368 lines
12 KiB
Go
368 lines
12 KiB
Go
package system
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/jinzhu/gorm"
|
|
"goji.io"
|
|
"goji.io/pat"
|
|
"golang.org/x/net/context"
|
|
|
|
libapi "dev.sum7.eu/sum7/warehost/lib/api"
|
|
liblog "dev.sum7.eu/sum7/warehost/lib/log"
|
|
libpassword "dev.sum7.eu/sum7/warehost/lib/password"
|
|
libsession "dev.sum7.eu/sum7/warehost/lib/session"
|
|
)
|
|
|
|
//MODULNAME to get global name for the modul
|
|
const MODULNAME = "system"
|
|
|
|
var dbconnection *gorm.DB
|
|
var log *liblog.ModulLog
|
|
|
|
// BindAPI sets the routes to the api functions
|
|
func BindAPI(db *gorm.DB, router *goji.Mux, prefix string) {
|
|
dbconnection = db
|
|
log = liblog.NewModulLog(MODULNAME)
|
|
|
|
router.HandleFuncC(pat.Get(prefix+"/status"), libapi.SessionHandler(status))
|
|
router.HandleFuncC(pat.Post(prefix+"/login"), libapi.SessionHandler(login))
|
|
router.HandleFuncC(pat.Get(prefix+"/logout"), libapi.SessionHandler(LoginHandler(logout)))
|
|
router.HandleFuncC(pat.Post(prefix+"/password"), libapi.SessionHandler(LoginHandler(password)))
|
|
router.HandleFuncC(pat.Get(prefix+"/delete"), libapi.SessionHandler(LoginHandler(delete)))
|
|
router.HandleFuncC(pat.Get(prefix+"/invite"), libapi.SessionHandler(LoginHandler(inviteList)))
|
|
router.HandleFuncC(pat.Post(prefix+"/invite"), libapi.SessionHandler(LoginHandler(inviteAdd)))
|
|
router.HandleFuncC(pat.Get(prefix+"/user"), libapi.SessionHandler(LoginHandler(loginList)))
|
|
router.HandleFuncC(pat.Post(prefix+"/user"), libapi.SessionHandler(LoginHandler(loginAdd)))
|
|
router.HandleFuncC(pat.Put(prefix+"/user/:id"), libapi.SessionHandler(LoginHandler(loginEdit)))
|
|
router.HandleFuncC(pat.Delete(prefix+"/user/:id"), libapi.SessionHandler(LoginHandler(loginDelete)))
|
|
router.HandleFuncC(pat.Get(prefix+"/invitor"), libapi.SessionHandler(LoginHandler(invitor)))
|
|
router.HandleFuncC(pat.Put(prefix+"/invitor"), libapi.SessionHandler(LoginHandler(invitorAdminToggle)))
|
|
}
|
|
|
|
// Status to get Login and Server status
|
|
func status(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
returndata = false
|
|
logger := log.GetLog(r, "status")
|
|
var result int64
|
|
dbconnection.Model(&Login{}).Count(&result)
|
|
if result > 0 {
|
|
returndata = true
|
|
}
|
|
logger.Info("done")
|
|
return
|
|
}
|
|
|
|
// Logout current user
|
|
func logout(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
sess := ctx.Value("session").(libsession.Session)
|
|
libsession.SessionDestroy(w, r)
|
|
logger := log.GetLog(r, "logout")
|
|
if login := sess.Get("login"); login != nil {
|
|
logger = logger.WithField("user", login.(Login).Username)
|
|
}
|
|
sess.Delete("login")
|
|
sess.Delete("profil")
|
|
logger.Info("done")
|
|
returndata = true
|
|
|
|
return
|
|
}
|
|
|
|
// Login of system
|
|
func login(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
sess := ctx.Value("session").(libsession.Session)
|
|
returndata = false
|
|
logger := log.GetLog(r, "login")
|
|
var requestlogin RequestLogin
|
|
err := json.NewDecoder(r.Body).Decode(&requestlogin)
|
|
if err != nil {
|
|
logger.Error("fetch request")
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
logger = logger.WithField("user", requestlogin.Username)
|
|
var login = Login{Username: requestlogin.Username}
|
|
dbconnection.Where("mail = ?", requestlogin.Username).First(&login)
|
|
if login.ID <= 0 {
|
|
logger.Warn("user not found")
|
|
returnerr = &libapi.ErrorResult{Fields: []string{"username"}, Message: "User not Found"}
|
|
return
|
|
}
|
|
if login.Active {
|
|
output, _ := libpassword.Validate(login.Password, requestlogin.Password)
|
|
if output {
|
|
returndata = true
|
|
dbconnection.Model(&login).Update("LastLoginAt", time.Now())
|
|
sess.Set("login", login)
|
|
logger.Info("done")
|
|
} else {
|
|
logger.Warn("wrong password")
|
|
returnerr = &libapi.ErrorResult{Fields: []string{"password"}, Message: "Wrong Password"}
|
|
}
|
|
} else {
|
|
logger.Warn("not active")
|
|
returnerr = &libapi.ErrorResult{Fields: []string{"active"}, Message: "Not a active User"}
