fix(api): accept API tokens in auth middleware (#162)

Author: nazarli-shabnam

apps/api/internal/auth/service.go

@@ -253,6 +253,17 @@ func (s *Service) UserFromSession(ctx context.Context, sessionKey string) (*mode
 	return user, nil
 }
 
+// ActiveUserByID returns the user if they exist and are active, otherwise
+// nil. Used by API-token authentication so a deactivated user's still-valid
+// token is rejected the same way a deactivated user's session is.
+func (s *Service) ActiveUserByID(ctx context.Context, id uuid.UUID) (*model.User, error) {
+	user, err := s.userStore.GetByID(ctx, id)
+	if err != nil || user == nil || !user.IsActive {
+		return nil, nil
+	}
+	return user, nil
+}
+
 func (s *Service) UpdateProfile(ctx context.Context, u *model.User) error {
 	return s.userStore.Update(ctx, u)
 }

apps/api/internal/handler/auth_test.go

@@ -303,6 +303,75 @@ func TestAuth_Tokens_RequiresAuth(t *testing.T) {
 	require.Equal(t, http.StatusUnauthorized, rr.Code)
 }
 
+// TestAuth_ApiToken_AuthenticatesRequests proves an API token created via
+// the tokens endpoint actually authenticates requests (the bug in #162 was
+// that tokens were issued but never accepted by RequireAuth).
+func TestAuth_ApiToken_AuthenticatesRequests(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	user := testutil.CreateUser(t, ts.DB)
+	session := testutil.LoginAs(t, ts.DB, user)
+
+	rr := ts.POST("/api/users/me/tokens/", map[string]any{"label": "ci-token"}, session)
+	require.Equal(t, http.StatusCreated, rr.Code, "body=%s", rr.Body.String())
+	plainToken, _ := testutil.MustJSONMap(t, rr)["token"].(string)
+	require.NotEmpty(t, plainToken)
+
+	rr2 := ts.DoWithHeaders(http.MethodGet, "/api/users/me/", nil, http.Header{
+		"Authorization": []string{"Bearer " + plainToken},
+	})
+	require.Equal(t, http.StatusOK, rr2.Code, "body=%s", rr2.Body.String())
+	assert.Equal(t, user.ID.String(), testutil.MustJSONMap(t, rr2)["id"])
+}
+
+// TestAuth_ApiToken_RevokedRejected proves a revoked token no longer
+// authenticates.
+func TestAuth_ApiToken_RevokedRejected(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	user := testutil.CreateUser(t, ts.DB)
+	session := testutil.LoginAs(t, ts.DB, user)
+
+	rr := ts.POST("/api/users/me/tokens/", map[string]any{"label": "ci-token"}, session)
+	require.Equal(t, http.StatusCreated, rr.Code, "body=%s", rr.Body.String())
+	createdBody := testutil.MustJSONMap(t, rr)
+	plainToken, _ := createdBody["token"].(string)
+	require.NotEmpty(t, plainToken)
+
+	listRR := ts.GET("/api/users/me/tokens/", session)
+	tokens, _ := testutil.MustJSONMap(t, listRR)["tokens"].([]any)
+	require.Len(t, tokens, 1)
+	tokenID, _ := tokens[0].(map[string]any)["id"].(string)
+	require.NotEmpty(t, tokenID)
+
+	revokeRR := ts.DELETE("/api/users/me/tokens/"+tokenID+"/", session)
+	require.Equal(t, http.StatusNoContent, revokeRR.Code)
+
+	rr2 := ts.DoWithHeaders(http.MethodGet, "/api/users/me/", nil, http.Header{
+		"Authorization": []string{"Bearer " + plainToken},
+	})
+	require.Equal(t, http.StatusUnauthorized, rr2.Code, "body=%s", rr2.Body.String())
+}
+
+// TestAuth_ApiToken_DeactivatedUserRejected proves a deactivated user's
+// still-valid API token is rejected, mirroring the #155 protection for
+// cookie sessions.
+func TestAuth_ApiToken_DeactivatedUserRejected(t *testing.T) {
+	ts := testutil.NewTestServer(t)
+	user := testutil.CreateUser(t, ts.DB)
+	session := testutil.LoginAs(t, ts.DB, user)
+
+	rr := ts.POST("/api/users/me/tokens/", map[string]any{"label": "ci-token"}, session)
+	require.Equal(t, http.StatusCreated, rr.Code, "body=%s", rr.Body.String())
+	plainToken, _ := testutil.MustJSONMap(t, rr)["token"].(string)
+	require.NotEmpty(t, plainToken)
+
+	require.NoError(t, ts.DB.Exec("UPDATE users SET is_active = false WHERE id = ?", user.ID).Error)
+
+	rr2 := ts.DoWithHeaders(http.MethodGet, "/api/users/me/", nil, http.Header{
+		"Authorization": []string{"Bearer " + plainToken},
+	})
+	require.Equal(t, http.StatusUnauthorized, rr2.Code, "body=%s", rr2.Body.String())
+}
+
 func TestAuth_ForgotPassword_NoSMTPReturns503(t *testing.T) {
 	ts := testutil.NewTestServer(t)
 	testutil.CreateUser(t, ts.DB, testutil.WithUserEmail("forgot@test.local"))

