next_changes (#32)

Reviewed-on: phoenix/textsender-auth#32

.env.docker.sample

@@ -5,3 +5,5 @@ DB_PASSWORD=password
 DB_HOST=auth_db
 DB_PORT=5432
 DB_SSLMODE=disable
+ENABLE_REGISTRATION=true
+ALLOWED_ORIGINS="http://textsender.com"

.env.sample

@@ -5,3 +5,5 @@ DB_PASSWORD=yEDjWZCH2vdctjn!
 DB_HOST=localhost
 DB_PORT=5432
 DB_SSLMODE=disable
+ENABLE_REGISTRATION=true
+ALLOWED_ORIGINS="http://textsender.com"

.gitea/workflows/workflow.yaml

@@ -14,9 +14,9 @@ jobs:
     - uses: actions/checkout@v5
 
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@v6
       with:
-        go-version: '1.25.3' # You can specify a specific version or 'stable'
+        go-version: '1.25.4' # You can specify a specific version or 'stable'
 
     - name: Build
       run: |
@@ -24,7 +24,7 @@ jobs:
         mkdir -p ~/.ssh
         echo "${{ secrets.MYREPO_TOKEN }}" > ~/.ssh/textsender_models_deploy_key
         chmod 600 ~/.ssh/textsender_models_deploy_key
-        ssh-keyscan ${{ vars.MY_HOST }} >> ~/.ssh/known_hosts
+        ssh-keyscan ${{ secrets.MY_HOST }} >> ~/.ssh/known_hosts
  
         eval $(ssh-agent -s)
         ssh-add -v ~/.ssh/textsender_models_deploy_key
@@ -66,9 +66,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.25.3'
+          go-version: '1.25.4'
 
       - name: Install PostgreSQL client
         run: sudo apt update && sudo apt-get install -y postgresql-client
@@ -99,19 +99,21 @@ jobs:
           echo "Parent directory"
           echo `pwd`
 
-          echo "SECRET_KEY=$SECRET_KEY" >> .env
+          echo "SECRET_KEY=$SECRET_KEY" > .env
-          echo "DB_NAME=$DB_NAME" > .env
+          echo "DB_NAME=$DB_NAME" >> .env
           echo "DB_USER=$DB_USER" >> .env
           echo "DB_PASSWORD=$DB_PASSWORD" >> .env
           echo "DB_HOST=$DB_HOST" >> .env
           echo "DB_PORT=$DB_PORT" >> .env
           echo "DB_SSLMODE=$DB_SSLMODE" >> .env
+          echo "ENABLE_REGISTRATION=true" >> .env
+          echo "ALLOWED_ORIGINS=http://localhost:9080" >> .env
 
           echo "Initializing config"
           mkdir -p ~/.ssh
           echo "${{ secrets.MYREPO_TOKEN }}" > ~/.ssh/textsender_models_deploy_key
           chmod 600 ~/.ssh/textsender_models_deploy_key
-          ssh-keyscan ${{ vars.MY_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan ${{ secrets.MY_HOST }} >> ~/.ssh/known_hosts
    
           eval $(ssh-agent -s)
           ssh-add -v ~/.ssh/textsender_models_deploy_key

Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage Dockerfile for Go application
-FROM golang:1.25.3 AS builder
+FROM golang:1.25.4 AS builder
 
 WORKDIR /app
 

cmd/api/main.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/cors"
 	"github.com/swaggo/http-swagger/v2"
 
 	_ "git.kundeng.us/phoenix/textsender-auth/docs"
@@ -20,7 +21,6 @@ import (
 	"git.kundeng.us/phoenix/textsender-auth/internal/handler"
 	"git.kundeng.us/phoenix/textsender-auth/internal/handler/endpoint"
 	mdleware "git.kundeng.us/phoenix/textsender-auth/internal/middleware"
-	"git.kundeng.us/phoenix/textsender-auth/internal/model"
 	"git.kundeng.us/phoenix/textsender-auth/internal/store"
 )
 
@@ -73,15 +73,25 @@ func main() {
 	}
 
 	// Services
-	userStore := model.NewUserStore(db.Pool)
+	userStore := store.NewUserStore(db.Pool)
 	serviceStore := store.NewServiceStore(db.Pool)
 
-	userHandler := handler.NewUserHandler(userStore)
+	userHandler := handler.NewUserHandler(cfg, userStore)
-	loginHandler := handler.NewLoginHandler(userStore)
+	loginHandler := handler.NewLoginHandler(cfg, userStore)
-	serviceHandler := handler.NewServiceHandler(serviceStore)
+	serviceHandler := handler.NewServiceHandler(cfg, serviceStore)
+	refreshHandler := handler.NewRefreshHandler(cfg, userStore, serviceStore)
 
 	router := chi.NewRouter()
 
+	// Configure CORS
+	router.Use(cors.Handler(cors.Options{
+		AllowedOrigins:   cfg.AllowedOrigins,
+		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
+		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
+		ExposedHeaders:   []string{"Link", "X-Total-Count"},
+		AllowCredentials: true,
+		MaxAge:           300, // 5 minutes
+	}))
 	router.Use(middleware.Logger)
 	router.Use(middleware.Recoverer)
 	router.Use(middleware.Timeout(60 * time.Second))
@@ -90,6 +100,8 @@ func main() {
 	router.Method("Post", endpoint.Register, http.HandlerFunc(userHandler.Register))
 	router.Method("Post", endpoint.Login, http.HandlerFunc(loginHandler.Login))
 	router.Method("Post", endpoint.CreateServiceUser, http.HandlerFunc(serviceHandler.Register))
+	router.Method("Post", endpoint.LoginServiceUser, http.HandlerFunc(serviceHandler.Login))
+	router.Method("Post", endpoint.TokenRefresh, http.HandlerFunc(refreshHandler.Refresh))
 
 	router.Method("GET", "/swagger/*", httpSwagger.Handler(
 		httpSwagger.URL(fmt.Sprintf("http://localhost:%s/swagger/doc.json", config.Port)),

cmd/api/main_test.go

@@ -15,7 +15,6 @@ import (
 	"git.kundeng.us/phoenix/textsender-auth/internal/db"
 	"git.kundeng.us/phoenix/textsender-auth/internal/handler"
 	"git.kundeng.us/phoenix/textsender-auth/internal/handler/endpoint"
-	"git.kundeng.us/phoenix/textsender-auth/internal/model"
 	"git.kundeng.us/phoenix/textsender-auth/internal/store"
 )
 
