13 Membuat Middleware Authentication Menggunakan Oauth Pada Golang

go get github.com/julienschmidt/httprouter

go get golang.org/x/oauth2
go get golang.org/x/oauth2/google

package main

import (
    "fmt"
    "log"
    "net/http"

    "github.com/julienschmidt/httprouter"
    "golang.org/x/oauth2"
    "golang.org/x/oauth2/google"
)

var oauth2Config oauth2.Config

// OAuth2 middleware to check for valid token
func oauth2Middleware(next httprouter.Handle) httprouter.Handle {
    return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
        token, err := oauth2Config.TokenSource(r.Context()).Token()
        if err != nil || !token.Valid() {
            http.Redirect(w, r, oauth2Config.AuthCodeURL("", oauth2.AccessTypeOffline), http.StatusFound)
            return
        }
        next(w, r, ps)
    }
}

// HomeHandler that will be protected by OAuth2 middleware
func homeHandler(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
    fmt.Fprintf(w, "Welcome, you are authenticated!")
}

func main() {
    oauth2Config = oauth2.Config{
        ClientID:     "YOUR_CLIENT_ID",
        ClientSecret: "YOUR_CLIENT_SECRET",
        RedirectURL:  "http://localhost:8080/callback",
        Scopes:       []string{"openid", "profile", "email"},
        Endpoint:     google.Endpoint,
    }

    router := httprouter.New()

    // Protect /home route with OAuth2 middleware
    router.GET("/home", oauth2Middleware(homeHandler))

    log.Println("Starting server on :8080")
    log.Fatal(http.ListenAndServe(":8080", router))
}

func callbackHandler(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
    code := r.URL.Query().Get("code")
    token, err := oauth2Config.Exchange(r.Context(), code)
    if err != nil {
        http.Error(w, "Failed to get token: "+err.Error(), http.StatusInternalServerError)
        return
    }

    // Save token in session or context for future requests
    fmt.Fprintf(w, "You are authenticated! Token: %s", token.AccessToken)
}

router.GET("/callback", callbackHandler)

package main

import (
    "net/http"
    "net/http/httptest"
    "testing"
    "github.com/stretchr/testify/assert"
)

func TestOauth2Middleware(t *testing.T) {
    // Setup fake OAuth2 config (biasanya Anda akan menggunakan mock token)
    oauth2Config = oauth2.Config{
        ClientID:     "YOUR_CLIENT_ID",
        ClientSecret: "YOUR_CLIENT_SECRET",
        RedirectURL:  "http://localhost:8080/callback",
        Scopes:       []string{"openid", "profile", "email"},
        Endpoint:     google.Endpoint,
    }

    // Create a mock request
    req, err := http.NewRequest("GET", "/home", nil)
    if err != nil {
        t.Fatal(err)
    }

    // Create a mock ResponseRecorder to record the response
    rr := httptest.NewRecorder()

    // Mock token source untuk OAuth 2.0
    token := &oauth2.Token{AccessToken: "fake-access-token", TokenType: "bearer"}
    oauth2Config.TokenSource = func(ctx context.Context) oauth2.TokenSource {
        return oauth2.StaticTokenSource(token)
    }

    // Mock handler untuk route /home
    handler := oauth2Middleware(func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
        w.WriteHeader(http.StatusOK)
        w.Write([]byte("Authenticated"))
    })

    // Call the handler using the mock request and response recorder
    handler(rr, req, nil)

    // Assert that the status code is 200 OK, karena token dianggap valid
    assert.Equal(t, http.StatusOK, rr.Code)
    assert.Equal(t, "Authenticated", rr.Body.String())
}

func TestCallbackHandler(t *testing.T) {
    // Setup fake OAuth2 config dengan client ID dan client secret yang benar
    oauth2Config = oauth2.Config{
        ClientID:     "YOUR_CLIENT_ID",
        ClientSecret: "YOUR_CLIENT_SECRET",
        RedirectURL:  "http://localhost:8080/callback",
        Scopes:       []string{"openid", "profile", "email"},
        Endpoint:     google.Endpoint,
    }

    // Create a mock request to simulate the callback with an authorization code
    req, err := http.NewRequest("GET", "/callback?code=fake-auth-code", nil)
    if err != nil {
        t.Fatal(err)
    }

    // Create a mock ResponseRecorder to record the response
    rr := httptest.NewRecorder()

    // Mock the Exchange method untuk menukar kode dengan token
    oauth2Config.Exchange = func(ctx context.Context, code string) (*oauth2.Token, error) {
        return &oauth2.Token{AccessToken: "fake-access-token", TokenType: "bearer"}, nil
    }

    // Call the callbackHandler
    callbackHandler(rr, req, nil)

    // Assert that the status code is 200 OK, dan token yang diterima benar
    assert.Equal(t, http.StatusOK, rr.Code)
    assert.Contains(t, rr.Body.String(), "You are authenticated! Token: fake-access-token")
}

go test -v