iu/ds-galo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

feat(auth): store the token signing secret in the metadata layer

Browse Source 
- app_settings table (PostgreSQL migration 000010, SQLite 000002)
- internal/settings repository (Get/Set/Ensure) wired into store.Repos
- secret generated with crypto/rand on first start and persisted; reused on restart
- drop required JWT_SECRET from env/config; app.New takes a TokenManager and
  storage.Open takes the resolved secret (URL_SECRET still overrides)
- docs updated
This commit is contained in:
iu
2026-10-11 10:18:31 +03:00
parent 176a8d8ced
commit cb272398ce
29 changed files with 489 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/cmd/backfill-exif/main.go
+11 -4
View File
@@ -9,8 +9,9 @@ import (
"shared-album/internal/config"
"shared-album/internal/db"
"shared-album/internal/photos"
"shared-album/internal/settings"
"shared-album/internal/storage"
"shared-album/internal/store"
)
func main() {
@@ -35,14 +36,20 @@ func main() {
}
defer pool.Close()
store, err := storage.Open(ctx, cfg)
repos := store.NewPostgres(pool)
secret, err := repos.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
if err != nil {
slog.Error("secret init failed", "error", err)
os.Exit(1)
}
blob, err := storage.Open(ctx, cfg, secret)
if err != nil {
slog.Error("storage init failed", "error", err)
os.Exit(1)
}
photoStore := photos.NewStore(pool)
updated, err := photoStore.BackfillEXIF(ctx, store.Get)
updated, err := repos.Photos.BackfillEXIF(ctx, blob.Get)
if err != nil {
slog.Error("backfill failed", "error", err)
os.Exit(1)
backend/cmd/reconcile/main.go
+8 -1
View File
@@ -18,6 +18,7 @@ import (
"shared-album/internal/config"
"shared-album/internal/db"
"shared-album/internal/reconcile"
"shared-album/internal/settings"
"shared-album/internal/storage"
"shared-album/internal/store"
)
@@ -50,7 +51,13 @@ func main() {
}
defer closer()
blob, err := storage.Open(ctx, cfg)
secret, err := repos.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
if err != nil {
slog.Error("secret init failed", "error", err)
os.Exit(1)
}
blob, err := storage.Open(ctx, cfg, secret)
if err != nil {
slog.Error("storage init failed", "error", err)
os.Exit(1)
backend/cmd/server/main.go
+11 -2
View File
@@ -15,8 +15,10 @@ import (
assets "shared-album"
"shared-album/internal/app"
"shared-album/internal/auth"
"shared-album/internal/config"
"shared-album/internal/db"
"shared-album/internal/settings"
"shared-album/internal/sse"
"shared-album/internal/storage"
"shared-album/internal/store"
@@ -84,7 +86,14 @@ func main() {
defer closer()
slog.Info("migrations applied", "db_backend", cfg.Database.Backend)
blob, err := storage.Open(ctx, cfg)
secret, err := repos.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
if err != nil {
slog.Error("secret init failed", "error", err)
os.Exit(1)
}
tm := auth.NewTokenManager(secret, cfg.Auth.AccessTTL, cfg.Auth.RefreshTTL)
blob, err := storage.Open(ctx, cfg, secret)
if err != nil {
slog.Error("storage init failed", "error", err)
os.Exit(1)
@@ -96,7 +105,7 @@ func main() {
}
hub := sse.NewHub(cfg.SSE.ClientBuffer)
server := app.New(cfg, repos, ping, blob, hub)
server := app.New(cfg, repos, ping, tm, blob, hub)
go server.StartWorker(ctx)
backend/internal/app/app.go
+1 -2
View File
@@ -50,8 +50,7 @@ type Server struct {
// New wires the domain services over the selected metadata repositories. ping
// reports the health of the metadata backend so health stays backend-agnostic.