@@ -38,16 +37,19 @@ func TestMain(m *testing.M) {
 		panic("Failed to initialize database")
 	}
 
-	userStore := model.NewUserStore(database.Pool)
+	userStore := store.NewUserStore(database.Pool)
 	serviceStore := store.NewServiceStore(database.Pool)
-	userHandler := handler.NewUserHandler(userStore)
+	userHandler := handler.NewUserHandler(cfg, userStore)
-	loginHandler := handler.NewLoginHandler(userStore)
+	loginHandler := handler.NewLoginHandler(cfg, userStore)
-	serviceHandler := handler.NewServiceHandler(serviceStore)
+	serviceHandler := handler.NewServiceHandler(cfg, serviceStore)
+	refreshHandler := handler.NewRefreshHandler(cfg, userStore, serviceStore)
 
 	testRouter = mux.NewRouter()
 	testRouter.HandleFunc(endpoint.Register, userHandler.Register).Methods("POST")
 	testRouter.HandleFunc(endpoint.Login, loginHandler.Login).Methods("POST")
 	testRouter.HandleFunc(endpoint.CreateServiceUser, serviceHandler.Register).Methods("POST")
+	testRouter.HandleFunc(endpoint.LoginServiceUser, serviceHandler.Login).Methods("POST")
+	testRouter.HandleFunc(endpoint.TokenRefresh, refreshHandler.Refresh).Methods("POST")
 
 	code := m.Run()
 	os.Exit(code)
@@ -76,6 +78,7 @@ func load() *config.Config {
 		DBConnString:       dbConnString,
 		ServerPort:         *port,
 		ResetDB:            *resetDb,
+		EnableRegistration: config.CheckRegistration(),
 	}
 }
 

docs/docs.go

@@ -108,6 +108,12 @@ const docTemplate = `{
                             "$ref": "#/definitions/handler.RegisterResponse"
                         }
                     },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RegisterResponse"
+                        }
+                    },
                     "500": {
                         "description": "Internal Server Error",
                         "schema": {
@@ -117,6 +123,51 @@ const docTemplate = `{
                 }
             }
         },
+        "/service/login": {
+            "post": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "Servce login and be given an access token (requires JWT)",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "service users"
+                ],
+                "summary": "Service login",
+                "parameters": [
+                    {
+                        "description": "Data to obtain a service token",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceLoginRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceLoginResponse"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceLoginResponse"
+                        }
+                    }
+                }
+            }
+        },
         "/service/register": {
             "post": {
                 "security": [
@@ -159,6 +210,12 @@ const docTemplate = `{
                             "$ref": "#/definitions/handler.ServiceCreationResponse"
                         }
                     },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceCreationResponse"
+                        }
+                    },
                     "500": {
                         "description": "Internal Server Error",
                         "schema": {
@@ -167,6 +224,57 @@ const docTemplate = `{
                     }
                 }
             }
+        },
+        "/token/refresh": {
+            "post": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "Refresh token endpoint (requires JWT)",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "refresh"
+                ],
+                "summary": "Obtain a refresh token",
+                "parameters": [
+                    {
+                        "description": "Data to refresh token",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshResponse"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshResponse"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshResponse"
+                        }
+                    }
+                }
+            }
         }
     },
     "definitions": {
@@ -195,6 +303,28 @@ const docTemplate = `{
                 }
             }
         },
+        "handler.RefreshRequest": {
+            "type": "object",
+            "properties": {
+                "access_token": {
+                    "type": "string"
+                }
+            }
+        },
+        "handler.RefreshResponse": {
+            "type": "object",
+            "properties": {
+                "data": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/token.Login"
+                    }
+                },
+                "message": {
+                    "type": "string"
+                }
+            }
+        },
         "handler.RegisterResponse": {
             "type": "object",
             "properties": {
@@ -262,6 +392,31 @@ const docTemplate = `{
                 }
             }
         },
+        "handler.ServiceLoginRequest": {
+            "type": "object",
+            "properties": {
+                "passphrase": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "handler.ServiceLoginResponse": {
+            "type": "object",
+            "properties": {
+                "data": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/token.Login"
+                    }
+                },
+                "message": {
+                    "type": "string"
+                }
+            }
+        },
         "token.Login": {
             "type": "object",
             "properties": {

docs/swagger.json

@@ -102,6 +102,12 @@
                             "$ref": "#/definitions/handler.RegisterResponse"
                         }
                     },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RegisterResponse"
+                        }
+                    },
                     "500": {
                         "description": "Internal Server Error",
                         "schema": {
@@ -111,6 +117,51 @@
                 }
             }
         },
+        "/service/login": {
+            "post": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "Servce login and be given an access token (requires JWT)",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "service users"
+                ],
+                "summary": "Service login",
+                "parameters": [
+                    {
+                        "description": "Data to obtain a service token",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceLoginRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceLoginResponse"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceLoginResponse"
+                        }
+                    }
+                }
+            }
+        },
         "/service/register": {
             "post": {
                 "security": [
@@ -153,6 +204,12 @@
                             "$ref": "#/definitions/handler.ServiceCreationResponse"
                         }
                     },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "$ref": "#/definitions/handler.ServiceCreationResponse"
+                        }
+                    },
                     "500": {
                         "description": "Internal Server Error",
                         "schema": {
@@ -161,6 +218,57 @@
                     }
                 }
             }
+        },
+        "/token/refresh": {
+            "post": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "Refresh token endpoint (requires JWT)",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "refresh"
+                ],
+                "summary": "Obtain a refresh token",
+                "parameters": [
+                    {
+                        "description": "Data to refresh token",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshResponse"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshResponse"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/handler.RefreshResponse"
+                        }
+                    }
+                }
+            }
         }
     },
     "definitions": {
@@ -189,6 +297,28 @@
                 }
             }
         },
+        "handler.RefreshRequest": {
+            "type": "object",
+            "properties": {
+                "access_token": {
+                    "type": "string"
+                }
+            }
+        },
+        "handler.RefreshResponse": {
+            "type": "object",
+            "properties": {
+                "data": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/token.Login"
+                    }
+                },
+                "message": {
+                    "type": "string"
+                }
+            }
+        },
         "handler.RegisterResponse": {
             "type": "object",
             "properties": {
@@ -256,6 +386,31 @@
                 }
             }
         },
+        "handler.ServiceLoginRequest": {
+            "type": "object",
+            "properties": {
+                "passphrase": {
+                    "type": "string"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "handler.ServiceLoginResponse": {
+            "type": "object",
+            "properties": {
+                "data": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/token.Login"
+                    }
+                },
+                "message": {
+                    "type": "string"
+                }
+            }
+        },
         "token.Login": {
             "type": "object",
             "properties": {

