feat: завершён этап 2 - Аутентификация Core Service

- Реализована JWT аутентификация с organization-scope
- Добавлено хеширование паролей через bcrypt
- Созданы репозитории для организаций и пользователей
- Реализован AuthService с бизнес-логикой
- Добавлен AuthMiddleware для проверки токенов
- Созданы handlers для регистрации и входа
- Обновлён API сервер для использования аутентификации

Готово для этапа 3 - API структура

core-service/internal/api/handlers/auth.go

@@ -0,0 +1,78 @@
+package handlers
+
+import (
+	"net/http"
+
+	"erp-mvp/core-service/internal/models"
+	"erp-mvp/core-service/internal/service"
+	"github.com/gin-gonic/gin"
+	"github.com/go-playground/validator/v10"
+)
+
+type AuthHandler struct {
+	authService service.AuthService
+	validate    *validator.Validate
+}
+
+func NewAuthHandler(authService service.AuthService) *AuthHandler {
+	return &AuthHandler{
+		authService: authService,
+		validate:    validator.New(),
+	}
+}
+
+// Register регистрация новой организации и пользователя
+func (h *AuthHandler) Register(c *gin.Context) {
+	var req models.RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
+		return
+	}
+
+	// Валидируем запрос
+	if err := h.validate.Struct(req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Validation failed", "details": err.Error()})
+		return
+	}
+
+	// Выполняем регистрацию
+	response, err := h.authService.Register(c.Request.Context(), &req)
+	if err != nil {
+		if validationErr, ok := err.(*service.ValidationError); ok {
+			c.JSON(http.StatusBadRequest, gin.H{"error": validationErr.Message})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Registration failed"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, response)
+}
+
+// Login вход в систему
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req models.LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body"})
+		return
+	}
+
+	// Валидируем запрос
+	if err := h.validate.Struct(req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Validation failed", "details": err.Error()})
+		return
+	}
+
+	// Выполняем вход
+	response, err := h.authService.Login(c.Request.Context(), &req)
+	if err != nil {
+		if validationErr, ok := err.(*service.ValidationError); ok {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": validationErr.Message})
+			return
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Login failed"})
+		return
+	}
+
+	c.JSON(http.StatusOK, response)
+}

core-service/internal/api/middleware/auth.go

@@ -0,0 +1,57 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"erp-mvp/core-service/internal/auth"
+	"github.com/gin-gonic/gin"
+)
+
+type AuthMiddleware struct {
+	jwtService *auth.JWTService
+}
+
+func NewAuthMiddleware(jwtService *auth.JWTService) *AuthMiddleware {
+	return &AuthMiddleware{
+		jwtService: jwtService,
+	}
+}
+
+func (m *AuthMiddleware) AuthRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// Получаем токен из заголовка Authorization
+		authHeader := c.GetHeader("Authorization")
+		if authHeader == "" {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header required"})
+			c.Abort()
+			return
+		}
+
+		// Проверяем формат "Bearer <token>"
+		tokenParts := strings.Split(authHeader, " ")
+		if len(tokenParts) != 2 || tokenParts[0] != "Bearer" {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid authorization header format"})
+			c.Abort()
+			return
+		}
+
+		tokenString := tokenParts[1]
+
+		// Валидируем токен
+		claims, err := m.jwtService.ValidateToken(tokenString)
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
+			c.Abort()
+			return
+		}
+
+		// Сохраняем claims в контексте
+		c.Set("user_id", claims.UserID)
+		c.Set("organization_id", claims.OrganizationID)
+		c.Set("email", claims.Email)
+		c.Set("role", claims.Role)
+
+		c.Next()
+	}
+}

core-service/internal/api/server.go

@@ -5,8 +5,13 @@ import (
 	"database/sql"
 	"net/http"
 
+	"erp-mvp/core-service/internal/auth"
 	"erp-mvp/core-service/internal/config"
 	"erp-mvp/core-service/internal/logger"
+	"erp-mvp/core-service/internal/repository"
+	"erp-mvp/core-service/internal/service"
+	"erp-mvp/core-service/internal/api/handlers"
+	"erp-mvp/core-service/internal/api/middleware"
 
