Authentication Service (recerdo-auth)¶

// User エンティティ
type User struct {
    UserID      string    // UUID
    Email       string
    PhoneNumber string
    CognitoSub  string    // Cognito User Pool内の一意識別子
    Status      string    // ACTIVE, SUSPENDED
    CreatedAt   time.Time
    UpdatedAt   time.Time
    SyncVersion int64     // 楽観的ロック・監査用
}

func (u *User) IsSuspended() bool {
    return u.Status == "SUSPENDED"
}

func (u *User) CanLogin() bool {
    return u.Status == "ACTIVE" && u.CognitoSub != ""
}

// Session エンティティ
type Session struct {
    SessionID        string
    UserID          string
    DeviceID        string
    AccessTokenJTI  string
    RefreshTokenJTI string
    IssuedAt        time.Time
    AccessExpiresAt time.Time
    RefreshExpiresAt time.Time
    IPAddress       string
    UserAgent       string
    IsRevoked       bool
}

func (s *Session) IsAccessTokenExpired(now time.Time) bool {
    return now.After(s.AccessExpiresAt)
}

func (s *Session) IsRefreshTokenExpired(now time.Time) bool {
    return now.After(s.RefreshExpiresAt)
}

func (s *Session) IsValid(now time.Time, isTokenBlocked bool) bool {
    return !s.IsRevoked && !isTokenBlocked && !s.IsAccessTokenExpired(now)
}

// Device エンティティ
type Device struct {
    DeviceID     string
    UserID      string
    DeviceName  string
    DeviceType  string    // iOS, Web, Android
    OSVersion   string
    AppVersion  string
    Fingerprint string    // SHA256(type+os+app)
    LastSeenAt  time.Time
    CreatedAt   time.Time
    IsArchived  bool
}

func (d *Device) MatchesFingerprint(calculated string) bool {
    return d.Fingerprint == calculated
}

func (d *Device) UpdateLastSeen(now time.Time) {
    d.LastSeenAt = now
}

// BlockedToken エンティティ
type BlockedToken struct {
    JTI               string    // JWT ID
    UserID           string
    TokenType        string    // ACCESS, REFRESH
    RevocationReason string    // LOGOUT, USER_SUSPENDED, DEVICE_ARCHIVED
    ExpiresAt        time.Time // トークン本来の有効期限
    BlockedAt        time.Time
}

func (b *BlockedToken) IsExpired(now time.Time) bool {
    return now.After(b.ExpiresAt)
}

// RefreshTokenGrant エンティティ (監査ログ)
type RefreshTokenGrant struct {
    GrantID   string
    UserID   string
    OldJTI   string
    NewJTI   string
    DeviceID string
    RequestedAt time.Time
    GrantedAt   time.Time
    ClientIP    string
}

// Repository Ports
type UserRepository interface {
    GetUser(ctx context.Context, userID string) (*User, error)
    GetByCognitoSub(ctx context.Context, cognitoSub string) (*User, error)
    CreateOrUpdate(ctx context.Context, user *User) error
    ListByCognitoSubs(ctx context.Context, subs []string) ([]*User, error)
}

type SessionRepository interface {
    Create(ctx context.Context, session *Session) error
    GetBySessionID(ctx context.Context, sessionID string) (*Session, error)
    GetByAccessTokenJTI(ctx context.Context, jti string) (*Session, error)
    GetByRefreshTokenJTI(ctx context.Context, jti string) (*Session, error)
    ListByUserID(ctx context.Context, userID string) ([]*Session, error)
    Update(ctx context.Context, session *Session) error
    RevokeByUserID(ctx context.Context, userID string, skipDeviceID *string) (int64, error)
    RevokeByDeviceID(ctx context.Context, deviceID string) (int64, error)
    DeleteExpired(ctx context.Context, beforeTime time.Time) (int64, error)
}

type DeviceRepository interface {
    Create(ctx context.Context, device *Device) error
    GetByDeviceID(ctx context.Context, deviceID string) (*Device, error)
    ListByUserID(ctx context.Context, userID string) ([]*Device, error)
    FindOrCreateByFingerprint(ctx context.Context, userID, fingerprint string, name, dtype string) (*Device, error)
    Archive(ctx context.Context, deviceID string) error
    UpdateLastSeen(ctx context.Context, deviceID string, now time.Time) error
}

type BlockedTokenRepository interface {
    Add(ctx context.Context, token *BlockedToken) error
    Exists(ctx context.Context, jti string) (bool, error)
    DeleteExpired(ctx context.Context, beforeTime time.Time) (int64, error)
    ListByUserID(ctx context.Context, userID string) ([]*BlockedToken, error)
}

type RefreshTokenGrantRepository interface {
    Record(ctx context.Context, grant *RefreshTokenGrant) error
    ListByUserID(ctx context.Context, userID string, limit int) ([]*RefreshTokenGrant, error)
}

type JWKSRepository interface {
    GetCached(ctx context.Context) (map[string]interface{}, error)
    Set(ctx context.Context, jwks map[string]interface{}, ttl time.Duration) error
    Invalidate(ctx context.Context) error
}

