add auth

pkg/auth/cookie.go

@@ -0,0 +1,56 @@
+package auth
+
+import (
+	"net/http"
+	"time"
+)
+
+// CookieName is the single httpOnly cookie that carries the JWT.
+const CookieName = "spsays_auth"
+
+// CookieOptions captures the per-environment knobs for the auth cookie.
+type CookieOptions struct {
+	Domain string // empty in dev; ".prabhupadasays.org" in prod for subdomain sharing
+	Secure bool   // true in production (HTTPS-only)
+}
+
+// Set writes the JWT into a Secure, httpOnly, SameSite=Lax cookie.
+// SameSite=Lax + same-registrable-domain (prabhupadasays.org / api.prabhupadasays.org)
+// is enough for cross-subdomain auth without resorting to SameSite=None.
+func Set(w http.ResponseWriter, token string, expires time.Time, opts CookieOptions) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    token,
+		Path:     "/",
+		Domain:   opts.Domain,
+		Expires:  expires,
+		MaxAge:   int(time.Until(expires).Seconds()),
+		HttpOnly: true,
+		Secure:   opts.Secure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+// Clear overwrites the auth cookie with an immediately-expired one.
+func Clear(w http.ResponseWriter, opts CookieOptions) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     CookieName,
+		Value:    "",
+		Path:     "/",
+		Domain:   opts.Domain,
+		Expires:  time.Unix(0, 0),
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   opts.Secure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+// Read pulls the raw JWT out of the request cookie. Returns "" if missing.
+func Read(r *http.Request) string {
+	c, err := r.Cookie(CookieName)
+	if err != nil {
+		return ""
+	}
+	return c.Value
+}