pcmt/handlers/manage-user.go
leo dbd0e9d01d
All checks were successful
continuous-integration/drone/push Build is passing
go: implement session auth middleware
* simplify protection of endpoints
* role discernment still occures in respective handlers
* db client needs to be passed into handlers as a global var now
2023-05-30 23:50:37 +02:00

375 lines
8.0 KiB
Go

// Copyright 2023 wanderer <a_mirre at utb dot cz>
// SPDX-License-Identifier: AGPL-3.0-only
package handlers
import (
"context"
"errors"
"fmt"
"net/http"
"git.dotya.ml/mirre-mt/pcmt/ent"
moduser "git.dotya.ml/mirre-mt/pcmt/modules/user"
"github.com/gorilla/sessions"
"github.com/labstack/echo/v4"
)
func ManageUsers() echo.HandlerFunc {
return func(c echo.Context) error {
addHeaders(c)
u, ok := c.Get("sessUsr").(moduser.User)
if !ok {
return renderErrorPage(
c,
http.StatusUnauthorized,
http.StatusText(http.StatusUnauthorized),
"it appears there is no user",
)
}
sess, ok := c.Get("sess").(*sessions.Session)
if !ok {
return renderErrorPage(
c,
http.StatusInternalServerError,
http.StatusText(http.StatusInternalServerError),
"missing the session",
)
}
ctx, ok := c.Get("sloggerCtx").(context.Context)
if !ok {
ctx = context.WithValue(context.Background(), moduser.CtxKey{}, slogger)
}
if !u.IsAdmin {
c.Logger().Debug("this is a restricted endpoint")
status := http.StatusUnauthorized
msg := http.StatusText(status)
return renderErrorPage(
c, status, msg+": You should not be here", "Restricted endpoint",
)
}
data := make(map[string]any)
flash := sess.Values["flash"]
path := c.Request().URL.Path
if path == "/manage/users/new" {
p := page{
AppName: setting.AppName(),
AppVer: appver,
Title: "Manage Users - New User",
CSRF: c.Get("csrf").(string),
DevelMode: setting.IsDevel(),
Current: "manage-users-new",
User: u,
}
if flash != nil {
data["flash"] = flash.(string)
delete(sess.Values, "flash")
_ = sess.Save(c.Request(), c.Response())
}
err := c.Render(
http.StatusOK,
"manage/user-new.tmpl",
p,
)
if err != nil {
return renderErrorPage(
c,
http.StatusInternalServerError,
http.StatusText(http.StatusInternalServerError),
err.Error(),
)
}
return nil
}
var allUsers []*moduser.User
if users, err := moduser.ListAll(ctx, dbclient); err == nil && users != nil {
for _, u := range users {
usr := &moduser.User{
Username: u.Username,
Email: u.Email,
ID: u.ID,
IsActive: u.IsActive,
IsAdmin: u.IsAdmin,
CreatedAt: u.CreatedAt,
UpdatedAt: u.UpdatedAt,
}
allUsers = append(allUsers, usr)
}
} else {
c.Logger().Error(http.StatusText(http.StatusInternalServerError) + " - " + err.Error())
return renderErrorPage(
c,
http.StatusInternalServerError,
http.StatusText(http.StatusInternalServerError),
err.Error(),
)
}
data["allusers"] = allUsers
p := page{
AppName: setting.AppName(),
AppVer: appver,
Title: "Manage Users",
CSRF: c.Get("csrf").(string),
DevelMode: setting.IsDevel(),
Current: "manage-users",
User: u,
Data: data,
}
if flash != nil {
data["flash"] = flash.(string)
delete(sess.Values, "flash")
_ = sess.Save(c.Request(), c.Response())
}
err := c.Render(
http.StatusOK,
"manage/user.tmpl",
p,
)
if err != nil {
return renderErrorPage(
c,
http.StatusInternalServerError,
http.StatusText(http.StatusInternalServerError),
err.Error(),
)
}
return nil
}
}
func CreateUser() echo.HandlerFunc { //nolint:gocognit
return func(c echo.Context) error {
addHeaders(c)
u, ok := c.Get("sessUsr").(moduser.User)
if !ok {
return renderErrorPage(
c,
http.StatusUnauthorized,
http.StatusText(http.StatusUnauthorized),
"username was nil",
)
}
ctx, ok := c.Get("sloggerCtx").(context.Context)
if !ok {
ctx = context.WithValue(context.Background(), moduser.CtxKey{}, slogger)
}
if !u.IsAdmin {
c.Logger().Debug("this is a restricted endpoint")
status := http.StatusUnauthorized
msg := http.StatusText(status)
return renderErrorPage(
c, status, msg+": You should not be here", "Restricted endpoint",
)
}
p := page{
AppName: setting.AppName(),
AppVer: appver,
Title: "Manage Users",
DevelMode: setting.IsDevel(),
Current: "manage-user",
}
data := make(map[string]any)
uc := new(userCreate)
if err := c.Bind(uc); err != nil {
return renderErrorPage(
c,
http.StatusBadRequest,
http.StatusText(http.StatusBadRequest),
err.Error(),
)
}
if uc.Username == "" || uc.Password == "" || uc.RepeatPassword == "" || uc.Password != uc.RepeatPassword {
c.Logger().Error("username or password not set, returning to /manage/users/new")
msg := "Error: both username and password need to be set"
if uc.Password != uc.RepeatPassword {
msg += "; password needs to be passed the same twice"
}
data["flash"] = msg
data["form"] = uc
p.Data = data
return c.Render(
http.StatusBadRequest,
"manage/user-new.tmpl",
p,
)
}
var msg string
usr, err := moduser.CreateUser(ctx, dbclient, uc.Email, uc.Username, uc.Password, uc.IsAdmin)
if err == nil && usr != nil {
msg = "created user '" + usr.Username + "'!"
