Auth & Security · 11 Capstone: Secure User Management

11a

Thirteen files, nine routes

One package per concern. Each route's guards are visible in one line of routes.go.

usermgmt/
├─ cmd/api/main.go config · timeouts
└─ internal/
   ├─ app/routes.go wiring
   ├─ auth/password.go 01
   │    token.go 02–03
   │    middleware.go 03
   │    refresh.go 04
   ├─ authz/authz.go 05–06
   ├─ httpx/decode.go 08
   │     security.go 08–09
   │     errors.go 11
   ├─ config/config.go 10
   └─ user/user.go model · store
          handler.go endpoints

ROUTEGUARDS (outer → inner)

POST /auth/register5/min

POST /auth/login5/min

POST /auth/refresh30/mincookie

POST /auth/logoutauth

GET /users/meauth

GET /users/{id}authowner|admin

PATCH /users/{id}authowner|admin

GET /admin/usersauthuser:list

PATCH /admin/users/{id}/roleauthuser:set_role

→Around every route: Recover → SecureHeaders → CORS.

→The user store is in memory so the capstone runs anywhere; its methods are the seam where Postgres plugs in.

11c

The wiring and the one place errors are decided

Handlers return errors. httpx.Handle turns safe ones into their status and everything else into a bare 500.

internal/app/routes.go

func Routes(h *user.Handler, origins []string) http.Handler {
    mux := http.NewServeMux()
    H := httpx.Handle
    authn := func(next http.Handler) http.Handler {
        return auth.RequireAuth(h.Tokens, h.Refresh, next)
    }
    owner := func(next http.Handler) http.Handler {
        return authn(authz.OwnerOrAdmin(authz.PathOwner("id"), next))
    }
    admin := func(p authz.Perm, next http.Handler) http.Handler {
        return authn(authz.RequirePerm(p, next))
    }
    // one bucket per route: a shared one locks out normal users
    loginLim := httpx.NewIPLimiter(time.Minute/5, 5).Limit     // 5/min
    signupLim := httpx.NewIPLimiter(time.Minute/5, 5).Limit    // 5/min
    refreshLim := httpx.NewIPLimiter(time.Minute/30, 30).Limit // 30/min

    // public, rate limited
    mux.Handle("POST /auth/register", signupLim(H(h.Register)))
    mux.Handle("POST /auth/login", loginLim(H(h.Login)))
    mux.Handle("POST /auth/refresh", refreshLim(H(h.RefreshToken)))

    // authenticated
    mux.Handle("POST /auth/logout", authn(H(h.Logout)))
    mux.Handle("GET /users/me", authn(H(h.Me)))

    // owner or admin
    mux.Handle("GET /users/{id}", owner(H(h.Get)))
    mux.Handle("PATCH /users/{id}", owner(H(h.Patch)))

    // admin only
    mux.Handle("GET /admin/users", admin(authz.ListUsers, H(h.List)))
    mux.Handle("PATCH /admin/users/{id}/role", admin(authz.SetRole, H(h.SetRole)))

    return httpx.Recover(httpx.SecureHeaders(httpx.CORS(origins, mux)))
}

internal/httpx/errors.go

// Error is an error that is safe to show the client.
type Error struct {
    Status int
    Msg    string
}

// Handle is the one place errors become responses.
func Handle(h HandlerFunc) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        err := h(w, r)
        if err == nil {
            return
        }
        var e *Error
        if !errors.As(err, &e) {
            slog.Error("internal", "path", r.URL.Path, "err", err)
            e = &Error{500, "internal error"}
        }
        JSON(w, e.Status, map[string]string{"error": e.Msg})
    })
}

// Recover turns a panic into a clean 500; the stack goes to the log only.
func Recover(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        defer func() {
            if v := recover(); v != nil {
                slog.Error("panic", "path", r.URL.Path, "value", v,
                    "stack", string(debug.Stack()))
                JSON(w, 500, map[string]string{"error": "internal error"})
            }
        }()
        next.ServeHTTP(w, r)
    })
}

→Safe errors are typed (*httpx.Error): 400, 401, 404, 409, 413, 422, 429. Anything else — a DB error, a bug — becomes internal error.

→The detail goes to the log, keyed by path; the client never sees a hostname, SQL or stack.

→Recover is outermost, so a panic anywhere — even in a middleware — still gets a clean reply.

Found in the first run

The first version used one limiter for register, login and refresh. A normal journey — sign up, log in, refresh — hit 429 on its 6th request. Each route now has its own bucket, and refresh gets 30/min.