docs/swagger.yaml

@@ -16,6 +16,20 @@ definitions:
       message:
         type: string
     type: object
+  handler.RefreshRequest:
+    properties:
+      access_token:
+        type: string
+    type: object
+  handler.RefreshResponse:
+    properties:
+      data:
+        items:
+          $ref: '#/definitions/token.Login'
+        type: array
+      message:
+        type: string
+    type: object
   handler.RegisterResponse:
     properties:
       data:
@@ -59,6 +73,22 @@ definitions:
       message:
         type: string
     type: object
+  handler.ServiceLoginRequest:
+    properties:
+      passphrase:
+        type: string
+      username:
+        type: string
+    type: object
+  handler.ServiceLoginResponse:
+    properties:
+      data:
+        items:
+          $ref: '#/definitions/token.Login'
+        type: array
+      message:
+        type: string
+    type: object
   token.Login:
     properties:
       access_token:
@@ -141,6 +171,10 @@ paths:
           description: Bad Request
           schema:
             $ref: '#/definitions/handler.RegisterResponse'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/handler.RegisterResponse'
         "500":
           description: Internal Server Error
           schema:
@@ -150,6 +184,34 @@ paths:
       summary: Register user
       tags:
       - users
+  /service/login:
+    post:
+      consumes:
+      - application/json
+      description: Servce login and be given an access token (requires JWT)
+      parameters:
+      - description: Data to obtain a service token
+        in: body
+        name: request
+        required: true
+        schema:
+          $ref: '#/definitions/handler.ServiceLoginRequest'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/handler.ServiceLoginResponse'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/handler.ServiceLoginResponse'
+      security:
+      - BearerAuth: []
+      summary: Service login
+      tags:
+      - service users
   /service/register:
     post:
       consumes:
@@ -173,6 +235,10 @@ paths:
           description: Bad Request
           schema:
             $ref: '#/definitions/handler.ServiceCreationResponse'
+        "403":
+          description: Forbidden
+          schema:
+            $ref: '#/definitions/handler.ServiceCreationResponse'
         "500":
           description: Internal Server Error
           schema:
@@ -182,6 +248,38 @@ paths:
       summary: Register service user
       tags:
       - service users
+  /token/refresh:
+    post:
+      consumes:
+      - application/json
+      description: Refresh token endpoint (requires JWT)
+      parameters:
+      - description: Data to refresh token
+        in: body
+        name: request
+        required: true
+        schema:
+          $ref: '#/definitions/handler.RefreshRequest'
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/handler.RefreshResponse'
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/handler.RefreshResponse'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/handler.RefreshResponse'
+      security:
+      - BearerAuth: []
+      summary: Obtain a refresh token
+      tags:
+      - refresh
 securityDefinitions:
   BearerAuth:
     description: JWT Bearer Token

go.mod

@@ -1,10 +1,11 @@
 module git.kundeng.us/phoenix/textsender-auth
 
-go 1.25.3
+go 1.25.4
 
 require (
-	git.kundeng.us/phoenix/textsender-models v0.0.8-main-3ab81c2b6d-556
+	git.kundeng.us/phoenix/textsender-models v0.0.12
 	github.com/go-chi/chi/v5 v5.2.3
+	github.com/go-chi/cors v1.2.2
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1

go.sum

@@ -1,5 +1,5 @@
-git.kundeng.us/phoenix/textsender-models v0.0.8-main-3ab81c2b6d-556 h1:iVE8Dg3aYugoZseneN9tQtdV2cymukspShF7dfExSVw=
+git.kundeng.us/phoenix/textsender-models v0.0.12 h1:ps9H3FS5LyCwQhAiIvg4vYyfLZZ64dex1y9ytb0o9C4=
-git.kundeng.us/phoenix/textsender-models v0.0.8-main-3ab81c2b6d-556/go.mod h1:lx5MCnOgGgsdpwzrfi9uph5xmkeb6H8AuexUNGss2no=
+git.kundeng.us/phoenix/textsender-models v0.0.12/go.mod h1:9iPDQJg1Tc6WMNoW5+f8YKmnosMwlWHJ++hmxNLDEe0=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -8,6 +8,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
 github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
+github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=

internal/config/config.go

@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"path"
 	"strconv"
+	"strings"
 
 	"github.com/joho/godotenv"
 
@@ -16,6 +18,8 @@ type Config struct {
 	DBConnString       string
 	ServerPort         string
 	ResetDB            bool
+	EnableRegistration bool
+	AllowedOrigins     []string
 }
 
 type ConnectionInfo struct {
@@ -52,16 +56,35 @@ func Load() *Config {
 
 	err := godotenv.Load()
 	if err != nil {
+		cwd, _ := os.Getwd()
+		envPath := path.Join(cwd, "../..", ".env")
+		if err = godotenv.Load(envPath); err != nil {
+			prevPath := path.Join(envPath, "../..", ".env")
+			if err = godotenv.Load(prevPath); err != nil {
 				log.Fatal("Error loading .env file")
 			}
+		}
+	}
 
 	unpackedConnString := UnpackDBConnString()
 	dbConnString := unpackedConnString.Parse()
+	allowedOrigins := unpackAllowedOrigin()
 
