refactor: use dependency injection in backend

backend/internal/service/app_config_service.go

@@ -0,0 +1,213 @@
+package service
+
+import (
+	"fmt"
+	"github.com/stonith404/pocket-id/backend/internal/common"
+	"github.com/stonith404/pocket-id/backend/internal/model"
+	"github.com/stonith404/pocket-id/backend/internal/utils"
+	"gorm.io/gorm"
+	"log"
+	"mime/multipart"
+	"os"
+	"reflect"
+)
+
+type AppConfigService struct {
+	DbConfig *model.AppConfig
+	db       *gorm.DB
+}
+
+func NewAppConfigService(db *gorm.DB) *AppConfigService {
+	service := &AppConfigService{
+		DbConfig: &defaultDbConfig,
+		db:       db,
+	}
+	if err := service.InitDbConfig(); err != nil {
+		log.Fatalf("Failed to initialize app config service: %v", err)
+	}
+	return service
+}
+
+var defaultDbConfig = model.AppConfig{
+	AppName: model.AppConfigVariable{
+		Key:      "appName",
+		Type:     "string",
+		IsPublic: true,
+		Value:    "Pocket ID",
+	},
+	SessionDuration: model.AppConfigVariable{
+		Key:   "sessionDuration",
+		Type:  "number",
+		Value: "60",
+	},
+	BackgroundImageType: model.AppConfigVariable{
+		Key:        "backgroundImageType",
+		Type:       "string",
+		IsInternal: true,
+		Value:      "jpg",
+	},
+	LogoImageType: model.AppConfigVariable{
+		Key:        "logoImageType",
+		Type:       "string",
+		IsInternal: true,
+		Value:      "svg",
+	},
+}
+
+func (s *AppConfigService) UpdateApplicationConfiguration(input model.AppConfigUpdateDto) ([]model.AppConfigVariable, error) {
+	savedConfigVariables := make([]model.AppConfigVariable, 10)
+
+	tx := s.db.Begin()
+	rt := reflect.ValueOf(input).Type()
+	rv := reflect.ValueOf(input)
+
+	for i := 0; i < rt.NumField(); i++ {
+		field := rt.Field(i)
+		key := field.Tag.Get("json")
+		value := rv.FieldByName(field.Name).String()
+
+		var applicationConfigurationVariable model.AppConfigVariable
+		if err := tx.First(&applicationConfigurationVariable, "key = ? AND is_internal = false", key).Error; err != nil {
+			tx.Rollback()
+			return nil, err
+		}
+
+		applicationConfigurationVariable.Value = value
+		if err := tx.Save(&applicationConfigurationVariable).Error; err != nil {
+			tx.Rollback()
+			return nil, err
+		}
+
+		savedConfigVariables[i] = applicationConfigurationVariable
+	}
+
+	tx.Commit()
+
+	if err := s.loadDbConfigFromDb(); err != nil {
+		return nil, err
+	}
+
+	return savedConfigVariables, nil
+}
+
+func (s *AppConfigService) UpdateImageType(imageName string, fileType string) error {
+	key := fmt.Sprintf("%sImageType", imageName)
+	err := s.db.Model(&model.AppConfigVariable{}).Where("key = ?", key).Update("value", fileType).Error
+	if err != nil {
+		return err
+	}
+
+	return s.loadDbConfigFromDb()
+}
+
+func (s *AppConfigService) ListApplicationConfiguration(showAll bool) ([]model.AppConfigVariable, error) {
+	var configuration []model.AppConfigVariable
+	var err error
+
+	if showAll {
+		err = s.db.Find(&configuration).Error
+	} else {
+		err = s.db.Find(&configuration, "is_public = true").Error
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	return configuration, nil
+}
+
+func (s *AppConfigService) UpdateImage(uploadedFile *multipart.FileHeader, imageName string, oldImageType string) error {
+	fileType := utils.GetFileExtension(uploadedFile.Filename)
+	mimeType := utils.GetImageMimeType(fileType)
+	if mimeType == "" {
+		return common.ErrFileTypeNotSupported
+	}
+
+	// Delete the old image if it has a different file type
+	if fileType != oldImageType {
+		oldImagePath := fmt.Sprintf("%s/application-images/%s.%s", common.EnvConfig.UploadPath, imageName, oldImageType)
+		if err := os.Remove(oldImagePath); err != nil {
+			return err
+		}
+	}
+
+	imagePath := fmt.Sprintf("%s/application-images/%s.%s", common.EnvConfig.UploadPath, imageName, fileType)
+	if err := utils.SaveFile(uploadedFile, imagePath); err != nil {
+		return err
+	}
+
+	// Update the file type in the database
+	if err := s.UpdateImageType(imageName, fileType); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// InitDbConfig creates the default configuration values in the database if they do not exist,
+// updates existing configurations if they differ from the default, and deletes any configurations
+// that are not in the default configuration.