func New(cfg *config.Config, repos store.Repos, ping func(ctx context.Context) error, st storage.Backend, hub *sse.Hub) *Server {
tm := auth.NewTokenManager(cfg.Auth.JWTSecret, cfg.Auth.AccessTTL, cfg.Auth.RefreshTTL)
func New(cfg *config.Config, repos store.Repos, ping func(ctx context.Context) error, tm *auth.TokenManager, st storage.Backend, hub *sse.Hub) *Server {
authSvc := auth.NewService(repos.Auth, tm)
notifSvc := notifications.NewService(repos.Notifications, hub)
backend/internal/app/objects_test.go
+3 -1
View File
@@ -12,6 +12,7 @@ import (
"github.com/gin-gonic/gin"
"shared-album/internal/auth"
"shared-album/internal/config"
"shared-album/internal/sse"
"shared-album/internal/storage"
@@ -30,7 +31,8 @@ func newTestServerWithFS(t *testing.T) (*storage.FS, *gin.Engine) {
t.Fatalf("new fs: %v", err)
}
noop := func(context.Context) error { return nil }
srv := New(&config.Config{}, store.Repos{}, noop, fs, sse.NewHub(1))
tm := auth.NewTokenManager("test-secret", 15*time.Minute, time.Hour)
srv := New(&config.Config{}, store.Repos{}, noop, tm, fs, sse.NewHub(1))
return fs, srv.Router()
}
backend/internal/app/share_flow_test.go
+2 -1
View File
@@ -71,7 +71,8 @@ func runShareFlow(t *testing.T, backend storage.Backend, verify func(t *testing.
gin.SetMode(gin.TestMode)
hub := sse.NewHub(1)
srv := New(&config.Config{}, store.NewPostgres(pool), pool.Ping, backend, hub)
tm := auth.NewTokenManager("test-secret", 15*time.Minute, time.Hour)
srv := New(&config.Config{}, store.NewPostgres(pool), pool.Ping, tm, backend, hub)
router := srv.Router()
authStore := auth.NewStore(pool)
backend/internal/config/config.go
-6
View File
@@ -31,7 +31,6 @@ type S3 struct {
}
type Auth struct {
JWTSecret string
AccessTTL time.Duration
RefreshTTL time.Duration
}
@@ -154,7 +153,6 @@ func Load() (*Config, error) {
SQLitePath: getEnv("SQLITE_PATH", "./galo.db"),
},
Auth: Auth{
JWTSecret: getEnv("JWT_SECRET", ""),
AccessTTL: accessTTL,
RefreshTTL: refreshTTL,
},
@@ -173,10 +171,6 @@ func Load() (*Config, error) {
},
}
if cfg.Auth.JWTSecret == "" {
return nil, fmt.Errorf("JWT_SECRET is required")
}
switch cfg.Database.Backend {
case "postgres":
if cfg.Postgres.Password == "" {
backend/internal/e2e/sqlite_test.go
+48
View File
@@ -17,6 +17,7 @@ import (
"shared-album/internal/auth"
"shared-album/internal/db"
"shared-album/internal/photos"
"shared-album/internal/settings"
"shared-album/internal/sse"
"shared-album/internal/storage"
"shared-album/internal/store"
@@ -137,6 +138,53 @@ func TestSQLiteEndToEndWithRestart(t *testing.T) {
})
}
func TestJWTSecretPersistsAcrossRestart(t *testing.T) {
ctx := context.Background()
path := filepath.Join(t.TempDir(), "galo.db")
migFS, err := fs.Sub(assets.Migrations, "migrations/sqlite")
if err != nil {
t.Fatalf("migrations fs: %v", err)
}
open := func() (*sql.DB, store.Repos) {
t.Helper()
if err := db.MigrateSQLite(path, migFS); err != nil {
t.Fatalf("migrate: %v", err)
}
database, err := db.OpenSQLite(path)
if err != nil {
t.Fatalf("open: %v", err)
}
return database, store.NewSQLite(database)
}
db1, repos1 := open()
secret1, err := repos1.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
if err != nil || secret1 == "" {
t.Fatalf("ensure secret: %v %q", err, secret1)
}
tm1 := auth.NewTokenManager(secret1, 15*time.Minute, time.Hour)
token, err := tm1.GenerateAccess("user-1", "u@test.local")
if err != nil {
t.Fatalf("generate: %v", err)
}
_ = db1.Close()
db2, repos2 := open()
defer db2.Close()
secret2, err := repos2.Settings.Ensure(ctx, settings.JWTSecretKey, settings.GenerateSecret)
if err != nil {
t.Fatalf("ensure after restart: %v", err)
}
if secret2 != secret1 {
t.Fatalf("secret changed across restart")
}
tm2 := auth.NewTokenManager(secret2, 15*time.Minute, time.Hour)
if _, err := tm2.ParseAccess(token); err != nil {