+	if len(allowedOrigins) > 0 {
 		return &Config{
 			DBConnString:       dbConnString,
 			ServerPort:         *port,
 			ResetDB:            *resetDb,
+			EnableRegistration: CheckRegistration(),
+			AllowedOrigins:     allowedOrigins,
+		}
+	} else {
+		return &Config{
+			DBConnString:       dbConnString,
+			ServerPort:         *port,
+			ResetDB:            *resetDb,
+			EnableRegistration: CheckRegistration(),
+		}
 	}
 }
 
@@ -120,6 +143,26 @@ func UnpackDBConnString() (connInfo ConnectionInfo) {
 	return
 }
 
+func unpackAllowedOrigin() []string {
+	allowedOriginsRaw := os.Getenv("ALLOWED_ORIGINS")
+	allowedOriginsSplit := strings.Split(allowedOriginsRaw, ",")
+	return allowedOriginsSplit
+}
+
+func CheckRegistration() bool {
+	if flagValue := os.Getenv("ENABLE_REGISTRATION"); flagValue != "" {
+		if val := strings.ToUpper(flagValue); val == "TRUE" {
+			return true
+		} else if val == "FALSE" {
+			return false
+		} else {
+			return true
+		}
+	} else {
+		return true
+	}
+}
+
 func (c *Config) GetDBConnString() string {
 	return c.DBConnString
 }

internal/handler/endpoint/endpoint.go

@@ -4,3 +4,5 @@ package endpoint
 const Register = "/api/v1/register"
 const Login = "/api/v1/login"
 const CreateServiceUser = "/api/v1/service/register"
+const LoginServiceUser = "/api/v1/service/login"
+const TokenRefresh = "/api/v1/token/refresh"

internal/handler/login.go

@@ -4,10 +4,10 @@ import (
 	"fmt"
 	"net/http"
 
-	"git.kundeng.us/phoenix/textsender-models/pkg/token"
+	"git.kundeng.us/phoenix/textsender-models/tx0/token"
 
 	"git.kundeng.us/phoenix/textsender-auth/internal/config"
-	"git.kundeng.us/phoenix/textsender-auth/internal/model"
+	"git.kundeng.us/phoenix/textsender-auth/internal/store"
 	"git.kundeng.us/phoenix/textsender-auth/internal/utility"
 )
 
@@ -22,11 +22,12 @@ type LoginResponse struct {
 }
 
 type LoginHandler struct {
-	UserStore model.UserStore
+	Config    *config.Config
+	UserStore store.UserStore
 }
 
-func NewLoginHandler(userStore model.UserStore) *LoginHandler {
+func NewLoginHandler(cfg *config.Config, userStore store.UserStore) *LoginHandler {
-	return &LoginHandler{UserStore: userStore}
+	return &LoginHandler{Config: cfg, UserStore: userStore}
 }
 
 // Login godoc

internal/handler/login_test.go

@@ -17,8 +17,9 @@ import (
 )
 
 func TestLogin(t *testing.T) {
+	cfg := GetConfig()
 	mockstore := mock.NewMockUserStore()
-	handler := NewLoginHandler(mockstore)
+	handler := NewLoginHandler(cfg, mockstore)
 
 	testUser := GetTestUser()
 	unhashedPassword := testUser.Password

internal/handler/refresh.go

@@ -0,0 +1,100 @@
+package handler
+
+import (
+	"net/http"
+
+	"git.kundeng.us/phoenix/textsender-models/tx0/token"
+
+	"git.kundeng.us/phoenix/textsender-auth/internal/config"
+	"git.kundeng.us/phoenix/textsender-auth/internal/store"
+	"git.kundeng.us/phoenix/textsender-auth/internal/utility"
+)
+
+type RefreshHandler struct {
+	Config       *config.Config
+	UserStore    store.UserStore
+	ServiceStore store.ServiceStore
+}
+
+func NewRefreshHandler(cfg *config.Config, userStore store.UserStore, serviceStore store.ServiceStore) *RefreshHandler {
+	return &RefreshHandler{Config: cfg, UserStore: userStore, ServiceStore: serviceStore}
+}
+
+type RefreshRequest struct {
+	AccessToken string `json:"access_token"`
+}
+
+type RefreshResponse struct {
+	Message string         `json:"message"`
+	Data    []*token.Login `json:"data"`
+}
+
+// Refresh godoc
+// @Summary      Obtain a refresh token
+// @Description  Refresh token endpoint (requires JWT)
+// @Tags         refresh
+// @Accept       json
+// @Produce      json
+// @Security     BearerAuth
+// @Param        request body      RefreshRequest true  "Data to refresh token"
+// @Success      200  {object}  RefreshResponse
+// @Failure      400  {object}  RefreshResponse
+// @Failure      500  {object}  RefreshResponse
+// @Router       /token/refresh [post]
+func (rh *RefreshHandler) Refresh(w http.ResponseWriter, r *http.Request) {
+	var req RefreshRequest
+	if err := ExtractFromRequest(r, &req); err != nil {
+		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+	}
+	defer r.Body.Close()
+
+	var statusCode int
+	var resp RefreshResponse
+
+	secretKey := config.GetSecretKey()
+	tokGen := utility.TokenGenerator{}
+	tokGen.SetSecretKey(secretKey)
+	tokGen.SetHourOffset(12)
+	if verified, err := tokGen.VerifyToken(req.AccessToken); err != nil {
+		statusCode = http.StatusInternalServerError
+		resp.Message = err.Error()
+	} else {
+		if verified {
+			if id, err := tokGen.ExtractIdFromToken(req.AccessToken); err != nil {
+				statusCode = http.StatusInternalServerError
+				resp.Message = err.Error()
+			} else {
+				ctx := r.Context()
+				if usr, err := rh.UserStore.GetUserByID(ctx, id); err != nil || usr == nil {
+					if serviceUsr, err := rh.ServiceStore.GetWithId(ctx, id); err != nil || serviceUsr == nil {
+						statusCode = http.StatusInternalServerError
+						resp.Message = err.Error()
+					} else {
+						if myToken, err := tokGen.GenerateToken(serviceUsr); err != nil {
+							statusCode = http.StatusInternalServerError
+							resp.Message = err.Error()
+						} else {
+							statusCode = http.StatusOK
+							resp.Data = append(resp.Data, myToken)
+							resp.Message = "Successful"
+						}
+					}
+				} else {
+					if myToken, err := tokGen.GenerateToken(usr); err != nil {
+						statusCode = http.StatusInternalServerError
+						resp.Message = err.Error()
+					} else {
+						statusCode = http.StatusOK
+						resp.Data = append(resp.Data, myToken)
+						resp.Message = "Successful"
+					}
+				}
+			}
+		} else {
+			statusCode = http.StatusBadRequest
+			resp.Message = "Unverified"
+		}
+	}
+
+	RespondWithJson(w, statusCode, &resp)
+}