apps/api/internal/middleware/auth.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/Devlaner/devlane/api/internal/auth"
 	"github.com/Devlaner/devlane/api/internal/model"
+	"github.com/Devlaner/devlane/api/internal/store"
 	"github.com/gin-gonic/gin"
 )
 
@@ -27,20 +28,44 @@ func SessionKeyFromCookieOrBearer(c *gin.Context) string {
 	return sessionKey
 }
 
-// RequireAuth loads the user from session and returns 401 if not authenticated.
-func RequireAuth(authSvc *auth.Service, log *slog.Logger) gin.HandlerFunc {
+// RequireAuth loads the user from a session cookie or Authorization: Bearer
+// header, and returns 401 if not authenticated. Bearer values are tried
+// first as an API token (hashed + looked up in api_tokens); if that doesn't
+// match, they fall back to being treated as a raw session key — kept for
+// the cross-origin OAuth SPA fragment flow (see SessionKeyFromCookieOrBearer).
+func RequireAuth(authSvc *auth.Service, apiTokens *store.ApiTokenStore, log *slog.Logger) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		sessionKey := SessionKeyFromCookieOrBearer(c)
-		user, err := authSvc.UserFromSession(c.Request.Context(), sessionKey)
-		if err != nil || user == nil {
-			if log != nil {
-				log.Debug("auth required", "error", err, "has_session_key", sessionKey != "")
+		ctx := c.Request.Context()
+
+		if cookieKey, _ := c.Cookie(SessionCookieName); cookieKey != "" {
+			if user, err := authSvc.UserFromSession(ctx, cookieKey); err == nil && user != nil {
+				c.Set(UserContextKey, user)
+				c.Next()
+				return
+			}
+		} else if authHeader := c.GetHeader("Authorization"); len(authHeader) > 7 && strings.EqualFold(authHeader[:7], "bearer ") {
+			bearer := strings.TrimSpace(authHeader[7:])
+			if apiTokens != nil {
+				if tok, err := apiTokens.GetActiveByHash(ctx, store.HashToken(bearer)); err == nil && tok != nil {
+					if user, err := authSvc.ActiveUserByID(ctx, tok.UserID); err == nil && user != nil {
+						_ = apiTokens.UpdateLastUsed(ctx, tok.ID)
+						c.Set(UserContextKey, user)
+						c.Next()
+						return
+					}
+				}
+			}
+			if user, err := authSvc.UserFromSession(ctx, bearer); err == nil && user != nil {
+				c.Set(UserContextKey, user)
+				c.Next()
+				return
 			}
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Authentication required"})
-			return
 		}
-		c.Set(UserContextKey, user)
-		c.Next()
+
+		if log != nil {
+			log.Debug("auth required", "has_session_key", SessionKeyFromCookieOrBearer(c) != "")
+		}
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Authentication required"})
 	}
 }
 

