setup auth jwt to rather give response not redirect.

internal/web/handlers_auth.go

@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
+	"encoding/json"
 	"log"
 	"net/http"
 	"nfeeder/internal/db"
@@ -17,7 +18,10 @@ import (
 
 const ISSUER = "nfeeder-app"
 
-var jwtKey = []byte("very_super_duper_secret")
+type AuthResponse struct {
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
+}
 
 func (s *Server) handleRegister() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -44,7 +48,7 @@ func (s *Server) handleRegister() http.HandlerFunc {
 		}
 
 		// Auto-login after reg
-		s.issueTokenAndRedirect(w, r, user.ID)
+		s.issueToken(w, r, user.ID)
 	}
 }
 
@@ -66,7 +70,7 @@ func (s *Server) handleLogin() http.HandlerFunc {
 			return
 		}
 
-		s.issueTokenAndRedirect(w, r, user.ID)
+		s.issueToken(w, r, user.ID)
 	}
 }
 
@@ -100,7 +104,7 @@ func (s *Server) handleRefresh() http.HandlerFunc {
 	}
 }
 
-func (s *Server) issueTokenAndRedirect(w http.ResponseWriter, r *http.Request, userID int64) {
+func (s *Server) issueToken(w http.ResponseWriter, r *http.Request, userID int64) {
 	nowTime := time.Now()
 	jwtExpireTime := nowTime.Add(24 * time.Hour)
 	refreshExpireTime := nowTime.Add((24 * time.Hour) * 3)
@@ -113,22 +117,12 @@ func (s *Server) issueTokenAndRedirect(w http.ResponseWriter, r *http.Request, u
 	}
 
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString(jwtKey)
+	tokenString, err := token.SignedString(s.jwtSecret)
 	if err != nil {
 		http.Error(w, "Internal Error", http.StatusInternalServerError)
 		return
 	}
 
-	http.SetCookie(w, &http.Cookie{
-		Name:     "nfeeder_token",
-		Value:    tokenString,
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   false, // Set to true in prod for HTTPS
-		SameSite: http.SameSiteLaxMode,
-		Expires:  jwtExpireTime,
-	})
-
 	// Generate refresh token
 	rawToken := rand.Text()
 	hash := sha256.Sum256([]byte(rawToken))
@@ -146,15 +140,15 @@ func (s *Server) issueTokenAndRedirect(w http.ResponseWriter, r *http.Request, u
 		return
 	}
 
-	http.SetCookie(w, &http.Cookie{
-		Name:     "nfeeder_refresh",
-		Value:    string(rawToken),
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   false, // Set to true in prod for HTTPS
-		SameSite: http.SameSiteLaxMode,
-		Expires:  refreshExpireTime,
-	})
+	resp := AuthResponse{
+		AccessToken:  tokenString,
+		RefreshToken: rawToken,
+	}
 
-	http.Redirect(w, r, "/", http.StatusSeeOther)
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	if err := json.NewEncoder(w).Encode(resp); err != nil {
+		log.Printf("json encoding failed: %v", err)
+		return
+	}
 }