second commit

pkg/crypto/crypto_test.go

@@ -0,0 +1,131 @@
+package crypto
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// --- HashPassword and CheckPassword Tests ---
+
+func TestHashPassword_Success(t *testing.T) {
+	hash, err := HashPassword("mypassword123")
+	assert.NoError(t, err)
+	assert.NotEmpty(t, hash)
+	// bcrypt hashes should start with "$2a$" or "$2b$"
+	assert.Contains(t, hash, "$2")
+}
+
+func TestCheckPassword_Matches(t *testing.T) {
+	hash, err := HashPassword("securepassword")
+	assert.NoError(t, err)
+
+	result := CheckPassword("securepassword", hash)
+	assert.True(t, result)
+}
+
+func TestCheckPassword_DoesNotMatch(t *testing.T) {
+	hash, err := HashPassword("securepassword")
+	assert.NoError(t, err)
+
+	result := CheckPassword("wrongpassword", hash)
+	assert.False(t, result)
+}
+
+func TestHashPassword_DifferentHashesForSamePassword(t *testing.T) {
+	hash1, err := HashPassword("samepassword")
+	assert.NoError(t, err)
+
+	hash2, err := HashPassword("samepassword")
+	assert.NoError(t, err)
+
+	// bcrypt uses random salt, so hashes should differ
+	assert.NotEqual(t, hash1, hash2)
+
+	// But both should validate against the same password
+	assert.True(t, CheckPassword("samepassword", hash1))
+	assert.True(t, CheckPassword("samepassword", hash2))
+}
+
+func TestHashPassword_EmptyPassword(t *testing.T) {
+	hash, err := HashPassword("")
+	assert.NoError(t, err)
+	assert.True(t, CheckPassword("", hash))
+}
+
+// --- JWT GenerateToken and ValidateToken Tests ---
+
+func TestGenerateToken_Success(t *testing.T) {
+	cfg := JWTConfig{
+		Secret:           []byte("test-jwt-secret"),
+		ExpiryHours:      1,
+		RefreshExpiryHours: 24,
+	}
+
+	token, err := GenerateToken(cfg, 1, "user@example.com", "agent")
+	assert.NoError(t, err)
+	assert.NotEmpty(t, token)
+}
+
+func TestValidateToken_Valid(t *testing.T) {
+	cfg := JWTConfig{
+		Secret:           []byte("test-jwt-secret"),
+		ExpiryHours:      1,
+		RefreshExpiryHours: 24,
+	}
+
+	token, err := GenerateToken(cfg, 42, "test@example.com", "administrator")
+	assert.NoError(t, err)
+
+	claims, err := ValidateToken(cfg, token)
+	assert.NoError(t, err)
+	assert.Equal(t, float64(42), claims["user_id"])
+	assert.Equal(t, "test@example.com", claims["email"])
+	assert.Equal(t, "administrator", claims["type"])
+}
+
+func TestValidateToken_InvalidSignature(t *testing.T) {
+	cfg := JWTConfig{
+		Secret:           []byte("correct-secret"),
+		ExpiryHours:      1,
+		RefreshExpiryHours: 24,
+	}
+
+	token, err := GenerateToken(cfg, 1, "user@example.com", "agent")
+	assert.NoError(t, err)
+
+	wrongCfg := JWTConfig{
+		Secret:           []byte("wrong-secret"),
+		ExpiryHours:      1,
+		RefreshExpiryHours: 24,
+	}
+
+	claims, err := ValidateToken(wrongCfg, token)
+	assert.Error(t, err)
+	assert.Nil(t, claims)
+}
+
+func TestValidateToken_MalformedToken(t *testing.T) {
+	cfg := JWTConfig{
+		Secret:           []byte("test-jwt-secret"),
+		ExpiryHours:      1,
+		RefreshExpiryHours: 24,
+	}
+
+	claims, err := ValidateToken(cfg, "invalid-token-string")
+	assert.Error(t, err)
+	assert.Nil(t, claims)
+}
+
+// --- JWTConfig Tests ---
+
+func TestJWTConfig_Fields(t *testing.T) {
+	cfg := JWTConfig{
+		Secret:           []byte("secret"),
+		ExpiryHours:      2,
+		RefreshExpiryHours: 48,
+	}
+	assert.Equal(t, []byte("secret"), cfg.Secret)
+	assert.Equal(t, 2, cfg.ExpiryHours)
+	assert.Equal(t, 48, cfg.RefreshExpiryHours)
+}

pkg/crypto/hash.go

@@ -0,0 +1,18 @@
+package crypto
+
+import (
+	"golang.org/x/crypto/bcrypt"
+)
+
+// HashPassword creates a bcrypt hash of the password.
+// Reference: Chatwoot Devise bcrypt password hashing
+func HashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	return string(bytes), err
+}
+
+// CheckPassword verifies a password against its hash
+func CheckPassword(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}

pkg/crypto/jwt.go

@@ -0,0 +1,48 @@
+package crypto
+
+import (
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// JWTConfig holds JWT configuration
+type JWTConfig struct {
+	Secret           []byte
+	ExpiryHours      int
+	RefreshExpiryHours int
+}
+
+// GenerateToken creates a new JWT access token
+func GenerateToken(cfg JWTConfig, userID uint, email string, userType string) (string, error) {
+	claims := jwt.MapClaims{
+		"user_id":  userID,
+		"email":    email,
+		"type":     userType,
+		"exp":      time.Now().Add(time.Duration(cfg.ExpiryHours) * time.Hour).Unix(),
+		"iat":      time.Now().Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(cfg.Secret)
+}
+
+// ValidateToken validates and parses a JWT token
+func ValidateToken(cfg JWTConfig, tokenString string) (jwt.MapClaims, error) {
+	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, jwt.ErrSignatureInvalid
+		}
+		return cfg.Secret, nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, jwt.ErrSignatureInvalid
+}