Kyle Isom
a80242ae3e
- Introduced `web/templates/` for HTMX-fragmented pages (`dashboard`, `accounts`, `account_detail`, `error_fragment`, etc.). - Implemented UI routes for account CRUD, audit log display, and login/logout with CSRF protection. - Added `internal/ui/` package for handlers, CSRF manager, session validation, and token issuance. - Updated documentation to include new UI features and templates directory structure. - Security: Double-submit CSRF cookies, constant-time HMAC validation, login password/Argon2id re-verification at all steps to prevent bypass.
21 lines
751 B
Go
21 lines
751 B
Go
package ui
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"time"
|
|
|
|
"git.wntrmute.dev/kyle/mcias/internal/token"
|
|
)
|
|
|
|
// validateSessionToken wraps token.ValidateToken for use by UI session middleware.
|
|
// Security: identical validation pipeline as the REST API — alg check, signature,
|
|
// expiry, issuer, revocation (revocation checked by caller).
|
|
func validateSessionToken(pubKey ed25519.PublicKey, tokenStr, issuer string) (*token.Claims, error) {
|
|
return token.ValidateToken(pubKey, tokenStr, issuer)
|
|
}
|
|
|
|
// issueToken is a convenience method for issuing a signed JWT.
|
|
func (u *UIServer) issueToken(subject string, roles []string, expiry time.Duration) (string, *token.Claims, error) {
|
|
return token.IssueToken(u.privKey, u.cfg.Tokens.Issuer, subject, roles, expiry)
|
|
}
|