// Service Ports
type CognitoAuthPort interface {
    Authenticate(ctx context.Context, phoneNumber, password string) (*CognitoAuthResult, error)
    // CognitoAuthResult { AccessToken, IDToken, RefreshToken (Cognito側), ExpiresIn }
    FetchJWKS(ctx context.Context) (map[string]interface{}, error)
    GetUserAttributes(ctx context.Context, accessToken string) (map[string]string, error)
}

type JWTSignerPort interface {
    SignAccessToken(ctx context.Context, claims JWTClaims) (string, error)
    SignRefreshToken(ctx context.Context, claims JWTClaims) (string, error)
    VerifyToken(ctx context.Context, tokenString string) (*JWTClaims, error)
}

type PermissionPort interface {
    GetUserPermissionsVersion(ctx context.Context, userID string) (int64, error)
    CheckUserStatus(ctx context.Context, userID string) (string, error) // ACTIVE, SUSPENDED
}

type EventPublisherPort interface {
    PublishUserLoggedIn(ctx context.Context, event *UserLoggedInEvent) error
    PublishUserLoggedOut(ctx context.Context, event *UserLoggedOutEvent) error
    PublishTokenRefreshed(ctx context.Context, event *TokenRefreshedEvent) error
    PublishTokenRevoked(ctx context.Context, event *TokenRevokedEvent) error
    PublishDeviceRegistered(ctx context.Context, event *DeviceRegisteredEvent) error
    PublishUserSuspended(ctx context.Context, event *UserSuspendedEvent) error
    PublishCognitoUserSynced(ctx context.Context, event *CognitoUserSyncedEvent) error
}

type RateLimitPort interface {
    CheckLogin(ctx context.Context, phoneNumber string) (bool, error) // phone_number単位で1分に5回制限
    CheckRefresh(ctx context.Context, userID string) (bool, error)    // user_id単位で1時間に100回制限
}

fx.Provide(
    NewMySQLConnection,           // MySQL pool
    NewRedisClient,                  // Redis connection
    NewCognitoClient,                // AWS SDK Cognito（Cognito のみ AWS 利用）
    NewQueueClient,                  // QueuePort クライアント（Feature Flag で Beta: Redis+BullMQ/asynq, 本番: OCI Queue）
    NewGRPCPermissionClient,         // gRPC Permission Service

    // Repositories
    NewMySQLUserRepository,     // → UserRepository
    NewMySQLSessionRepository,  // → SessionRepository
    NewMySQLDeviceRepository,   // → DeviceRepository
    NewRedisBlockedTokenRepository,  // → BlockedTokenRepository
    NewMySQLRefreshTokenGrantRepository,
    NewRedisJWKSRepository,          // → JWKSRepository

    // Service Adapters
    NewAWSCognitoAdapter,            // → CognitoAuthPort
    NewRSA256JWTSigner,              // → JWTSignerPort
    NewPermissionServiceGRPCAdapter, // → PermissionPort
    NewQueueEventPublisher,          // → EventPublisherPort（QueuePort 委譲）
    NewRedisRateLimitAdapter,        // → RateLimitPort

    // Use Cases
    NewLoginUseCase,
    NewRefreshTokenUseCase,
    NewLogoutUseCase,
    NewGetJWKSUseCase,
    NewSyncCognitoUserUseCase,
    NewRegisterDeviceUseCase,
    NewArchiveDeviceUseCase,
    NewRevokeUserTokensUseCase,
    NewListSessionsUseCase,

    // Handlers
    NewAuthHTTPHandler,
    NewJWKSHTTPHandler,
    NewHealthHandler,
)