+func (s *AppConfigService) InitDbConfig() error {
+	// Reflect to get the underlying value of DbConfig and its default configuration
+	defaultConfigReflectValue := reflect.ValueOf(defaultDbConfig)
+	defaultKeys := make(map[string]struct{})
+
+	// Iterate over the fields of DbConfig
+	for i := 0; i < defaultConfigReflectValue.NumField(); i++ {
+		defaultConfigVar := defaultConfigReflectValue.Field(i).Interface().(model.AppConfigVariable)
+
+		defaultKeys[defaultConfigVar.Key] = struct{}{}
+
+		var storedConfigVar model.AppConfigVariable
+		if err := s.db.First(&storedConfigVar, "key = ?", defaultConfigVar.Key).Error; err != nil {
+			// If the configuration does not exist, create it
+			if err := s.db.Create(&defaultConfigVar).Error; err != nil {
+				return err
+			}
+			continue
+		}
+
+		// Update existing configuration if it differs from the default
+		if storedConfigVar.Type != defaultConfigVar.Type || storedConfigVar.IsPublic != defaultConfigVar.IsPublic || storedConfigVar.IsInternal != defaultConfigVar.IsInternal {
+			storedConfigVar.Type = defaultConfigVar.Type
+			storedConfigVar.IsPublic = defaultConfigVar.IsPublic
+			storedConfigVar.IsInternal = defaultConfigVar.IsInternal
+			if err := s.db.Save(&storedConfigVar).Error; err != nil {
+				return err
+			}
+		}
+	}
+
+	// Delete any configurations not in the default keys
+	var allConfigVars []model.AppConfigVariable
+	if err := s.db.Find(&allConfigVars).Error; err != nil {
+		return err
+	}
+
+	for _, config := range allConfigVars {
+		if _, exists := defaultKeys[config.Key]; !exists {
+			if err := s.db.Delete(&config).Error; err != nil {
+				return err
+			}
+		}
+	}
+	return s.loadDbConfigFromDb()
+}
+
+func (s *AppConfigService) loadDbConfigFromDb() error {
+	dbConfigReflectValue := reflect.ValueOf(s.DbConfig).Elem()
+
+	for i := 0; i < dbConfigReflectValue.NumField(); i++ {
+		dbConfigField := dbConfigReflectValue.Field(i)
+		currentConfigVar := dbConfigField.Interface().(model.AppConfigVariable)
+		var storedConfigVar model.AppConfigVariable
+		if err := s.db.First(&storedConfigVar, "key = ?", currentConfigVar.Key).Error; err != nil {
+			return err
+		}
+
+		dbConfigField.Set(reflect.ValueOf(storedConfigVar))
+	}
+
+	return nil
+}

backend/internal/service/jwt_service.go

@@ -0,0 +1,248 @@
+package service
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stonith404/pocket-id/backend/internal/common"
+	"github.com/stonith404/pocket-id/backend/internal/model"
+	"github.com/stonith404/pocket-id/backend/internal/utils"
+	"log"
+	"math/big"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const (
+	privateKeyPath = "data/keys/jwt_private_key.pem"
+	publicKeyPath  = "data/keys/jwt_public_key.pem"
+)
+
+type JwtService struct {
+	publicKey        *rsa.PublicKey
+	privateKey       *rsa.PrivateKey
+	appConfigService *AppConfigService
+}
+
+func NewJwtService(appConfigService *AppConfigService) *JwtService {
+	service := &JwtService{
+		appConfigService: appConfigService,
+	}
+
+	// Ensure keys are generated or loaded
+	if err := service.loadOrGenerateKeys(); err != nil {
+		log.Fatalf("Failed to initialize jwt service: %v", err)
+	}
+
+	return service
+}
+
+type AccessTokenJWTClaims struct {
+	jwt.RegisteredClaims
+	IsAdmin bool `json:"isAdmin,omitempty"`
+}
+
+type JWK struct {
+	Kty string `json:"kty"`
+	Use string `json:"use"`
+	Kid string `json:"kid"`
+	Alg string `json:"alg"`
+	N   string `json:"n"`
+	E   string `json:"e"`
+}
+
+// loadOrGenerateKeys loads RSA keys from the given paths or generates them if they do not exist.
+func (s *JwtService) loadOrGenerateKeys() error {
+	if _, err := os.Stat(privateKeyPath); os.IsNotExist(err) {
+		if err := s.generateKeys(); err != nil {
+			return err
+		}
+	}
+
+	privateKeyBytes, err := os.ReadFile(privateKeyPath)
+	if err != nil {
+		return errors.New("can't read jwt private key: " + err.Error())
+	}
+	s.privateKey, err = jwt.ParseRSAPrivateKeyFromPEM(privateKeyBytes)
+	if err != nil {
+		return errors.New("can't parse jwt private key: " + err.Error())
+	}
+
+	publicKeyBytes, err := os.ReadFile(publicKeyPath)
+	if err != nil {
+		return errors.New("can't read jwt public key: " + err.Error())
+	}
+	s.publicKey, err = jwt.ParseRSAPublicKeyFromPEM(publicKeyBytes)
+	if err != nil {
+		return errors.New("can't parse jwt public key: " + err.Error())
+	}
+
+	return nil
+}
+
+func (s *JwtService) GenerateIDToken(user model.User, clientID string, scope string, nonce string) (string, error) {
+	profileClaims := map[string]interface{}{
+		"given_name":         user.FirstName,
+		"family_name":        user.LastName,
+		"email":              user.Email,
+		"preferred_username": user.Username,
+	}
+
+	claims := jwt.MapClaims{
+		"sub": user.ID,
+		"aud": clientID,
+		"exp": jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+		"iat": jwt.NewNumericDate(time.Now()),
+	}
+
+	if nonce != "" {
+		claims["nonce"] = nonce
+	}
+	if strings.Contains(scope, "profile") {
+		for k, v := range profileClaims {
+			claims[k] = v
+		}
+	}
+	if strings.Contains(scope, "email") {
+		claims["email"] = user.Email
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	return token.SignedString(s.privateKey)
+}
+
+func (s *JwtService) GenerateAccessToken(user model.User) (string, error) {
+	sessionDurationInMinutes, _ := strconv.Atoi(s.appConfigService.DbConfig.SessionDuration.Value)
+	claim := AccessTokenJWTClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			Subject:   user.ID,
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(sessionDurationInMinutes) * time.Minute)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			Audience:  jwt.ClaimStrings{utils.GetHostFromURL(common.EnvConfig.AppURL)},
+		},
+		IsAdmin: user.IsAdmin,
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claim)
+	return token.SignedString(s.privateKey)
+}
+
+func (s *JwtService) VerifyAccessToken(tokenString string) (*AccessTokenJWTClaims, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &AccessTokenJWTClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return s.publicKey, nil
+	})
+	if err != nil || !token.Valid {
+		return nil, errors.New("couldn't handle this token")
+	}
+
+	claims, isValid := token.Claims.(*AccessTokenJWTClaims)
+	if !isValid {
+		return nil, errors.New("can't parse claims")
+	}
+
+	if !slices.Contains(claims.Audience, utils.GetHostFromURL(common.EnvConfig.AppURL)) {
+		return nil, errors.New("audience doesn't match")
+	}
+	return claims, nil
+}
+
+// GetJWK returns the JSON Web Key (JWK) for the public key.
