Initial multi-tenant blog host

Go + Postgres application serving a management dashboard on the base
domain and one public blog per subdomain. Markdown posts organised in
pages, form-based theme customisation, image uploads stored in Postgres,
JWT cookie sessions with CSRF, superadmin user management, RSS feeds.
Docker/compose deployment and a Makefile-driven dev environment with
seed data.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

5 files changed, 143 insertions, 0 deletions

diff --git a/internal/auth/auth_test.go b/internal/auth/auth_test.go
new file mode 100644
index 0000000..d09ec3c
--- /dev/null
+++ b/internal/auth/auth_test.go
@@ -0,0 +1,46 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestTokenRoundTrip(t *testing.T) {
+	secret := []byte("test-secret-test-secret")
+	tok, err := IssueToken(secret, 42, 3, time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, err := ParseToken(secret, tok)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.UserID != 42 || c.TokenVersion != 3 {
+		t.Errorf("claims = %+v", c)
+	}
+	if _, err := ParseToken([]byte("other-secret-other-secret"), tok); err == nil {
+		t.Error("token accepted with wrong secret")
+	}
+	old, _ := IssueToken(secret, 42, 3, time.Now().Add(-8*24*time.Hour))
+	if _, err := ParseToken(secret, old); err == nil {
+		t.Error("expired token accepted")
+	}
+}
+
+func TestPasswordAndCSRF(t *testing.T) {
+	h, err := HashPassword("hunter22")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !CheckPassword(h, "hunter22") || CheckPassword(h, "hunter23") {
+		t.Error("password check wrong")
+	}
+	secret := []byte("s")
+	tok := CSRFToken(secret, 1, 0)
+	if !CheckCSRF(secret, 1, 0, tok) {
+		t.Error("valid csrf rejected")
+	}
+	if CheckCSRF(secret, 1, 1, tok) || CheckCSRF(secret, 2, 0, tok) || CheckCSRF(secret, 1, 0, "") {
+		t.Error("invalid csrf accepted")
+	}
+}
diff --git a/internal/auth/cookie.go b/internal/auth/cookie.go
new file mode 100644
index 0000000..9fd6b6e
--- /dev/null
+++ b/internal/auth/cookie.go
@@ -0,0 +1,23 @@
+package auth
+
+import (
+	"net/http"
+	"time"
+)
+
+const CookieName = "session"
+
+func SetSessionCookie(w http.ResponseWriter, token string) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    token,
+		Path:     "/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   int(SessionTTL / time.Second),
+	})
+}
+
+func ClearSessionCookie(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{Name: CookieName, Value: "", Path: "/", HttpOnly: true, MaxAge: -1})
+}
diff --git a/internal/auth/csrf.go b/internal/auth/csrf.go
new file mode 100644
index 0000000..da34309
--- /dev/null
+++ b/internal/auth/csrf.go
@@ -0,0 +1,20 @@
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+)
+
+// CSRFToken derives a per-user token from the secret; it changes whenever the
+// user's token_version changes (password reset, disable) and needs no storage.
+func CSRFToken(secret []byte, userID int64, tokenVersion int) string {
+	m := hmac.New(sha256.New, secret)
+	fmt.Fprintf(m, "csrf:%d:%d", userID, tokenVersion)
+	return hex.EncodeToString(m.Sum(nil))
+}
+
+func CheckCSRF(secret []byte, userID int64, tokenVersion int, got string) bool {
+	return hmac.Equal([]byte(CSRFToken(secret, userID, tokenVersion)), []byte(got))
+}
diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go
new file mode 100644
index 0000000..a7fb52a
--- /dev/null
+++ b/internal/auth/jwt.go
@@ -0,0 +1,41 @@
+package auth
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+const SessionTTL = 7 * 24 * time.Hour
+
+type Claims struct {
+	jwt.RegisteredClaims
+	UserID       int64 `json:"uid"`
+	TokenVersion int   `json:"ver"`
+}
+
+func IssueToken(secret []byte, userID int64, tokenVersion int, now time.Time) (string, error) {
+	c := Claims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(SessionTTL)),
+		},
+		UserID:       userID,
+		TokenVersion: tokenVersion,
+	}
+	return jwt.NewWithClaims(jwt.SigningMethodHS256, c).SignedString(secret)
+}
+
+func ParseToken(secret []byte, tok string) (*Claims, error) {
+	var c Claims
+	_, err := jwt.ParseWithClaims(tok, &c, func(t *jwt.Token) (any, error) { return secret, nil },
+		jwt.WithValidMethods([]string{"HS256"}), jwt.WithExpirationRequired())
+	if err != nil {
+		return nil, err
+	}
+	if c.UserID == 0 {
+		return nil, errors.New("missing uid")
+	}
+	return &c, nil
+}
diff --git a/internal/auth/password.go b/internal/auth/password.go
new file mode 100644
index 0000000..97aba55
--- /dev/null
+++ b/internal/auth/password.go
@@ -0,0 +1,13 @@
+// Package auth implements password hashing, JWT sessions and CSRF tokens.
+package auth
+
+import "golang.org/x/crypto/bcrypt"
+
+func HashPassword(pw string) (string, error) {
+	h, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.DefaultCost)
+	return string(h), err
+}
+
+func CheckPassword(hash, pw string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(pw)) == nil
+}