feat(auth): implement user and device authentication

2026-07-26 15:18:48 +08:00
parent c5d3b215ff
commit 49db5b8305
66 changed files with 6216 additions and 271 deletions
@@ -0,0 +1,62 @@
+package usecase
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"cmroubao/backend-api/internal/domain"
+)
+
+type PasswordManager interface {
+	Hash(string) (string, error)
+	Verify(string, string) error
+	VerifyDummy(string)
+}
+
+type OpaqueTokenGenerator interface {
+	NewToken() (string, error)
+}
+
+type AuthRepository interface {
+	FindUserByUsername(context.Context, string) (domain.User, error)
+	ProvisionUser(context.Context, domain.User) (domain.User, error)
+	ProvisionDevice(context.Context, domain.Device) (domain.Device, error)
+	SetUserActive(context.Context, string, bool, time.Time) error
+	SetDeviceEnabled(context.Context, string, bool, time.Time) error
+	CreateAdminSession(
+		context.Context,
+		domain.AdminSession,
+		time.Time,
+	) error
+	AuthenticateAdminSession(
+		context.Context,
+		string,
+		time.Time,
+	) (domain.AuthPrincipal, error)
+	RevokeAdminSession(context.Context, string, time.Time) error
+	CreateAccessTokenAndBindDevice(
+		context.Context,
+		string,
+		string,
+		string,
+		string,
+		string,
+		domain.AccessToken,
+		time.Time,
+	) (domain.Device, error)
+	AuthenticateAccessToken(
+		context.Context,
+		string,
+		time.Time,
+	) (domain.AuthPrincipal, error)
+}
+
+var (
+	ErrAuthCredentials = errors.New("authentication credentials are invalid")
+	ErrAuthDisabled    = errors.New("authentication subject is disabled")
+	ErrAuthForbidden   = errors.New("authentication role is forbidden")
+	ErrAuthExpired     = errors.New("authentication session expired")
+	ErrAuthRevoked     = errors.New("authentication session revoked")
+	ErrAuthConflict    = errors.New("authentication resource conflict")
+)