+func (s *JwtService) GetJWK() (JWK, error) {
+	if s.publicKey == nil {
+		return JWK{}, errors.New("public key is not initialized")
+	}
+
+	jwk := JWK{
+		Kty: "RSA",
+		Use: "sig",
+		Kid: "1",
+		Alg: "RS256",
+		N:   base64.RawURLEncoding.EncodeToString(s.publicKey.N.Bytes()),
+		E:   base64.RawURLEncoding.EncodeToString(big.NewInt(int64(s.publicKey.E)).Bytes()),
+	}
+
+	return jwk, nil
+}
+
+// generateKeys generates a new RSA key pair and saves them to the specified paths.
+func (s *JwtService) generateKeys() error {
+	if err := os.MkdirAll(filepath.Dir(privateKeyPath), 0700); err != nil {
+		return errors.New("failed to create directories for keys: " + err.Error())
+	}
+
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return errors.New("failed to generate private key: " + err.Error())
+	}
+	s.privateKey = privateKey
+
+	if err := s.savePEMKey(privateKeyPath, x509.MarshalPKCS1PrivateKey(privateKey), "RSA PRIVATE KEY"); err != nil {
+		return err
+	}
+
+	publicKey := &privateKey.PublicKey
+	s.publicKey = publicKey
+
+	if err := s.savePEMKey(publicKeyPath, x509.MarshalPKCS1PublicKey(publicKey), "RSA PUBLIC KEY"); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// savePEMKey saves a PEM encoded key to a file.
+func (s *JwtService) savePEMKey(path string, keyBytes []byte, keyType string) error {
+	keyFile, err := os.Create(path)
+	if err != nil {
+		return errors.New("failed to create key file: " + err.Error())
+	}
+	defer keyFile.Close()
+
+	keyPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  keyType,
+		Bytes: keyBytes,
+	})
+
+	if _, err := keyFile.Write(keyPEM); err != nil {
+		return errors.New("failed to write key file: " + err.Error())
+	}
+
+	return nil
+}
+
+// loadKeys loads RSA keys from the given paths.
+func (s *JwtService) loadKeys() error {
+	if _, err := os.Stat(privateKeyPath); os.IsNotExist(err) {
+		if err := s.generateKeys(); err != nil {
+			return err
+		}
+	}
+
+	privateKeyBytes, err := os.ReadFile(privateKeyPath)
+	if err != nil {
+		return fmt.Errorf("can't read jwt private key: %w", err)
+	}
+	s.privateKey, err = jwt.ParseRSAPrivateKeyFromPEM(privateKeyBytes)
+	if err != nil {
+		return fmt.Errorf("can't parse jwt private key: %w", err)
+	}
+
+	publicKeyBytes, err := os.ReadFile(publicKeyPath)
+	if err != nil {
+		return fmt.Errorf("can't read jwt public key: %w", err)
+	}
+	s.publicKey, err = jwt.ParseRSAPublicKeyFromPEM(publicKeyBytes)
+	if err != nil {
+		return fmt.Errorf("can't parse jwt public key: %w", err)
+	}
+
+	return nil
+}

backend/internal/service/oidc_service.go

@@ -0,0 +1,282 @@
+package service
+
+import (
+	"errors"
+	"fmt"
+	"github.com/stonith404/pocket-id/backend/internal/common"
+	"github.com/stonith404/pocket-id/backend/internal/model"
+	"github.com/stonith404/pocket-id/backend/internal/utils"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+	"mime/multipart"
+	"os"
+	"time"
+)
+
+type OidcService struct {
+	db         *gorm.DB
+	jwtService *JwtService
+}
+
+func NewOidcService(db *gorm.DB, jwtService *JwtService) *OidcService {
+	return &OidcService{
+		db:         db,
+		jwtService: jwtService,
+	}
+}
+
+func (s *OidcService) Authorize(req model.AuthorizeRequest, userID string) (string, error) {
+	var userAuthorizedOIDCClient model.UserAuthorizedOidcClient
+	s.db.First(&userAuthorizedOIDCClient, "client_id = ? AND user_id = ?", req.ClientID, userID)
+
+	if userAuthorizedOIDCClient.Scope != req.Scope {
+		return "", common.ErrOidcMissingAuthorization
+	}
+
+	return s.createAuthorizationCode(req.ClientID, userID, req.Scope, req.Nonce)
+}
+
+func (s *OidcService) AuthorizeNewClient(req model.AuthorizeNewClientDto, userID string) (string, error) {
+	userAuthorizedClient := model.UserAuthorizedOidcClient{
+		UserID:   userID,
+		ClientID: req.ClientID,
+		Scope:    req.Scope,
+	}
+
+	if err := s.db.Create(&userAuthorizedClient).Error; err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			err = s.db.Model(&userAuthorizedClient).Update("scope", req.Scope).Error
+		} else {
+			return "", err
+		}
+	}
+
+	return s.createAuthorizationCode(req.ClientID, userID, req.Scope, req.Nonce)
+}
+
+func (s *OidcService) CreateIDToken(req model.OidcIdTokenDto) (string, error) {
+	if req.GrantType != "authorization_code" {
+		return "", common.ErrOidcGrantTypeNotSupported
+	}
+
+	clientID := req.ClientID
+	clientSecret := req.ClientSecret
+
+	if clientID == "" || clientSecret == "" {
+		return "", common.ErrOidcMissingClientCredentials
+	}
+