 	"github.com/gin-gonic/gin"
 )
@@ -16,14 +21,42 @@ type Server struct {
 	db     *sql.DB
 	logger logger.Logger
 	router *gin.Engine
+
+	// Services
+	authService service.AuthService
+
+	// Handlers
+	authHandler *handlers.AuthHandler
+
+	// Middleware
+	authMiddleware *middleware.AuthMiddleware
 }
 
 func NewServer(cfg *config.Config, db *sql.DB, log logger.Logger) *Server {
+	// Инициализируем JWT сервис
+	jwtService := auth.NewJWTService(cfg.JWT.Secret, cfg.JWT.TTL)
+
+	// Инициализируем репозитории
+	orgRepo := repository.NewOrganizationRepository(db)
+	userRepo := repository.NewUserRepository(db)
+
+	// Инициализируем сервисы
+	authService := service.NewAuthService(orgRepo, userRepo, jwtService)
+
+	// Инициализируем handlers
+	authHandler := handlers.NewAuthHandler(authService)
+
+	// Инициализируем middleware
+	authMiddleware := middleware.NewAuthMiddleware(jwtService)
+
 	server := &Server{
-		config: cfg,
-		db:     db,
-		logger: log,
-		router: gin.Default(),
+		config:         cfg,
+		db:             db,
+		logger:         log,
+		router:         gin.Default(),
+		authService:    authService,
+		authHandler:    authHandler,
+		authMiddleware: authMiddleware,
 	}
 
 	server.setupRoutes()
@@ -40,13 +73,13 @@ func (s *Server) setupRoutes() {
 		// Auth routes
 		auth := api.Group("/auth")
 		{
-			auth.POST("/register", s.register)
-			auth.POST("/login", s.login)
+			auth.POST("/register", s.authHandler.Register)
+			auth.POST("/login", s.authHandler.Login)
 		}
 
 		// Protected routes
 		protected := api.Group("/")
-		protected.Use(s.authMiddleware())
+		protected.Use(s.authMiddleware.AuthRequired())
 		{
 			// Organizations
 			protected.GET("/organizations/:id", s.getOrganization)
@@ -86,21 +119,6 @@ func (s *Server) healthCheck(c *gin.Context) {
 }
 
 // Placeholder handlers - will be implemented in next stages
-func (s *Server) register(c *gin.Context) {
-	c.JSON(http.StatusNotImplemented, gin.H{"error": "Not implemented yet"})
-}
-
-func (s *Server) login(c *gin.Context) {
-	c.JSON(http.StatusNotImplemented, gin.H{"error": "Not implemented yet"})
-}
-
-func (s *Server) authMiddleware() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "Auth not implemented yet"})
-		c.Abort()
-	}
-}
-
 func (s *Server) getOrganization(c *gin.Context) {
 	c.JSON(http.StatusNotImplemented, gin.H{"error": "Not implemented yet"})
 }

core-service/internal/auth/jwt.go

@@ -0,0 +1,69 @@
+package auth
+
+import (
+	"errors"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+)
+
+type Claims struct {
+	UserID         uuid.UUID `json:"user_id"`
+	OrganizationID uuid.UUID `json:"organization_id"`
+	Email          string    `json:"email"`
+	Role           string    `json:"role"`
+	jwt.RegisteredClaims
+}
+
+type JWTService struct {
+	secret string
+	ttl    time.Duration
+}
+
+func NewJWTService(secret string, ttl time.Duration) *JWTService {
+	return &JWTService{
+		secret: secret,
+		ttl:    ttl,
+	}
+}
+
+// GenerateToken создаёт JWT токен для пользователя
+func (j *JWTService) GenerateToken(userID, organizationID uuid.UUID, email, role string) (string, error) {
+	claims := Claims{
+		UserID:         userID,
+		OrganizationID: organizationID,
+		Email:          email,
+		Role:           role,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(j.ttl)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			NotBefore: jwt.NewNumericDate(time.Now()),
+			Issuer:    "erp-mvp-core",
+			Subject:   userID.String(),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(j.secret))
+}
+
+// ValidateToken валидирует JWT токен и возвращает claims
+func (j *JWTService) ValidateToken(tokenString string) (*Claims, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, errors.New("unexpected signing method")
+		}
+		return []byte(j.secret), nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	if claims, ok := token.Claims.(*Claims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, errors.New("invalid token")
+}

core-service/internal/auth/password.go

@@ -0,0 +1,17 @@
+package auth
+
+import (
+	"golang.org/x/crypto/bcrypt"
+)
+
+// HashPassword хеширует пароль с использованием bcrypt
+func HashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	return string(bytes), err
+}
+
+// CheckPassword проверяет пароль против хеша
+func CheckPassword(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}

