Auth & JWT

JWT utilities (internal/auth)

Framework menyediakan JWT utilities stateless — tidak ada middleware auth atau model user bawaan.

// Generate
token, err := auth.SignAccessToken(userID)
refresh, err := auth.SignRefreshToken(userID)

// Parse/verify
userID, err := auth.ParseAccessToken(tokenStr)
userID, err := auth.ParseRefreshToken(tokenStr)

// Expiry
accessExp := auth.AccessExpirySeconds()    // 900 (15 menit)
refreshExp := auth.RefreshExpirySeconds()  // 1209600 (14 hari)

Custom claims

token, expTime, err := auth.GenerateAccessTokenWithLevel(adminID, "admin", 15*time.Minute)

claims, err := auth.ParseAccessTokenClaims(tokenStr)
// claims.AdminID, claims.Level, claims.ExpiresAt

Opaque refresh token (non-JWT)

plainToken, hashedToken, err := auth.GenerateOpaqueRefreshToken()
// simpan hashedToken di DB, kirim plainToken ke client

receivedHash := auth.HashOpaqueToken(plainTokenFromClient)
// bandingkan dengan hash di DB

Poin penting

• JWT stateless & database-agnostic — hanya encode/decode data ke token string
• Query DB dilakukan terpisah memakai ID dari token
• Nama kolom & struktur tabel sepenuhnya terserah kamu

Implementasi auth sebagai plugin

1. Buat plugin: go run ./cmd/console plugin new --id auth
2. Tambah model user/admin di plugin
3. Implement handler login/register + service
4. Buat middleware yang validasi token & inject user ID ke context
5. Register middleware dengan priority sesuai di RegisterMiddleware()

Security recommendations

• Jangan commit AUTH_JWT_SECRET — pakai secret manager
• Access token pendek (900s), refresh token panjang
• Selalu HTTPS; cookie flag Secure, HttpOnly, SameSite