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return "", err
+	}
+
+	err := bcrypt.CompareHashAndPassword([]byte(client.Secret), []byte(clientSecret))
+	if err != nil {
+		return "", common.ErrOidcClientSecretInvalid
+	}
+
+	var authorizationCodeMetaData model.OidcAuthorizationCode
+	err = s.db.Preload("User").First(&authorizationCodeMetaData, "code = ?", req.Code).Error
+	if err != nil {
+		return "", common.ErrOidcInvalidAuthorizationCode
+	}
+
+	if authorizationCodeMetaData.ClientID != clientID && authorizationCodeMetaData.ExpiresAt.Before(time.Now()) {
+		return "", common.ErrOidcInvalidAuthorizationCode
+	}
+
+	idToken, err := s.jwtService.GenerateIDToken(authorizationCodeMetaData.User, clientID, authorizationCodeMetaData.Scope, authorizationCodeMetaData.Nonce)
+	if err != nil {
+		return "", err
+	}
+
+	s.db.Delete(&authorizationCodeMetaData)
+
+	return idToken, nil
+}
+
+func (s *OidcService) GetClient(clientID string) (*model.OidcClient, error) {
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return nil, err
+	}
+	return &client, nil
+}
+
+func (s *OidcService) ListClients(searchTerm string, page int, pageSize int) ([]model.OidcClient, utils.PaginationResponse, error) {
+	var clients []model.OidcClient
+
+	query := s.db.Model(&model.OidcClient{})
+	if searchTerm != "" {
+		searchPattern := "%" + searchTerm + "%"
+		query = query.Where("name LIKE ?", searchPattern)
+	}
+
+	pagination, err := utils.Paginate(page, pageSize, query, &clients)
+	if err != nil {
+		return nil, utils.PaginationResponse{}, err
+	}
+
+	return clients, pagination, nil
+}
+
+func (s *OidcService) CreateClient(input model.OidcClientCreateDto, userID string) (*model.OidcClient, error) {
+	client := model.OidcClient{
+		Name:        input.Name,
+		CallbackURL: input.CallbackURL,
+		CreatedByID: userID,
+	}
+
+	if err := s.db.Create(&client).Error; err != nil {
+		return nil, err
+	}
+
+	return &client, nil
+}
+
+func (s *OidcService) UpdateClient(clientID string, input model.OidcClientCreateDto) (*model.OidcClient, error) {
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return nil, err
+	}
+
+	client.Name = input.Name
+	client.CallbackURL = input.CallbackURL
+
+	if err := s.db.Save(&client).Error; err != nil {
+		return nil, err
+	}
+
+	return &client, nil
+}
+
+func (s *OidcService) DeleteClient(clientID string) error {
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return err
+	}
+
+	if err := s.db.Delete(&client).Error; err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *OidcService) CreateClientSecret(clientID string) (string, error) {
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return "", err
+	}
+
+	clientSecret, err := utils.GenerateRandomAlphanumericString(32)
+	if err != nil {
+		return "", err
+	}
+
+	hashedSecret, err := bcrypt.GenerateFromPassword([]byte(clientSecret), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+
+	client.Secret = string(hashedSecret)
+	if err := s.db.Save(&client).Error; err != nil {
+		return "", err
+	}
+
+	return clientSecret, nil
+}
+
+func (s *OidcService) GetClientLogo(clientID string) (string, string, error) {
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return "", "", err
+	}
+
+	if client.ImageType == nil {
+		return "", "", errors.New("image not found")
+	}
+
+	imageType := *client.ImageType
+	imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, imageType)
+	mimeType := utils.GetImageMimeType(imageType)
+
+	return imagePath, mimeType, nil
+}
+
+func (s *OidcService) UpdateClientLogo(clientID string, file *multipart.FileHeader) error {
+	fileType := utils.GetFileExtension(file.Filename)
+	if mimeType := utils.GetImageMimeType(fileType); mimeType == "" {
+		return common.ErrFileTypeNotSupported
+	}
+
+	imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, clientID, fileType)
+	if err := utils.SaveFile(file, imagePath); err != nil {
+		return err
+	}
+
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return err
+	}
+
+	if client.ImageType != nil && fileType != *client.ImageType {
+		oldImagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, *client.ImageType)
+		if err := os.Remove(oldImagePath); err != nil {
+			return err
+		}
+	}
+
+	client.ImageType = &fileType
+	if err := s.db.Save(&client).Error; err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *OidcService) DeleteClientLogo(clientID string) error {
+	var client model.OidcClient
+	if err := s.db.First(&client, "id = ?", clientID).Error; err != nil {
+		return err