internal/handler/refresh_test.go

@@ -0,0 +1,66 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
+	"github.com/stretchr/testify/assert"
+
+	"git.kundeng.us/phoenix/textsender-auth/internal/handler/endpoint"
+	"git.kundeng.us/phoenix/textsender-auth/internal/store/mock"
+	"git.kundeng.us/phoenix/textsender-auth/internal/utility"
+)
+
+func TestRefreshTokenWithMock(t *testing.T) {
+	var serviceUser user.ServiceUser
+	var hashedPassword string
+	var err error
+	unhashed := "9328nr29nudx3292m320!"
+	hashing := utility.HashMash{Password: unhashed}
+	if hashedPassword, err = hashing.HashPassword(); err != nil {
+		assert.NoError(t, err, "Error hashing password: %v", err)
+	} else {
+		serviceUser.Passphrase = hashedPassword
+	}
+	serviceUser.Username = "swoon"
+	ctx := t.Context()
+	mockStore := mock.NewMockServiceUserStore()
+	userStore := mock.NewMockUserStore()
+
+	if err := mockStore.Create(ctx, &serviceUser); err != nil {
+		assert.NoError(t, err, "Error creating service user: %v", err)
+	}
+
+	cfg := GetConfig()
+	handler := NewServiceHandler(cfg, mockStore)
+	testService := ServiceLoginRequest{Username: serviceUser.Username, Passphrase: unhashed}
+	jsonValue, err := json.Marshal(testService)
+	assert.NoError(t, err, "Error marshaling request")
+
+	req, _ := http.NewRequest("POST", endpoint.LoginServiceUser, strings.NewReader(string(jsonValue)))
+	rr := httptest.NewRecorder()
+
+	handler.Login(rr, req)
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var response ServiceLoginResponse
+	err = json.Unmarshal(rr.Body.Bytes(), &response)
+	assert.NoError(t, err)
+
+	accessToken := response.Data[0].AccessToken
+
+	testReq := RefreshRequest{AccessToken: accessToken}
+	jsonValue, err = json.Marshal(testReq)
+	assert.NoError(t, err, "Error marshaling request")
+
+	newHandler := NewRefreshHandler(cfg, userStore, mockStore)
+	req, _ = http.NewRequest("POST", endpoint.TokenRefresh, strings.NewReader(string(jsonValue)))
+	rr = httptest.NewRecorder()
+
+	newHandler.Refresh(rr, req)
+	assert.Equal(t, http.StatusOK, rr.Code)
+}

internal/handler/register.go

@@ -4,10 +4,11 @@ import (
 	"fmt"
 	"net/http"
 
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 	"github.com/google/uuid"
 
-	"git.kundeng.us/phoenix/textsender-auth/internal/model"
+	"git.kundeng.us/phoenix/textsender-auth/internal/config"
+	"git.kundeng.us/phoenix/textsender-auth/internal/store"
 	"git.kundeng.us/phoenix/textsender-auth/internal/utility"
 )
 
@@ -29,11 +30,12 @@ type RegisterResponse struct {
 }
 
 type UserHandler struct {
-	UserStore model.UserStore
+	Config    *config.Config
+	UserStore store.UserStore
 }
 
-func NewUserHandler(userStore model.UserStore) *UserHandler {
+func NewUserHandler(cfg *config.Config, userStore store.UserStore) *UserHandler {
-	return &UserHandler{UserStore: userStore}
+	return &UserHandler{Config: cfg, UserStore: userStore}
 }
 
 // Register godoc
@@ -46,6 +48,7 @@ func NewUserHandler(userStore model.UserStore) *UserHandler {
 // @Param        request body      RegisterUser true  "Data to add user"
 // @Success      200  {object}  RegisterResponse
 // @Failure      400  {object}  RegisterResponse
+// @Failure      403  {object}  RegisterResponse
 // @Failure      500  {object}  RegisterResponse
 // @Router       /register [post]
 func (u *UserHandler) Register(w http.ResponseWriter, r *http.Request) {
@@ -60,6 +63,12 @@ func (u *UserHandler) Register(w http.ResponseWriter, r *http.Request) {
 
 	var statusCode int
 	var resp RegisterResponse
+	if !u.Config.EnableRegistration {
+		statusCode = http.StatusForbidden
+		resp.Message = "Registration disabled"
+		RespondWithJson(w, statusCode, &resp)
+		return
+	}
 	user := user.User{Username: req.Username, Password: req.Password, PhoneNumber: req.PhoneNumber}
 
 	fmt.Println("Username:", user.Username)

internal/handler/register_test.go

@@ -14,8 +14,9 @@ import (
 )
 
 func TestCreateUserWithMock(t *testing.T) {
+	cfg := GetConfig()
 	mockstore := mock.NewMockUserStore()
-	handler := NewUserHandler(mockstore)
+	handler := NewUserHandler(cfg, mockstore)
 
 	testUser := GetTestUser()
 	jsonValue, _ := json.Marshal(testUser)

internal/handler/service.go

@@ -3,12 +3,23 @@ package handler
 import (
 	"net/http"
 
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
+	"git.kundeng.us/phoenix/textsender-models/tx0/token"
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 
+	"git.kundeng.us/phoenix/textsender-auth/internal/config"
 	"git.kundeng.us/phoenix/textsender-auth/internal/store"
 	"git.kundeng.us/phoenix/textsender-auth/internal/utility"
 )
 