apps/api/internal/router/router.go

@@ -236,7 +236,7 @@ func New(cfg Config) *gin.Engine {
 
 	// Protected API: require auth
 	api := r.Group("/api")
-	api.Use(middleware.RequireAuth(authSvc, cfg.Log))
+	api.Use(middleware.RequireAuth(authSvc, apiTokenStore, cfg.Log))
 	{
 		api.GET("/users/me/", authHandler.Me)
 		api.PATCH("/users/me/", authHandler.UpdateMe)
@@ -503,7 +503,7 @@ func New(cfg Config) *gin.Engine {
 		authGroup.POST("/reset-password/", authHandler.ResetPassword)
 		authGroup.POST("/magic-code/request/", middleware.RateLimit(cfg.Redis, "magiccode", 10, 15*time.Minute), authHandler.MagicCodeRequest)
 		authGroup.POST("/magic-code/verify/", authHandler.MagicCodeVerify)
-		authGroup.POST("/set-password/", middleware.RequireAuth(authSvc, cfg.Log), authHandler.SetPassword)
+		authGroup.POST("/set-password/", middleware.RequireAuth(authSvc, apiTokenStore, cfg.Log), authHandler.SetPassword)
 	}
 
 	// OAuth routes (no auth required); provider resolved from instance settings at request time.
@@ -522,16 +522,16 @@ func New(cfg Config) *gin.Engine {
 	// GitHub App install flow (separate from OAuth user sign-in). Both
 	// require the user to be signed in so we can attach the installation to
 	// their workspace.
-	r.GET("/auth/github-app/install", middleware.RequireAuth(authSvc, cfg.Log), integrationHandler.GitHubInstallStart)
-	r.GET("/auth/github-app/callback", middleware.RequireAuth(authSvc, cfg.Log), integrationHandler.GitHubInstallCallback)
+	r.GET("/auth/github-app/install", middleware.RequireAuth(authSvc, apiTokenStore, cfg.Log), integrationHandler.GitHubInstallStart)
+	r.GET("/auth/github-app/callback", middleware.RequireAuth(authSvc, apiTokenStore, cfg.Log), integrationHandler.GitHubInstallCallback)
 
 	// GitHub webhook receiver — public; HMAC-signature-verified.
 	r.POST("/webhooks/github", integrationHandler.GitHubWebhook)
 	r.POST("/webhooks/github/", integrationHandler.GitHubWebhook)
 
 	// Legacy /api/v1
 	v1 := r.Group("/api/v1")
-	v1.Use(middleware.RequireAuth(authSvc, cfg.Log))
+	v1.Use(middleware.RequireAuth(authSvc, apiTokenStore, cfg.Log))
 	{
 		v1.GET("/", func(c *gin.Context) {
 			c.JSON(200, gin.H{"message": "Devlane API v1"})

apps/api/internal/store/api_token.go

@@ -30,6 +30,10 @@ func hashToken(plain string) string {
 	return hex.EncodeToString(h[:])
 }
 
+// HashToken hashes a plain-text API token for lookup (auth middleware never
+// stores or compares the plain value).
+func HashToken(plain string) string { return hashToken(plain) }
+
 // Create generates a new token, stores its hash, and returns the plain token (caller must show it once).
 func (s *ApiTokenStore) Create(ctx context.Context, userID uuid.UUID, label, description string, expiredAt *time.Time) (plainToken string, err error) {
 	plain, err := generateToken()
@@ -75,3 +79,21 @@ func (s *ApiTokenStore) Delete(ctx context.Context, tokenID, userID uuid.UUID) e
 	}
 	return nil
 }
+
+// GetActiveByHash returns the token matching hash if it is active and not
+// expired, for use by the auth middleware.
+func (s *ApiTokenStore) GetActiveByHash(ctx context.Context, hash string) (*model.ApiToken, error) {
+	var t model.ApiToken
+	err := s.db.WithContext(ctx).
+		Where("token = ? AND is_active = true AND (expired_at IS NULL OR expired_at > ?)", hash, time.Now().UTC()).
+		First(&t).Error
+	if err != nil {
+		return nil, err
+	}
+	return &t, nil
+}
+
+// UpdateLastUsed stamps the token's last_used time.
+func (s *ApiTokenStore) UpdateLastUsed(ctx context.Context, id uuid.UUID) error {
+	return s.db.WithContext(ctx).Model(&model.ApiToken{}).Where("id = ?", id).Update("last_used", time.Now().UTC()).Error
+}