+	}
+
+	if client.ImageType == nil {
+		return errors.New("image not found")
+	}
+
+	imagePath := fmt.Sprintf("%s/oidc-client-images/%s.%s", common.EnvConfig.UploadPath, client.ID, *client.ImageType)
+	if err := os.Remove(imagePath); err != nil {
+		return err
+	}
+
+	client.ImageType = nil
+	if err := s.db.Save(&client).Error; err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *OidcService) createAuthorizationCode(clientID string, userID string, scope string, nonce string) (string, error) {
+	randomString, err := utils.GenerateRandomAlphanumericString(32)
+	if err != nil {
+		return "", err
+	}
+
+	oidcAuthorizationCode := model.OidcAuthorizationCode{
+		ExpiresAt: time.Now().Add(15 * time.Minute),
+		Code:      randomString,
+		ClientID:  clientID,
+		UserID:    userID,
+		Scope:     scope,
+		Nonce:     nonce,
+	}
+
+	if err := s.db.Create(&oidcAuthorizationCode).Error; err != nil {
+		return "", err
+	}
+
+	return randomString, nil
+}

backend/internal/service/test_service.go

@@ -0,0 +1,223 @@
+package service
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/base64"
+	"fmt"
+	"github.com/fxamacker/cbor/v2"
+	"log"
+	"os"
+	"time"
+
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/stonith404/pocket-id/backend/internal/common"
+	"github.com/stonith404/pocket-id/backend/internal/model"
+	"github.com/stonith404/pocket-id/backend/internal/utils"
+	"gorm.io/gorm"
+)
+
+type TestService struct {
+	db               *gorm.DB
+	appConfigService *AppConfigService
+}
+
+func NewTestService(db *gorm.DB, appConfigService *AppConfigService) *TestService {
+	return &TestService{db: db, appConfigService: appConfigService}
+}
+
+func (s *TestService) SeedDatabase() error {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		users := []model.User{
+			{
+				Base: model.Base{
+					ID: "f4b89dc2-62fb-46bf-9f5f-c34f4eafe93e",
+				},
+				Username:  "tim",
+				Email:     "tim.cook@test.com",
+				FirstName: "Tim",
+				LastName:  "Cook",
+				IsAdmin:   true,
+			},
+			{
+				Base: model.Base{
+					ID: "1cd19686-f9a6-43f4-a41f-14a0bf5b4036",
+				},
+				Username:  "craig",
+				Email:     "craig.federighi@test.com",
+				FirstName: "Craig",
+				LastName:  "Federighi",
+				IsAdmin:   false,
+			},
+		}
+		for _, user := range users {
+			if err := tx.Create(&user).Error; err != nil {
+				return err
+			}
+		}
+
+		oidcClients := []model.OidcClient{
+			{
+				Base: model.Base{
+					ID: "3654a746-35d4-4321-ac61-0bdcff2b4055",
+				},
+				Name:        "Nextcloud",
+				Secret:      "$2a$10$9dypwot8nGuCjT6wQWWpJOckZfRprhe2EkwpKizxS/fpVHrOLEJHC", // w2mUeZISmEvIDMEDvpY0PnxQIpj1m3zY
+				CallbackURL: "http://nextcloud/auth/callback",
+				ImageType:   utils.StringPointer("png"),
+				CreatedByID: users[0].ID,
+			},
+			{
+				Base: model.Base{
+					ID: "606c7782-f2b1-49e5-8ea9-26eb1b06d018",
+				},
+				Name:        "Immich",
+				Secret:      "$2a$10$Ak.FP8riD1ssy2AGGbG.gOpnp/rBpymd74j0nxNMtW0GG1Lb4gzxe", // PYjrE9u4v9GVqXKi52eur0eb2Ci4kc0x
+				CallbackURL: "http://immich/auth/callback",
+				CreatedByID: users[0].ID,
+			},
+		}
+		for _, client := range oidcClients {
+			if err := tx.Create(&client).Error; err != nil {
+				return err
+			}
+		}
+
+		authCode := model.OidcAuthorizationCode{
+			Code:      "auth-code",
+			Scope:     "openid profile",
+			Nonce:     "nonce",
+			ExpiresAt: time.Now().Add(1 * time.Hour),
+			UserID:    users[0].ID,
+			ClientID:  oidcClients[0].ID,
+		}
+		if err := tx.Create(&authCode).Error; err != nil {
+			return err
+		}
+
+		accessToken := model.OneTimeAccessToken{
+			Token:     "one-time-token",
+			ExpiresAt: time.Now().Add(1 * time.Hour),
+			UserID:    users[0].ID,
+		}
+		if err := tx.Create(&accessToken).Error; err != nil {
+			return err
+		}
+
+		userAuthorizedClient := model.UserAuthorizedOidcClient{
+			Scope:    "openid profile email",
+			UserID:   users[0].ID,
+			ClientID: oidcClients[0].ID,
+		}
+		if err := tx.Create(&userAuthorizedClient).Error; err != nil {
+			return err
+		}
+
+		publicKey1, err := getCborPublicKey("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwcOo5KV169KR67QEHrcYkeXE3CCxv2BgwnSq4VYTQxyLtdmKxegexa8JdwFKhKXa2BMI9xaN15BoL6wSCRFJhg==")
+		publicKey2, err := getCborPublicKey("MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESq/wR8QbBu3dKnpaw/v0mDxFFDwnJ/L5XHSg2tAmq5x1BpSMmIr3+DxCbybVvGRmWGh8kKhy7SMnK91M6rFHTA==")
+		if err != nil {
+			return err
+		}
+		webauthnCredentials := []model.WebauthnCredential{