if sess, ok := c.Get("sess").(*sessions.Session); ok {
sess.Values["flash"] = msg
_ = sess.Save(c.Request(), c.Response())
}
return c.Redirect(http.StatusSeeOther, "/manage/users")
}
if ent.IsNotSingular(err) {
c.Logger().Error("user exists")
msg = "Error: user already exists: " + err.Error()
} else {
msg = "Error: " + err.Error()
}
data["flash"] = msg
data["form"] = uc
p.Data = data
return c.Render(
http.StatusInternalServerError,
"manage/user-new.tmpl",
p,
)
}
}
func ViewUser() echo.HandlerFunc {
return func(c echo.Context) error {
addHeaders(c)
u, ok := c.Get("sessUsr").(moduser.User)
if !ok {
return renderErrorPage(
c,
http.StatusUnauthorized,
http.StatusText(http.StatusUnauthorized),
"username was nil",
)
}
ctx, ok := c.Get("sloggerCtx").(context.Context)
if !ok {
ctx = context.WithValue(context.Background(), moduser.CtxKey{}, slogger)
}
if !u.IsAdmin {
c.Logger().Debug("this is a restricted endpoint")
status := http.StatusUnauthorized
msg := http.StatusText(status)
return renderErrorPage(
c, status, msg+": You should not be here", "Restricted endpoint",
)
}
p := page{
AppName: setting.AppName(),
AppVer: appver,
Title: "Manage Users - User Details",
DevelMode: setting.IsDevel(),
Current: "manage-users-user-details",
User: u,
}
data := make(map[string]any)
uid := new(userID)
err := c.Bind(uid)
if err == nil {
usr, err := getUserByID(ctx, dbclient, uid.ID)
if err != nil {
if errors.Is(err, moduser.ErrUserNotFound) { //nolint:gocritic
c.Logger().Errorf("user not found by ID: '%s'", uid.ID)
data["flash"] = fmt.Sprintf("No user found with the UUID: %q", uid.ID)
p.Data = data
return c.Render(
http.StatusNotFound,
"manage/user-details.tmpl",
p,
)
} else if errors.Is(err, moduser.ErrFailedToQueryUser) {
c.Logger().Errorf("failed to query user by ID: '%s'", uid.ID)
data["flash"] = fmt.Sprintf("failed to query user by UUID %q", uid.ID)
p.Data = data
return c.Render(
http.StatusInternalServerError,
"manage/user-details.tmpl",
p,
)
} else if errors.Is(err, moduser.ErrBadUUID) {
c.Logger().Errorf("Invalid UUID '%s': %q", uid.ID, err)
data["flash"] = fmt.Sprintf("invalid UUID %q", uid.ID)
p.Data = data
return c.Render(
http.StatusBadRequest,
"manage/user-details.tmpl",
p,
)
}
c.Logger().Errorf("UUID-related issue for UUID '%s': %q", uid.ID, err)
return renderErrorPage(
c,
http.StatusInternalServerError,
http.StatusText(http.StatusInternalServerError),
err.Error(),
)
}
data["user"] = usr
p.Data = data
return c.Render(
http.StatusOK,
"manage/user-details.tmpl",
p,
)
}
return renderErrorPage(
c,
http.StatusBadRequest,
http.StatusText(http.StatusBadRequest),
err.Error(),
)
}
}