t.Fatalf("token issued before restart not valid after: %v", err)
}
}
func waitFor(t *testing.T, what string, cond func() bool) {
t.Helper()
deadline := time.Now().Add(10 * time.Second)
backend/internal/repo/contract/contract.go
+27
View File
@@ -15,6 +15,7 @@ import (
"shared-album/internal/models"
"shared-album/internal/notifications"
"shared-album/internal/photos"
"shared-album/internal/settings"
"shared-album/internal/sharelinks"
"shared-album/internal/social"
)
@@ -29,6 +30,7 @@ type Repos struct {
Social social.Repository
Notifications notifications.Repository
ShareLinks sharelinks.Repository
Settings settings.Repository
Reset func(ctx context.Context) error
}
@@ -47,6 +49,7 @@ func Run(t *testing.T, r Repos) {
{"Social", testSocial},
{"Photos", testPhotos},
{"Objects", testObjects},
{"Settings", testSettings},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
@@ -523,6 +526,30 @@ func testObjects(t *testing.T, ctx context.Context, r Repos) {
}
}
func testSettings(t *testing.T, ctx context.Context, r Repos) {
v, err := r.Settings.Ensure(ctx, settings.JWTSecretKey, func() (string, error) { return "generated-1", nil })
if err != nil || v != "generated-1" {
t.Fatalf("ensure first: %v %q", err, v)
}
v2, err := r.Settings.Ensure(ctx, settings.JWTSecretKey, func() (string, error) { return "generated-2", nil })
if err != nil || v2 != "generated-1" {
t.Fatalf("ensure not idempotent: %v %q", err, v2)
}
got, ok, err := r.Settings.Get(ctx, settings.JWTSecretKey)
if err != nil || !ok || got != "generated-1" {
t.Fatalf("get: %v ok=%v %q", err, ok, got)
}
if _, ok, _ := r.Settings.Get(ctx, "missing"); ok {
t.Fatalf("missing key reported present")
}
if err := r.Settings.Set(ctx, settings.JWTSecretKey, "rotated"); err != nil {
t.Fatalf("set: %v", err)
}
if got, _, _ := r.Settings.Get(ctx, settings.JWTSecretKey); got != "rotated" {
t.Fatalf("set not applied: %q", got)
}
}
func contains(list []string, v string) bool {
for _, x := range list {
if x == v {
backend/internal/repo/contract/postgres_test.go
+3 -1
View File
@@ -17,6 +17,7 @@ import (
"shared-album/internal/members"
"shared-album/internal/notifications"
"shared-album/internal/photos"
"shared-album/internal/settings"
"shared-album/internal/sharelinks"
"shared-album/internal/social"
)
@@ -70,8 +71,9 @@ func TestPostgresContract(t *testing.T) {
Social: social.NewStore(pool),
Notifications: notifications.NewStore(pool),
ShareLinks: sharelinks.NewStore(pool),
Settings: settings.NewStore(pool),
Reset: func(ctx context.Context) error {
_, err := pool.Exec(ctx, `TRUNCATE users, objects CASCADE`)
_, err := pool.Exec(ctx, `TRUNCATE users, objects, app_settings CASCADE`)
return err
},
})
backend/internal/repo/contract/sqlite_test.go
+3 -1
View File
@@ -13,6 +13,7 @@ import (
"shared-album/internal/members"
"shared-album/internal/notifications"
"shared-album/internal/photos"
"shared-album/internal/settings"
"shared-album/internal/sharelinks"
"shared-album/internal/social"
)
@@ -40,11 +41,12 @@ func TestSQLiteContract(t *testing.T) {
Social: social.NewSQLiteStore(database),
Notifications: notifications.NewSQLiteStore(database),
ShareLinks: sharelinks.NewSQLiteStore(database),
Settings: settings.NewSQLiteStore(database),
Reset: func(ctx context.Context) error {
tables := []string{
"variant_jobs", "photo_objects", "objects", "photo_tags", "tags",
"refresh_tokens", "share_links", "notifications", "likes", "comments",
"invites", "album_members", "photos", "albums", "users",
"invites", "album_members", "photos", "albums", "users", "app_settings",
}
for _, tbl := range tables {
if _, err := database.ExecContext(ctx, "DELETE FROM "+tbl); err != nil {
backend/internal/settings/generate.go
+15
View File
@@ -0,0 +1,15 @@
package settings
import (
"crypto/rand"
"encoding/base64"
)
// GenerateSecret returns a new random secret suitable for HMAC signing.