+			{
+				Name:            "Passkey 1",
+				CredentialID:    "test-credential-1",
+				PublicKey:       publicKey1,
+				AttestationType: "none",
+				Transport:       model.AuthenticatorTransportList{protocol.Internal},
+				UserID:          users[0].ID,
+			},
+			{
+				Name:            "Passkey 2",
+				CredentialID:    "test-credential-2",
+				PublicKey:       publicKey2,
+				AttestationType: "none",
+				Transport:       model.AuthenticatorTransportList{protocol.Internal},
+				UserID:          users[0].ID,
+			},
+		}
+		for _, credential := range webauthnCredentials {
+			if err := tx.Create(&credential).Error; err != nil {
+				return err
+			}
+		}
+
+		webauthnSession := model.WebauthnSession{
+			Challenge:        "challenge",
+			ExpiresAt:        time.Now().Add(1 * time.Hour),
+			UserVerification: "preferred",
+		}
+		if err := tx.Create(&webauthnSession).Error; err != nil {
+			return err
+		}
+
+		return nil
+	})
+}
+
+func (s *TestService) ResetDatabase() error {
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		var tables []string
+		if err := tx.Raw("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name != 'schema_migrations';").Scan(&tables).Error; err != nil {
+			return err
+		}
+
+		for _, table := range tables {
+			if err := tx.Exec("DELETE FROM " + table).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	err = s.appConfigService.InitDbConfig()
+	return err
+}
+
+func (s *TestService) ResetApplicationImages() error {
+	if err := os.RemoveAll(common.EnvConfig.UploadPath); err != nil {
+		log.Printf("Error removing directory: %v", err)
+		return err
+	}
+
+	if err := utils.CopyDirectory("./images", common.EnvConfig.UploadPath+"/application-images"); err != nil {
+		log.Printf("Error copying directory: %v", err)
+		return err
+	}
+
+	return nil
+}
+
+// getCborPublicKey decodes a Base64 encoded public key and returns the CBOR encoded COSE key
+func getCborPublicKey(base64PublicKey string) ([]byte, error) {
+	decodedKey, err := base64.StdEncoding.DecodeString(base64PublicKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode base64 key: %w", err)
+	}
+	pubKey, err := x509.ParsePKIXPublicKey(decodedKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse public key: %w", err)
+	}
+
+	ecdsaPubKey, ok := pubKey.(*ecdsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("not an ECDSA public key")
+	}
+
+	coseKey := map[int]interface{}{
+		1:  2,                     // Key type: EC2
+		3:  -7,                    // Algorithm: ECDSA with SHA-256
+		-1: 1,                     // Curve: P-256
+		-2: ecdsaPubKey.X.Bytes(), // X coordinate
+		-3: ecdsaPubKey.Y.Bytes(), // Y coordinate
+	}
+
+	cborPublicKey, err := cbor.Marshal(coseKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal COSE key: %w", err)
+	}
+
+	return cborPublicKey, nil
+}

backend/internal/service/user_sevice.go

@@ -0,0 +1,165 @@
+package service
+
+import (
+	"errors"
+	"github.com/stonith404/pocket-id/backend/internal/common"
+	"github.com/stonith404/pocket-id/backend/internal/model"
+	"github.com/stonith404/pocket-id/backend/internal/utils"
+	"gorm.io/gorm"
+	"time"
+)
+
+type UserService struct {
+	db         *gorm.DB
+	jwtService *JwtService
+}
+
+func NewUserService(db *gorm.DB, jwtService *JwtService) *UserService {
+	return &UserService{db: db, jwtService: jwtService}
+}
+
+func (s *UserService) ListUsers(searchTerm string, page int, pageSize int) ([]model.User, utils.PaginationResponse, error) {
+	var users []model.User
+	query := s.db.Model(&model.User{})
+
+	if searchTerm != "" {
+		searchPattern := "%" + searchTerm + "%"
+		query = query.Where("email LIKE ? OR first_name LIKE ? OR username LIKE ?", searchPattern, searchPattern, searchPattern)
+	}
+
+	pagination, err := utils.Paginate(page, pageSize, query, &users)
+	return users, pagination, err
+}
+
+func (s *UserService) GetUser(userID string) (model.User, error) {
+	var user model.User
+	err := s.db.Where("id = ?", userID).First(&user).Error
+	return user, err
+}
+
+func (s *UserService) DeleteUser(userID string) error {
+	var user model.User
+	if err := s.db.Where("id = ?", userID).First(&user).Error; err != nil {
+		return err
+	}
+
+	return s.db.Delete(&user).Error
+}
+
+func (s *UserService) CreateUser(user *model.User) error {
+	if err := s.db.Create(user).Error; err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			return s.checkDuplicatedFields(*user)
+		}
+		return err
+	}
+	return nil
+}
+