+type ServiceHandler struct {
+	Config       *config.Config
+	ServiceStore store.ServiceStore
+}
+
+func NewServiceHandler(cfg *config.Config, serviceStore store.ServiceStore) *ServiceHandler {
+	return &ServiceHandler{Config: cfg, ServiceStore: serviceStore}
+}
+
 type ServiceCreationRequest struct {
 	Username   string `json:"username"`
 	Passphrase string `json:"passphrase"`
@@ -19,14 +30,6 @@ type ServiceCreationResponse struct {
 	Data    []*user.ServiceUser `json:"data"`
 }
 
-type ServiceHandler struct {
-	ServiceStore store.ServiceStore
-}
-
-func NewServiceHandler(serviceStore store.ServiceStore) *ServiceHandler {
-	return &ServiceHandler{ServiceStore: serviceStore}
-}
-
 // Register godoc
 // @Summary      Register service user
 // @Description  Create a service user that can send texts (requires JWT)
@@ -37,6 +40,7 @@ func NewServiceHandler(serviceStore store.ServiceStore) *ServiceHandler {
 // @Param        request body      ServiceCreationRequest true  "Data to add user"
 // @Success      200  {object}  ServiceCreationResponse
 // @Failure      400  {object}  ServiceCreationResponse
+// @Failure      403  {object}  ServiceCreationResponse
 // @Failure      500  {object}  ServiceCreationResponse
 // @Router       /service/register [post]
 func (s *ServiceHandler) Register(w http.ResponseWriter, r *http.Request) {
@@ -50,6 +54,12 @@ func (s *ServiceHandler) Register(w http.ResponseWriter, r *http.Request) {
 
 	var statusCode int
 	var resp ServiceCreationResponse
+	if !s.Config.EnableRegistration {
+		statusCode = http.StatusForbidden
+		resp.Message = "Registration disabled"
+		RespondWithJson(w, statusCode, &resp)
+		return
+	}
 
 	ctx := r.Context()
 	if exists, err := s.ServiceStore.CheckWithUsername(ctx, req.Username); err != nil {
@@ -80,3 +90,76 @@ func (s *ServiceHandler) Register(w http.ResponseWriter, r *http.Request) {
 
 	RespondWithJson(w, statusCode, &resp)
 }
+
+type ServiceLoginRequest struct {
+	Username   string `json:"username"`
+	Passphrase string `json:"passphrase"`
+}
+
+type ServiceLoginResponse struct {
+	Message string         `json:"message"`
+	Data    []*token.Login `json:"data"`
+}
+
+// Login godoc
+// @Summary      Service login
+// @Description  Servce login and be given an access token (requires JWT)
+// @Tags         service users
+// @Accept       json
+// @Produce      json
+// @Security     BearerAuth
+// @Param        request body      ServiceLoginRequest true  "Data to obtain a service token"
+// @Success      200  {object}  ServiceLoginResponse
+// @Failure      500  {object}  ServiceLoginResponse
+// @Router       /service/login [post]
+func (s *ServiceHandler) Login(w http.ResponseWriter, r *http.Request) {
+	var req ServiceLoginRequest
+	if err := ExtractFromRequest(r, &req); err != nil {
+		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
+	}
+	defer r.Body.Close()
+
+	var statusCode int
+	var resp ServiceLoginResponse
+
+	if len(req.Username) == 0 || len(req.Passphrase) == 0 {
+		statusCode = http.StatusBadRequest
+		resp.Message = "Invalid request"
+		RespondWithJson(w, statusCode, &resp)
+		return
+	}
+
+	ctx := r.Context()
+
+	if serviceUser, err := s.ServiceStore.GetWithUsername(ctx, req.Username); err != nil {
+		statusCode = http.StatusInternalServerError
+		resp.Message = err.Error()
+	} else {
+		if serviceUser == nil {
+			statusCode = http.StatusNotFound
+			resp.Message = "Not found"
+		} else {
+			hashing := utility.HashMash{Password: req.Passphrase}
+			if !hashing.CheckPasswordHash(req.Passphrase, serviceUser.Passphrase) {
+				statusCode = http.StatusInternalServerError
+				resp.Message = "Not valid"
+			} else {
+				var tokGen utility.TokenGenerator
+				tokGen.SetHourOffset(8)
+				secretKey := config.GetSecretKey()
+				tokGen.SetSecretKey(secretKey)
+
+				if myToken, err := tokGen.GenerateToken(*serviceUser); err != nil {
+					statusCode = http.StatusInternalServerError
+					resp.Message = err.Error()
+				} else {
+					statusCode = http.StatusOK
+					resp.Data = append(resp.Data, myToken)
+					resp.Message = "Successful"
+				}
+			}
+		}
+	}
+
+	RespondWithJson(w, statusCode, &resp)
+}

internal/handler/service_test.go

@@ -7,15 +7,18 @@ import (
 	"strings"
 	"testing"
 
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 	"github.com/stretchr/testify/assert"
 
 	"git.kundeng.us/phoenix/textsender-auth/internal/handler/endpoint"
 	"git.kundeng.us/phoenix/textsender-auth/internal/store/mock"
+	"git.kundeng.us/phoenix/textsender-auth/internal/utility"
 )
 
 func TestCreateServiceUserWithMock(t *testing.T) {
+	cfg := GetConfig()
 	mockStore := mock.NewMockServiceUserStore()
-	handler := NewServiceHandler(mockStore)
+	handler := NewServiceHandler(cfg, mockStore)
 
 	testService := ServiceCreationRequest{Username: "swoon", Passphrase: "ewrewr329n12y3x2!2"}
 	jsonValue, err := json.Marshal(testService)
@@ -31,3 +34,39 @@ func TestCreateServiceUserWithMock(t *testing.T) {
 	err = json.Unmarshal(rr.Body.Bytes(), &response)
 	assert.NoError(t, err)
 }
+
+func TestLoginServiceUserWithMock(t *testing.T) {
+	var serviceUser user.ServiceUser
+	var hashedPassword string
+	var err error
+	unhashed := "9328nr29nudx3292m320!"
+	hashing := utility.HashMash{Password: unhashed}
+	if hashedPassword, err = hashing.HashPassword(); err != nil {
+		assert.NoError(t, err, "Error hashing password: %v", err)
+	} else {
+		serviceUser.Passphrase = hashedPassword
+	}
+	serviceUser.Username = "swoon"
+	ctx := t.Context()
+	mockStore := mock.NewMockServiceUserStore()
+
+	if err := mockStore.Create(ctx, &serviceUser); err != nil {
+		assert.NoError(t, err, "Error creating service user: %v", err)
+	}
+
+	cfg := GetConfig()
+	handler := NewServiceHandler(cfg, mockStore)
+	testService := ServiceLoginRequest{Username: serviceUser.Username, Passphrase: unhashed}
+	jsonValue, err := json.Marshal(testService)
+	assert.NoError(t, err, "Error marshaling request")
+
+	req, _ := http.NewRequest("POST", endpoint.LoginServiceUser, strings.NewReader(string(jsonValue)))
+	rr := httptest.NewRecorder()
+
+	handler.Login(rr, req)
+	assert.Equal(t, http.StatusOK, rr.Code)
+
+	var response ServiceLoginResponse
+	err = json.Unmarshal(rr.Body.Bytes(), &response)
+	assert.NoError(t, err)
+}

