From 5b70bc3137e9a79754bfb3bee2e446e0ced29b2c Mon Sep 17 00:00:00 2001
From: ga <admin@buhapp.mygoodservice.ru>
Date: Thu, 20 Aug 2026 21:50:28 +0000
Subject: [PATCH] =?UTF-8?q?Auth:=20HttpOnly=20cookie=20buhapp=5Fat=20(?=
 =?UTF-8?q?=D0=B1=D0=B5=D0=B7=20CORS=20preflight)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Login/Register ставят cookie (HttpOnly, Secure, SameSite=Lax)
- Middleware читает cookie первым
- CORS: AllowCredentials=true
- Для прямых API-вызовов остался Authorization Bearer
- Legacy ?_t= query fallback
---
 cmd/server/main.go          |  7 ++++---
 internal/auth/middleware.go | 26 +++++++++++++++++++-------
 internal/handlers/auth.go   | 25 +++++++++++++++++++------
 3 files changed, 42 insertions(+), 16 deletions(-)

diff --git a/cmd/server/main.go b/cmd/server/main.go
index 899042a..ebd43cb 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -117,9 +117,10 @@ func main() {
 	app.Use(recover.New())
 	app.Use(flog.New())
 	app.Use(cors.New(cors.Config{
-		AllowOrigins: "https://buhapp.mygoodservice.ru,https://t.me,https://web.telegram.org",
-		AllowHeaders: "Origin, Content-Type, Accept, Authorization, X-Telegram-Bot-Api-Secret-Token",
-		AllowMethods: "GET, POST, PUT, DELETE, OPTIONS",
+		AllowOrigins:     "https://buhapp.mygoodservice.ru,https://t.me,https://web.telegram.org",
+		AllowHeaders:     "Origin, Content-Type, Accept, Authorization, X-Telegram-Bot-Api-Secret-Token",
+		AllowMethods:     "GET, POST, PUT, DELETE, OPTIONS",
+		AllowCredentials: true,
 	}))
 
 	loginLimiter := limiter.New(limiter.Config{
diff --git a/internal/auth/middleware.go b/internal/auth/middleware.go
index e6390c9..6d3ee46 100644
--- a/internal/auth/middleware.go
+++ b/internal/auth/middleware.go
@@ -11,15 +11,27 @@ const UserIDKey = "user_id"
 
 func Middleware(svc *Service) fiber.Handler {
 	return func(c *fiber.Ctx) error {
-		h := c.Get("Authorization")
-		if h == "" {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "missing Authorization header"})
+		var token string
+		// 1. HttpOnly cookie (основной способ — без CORS preflight)
+		token = c.Cookies("buhapp_at")
+		// 2. Authorization: Bearer <token> (для прямых API-вызовов)
+		if token == "" {
+			h := c.Get("Authorization")
+			if h != "" {
+				parts := strings.SplitN(h, " ", 2)
+				if len(parts) == 2 && strings.ToLower(parts[0]) == "bearer" {
+					token = parts[1]
+				}
+			}
 		}
-		parts := strings.SplitN(h, " ", 2)
-		if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
-			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid Authorization header"})
+		// 3. Fallback — query param ?_t=<token> (legacy)
+		if token == "" {
+			token = c.Query("_t")
 		}
-		claims, err := svc.Parse(c.UserContext(), parts[1])
+		if token == "" {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "missing token"})
+		}
+		claims, err := svc.Parse(c.UserContext(), token)
 		if err != nil {
 			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "invalid token"})
 		}
diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go
index 1c29908..60dd7dc 100644
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -16,6 +16,21 @@ import (
 	"github.com/buhapp/backend/internal/users"
 )
 
+const cookieName = "buhapp_at"
+
+// setAuthCookie — кладём access-token в HttpOnly cookie (CORS-friendly, без preflight)
+func setAuthCookie(c *fiber.Ctx, token string, ttl time.Duration) {
+	c.Cookie(&fiber.Cookie{
+		Name:     cookieName,
+		Value:    token,
+		Path:     "/",
+		MaxAge:   int(ttl.Seconds()),
+		HTTPOnly: true,
+		Secure:   true,
+		SameSite: "Lax",
+	})
+}
+
 type AuthHandler struct {
 	cfg     *config.Config
 	users   *users.Repo
@@ -145,6 +160,8 @@ func (h *AuthHandler) Register(c *fiber.Ctx) error {
 	if err != nil {
 		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "token failed"})
 	}
+	// ставим access-token в HttpOnly cookie
+	setAuthCookie(c, tokens.Access, h.cfg.JwTAccessTTL())
 
 	return c.Status(fiber.StatusCreated).JSON(fiber.Map{
 		"user": fiber.Map{
@@ -207,12 +224,8 @@ func (h *AuthHandler) Login(c *fiber.Ctx) error {
 	if err != nil {
 		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "token failed"})
 	}
-
-	uid := u.ID
-	_ = h.audit.Log(c.UserContext(), &audit.Event{
-		UserID: &uid, Action: "user.login",
-		IP: c.IP(), UserAgent: c.Get("User-Agent"),
-	})
+	// ставим access-token в HttpOnly cookie — браузер шлёт автоматически, без CORS preflight
+	setAuthCookie(c, tokens.Access, h.cfg.JwTAccessTTL())
 
 	return c.JSON(fiber.Map{
 		"user":   u,