+func (s *UserService) UpdateUser(userID string, updatedUser model.User, updateOwnUser bool) (model.User, error) {
+	var user model.User
+	if err := s.db.Where("id = ?", userID).First(&user).Error; err != nil {
+		return model.User{}, err
+	}
+	user.FirstName = updatedUser.FirstName
+	user.LastName = updatedUser.LastName
+	user.Email = updatedUser.Email
+	user.Username = updatedUser.Username
+	if !updateOwnUser {
+		user.IsAdmin = updatedUser.IsAdmin
+	}
+
+	if err := s.db.Save(&user).Error; err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			return user, s.checkDuplicatedFields(user)
+		}
+		return user, err
+	}
+
+	return user, nil
+}
+
+func (s *UserService) CreateOneTimeAccessToken(userID string, expiresAt time.Time) (string, error) {
+	randomString, err := utils.GenerateRandomAlphanumericString(16)
+	if err != nil {
+		return "", err
+	}
+
+	oneTimeAccessToken := model.OneTimeAccessToken{
+		UserID:    userID,
+		ExpiresAt: expiresAt,
+		Token:     randomString,
+	}
+
+	if err := s.db.Create(&oneTimeAccessToken).Error; err != nil {
+		return "", err
+	}
+
+	return oneTimeAccessToken.Token, nil
+}
+
+func (s *UserService) ExchangeOneTimeAccessToken(token string) (model.User, string, error) {
+	var oneTimeAccessToken model.OneTimeAccessToken
+	if err := s.db.Where("token = ? AND expires_at > ?", token, utils.FormatDateForDb(time.Now())).Preload("User").First(&oneTimeAccessToken).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return model.User{}, "", common.ErrTokenInvalidOrExpired
+		}
+		return model.User{}, "", err
+	}
+	accessToken, err := s.jwtService.GenerateAccessToken(oneTimeAccessToken.User)
+	if err != nil {
+		return model.User{}, "", err
+	}
+
+	if err := s.db.Delete(&oneTimeAccessToken).Error; err != nil {
+		return model.User{}, "", err
+	}
+
+	return oneTimeAccessToken.User, accessToken, nil
+}
+
+func (s *UserService) SetupInitialAdmin() (model.User, string, error) {
+	var userCount int64
+	if err := s.db.Model(&model.User{}).Count(&userCount).Error; err != nil {
+		return model.User{}, "", err
+	}
+	if userCount > 1 {
+		return model.User{}, "", common.ErrSetupAlreadyCompleted
+	}
+
+	user := model.User{
+		FirstName: "Admin",
+		LastName:  "Admin",
+		Username:  "admin",
+		Email:     "admin@admin.com",
+		IsAdmin:   true,
+	}
+
+	if err := s.db.Model(&model.User{}).Preload("Credentials").FirstOrCreate(&user).Error; err != nil {
+		return model.User{}, "", err
+	}
+
+	if len(user.Credentials) > 0 {
+		return model.User{}, "", common.ErrSetupAlreadyCompleted
+	}
+
+	token, err := s.jwtService.GenerateAccessToken(user)
+	if err != nil {
+		return model.User{}, "", err
+	}
+
+	return user, token, nil
+}
+
+func (s *UserService) checkDuplicatedFields(user model.User) error {
+	var existingUser model.User
+	if s.db.Where("id != ? AND email = ?", user.ID, user.Email).First(&existingUser).Error == nil {
+		return common.ErrEmailTaken
+	}
+
+	if s.db.Where("id != ? AND username = ?", user.ID, user.Username).First(&existingUser).Error == nil {
+		return common.ErrUsernameTaken
+	}
+
+	return nil
+}

backend/internal/service/webauthn_service.go

@@ -0,0 +1,196 @@
+package service
+
+import (
+	"github.com/go-webauthn/webauthn/protocol"
+	"github.com/go-webauthn/webauthn/webauthn"
+	"github.com/stonith404/pocket-id/backend/internal/common"
+	"github.com/stonith404/pocket-id/backend/internal/model"
+	"github.com/stonith404/pocket-id/backend/internal/utils"
+	"gorm.io/gorm"
+	"net/http"
+	"time"
+)
+
+type WebAuthnService struct {
+	db       *gorm.DB
+	webAuthn *webauthn.WebAuthn
+}
+
+func NewWebAuthnService(db *gorm.DB, appConfigService *AppConfigService) *WebAuthnService {
+	webauthnConfig := &webauthn.Config{
+		RPDisplayName: appConfigService.DbConfig.AppName.Value,
+		RPID:          utils.GetHostFromURL(common.EnvConfig.AppURL),
+		RPOrigins:     []string{common.EnvConfig.AppURL},
+		Timeouts: webauthn.TimeoutsConfig{
+			Login: webauthn.TimeoutConfig{
+				Enforce:    true,
+				Timeout:    time.Second * 60,
+				TimeoutUVD: time.Second * 60,
+			},
+			Registration: webauthn.TimeoutConfig{
+				Enforce:    true,
+				Timeout:    time.Second * 60,
+				TimeoutUVD: time.Second * 60,
+			},
+		},
+	}
+
+	wa, _ := webauthn.New(webauthnConfig)
+	return &WebAuthnService{db: db, webAuthn: wa}
+}
+
+func (s *WebAuthnService) BeginRegistration(userID string) (*model.PublicKeyCredentialCreationOptions, error) {
+	var user model.User
+	if err := s.db.Preload("Credentials").Find(&user, "id = ?", userID).Error; err != nil {
