Add authenticated profiles and prefill Google account names

internal/auth/session.go

@@ -0,0 +1,27 @@
+package auth
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"strings"
+)
+
+var ErrInvalidSession = errors.New("invalid session")
+
+// Authenticate resolves only an unexpired session belonging to this project.
+func Authenticate(ctx context.Context, db *sql.DB, project, authorization string) (string, error) {
+	value, ok := strings.CutPrefix(authorization, "Bearer ")
+	if !ok || !tokenPattern.MatchString(value) {
+		return "", ErrInvalidSession
+	}
+	var id string
+	err := db.QueryRowContext(ctx, `
+SELECT account_id::text FROM project_sessions
+WHERE project=$1 AND token_hash=$2 AND expires_at>now()
+`, project, digest(value)).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", ErrInvalidSession
+	}
+	return id, err
+}