// Entity Test
func TestUser_CanLogin_ActiveUser(t *testing.T) {
    user := &User{
        UserID:     "user-123",
        CognitoSub: "cognito-456",
        Status:     "ACTIVE",
    }
    assert.True(t, user.CanLogin())
}

func TestUser_CanLogin_SuspendedUser(t *testing.T) {
    user := &User{
        UserID:     "user-123",
        CognitoSub: "cognito-456",
        Status:     "SUSPENDED",
    }
    assert.False(t, user.CanLogin())
}

func TestSession_IsValid_AllChecks(t *testing.T) {
    session := &Session{
        IsRevoked:        false,
        AccessExpiresAt:  time.Now().Add(30 * time.Minute),
    }
    now := time.Now()
    assert.True(t, session.IsValid(now, false)) // not revoked, not blocked, not expired
    assert.False(t, session.IsValid(now, true))  // blocked
}

func TestDevice_MatchesFingerprint(t *testing.T) {
    device := &Device{
        Fingerprint: "sha256_value_123",
    }
    assert.True(t, device.MatchesFingerprint("sha256_value_123"))
    assert.False(t, device.MatchesFingerprint("different_value"))
}

// UseCase Test
func TestLoginUseCase_InvalidCredentials_ReturnsError(t *testing.T) {
    mockCognito := new(MockCognitoAuthPort)
    mockCognito.On("Authenticate", "01234567890", "password").Return(nil, ErrInvalidCredentials)

    uc := NewLoginUseCase(mockCognito, nil, nil, nil, nil)
    _, err := uc.Execute(ctx, LoginInput{PhoneNumber: "01234567890", Password: "password"})

    assert.ErrorIs(t, err, ErrInvalidCredentials)
}

func TestLoginUseCase_UserSuspended_ReturnsError(t *testing.T) {
    mockCognito := new(MockCognitoAuthPort)
    mockCognito.On("Authenticate", mock.Anything, mock.Anything).Return(
        &CognitoAuthResult{AccessToken: "token", IDToken: "id_token"},
        nil,
    )

    mockUser := new(MockUserRepository)
    mockUser.On("GetByCognitoSub", "cognito-sub-123").Return(
        &User{UserID: "user-1", Status: "SUSPENDED"},
        nil,
    )

    uc := NewLoginUseCase(mockCognito, mockUser, nil, nil, nil)
    _, err := uc.Execute(ctx, LoginInput{PhoneNumber: "0123...", Password: "pass"})

    assert.ErrorIs(t, err, ErrUserSuspended)
}

func TestRefreshTokenUseCase_TokenBlocked_ReturnsError(t *testing.T) {
    mockBlocked := new(MockBlockedTokenRepository)
    mockBlocked.On("Exists", "old_jti_123").Return(true, nil)

    uc := NewRefreshTokenUseCase(nil, mockBlocked, nil, nil)
    _, err := uc.Execute(ctx, RefreshTokenInput{RefreshToken: "..."})

    assert.ErrorIs(t, err, ErrTokenRevoked)
}

// Integration Test (MySQL)
func TestSessionRepository_RevokeByUserID(t *testing.T) {
    db := setupTestDB()
    defer db.Close()

    repo := NewMySQLSessionRepository(db)

    // Insert test sessions
    session1 := &Session{SessionID: "s1", UserID: "user-1", DeviceID: "d1", IsRevoked: false}
    session2 := &Session{SessionID: "s2", UserID: "user-1", DeviceID: "d2", IsRevoked: false}

    repo.Create(ctx, session1)
    repo.Create(ctx, session2)

    // Revoke all
    count, err := repo.RevokeByUserID(ctx, "user-1", nil)

    assert.NoError(t, err)
    assert.Equal(t, int64(2), count)

    // Verify both are revoked
    s1, _ := repo.GetBySessionID(ctx, "s1")
    assert.True(t, s1.IsRevoked)
}

// Integration Test (Redis)
func TestBlockedTokenRepository_ExpirationCleanup(t *testing.T) {
    redis := setupTestRedis()
    defer redis.Close()

    repo := NewRedisBlockedTokenRepository(redis)

    expiredToken := &BlockedToken{
        JTI:       "jti-expired",
        ExpiresAt: time.Now().Add(-1 * time.Hour), // 過去
        BlockedAt: time.Now().Add(-2 * time.Hour),
    }

    repo.Add(ctx, expiredToken)

    // Cleanup
    count, _ := repo.DeleteExpired(ctx, time.Now())
    assert.Equal(t, int64(1), count)

    // Verify deleted
    exists, _ := repo.Exists(ctx, "jti-expired")
    assert.False(t, exists)
}