11d

The end-to-end run

Real TCP server, real HTTP client, Redis protocol via miniredis. Bodies are cut at 110 characters by the test driver.

go run ./cmd/e2e · stdout = what the client saw

── 1 · register & login
POST /auth/register asha           → 201 {"id":"2","email":"asha@example.com","name":"Asha","role":"user","created_at":"2026-09-30T18:13:38.087930999Z"…
POST /auth/register ravi           → 201 {"id":"3","email":"ravi@example.com","name":"Ravi","role":"user","created_at":"2026-09-30T18:13:38.455595843Z"…
POST /auth/register (role:admin)   → 400 {"error":"bad request"}
POST /auth/register (bad input)    → 422 {"error":"email: invalid; name: 1-80 chars; password: 8-72 bytes"}
POST /auth/login wrong pw          → 401 {"error":"invalid email or password"}
POST /auth/login unknown email     → 401 {"error":"invalid email or password"}
POST /auth/login asha              → 200 {"access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoidXNlciIsInN1YiI6IjIiLCJleHAiOjE3OTA3OTI5MTks…
── 2 · authentication
GET /users/me (no token)           → 401 {"error":"unauthorized"}
GET /users/me asha                 → 200 {"id":"2","email":"asha@example.com","name":"Asha","role":"user","created_at":"2026-09-30T18:13:38.087930999Z"…
── 3 · ownership & RBAC
PATCH /users/2 asha (own)          → 200 {"id":"2","email":"asha@example.com","name":"Asha K","role":"user","created_at":"2026-09-30T18:13:38.087930999…
PATCH /users/3 asha (ravi)         → 404 {"error":"not found"}
PATCH /users/3 admin               → 200 {"id":"3","email":"ravi@example.com","name":"Ravi S","role":"user","created_at":"2026-09-30T18:13:38.455595843…
GET /admin/users asha              → 403 {"error":"forbidden"}
GET /admin/users admin             → 200 [{"id":"1","email":"admin@example.com","name":"Admin","role":"admin","created_at":"2026-09-30T18:13:37.7206601…
── 4 · refresh rotation
POST /auth/refresh with R1         → 200 {"access_token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoidXNlciIsInN1YiI6IjIiLCJleHAiOjE3OTA3OTI5MTks…
POST /auth/refresh with R1 again   → 401 {"error":"unauthorized"}
POST /auth/refresh with R2         → 401 {"error":"unauthorized"}
── 5 · logout denies the access token
GET /users/me ravi                 → 200 {"id":"3","email":"ravi@example.com","name":"Ravi S","role":"user","created_at":"2026-09-30T18:13:38.455595843…
POST /auth/logout ravi             → 204
GET /users/me ravi (same token)    → 401 {"error":"unauthorized"}
POST /auth/refresh ravi's cookie   → 401 {"error":"unauthorized"}
── 6 · hardening
PATCH /users/2 (2 MB body)         → 413 {"error":"body too large"}
OPTIONS from evil.example          → 204
  headers: nosniff · DENY · max-age=63072000; includeSubDomains
POST /auth/login (6th this minute) → 429 {"error":"too many requests"}
── 7 · errors never leak internals
GET /debug/db                      → 500 {"error":"internal error"}
GET /debug/panic                   → 500 {"error":"internal error"}

stderr = the server log (only you see this)

level=ERROR msg=internal path=/debug/db err="pq: connection refused to 10.0.3.7:5432 (user api_app)"
level=ERROR msg=panic path=/debug/panic value="assignment to entry in nil map" stack="goroutine 100 [running]:\nruntime/debug.Stack()…

./api · started without REDIS_ADDR and JWT_SECRET

ERROR refusing to start err="REDIS_ADDR is required\nJWT_SECRET must be ≥ 32 bytes"
exit=1

→Step 1: "role":"admin" in the register body is rejected (unknown field) — and the handler hard-codes "user" anyway.

→Step 4: replaying R1 revoked the family, so the legitimate R2 died too — reuse detection working.

→Step 5: after logout the same, unexpired access token is refused — the jti denylist.

11e

The brief, feature by feature

Everything the capstone had to include — and the file it lives in.

Registration & login

bcrypt cost 12, dummy hash for unknown emails
15-min access JWT with jti
7-day refresh, rotated, reuse-detected

auth/password.go · token.go · refresh.go

Auth middleware

Bearer parse, HS256 pinned
denylist check, fails closed
claims in context

auth/middleware.go

RBAC & ownership

permission map, default deny
OwnerOrAdmin → 404 for others
role never taken from input

authz/authz.go · user/handler.go

Hardening

per-route rate limits
CORS allowlist, 5 security headers
1 MB bodies, strict JSON, validation
HttpOnly · Secure · SameSite cookie
server timeouts, config refuses bad boot

httpx/security.go · decode.go · cmd/api

Centralised errors

one Handle maps errors to status
unknown errors → bare 500
panics recovered, stack to log only

httpx/errors.go

CAPSTONE · TOPIC 4

Build it — then make the run above pass

Recreate the 13-file layout yourself; write each file from its session.
Your acceptance test is the 26-request end-to-end run: every status code must match.
Swap the in-memory store for PostgreSQL with the api_app role from session 10.
Stretch: move the limiter to Redis and run two instances behind one port.

Secure User Management System

Thirteen files, nine routes

One request, every layer

The wiring and the one place errors are decided

The end-to-end run

The brief, feature by feature

Registration & login

Auth middleware

RBAC & ownership

Hardening

Centralised errors

Build it — then make the run above pass

The whole track in four lines