|
|
}
|
|
return
|
|
}
|
|
|
|
//Password to change the password
|
|
func password(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
sess := ctx.Value("session").(libsession.Session)
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "password")
|
|
var changePasswordRequest ChangePasswordRequest
|
|
|
|
err := json.NewDecoder(r.Body).Decode(&changePasswordRequest)
|
|
if err != nil {
|
|
logger.Error("fetch request")
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
returnerr = &libapi.ErrorResult{Message: "Internal Request Error"}
|
|
return
|
|
}
|
|
output, _ := libpassword.Validate(login.Password, changePasswordRequest.CurrentPassword)
|
|
if !output {
|
|
logger.Warn("wrong current password")
|
|
returnerr = &libapi.ErrorResult{Fields: []string{"currentpassword"}, Message: "Wrong CurrentPassword"}
|
|
return
|
|
}
|
|
|
|
if len(changePasswordRequest.NewPassword) < MINPASSWORDLENTH {
|
|
logger.Warn("wrong new password")
|
|
returnerr = &libapi.ErrorResult{Fields: []string{"newpassword"}, Message: "Wrong NewPassword"}
|
|
return
|
|
}
|
|
login.Password = libpassword.NewHash(changePasswordRequest.NewPassword)
|
|
if err := dbconnection.Save(login).Error; err != nil {
|
|
logger.Warn("error save new password to database")
|
|
returnerr = &libapi.ErrorResult{Message: "Error save new password"}
|
|
return
|
|
}
|
|
sess.Set("login", *login)
|
|
logger.Info("done")
|
|
returndata = true
|
|
return
|
|
}
|
|
|
|
//Delete of login on warehost
|
|
func delete(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
sess := ctx.Value("session").(libsession.Session)
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "delete")
|
|
sess.Delete("login")
|
|
if err := dbconnection.Unscoped().Delete(login).Error; err != nil {
|
|
logger.Warn("error detete login")
|
|
returnerr = &libapi.ErrorResult{Message: "Error delete login"}
|
|
return
|
|
}
|
|
logger.Warn("done")
|
|
returndata = true
|
|
return
|
|
}
|
|
|
|
// InviteList list all of your invites
|
|
func inviteList(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "invitelist")
|
|
if err := dbconnection.Model(login).Preload("Invites.Invited").First(login).Error; err != nil {
|
|
logger.Warn("error load own invites")
|
|
returnerr = &libapi.ErrorResult{Message: "Could not load invites!"}
|
|
return
|
|
}
|
|
logger.Info("done")
|
|
returndata = login.Invites
|
|
return
|
|
}
|
|
|
|
// InviteAdd invite a new user to warehost
|
|
func inviteAdd(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "inviteadd")
|
|
var newLogin RequestLogin
|
|
err := json.NewDecoder(r.Body).Decode(&newLogin)
|
|
if err != nil {
|
|
logger.Error("fetch request")
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
returnerr = &libapi.ErrorResult{Message: "Internal Request Error"}
|
|
return
|
|
}
|
|
invite := &Invite{
|
|
Login: *login,
|
|
Invited: Login{
|
|
Username: strings.ToLower(newLogin.Username),
|
|
Password: libpassword.NewHash(newLogin.Password),
|
|
Active: true,
|
|
},
|
|
}
|
|
if err := dbconnection.Create(invite).Error; err != nil {
|
|
logger.Warn("error create invite")
|
|
returnerr = &libapi.ErrorResult{Message: "Username exists already"}
|
|
return
|
|
}
|
|
logger.Info("done")
|
|
returndata = true
|
|
return
|
|
}
|
|
|
|
// LoginList list all users in system
|
|
func loginList(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "loginlist")
|
|
var logins []Login
|
|
selectfield := "ID, mail"
|
|
if login.Superadmin {
|
|
selectfield = "ID, mail, superadmin"
|
|
}
|
|
if err := dbconnection.Select(selectfield).Find(&logins).Error; err != nil {
|
|
logger.Warn("sql edit login")
|
|
returnerr = &libapi.ErrorResult{Message: "Error during edit login"}
|
|
return
|
|
}
|
|
logger.Info("done")
|
|
returndata = logins
|
|
return
|
|
}
|
|
|
|
// LoginAdd add a new Login
|
|
func loginAdd(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "loginadd")
|
|
if !login.Superadmin {
|
|
logger.Error("no superadmin")
|
|
returnerr = &libapi.ErrorResult{Message: "Error no permission to edit this invite"}
|
|
return
|
|
}
|
|
var newLogin RequestLogin
