Unknown ID - Privacy-Focused User Management Backend

🔒 A Golang backend for user management where users are identified only by random 20-digit numbers. No names, emails, passwords, or any personal information is stored - maximum privacy!

Features

• 🎲 Create users with auto-generated 20-digit cryptographically secure identifiers
• 🔒 Separate public ID for enhanced security - JWT tokens contain only public ID and nickname, never the internal user ID
• 📝 Optional nickname field with random emoticon generation when not provided
• 🔑 Authenticate using just the user ID - get a JWT token back (contains public ID and nickname)
• ✅ Verify JWT tokens - returns public ID and nickname directly from token claims (no database lookup needed)
• 🛡️ Authentication middleware for protecting endpoints
• 🔍 Retrieve user information by ID (only ID, public ID, nickname, and timestamps)
• 📋 List all users
• 🗑️ Delete users
• 🌐 RESTful API
• 💾 SQLite and PostgreSQL database support
• 🔐 Complete privacy - no personal data stored

API Endpoints

Public Endpoints (No Authentication)

• POST /users - Create a new user (optional nickname can be provided)
• POST /auth - Authenticate with user ID and get JWT token
• POST /verify - Verify JWT token validity
• GET /health - Health check

Admin Endpoints (Basic Auth Required)

All admin endpoints require HTTP Basic Authentication with admin credentials.

• GET /admin/users - List all users
• GET /admin/users/{id} - Get user by 20-digit ID
• DELETE /admin/users/{id} - Delete user by ID

Running the Application

1. Copy the example environment file:

cp .env.example .env

2. Edit .env to configure your settings:

PORT=3690
DB_TYPE=sqlite
DB_PATH=./users.db
JWT_SECRET=your-super-secret-key

3. Install dependencies and run:

go mod download
go run main.go

The server will start on the port specified in .env (default: http://localhost:3690)

Example Usage

Create a user (no input needed - gets random emoticon!):

curl -X POST http://localhost:8080/users

Response (with auto-generated emoticon):

{
  "message": "User created successfully",
  "data": {
    "id": "12345678901234567890",
    "public_id": "98765432109876543210",
    "nickname": "🐱",
    "created_at": "2025-12-20T10:30:00Z",
    "updated_at": "2025-12-20T10:30:00Z"
  }
}

Or with a custom nickname:

curl -X POST http://localhost:8080/users \
  -H "Content-Type: application/json" \
  -d '{"nickname":"alice"}'

Response:

{
  "message": "User created successfully",
  "data": {
    "id": "98765432109876543210",
    "public_id": "11223344556677889900",
    "nickname": "alice",
    "created_at": "2025-12-20T10:30:00Z",
    "updated_at": "2025-12-20T10:30:00Z"
  }
}

Authenticate with user ID:

curl -X POST http://localhost:8080/auth \
  -H "Content-Type: application/json" \
  -d '{"user_id":"12345678901234567890"}'

Response:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user_id": "12345678901234567890",
  "nickname": "🐱",
  "expires_at": "2025-12-21T10:30:00Z"
}

Verify a JWT token:

curl -X POST http://localhost:3690/verify \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Response:

{
  "valid": true,
  "public_id": "98765432109876543210",
  "nickname": "🐱",
  "expires_at": "2025-12-21T10:30:00Z"
}

Note: JWT tokens contain both public_id and nickname in their claims. The /verify endpoint extracts and returns these values directly from the token without requiring a database lookup, providing fast token verification. The internal user ID is never exposed in tokens or verification responses, ensuring maximum security and privacy.

Admin Operations (Basic Auth Required)

List all users (admin only):

curl -u admin:your-password http://localhost:3690/admin/users

Get a user by ID (admin only):

curl -u admin:your-password http://localhost:3690/admin/users/12345678901234567890

Delete a user (admin only):

curl -u admin:your-password -X DELETE http://localhost:3690/admin/users/12345678901234567890

Configuration

The application uses a .env file for configuration. Copy .env.example to .env and customize:

# Server Configuration
PORT=3690                    # Server port

# Database Configuration
DB_TYPE=sqlite              # Database type: "sqlite" or "postgres"
DB_PATH=./users.db          # SQLite database file path (when DB_TYPE=sqlite)
POSTGRES_URL=postgres://... # PostgreSQL connection string (when DB_TYPE=postgres)

# JWT Configuration
JWT_SECRET=your-secret      # Secret key for JWT signing (CHANGE IN PRODUCTION!)

# Admin Configuration
ADMIN_USERNAME=admin        # Admin username for protected endpoints
ADMIN_PASSWORD=secret       # Admin password (CHANGE IN PRODUCTION!)

Environment Variables

All settings can also be set via environment variables (which override .env file):

• PORT - Server port (default: 3690)
• DB_TYPE - Database type: "sqlite" or "postgres" (default: sqlite)
• DB_PATH - SQLite database file path (default: ./users.db)
• POSTGRES_URL - PostgreSQL connection string (required when DB_TYPE=postgres)
• JWT_SECRET - Secret key for JWT signing (default: development key)
• ADMIN_USERNAME - Admin username (default: admin)
• ADMIN_PASSWORD - Admin password (default: admin)

Example using environment variables:

export JWT_SECRET="your-super-secret-key"
export PORT=8080
export DB_TYPE=postgres
export POSTGRES_URL="postgres://user:pass@localhost:5432/unknown_id?sslmode=disable"
go run main.go

Admin Authentication

Admin endpoints use HTTP Basic Authentication to protect sensitive operations like listing and deleting users.

Security Design

• 🔓 Public endpoints - User creation and authentication (no admin needed)
• 🔒 Admin endpoints - All GET and DELETE operations require admin credentials
• 🛡️ Uses constant-time comparison to prevent timing attacks
• 🔑 Credentials stored in environment variables

Setting Up Admin Access

1. Set admin credentials in your .env file:

ADMIN_USERNAME=admin
ADMIN_PASSWORD=your-secure-password

2. Access admin endpoints using basic auth:

curl -u admin:your-secure-password http://localhost:3690/admin/users

⚠️ Important: Always change the default admin password in production!

Testing

The project includes comprehensive Go unit tests covering all packages:

Run All Tests

go test ./...

Run Tests with Verbose Output

go test ./... -v

Run Tests for Specific Package

go test ./models -v
go test ./auth -v
go test ./database -v
go test ./handlers -v

Test Coverage

The test suite covers:

• ✅ User ID generation (20-digit uniqueness, cryptographic security)
• ✅ JWT token generation and validation
• ✅ Token expiration and security
• ✅ Database CRUD operations
• ✅ HTTP endpoint handlers
• ✅ Admin authentication middleware
• ✅ Error handling and edge cases

Generate Coverage Report

go test ./... -cover

For detailed coverage:

go test ./... -coverprofile=coverage.out
go tool cover -html=coverage.out