core-service/internal/repository/organizations.go

@@ -0,0 +1,88 @@
+package repository
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	"erp-mvp/core-service/internal/models"
+	"github.com/google/uuid"
+)
+
+type OrganizationRepository interface {
+	Create(ctx context.Context, org *models.Organization) error
+	GetByID(ctx context.Context, id uuid.UUID) (*models.Organization, error)
+	Update(ctx context.Context, org *models.Organization) error
+}
+
+type organizationRepository struct {
+	db *sql.DB
+}
+
+func NewOrganizationRepository(db *sql.DB) OrganizationRepository {
+	return &organizationRepository{db: db}
+}
+
+func (r *organizationRepository) Create(ctx context.Context, org *models.Organization) error {
+	query := `
+		INSERT INTO organizations (id, name, type, settings, created_at)
+		VALUES ($1, $2, $3, $4, $5)
+	`
+	
+	_, err := r.db.ExecContext(ctx, query, org.ID, org.Name, org.Type, org.Settings, org.CreatedAt)
+	if err != nil {
+		return fmt.Errorf("failed to create organization: %w", err)
+	}
+	
+	return nil
+}
+
+func (r *organizationRepository) GetByID(ctx context.Context, id uuid.UUID) (*models.Organization, error) {
+	query := `
+		SELECT id, name, type, settings, created_at
+		FROM organizations
+		WHERE id = $1
+	`
+	
+	org := &models.Organization{}
+	err := r.db.QueryRowContext(ctx, query, id).Scan(
+		&org.ID,
+		&org.Name,
+		&org.Type,
+		&org.Settings,
+		&org.CreatedAt,
+	)
+	
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("organization not found")
+		}
+		return nil, fmt.Errorf("failed to get organization: %w", err)
+	}
+	
+	return org, nil
+}
+
+func (r *organizationRepository) Update(ctx context.Context, org *models.Organization) error {
+	query := `
+		UPDATE organizations
+		SET name = $2, type = $3, settings = $4
+		WHERE id = $1
+	`
+	
+	result, err := r.db.ExecContext(ctx, query, org.ID, org.Name, org.Type, org.Settings)
+	if err != nil {
+		return fmt.Errorf("failed to update organization: %w", err)
+	}
+	
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+	
+	if rowsAffected == 0 {
+		return fmt.Errorf("organization not found")
+	}
+	
+	return nil
+}

core-service/internal/repository/users.go

@@ -0,0 +1,99 @@
+package repository
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	"erp-mvp/core-service/internal/models"
+	"github.com/google/uuid"
+)
+
+type UserRepository interface {
+	Create(ctx context.Context, user *models.User, password string) error
+	GetByEmail(ctx context.Context, email string) (*models.User, error)
+	GetByID(ctx context.Context, id uuid.UUID) (*models.User, error)
+}
+
+type userRepository struct {
+	db *sql.DB
+}
+
+func NewUserRepository(db *sql.DB) UserRepository {
+	return &userRepository{db: db}
+}
+
+func (r *userRepository) Create(ctx context.Context, user *models.User, password string) error {
+	query := `
+		INSERT INTO users (id, organization_id, email, password_hash, role, created_at)
+		VALUES ($1, $2, $3, $4, $5, $6)
+	`
+	
+	_, err := r.db.ExecContext(ctx, query, 
+		user.ID, 
+		user.OrganizationID, 
+		user.Email, 
+		password, 
+		user.Role, 
+		user.CreatedAt,
+	)
+	if err != nil {
+		return fmt.Errorf("failed to create user: %w", err)
+	}
+	
+	return nil
+}
+
+func (r *userRepository) GetByEmail(ctx context.Context, email string) (*models.User, error) {
+	query := `
+		SELECT id, organization_id, email, password_hash, role, created_at
+		FROM users
+		WHERE email = $1
+	`
+	
+	user := &models.User{}
+	err := r.db.QueryRowContext(ctx, query, email).Scan(
+		&user.ID,
+		&user.OrganizationID,
+		&user.Email,
+		&user.PasswordHash,
+		&user.Role,
+		&user.CreatedAt,
+	)
+	
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("user not found")
+		}
+		return nil, fmt.Errorf("failed to get user: %w", err)
+	}
+	
+	return user, nil
+}
+
+func (r *userRepository) GetByID(ctx context.Context, id uuid.UUID) (*models.User, error) {
+	query := `
+		SELECT id, organization_id, email, password_hash, role, created_at
+		FROM users
+		WHERE id = $1
+	`
+	
+	user := &models.User{}
+	err := r.db.QueryRowContext(ctx, query, id).Scan(
+		&user.ID,
+		&user.OrganizationID,
+		&user.Email,
+		&user.PasswordHash,
+		&user.Role,
+		&user.CreatedAt,
+	)
+	
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("user not found")
+		}
+		return nil, fmt.Errorf("failed to get user: %w", err)
+	}
+	
+	return user, nil
+}