func GenerateSecret() (string, error) {
buf := make([]byte, 32)
if _, err := rand.Read(buf); err != nil {
return "", err
}
return base64.RawURLEncoding.EncodeToString(buf), nil
}
backend/internal/settings/settings.go
+20
View File
@@ -0,0 +1,20 @@
// Package settings persists application-level key/value settings in the
// metadata layer. The main use is the token signing secret, generated on first
// use and reused afterwards.
package settings
import "context"
// JWTSecretKey is the settings key holding the token signing secret.
const JWTSecretKey = "jwt_secret"
// Repository reads and writes application settings.
type Repository interface {
// Get returns the value for key and whether it exists.
Get(ctx context.Context, key string) (string, bool, error)
// Set stores or replaces the value for key.
Set(ctx context.Context, key, value string) error
// Ensure returns the existing value for key, or generates and stores one
// using generate when absent. Concurrent first use yields one value.
Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error)
}
backend/internal/settings/sqlite_store.go
+63
View File
@@ -0,0 +1,63 @@
package settings
import (
"context"
"database/sql"
"errors"
"fmt"
"time"
"shared-album/internal/sqliteutil"
)
// SQLiteStore is the SQLite implementation of Repository.
type SQLiteStore struct {
db *sql.DB
}
func NewSQLiteStore(db *sql.DB) *SQLiteStore { return &SQLiteStore{db: db} }
func (s *SQLiteStore) Get(ctx context.Context, key string) (string, bool, error) {
var v string
err := s.db.QueryRowContext(ctx, `SELECT value FROM app_settings WHERE key = $1`, key).Scan(&v)
if err != nil {
if errors.Is(err, sql.ErrNoRows) {
return "", false, nil
}
return "", false, err
}
return v, true, nil
}
func (s *SQLiteStore) Set(ctx context.Context, key, value string) error {
_, err := s.db.ExecContext(ctx,
`INSERT INTO app_settings (key, value) VALUES ($1, $2)
ON CONFLICT (key) DO UPDATE SET value = excluded.value, updated_at = $3`,
key, value, sqliteutil.FormatTime(time.Now()))
return err
}
func (s *SQLiteStore) Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error) {
if v, ok, err := s.Get(ctx, key); err != nil {
return "", err
} else if ok {
return v, nil
}
v, err := generate()
if err != nil {
return "", err
}
if _, err := s.db.ExecContext(ctx,
`INSERT INTO app_settings (key, value) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING`,
key, v); err != nil {
return "", err
}
got, ok, err := s.Get(ctx, key)
if err != nil {
return "", err
}
if !ok {
return "", fmt.Errorf("settings: %q missing after insert", key)
}
return got, nil
}
backend/internal/settings/store.go
+62
View File
@@ -0,0 +1,62 @@
package settings
import (
"context"
"errors"
"fmt"
"github.com/jackc/pgx/v5"
"github.com/jackc/pgx/v5/pgxpool"
)
// Store is the PostgreSQL implementation of Repository.