internal/handler/utility_test.go

@@ -1,9 +1,40 @@
 package handler
 
 import (
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
+	"log"
+	"os"
+	"path"
+
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
+	"github.com/joho/godotenv"
+
+	"git.kundeng.us/phoenix/textsender-auth/internal/config"
 )
 
 func GetTestUser() user.User {
 	return user.User{Username: "ghost", PhoneNumber: "+1234567890", Password: "dfgdffddfd"}
 }
+
+func GetConfig() *config.Config {
+	err := godotenv.Load()
+	if err != nil {
+		cwd, _ := os.Getwd()
+		envPath := path.Join(cwd, "../..", ".env")
+		if err = godotenv.Load(envPath); err != nil {
+			prevPath := path.Join(envPath, "../..", ".env")
+			if err = godotenv.Load(prevPath); err != nil {
+				log.Fatal("Error loading .env file")
+			}
+		}
+	}
+
+	unpackedConnString := config.UnpackDBConnString()
+	dbConnString := unpackedConnString.Parse()
+
+	return &config.Config{
+		DBConnString:       dbConnString,
+		ServerPort:         config.Port,
+		ResetDB:            false,
+		EnableRegistration: config.CheckRegistration(),
+	}
+}

internal/store/mock/service_store.go

@@ -3,11 +3,11 @@ package mock
 import (
 	"context"
 	"errors"
+	"fmt"
 	"sync"
 
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 	"github.com/google/uuid"
-
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
 )
 
 type MockServiceUserStore struct {
@@ -53,10 +53,6 @@ func (m *MockServiceUserStore) CheckWithUsername(ctx context.Context, username s
 		return false, m.Error
 	}
 
-	if m.Error != nil {
-		return false, m.Error
-	}
-
 	var exists bool
 
 	for _, serviceUser := range m.ServiceUsers {
@@ -72,3 +68,36 @@ func (m *MockServiceUserStore) CheckWithUsername(ctx context.Context, username s
 		return exists, nil
 	}
 }
+
+func (m *MockServiceUserStore) GetWithUsername(ctx context.Context, username string) (*user.ServiceUser, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.Error != nil {
+		return nil, m.Error
+	}
+
+	serviceUser := m.ServiceUsersByUsername[username]
+	if serviceUser != nil {
+		return serviceUser, nil
+	} else {
+		return nil, fmt.Errorf("User not found")
+	}
+}
+
+func (m *MockServiceUserStore) GetWithId(ctx context.Context, id uuid.UUID) (*user.ServiceUser, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	if m.Error != nil {
+		return nil, m.Error
+	}
+
+	for _, serviceUser := range m.ServiceUsers {
+		if serviceUser.Id == id {
+			return serviceUser, nil
+		}
+	}
+
+	return nil, nil
+}

internal/store/mock/store.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/google/uuid"
 
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 )
 
 type MockUserStore struct {

internal/store/service.go

@@ -4,13 +4,16 @@ import (
 	"context"
 	"fmt"
 
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
+	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 type ServiceStore interface {
 	CheckWithUsername(ctx context.Context, username string) (bool, error)
+	GetWithUsername(ctx context.Context, username string) (*user.ServiceUser, error)
+	GetWithId(ctx context.Context, id uuid.UUID) (*user.ServiceUser, error)
 	Create(ctx context.Context, serviceUser *user.ServiceUser) error
 }
 
@@ -37,6 +40,36 @@ func (s *PGServiceStore) CheckWithUsername(ctx context.Context, username string)
 	}
 }
 
+func (s *PGServiceStore) GetWithUsername(ctx context.Context, username string) (*user.ServiceUser, error) {
+	var serviceUser user.ServiceUser
+	query := `SELECT id, username, passphrase, created FROM service_users WHERE username = $1`
+
+	if err := s.db.QueryRow(ctx, query, username).Scan(&serviceUser.Id, &serviceUser.Username, &serviceUser.Passphrase, &serviceUser.Created); err != nil {
+		if err == pgx.ErrNoRows {
+			return nil, nil
+		} else {
+			return nil, fmt.Errorf("Error querying row: %v", err)
+		}
+	} else {
+		return &serviceUser, nil
+	}
+}
+
+func (s *PGServiceStore) GetWithId(ctx context.Context, id uuid.UUID) (*user.ServiceUser, error) {
+	var serviceUser user.ServiceUser
+	query := `SELECT id, username, passphrase, created FROM service_users WHERE id = $1`
+
+	if err := s.db.QueryRow(ctx, query, id).Scan(&serviceUser.Id, &serviceUser.Username, &serviceUser.Passphrase, &serviceUser.Created); err != nil {
+		if err == pgx.ErrNoRows {
+			return nil, nil
+		} else {
+			return nil, fmt.Errorf("Error querying row: %v", err)
+		}
+	} else {
+		return &serviceUser, nil
+	}
+}
+
 func (s *PGServiceStore) Create(ctx context.Context, serviceUser *user.ServiceUser) error {
 	query := `
 		INSERT INTO service_users (username, passphrase)

internal/store/user.go

@@ -1,4 +1,4 @@
-package model
+package store
 
 import (
 	"context"
@@ -8,10 +8,9 @@ import (
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 )
 
