "Too many requests, please try again later",
+				})
+		},
+	})
+}