type Store struct {
pool *pgxpool.Pool
}
func NewStore(pool *pgxpool.Pool) *Store { return &Store{pool: pool} }
func (s *Store) Get(ctx context.Context, key string) (string, bool, error) {
var v string
err := s.pool.QueryRow(ctx, `SELECT value FROM app_settings WHERE key = $1`, key).Scan(&v)
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
return "", false, nil
}
return "", false, err
}
return v, true, nil
}
func (s *Store) Set(ctx context.Context, key, value string) error {
_, err := s.pool.Exec(ctx,
`INSERT INTO app_settings (key, value) VALUES ($1, $2)
ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = now()`,
key, value)
return err
}
func (s *Store) Ensure(ctx context.Context, key string, generate func() (string, error)) (string, error) {
if v, ok, err := s.Get(ctx, key); err != nil {
return "", err
} else if ok {
return v, nil
}
v, err := generate()
if err != nil {
return "", err
}
if _, err := s.pool.Exec(ctx,
`INSERT INTO app_settings (key, value) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING`,
key, v); err != nil {
return "", err
}
got, ok, err := s.Get(ctx, key)
if err != nil {
return "", err
}
if !ok {
return "", fmt.Errorf("settings: %q missing after insert", key)
}
return got, nil
}
backend/internal/storage/storage.go
+7 -3
View File
@@ -98,11 +98,15 @@ func (c *S3) Bucket() string { return c.bucket }
// Open builds the storage backend selected by configuration: S3-compatible by
// default, or the local file system when STORAGE_BACKEND=fs. Every backend
// delivers blobs through the app using a shared Signer.
func Open(ctx context.Context, cfg *config.Config) (Backend, error) {
// delivers blobs through the app using a shared Signer. jwtSecret is the
// application secret used to sign object URLs when URL_SECRET is not set.
func Open(ctx context.Context, cfg *config.Config, jwtSecret string) (Backend, error) {
secret := cfg.Storage.URLSecret
if secret == "" {
secret = cfg.Auth.JWTSecret
secret = jwtSecret
}
if secret == "" {
return nil, errors.New("object URL secret is not available")
}
signer, err := NewSigner(cfg.Server.BaseURL, secret, cfg.Storage.URLTTL)
if err != nil {
backend/internal/store/store.go
+4
View File
@@ -13,6 +13,7 @@ import (
"shared-album/internal/members"
"shared-album/internal/notifications"
"shared-album/internal/photos"
"shared-album/internal/settings"
"shared-album/internal/sharelinks"
"shared-album/internal/social"
)
@@ -26,6 +27,7 @@ type Repos struct {
Social social.Repository
Notifications notifications.Repository
ShareLinks sharelinks.Repository
Settings settings.Repository
}
// NewPostgres builds the repositories backed by PostgreSQL.
@@ -38,6 +40,7 @@ func NewPostgres(pool *pgxpool.Pool) Repos {
Social: social.NewStore(pool),
Notifications: notifications.NewStore(pool),
ShareLinks: sharelinks.NewStore(pool),
Settings: settings.NewStore(pool),
}
}
@@ -51,5 +54,6 @@ func NewSQLite(db *sql.DB) Repos {
Social: social.NewSQLiteStore(db),
Notifications: notifications.NewSQLiteStore(db),
ShareLinks: sharelinks.NewSQLiteStore(db),
Settings: settings.NewSQLiteStore(db),
}
}
backend/migrations/000010_app_settings.down.sql
+1
View File
@@ -0,0 +1 @@
DROP TABLE IF EXISTS app_settings;
backend/migrations/000010_app_settings.up.sql
+6
View File
@@ -0,0 +1,6 @@
CREATE TABLE IF NOT EXISTS app_settings (
key text PRIMARY KEY,
value text NOT NULL,
created_at timestamptz NOT NULL DEFAULT now(),
updated_at timestamptz NOT NULL DEFAULT now()
);
backend/migrations/sqlite/000002_app_settings.down.sql
+1
View File
@@ -0,0 +1 @@
DROP TABLE IF EXISTS app_settings;
backend/migrations/sqlite/000002_app_settings.up.sql
+6
View File
@@ -0,0 +1,6 @@
CREATE TABLE app_settings (
key TEXT PRIMARY KEY,
value TEXT NOT NULL,
created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
);