-
 type UserStore interface {
 	CreateUser(ctx context.Context, user *user.User) error
 	GetUserByID(ctx context.Context, id uuid.UUID) (*user.User, error)

internal/utility/hashing.go

@@ -8,12 +8,12 @@ type HashMash struct {
 	Password string
 }
 
-func (h HashMash) HashPassword() (string, error) {
+func (h *HashMash) HashPassword() (string, error) {
 	bytes, err := bcrypt.GenerateFromPassword([]byte(h.Password), bcrypt.DefaultCost)
 	return string(bytes), err
 }
 
-func (h HashMash) CheckPasswordHash(password string, hash string) bool {
+func (h *HashMash) CheckPasswordHash(password string, hash string) bool {
 	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
 	return err == nil
 }

internal/utility/token.go

@@ -1,13 +1,15 @@
 package utility
 
 import (
+	"fmt"
 	"time"
 
+	"git.kundeng.us/phoenix/textsender-models/tx0/token"
+	"git.kundeng.us/phoenix/textsender-models/tx0/user"
 	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
 
 	"git.kundeng.us/phoenix/textsender-auth/internal/config"
-	"git.kundeng.us/phoenix/textsender-models/pkg/token"
-	"git.kundeng.us/phoenix/textsender-models/pkg/user"
 )
 
 const ROLE_TYPE = "regular"
@@ -15,33 +17,123 @@ const TOKEN_TYPE = "Bearer"
 
 type TokenGenerator struct {
 	SecretKey  []byte
+	hourOffset time.Duration
 }
 
 func (t *TokenGenerator) SetSecretKey(secretKey string) {
 	t.SecretKey = []byte(secretKey)
 }
 
-func (t *TokenGenerator) GenerateToken(user user.User) (*token.Login, error) {
+func (t *TokenGenerator) SetHourOffset(offset time.Duration) error {
-	issuedAt := time.Now()
+	if offset < 48 {
-	expirationTime := time.Now().Add(4 * time.Hour)
+		t.hourOffset = offset
-	claims := t.generateClaims(user, TOKEN_TYPE, issuedAt, expirationTime)
+		return nil
-
-	myToken := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	if tokenString, err := myToken.SignedString(t.SecretKey); err != nil {
-		return nil, err
 	} else {
-		return &token.Login{AccessToken: tokenString, TokenType: TOKEN_TYPE, ExpiresIn: expirationTime.Unix()}, nil
+		return fmt.Errorf("No change")
 	}
 }
 
-func (t *TokenGenerator) generateClaims(user user.User, role string, issuedAt time.Time, expiredAt time.Time) token.Claims {
+func (t *TokenGenerator) GenerateToken(usr any) (*token.Login, error) {
-	return token.Claims{
+	issuedAt := time.Now()
-		UserId: user.Id,
+	if t.hourOffset == 0 {
+		t.hourOffset = 4
+	}
+
+	expirationTime := time.Now().Add(t.hourOffset * time.Hour)
+
+	if claims, err := t.generateClaims(usr, TOKEN_TYPE, issuedAt, expirationTime); err != nil {
+		return nil, fmt.Errorf("Error generating claims: %v", err)
+	} else {
+		myToken := jwt.NewWithClaims(jwt.SigningMethodHS256, *claims)
+		if tokenString, err := myToken.SignedString(t.SecretKey); err != nil {
+			return nil, err
+		} else {
+			return &token.Login{UserId: claims.UserId, AccessToken: tokenString, TokenType: TOKEN_TYPE, ExpiresIn: expirationTime.Unix()}, nil
+		}
+	}
+}
+
+func (t *TokenGenerator) VerifyToken(accessToken string) (bool, error) {
+	clms := &token.Claims{}
+
+	if tken, err := t.parseTokenWithClaims(accessToken, clms); err != nil {
+		return false, nil
+	} else {
+		if tken.Valid {
+			if clms != nil {
+				if clms.UserId != uuid.Nil {
+					return true, nil
+				} else {
+					return false, fmt.Errorf("User Id was not set")
+				}
+			} else {
+				return false, fmt.Errorf("Claims not parsed")
+			}
+		} else {
+			return false, fmt.Errorf("Invalid access token")
+		}
+	}
+}
+
+func (t *TokenGenerator) ExtractIdFromToken(accessToken string) (uuid.UUID, error) {
+	clms := &token.Claims{}
+
+	if tken, err := t.parseTokenWithClaims(accessToken, clms); err != nil {
+		return uuid.Nil, nil
+	} else {
+		if tken.Valid {
+			if clms != nil {
+				if clms.UserId != uuid.Nil {
+					return clms.UserId, nil
+				} else {
+					return uuid.Nil, fmt.Errorf("User Id was not set")
+				}
+			} else {
+				return uuid.Nil, fmt.Errorf("Claims not parsed")
+			}
+		} else {
+			return uuid.Nil, fmt.Errorf("Invalid access token")
+		}
+	}
+}
+
+func (t *TokenGenerator) parseTokenWithClaims(accessToken string, claims *token.Claims) (*jwt.Token, error) {
+	tken, err := jwt.ParseWithClaims(accessToken, claims, func(tken *jwt.Token) (any, error) {
+		if _, ok := tken.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", tken.Header["alg"])
+		}
+		return t.SecretKey, nil
+	}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}))
+
+	if err != nil {
+		return nil, err
+	} else {
+		return tken, nil
+	}
+}
+
+func (t *TokenGenerator) generateClaims(usr any, role string, issuedAt time.Time, expiredAt time.Time) (*token.Claims, error) {
+	var id uuid.UUID
+	switch val := usr.(type) {
+	case user.User:
+		id = val.Id
+	case *user.User:
+		id = val.Id
+	case user.ServiceUser:
+		id = val.Id
+	case *user.ServiceUser:
+		id = val.Id
+	default:
+		return nil, fmt.Errorf("Invalid type")
+	}
+
+	return &token.Claims{
+		UserId: id,
 		Role:   role,
 		RegisteredClaims: jwt.RegisteredClaims{
 			Issuer:    config.App_Name,
 			ExpiresAt: jwt.NewNumericDate(expiredAt),
 			IssuedAt:  jwt.NewNumericDate(issuedAt),
 		},
-	}
+	}, nil
 }