|
|
err := json.NewDecoder(r.Body).Decode(&newLogin)
|
|
if err != nil {
|
|
logger.Error("fetch request")
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
returnerr = &libapi.ErrorResult{Message: "Internal Request Error"}
|
|
return
|
|
}
|
|
loginObj := Login{
|
|
Username: strings.ToLower(newLogin.Username),
|
|
Password: libpassword.NewHash(newLogin.Password),
|
|
Active: true,
|
|
}
|
|
if err := dbconnection.Create(loginObj).Error; err != nil {
|
|
logger.Warn("error create login")
|
|
returnerr = &libapi.ErrorResult{Message: "Username exists already"}
|
|
return
|
|
}
|
|
logger.Info("done")
|
|
returndata = true
|
|
return
|
|
}
|
|
|
|
// LoginEdit edit a login by invite or superadmin
|
|
func loginEdit(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "loginedit")
|
|
id, err := strconv.ParseInt(pat.Param(ctx, "id"), 10, 64)
|
|
if err != nil {
|
|
returnerr = &libapi.ErrorResult{Message: "Error invalid input"}
|
|
logger.Warn("invalid userinput, no integer")
|
|
return
|
|
}
|
|
logger = logger.WithField("id", id)
|
|
var invitedLogin = Login{ID: id}
|
|
var changeLogin RequestLogin
|
|
err = json.NewDecoder(r.Body).Decode(&changeLogin)
|
|
if err != nil {
|
|
logger.Error("fetch request")
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
returnerr = &libapi.ErrorResult{Message: "Internal Request Error"}
|
|
return
|
|
}
|
|
|
|
dbconnection.Where("id = ?", invitedLogin.ID).First(&invitedLogin)
|
|
invite := invitedLogin.GetInvitedby(dbconnection)
|
|
if !login.Superadmin && !invite.Admin && invitedLogin.CreateAt.Before(invitedLogin.LastLoginAt) {
|
|
logger.Warn("no permission")
|
|
returnerr = &libapi.ErrorResult{Message: "Error no permission to edit this login"}
|
|
return
|
|
}
|
|
if len(changeLogin.Password) > 0 {
|
|
invitedLogin.Password = libpassword.NewHash(changeLogin.Password)
|
|
}
|
|
if login.Superadmin {
|
|
invitedLogin.Username = changeLogin.Username
|
|
invitedLogin.Superadmin = changeLogin.Superadmin
|
|
}
|
|
if err := dbconnection.Save(invitedLogin).Error; err != nil {
|
|
logger.Warn("sql edit login")
|
|
returnerr = &libapi.ErrorResult{Message: "Error during edit login"}
|
|
return
|
|
}
|
|
logger.Info("done")
|
|
returndata = true
|
|
return
|
|
}
|
|
|
|
// LoginDelete delete a login by invite or superadmin
|
|
func loginDelete(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "logindelete")
|
|
id, err := strconv.ParseInt(pat.Param(ctx, "id"), 10, 64)
|
|
if err != nil {
|
|
returnerr = &libapi.ErrorResult{Message: "Error invalid input"}
|
|
logger.Warn("invalid userinput, no integer")
|
|
return
|
|
}
|
|
logger = logger.WithField("id", id)
|
|
var invitedLogin = Login{ID: id}
|
|
dbconnection.Where("id = ?", invitedLogin.ID).First(&invitedLogin)
|
|
invite := invitedLogin.GetInvitedby(dbconnection)
|
|
if !login.Superadmin && !invite.Admin && invitedLogin.CreateAt.Before(invitedLogin.LastLoginAt) {
|
|
logger.Warn("no permission")
|
|
returnerr = &libapi.ErrorResult{Message: "Error no permission to delete this login"}
|
|
return
|
|
}
|
|
if err := dbconnection.Unscoped().Delete(invitedLogin).Error; err != nil {
|
|
logger.Warn("sql detete login")
|
|
returnerr = &libapi.ErrorResult{Message: "Error during delete login"}
|
|
return
|
|
}
|
|
logger.Info("done")
|
|
returndata = true
|
|
return
|
|
}
|
|
|
|
// Invitor get Invite of current login
|
|
func invitor(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "invitor")
|
|
invite := login.GetInvitedby(dbconnection)
|
|
logger.Info("done")
|
|
returndata = invite
|
|
return
|
|
}
|
|
|
|
// InvitorAdminToggle toggle admin of current login
|
|
func invitorAdminToggle(ctx context.Context, w http.ResponseWriter, r *http.Request) (returndata interface{}, returnerr *libapi.ErrorResult) {
|
|
login := ctx.Value("login").(*Login)
|
|
returndata = false
|
|
logger := log.GetLog(r, "invitoradmintoggle")
|
|
invite := login.GetInvitedby(dbconnection)
|
|
invite.Admin = !invite.Admin
|
|
dbconnection.Model(invite).Save(&invite)
|
|
logger.Info("done")
|
|
returndata = true
|
|
return
|
|
}
|