Method ValidateAccessToken

internal/token/auth_token.go:282–331

Function to validate access token for authorizer apis (profile, update_profile)

(gc *gin.Context, accessToken string)

// Function to validate access token for authorizer apis (profile, update_profile)
func (p *provider) ValidateAccessToken(gc *gin.Context, accessToken string) (map[string]interface{}, error) {
	res := make(map[string]interface{})

	if accessToken == "" {
		return res, fmt.Errorf(`unauthorized`)
	}

	res, err := p.ParseJWTToken(accessToken)
	if err != nil {
		return res, err
	}

	userID, ok := res["sub"].(string)
	if !ok || userID == "" {
		return res, fmt.Errorf(`unauthorized: missing sub claim`)
	}
	nonce, _ := res["nonce"].(string)

	loginMethod, _ := res["login_method"].(string)
	sessionKey := userID
	if loginMethod != "" {
		sessionKey = loginMethod + ":" + userID
	}

	token, err := p.dependencies.MemoryStoreProvider.GetUserSession(sessionKey, constants.TokenTypeAccessToken+"_"+nonce)
	if nonce == "" || err != nil {
		p.dependencies.Log.Debug().Err(err).Msgf("invalid access token: %v, key: %s", err, sessionKey+":"+constants.TokenTypeAccessToken+"_"+nonce)
		return res, fmt.Errorf(`unauthorized`)
	}

	if subtle.ConstantTimeCompare([]byte(token), []byte(accessToken)) != 1 {
		p.dependencies.Log.Debug().Msgf("invalid access token: %s, key: %s", err, sessionKey+":"+constants.TokenTypeAccessToken+"_"+nonce)
		return res, fmt.Errorf(`unauthorized`)
	}

	hostname := parsers.GetHost(gc)
	if ok, err := p.ValidateJWTClaims(res, &AuthTokenConfig{
		HostName: hostname,
		Nonce:    nonce,
		User:     &schemas.User{ID: userID},
	}); !ok || err != nil {
		return res, err
	}

	if res["token_type"] != constants.TokenTypeAccessToken {
		return res, fmt.Errorf(`unauthorized: invalid token type`)
	}

	return res, nil
}

// Function to validate refreshToken
func (p *provider) ValidateRefreshToken(gc *gin.Context, refreshToken string) (map[string]interface{}, error) {