core-service/internal/service/auth_service.go

@@ -0,0 +1,118 @@
+package service
+
+import (
+	"context"
+	"time"
+
+	"erp-mvp/core-service/internal/auth"
+	"erp-mvp/core-service/internal/models"
+	"erp-mvp/core-service/internal/repository"
+	"github.com/google/uuid"
+)
+
+type AuthService interface {
+	Register(ctx context.Context, req *models.RegisterRequest) (*models.LoginResponse, error)
+	Login(ctx context.Context, req *models.LoginRequest) (*models.LoginResponse, error)
+}
+
+type authService struct {
+	orgRepo    repository.OrganizationRepository
+	userRepo   repository.UserRepository
+	jwtService *auth.JWTService
+}
+
+func NewAuthService(orgRepo repository.OrganizationRepository, userRepo repository.UserRepository, jwtService *auth.JWTService) AuthService {
+	return &authService{
+		orgRepo:    orgRepo,
+		userRepo:   userRepo,
+		jwtService: jwtService,
+	}
+}
+
+func (s *authService) Register(ctx context.Context, req *models.RegisterRequest) (*models.LoginResponse, error) {
+	// Проверяем, что пользователь с таким email не существует
+	existingUser, err := s.userRepo.GetByEmail(ctx, req.UserEmail)
+	if err == nil && existingUser != nil {
+		return nil, &ValidationError{Message: "User with this email already exists"}
+	}
+
+	// Создаём организацию
+	orgID := uuid.New()
+	org := &models.Organization{
+		ID:        orgID,
+		Name:      req.OrganizationName,
+		Type:      req.OrganizationType,
+		Settings:  models.JSON{},
+		CreatedAt: time.Now(),
+	}
+
+	if err := s.orgRepo.Create(ctx, org); err != nil {
+		return nil, err
+	}
+
+	// Хешируем пароль
+	passwordHash, err := auth.HashPassword(req.UserPassword)
+	if err != nil {
+		return nil, err
+	}
+
+	// Создаём пользователя
+	userID := uuid.New()
+	user := &models.User{
+		ID:             userID,
+		OrganizationID: orgID,
+		Email:          req.UserEmail,
+		Role:           "admin", // Первый пользователь становится админом
+		CreatedAt:      time.Now(),
+	}
+
+	if err := s.userRepo.Create(ctx, user, passwordHash); err != nil {
+		return nil, err
+	}
+
+	// Генерируем JWT токен
+	token, err := s.jwtService.GenerateToken(user.ID, org.ID, user.Email, user.Role)
+	if err != nil {
+		return nil, err
+	}
+
+	return &models.LoginResponse{
+		Token:     token,
+		User:      *user,
+		ExpiresAt: time.Now().Add(24 * time.Hour), // TTL из конфигурации
+	}, nil
+}
+
+func (s *authService) Login(ctx context.Context, req *models.LoginRequest) (*models.LoginResponse, error) {
+	// Получаем пользователя по email
+	user, err := s.userRepo.GetByEmail(ctx, req.Email)
+	if err != nil {
+		return nil, &ValidationError{Message: "Invalid email or password"}
+	}
+
+	// Проверяем пароль
+	if !auth.CheckPassword(req.Password, user.PasswordHash) {
+		return nil, &ValidationError{Message: "Invalid email or password"}
+	}
+
+	// Генерируем JWT токен
+	token, err := s.jwtService.GenerateToken(user.ID, user.OrganizationID, user.Email, user.Role)
+	if err != nil {
+		return nil, err
+	}
+
+	return &models.LoginResponse{
+		Token:     token,
+		User:      *user,
+		ExpiresAt: time.Now().Add(24 * time.Hour), // TTL из конфигурации
+	}, nil
+}
+
+// ValidationError ошибка валидации
+type ValidationError struct {
+	Message string
+}
+
+func (e *ValidationError) Error() string {
+	return e.Message
+}