+		return nil, err
+	}
+
+	options, session, err := s.webAuthn.BeginRegistration(&user, webauthn.WithResidentKeyRequirement(protocol.ResidentKeyRequirementRequired), webauthn.WithExclusions(user.WebAuthnCredentialDescriptors()))
+	if err != nil {
+		return nil, err
+	}
+
+	sessionToStore := &model.WebauthnSession{
+		ExpiresAt:        session.Expires,
+		Challenge:        session.Challenge,
+		UserVerification: string(session.UserVerification),
+	}
+
+	if err := s.db.Create(&sessionToStore).Error; err != nil {
+		return nil, err
+	}
+
+	return &model.PublicKeyCredentialCreationOptions{
+		Response:  options.Response,
+		SessionID: sessionToStore.ID,
+		Timeout:   s.webAuthn.Config.Timeouts.Registration.Timeout,
+	}, nil
+}
+
+func (s *WebAuthnService) VerifyRegistration(sessionID, userID string, r *http.Request) (*model.WebauthnCredential, error) {
+	var storedSession model.WebauthnSession
+	if err := s.db.First(&storedSession, "id = ?", sessionID).Error; err != nil {
+		return nil, err
+	}
+
+	session := webauthn.SessionData{
+		Challenge: storedSession.Challenge,
+		Expires:   storedSession.ExpiresAt,
+		UserID:    []byte(userID),
+	}
+
+	var user model.User
+	if err := s.db.Find(&user, "id = ?", userID).Error; err != nil {
+		return nil, err
+	}
+
+	credential, err := s.webAuthn.FinishRegistration(&user, session, r)
+	if err != nil {
+		return nil, err
+	}
+
+	credentialToStore := model.WebauthnCredential{
+		Name:            "New Passkey",
+		CredentialID:    string(credential.ID),
+		AttestationType: credential.AttestationType,
+		PublicKey:       credential.PublicKey,
+		Transport:       credential.Transport,
+		UserID:          user.ID,
+		BackupEligible:  credential.Flags.BackupEligible,
+		BackupState:     credential.Flags.BackupState,
+	}
+	if err := s.db.Create(&credentialToStore).Error; err != nil {
+		return nil, err
+	}
+
+	return &credentialToStore, nil
+}
+
+func (s *WebAuthnService) BeginLogin() (*model.PublicKeyCredentialRequestOptions, error) {
+	options, session, err := s.webAuthn.BeginDiscoverableLogin()
+	if err != nil {
+		return nil, err
+	}
+
+	sessionToStore := &model.WebauthnSession{
+		ExpiresAt:        session.Expires,
+		Challenge:        session.Challenge,
+		UserVerification: string(session.UserVerification),
+	}
+
+	if err := s.db.Create(&sessionToStore).Error; err != nil {
+		return nil, err
+	}
+
+	return &model.PublicKeyCredentialRequestOptions{
+		Response:  options.Response,
+		SessionID: sessionToStore.ID,
+		Timeout:   s.webAuthn.Config.Timeouts.Registration.Timeout,
+	}, nil
+}
+
+func (s *WebAuthnService) VerifyLogin(sessionID, userID string, credentialAssertionData *protocol.ParsedCredentialAssertionData) (*model.User, error) {
+	var storedSession model.WebauthnSession
+	if err := s.db.First(&storedSession, "id = ?", sessionID).Error; err != nil {
+		return nil, err
+	}
+
+	session := webauthn.SessionData{
+		Challenge: storedSession.Challenge,
+		Expires:   storedSession.ExpiresAt,
+	}
+
+	var user *model.User
+	_, err := s.webAuthn.ValidateDiscoverableLogin(func(_, userHandle []byte) (webauthn.User, error) {
+		if err := s.db.Preload("Credentials").First(&user, "id = ?", string(userHandle)).Error; err != nil {
+			return nil, err
+		}
+		return user, nil
+	}, session, credentialAssertionData)
+
+	if err != nil {
+		return nil, common.ErrInvalidCredentials
+	}
+
+	if err := s.db.Find(&user, "id = ?", userID).Error; err != nil {
+		return nil, err
+	}
+
+	return user, nil
+}
+
+func (s *WebAuthnService) ListCredentials(userID string) ([]model.WebauthnCredential, error) {
+	var credentials []model.WebauthnCredential
+	if err := s.db.Find(&credentials, "user_id = ?", userID).Error; err != nil {
+		return nil, err
+	}
+	return credentials, nil
+}
+
+func (s *WebAuthnService) DeleteCredential(userID, credentialID string) error {
+	var credential model.WebauthnCredential
+	if err := s.db.First(&credential, "id = ? AND user_id = ?", credentialID, userID).Error; err != nil {
+		return err
+	}
+
+	if err := s.db.Delete(&credential).Error; err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *WebAuthnService) UpdateCredential(userID, credentialID, name string) error {
+	var credential model.WebauthnCredential
+	if err := s.db.Where("id = ? AND user_id = ?", credentialID, userID).First(&credential).Error; err != nil {
+		return err
+	}
+
+	credential.Name = name
+
+	if err := s.db.Save(&credential).Error; err != nil {
+		return err
+	}
+
+	return nil
+}