2017-07-08 16:51:47 +00:00
|
|
|
package filemanager
|
|
|
|
|
|
|
|
import (
|
|
|
|
"encoding/json"
|
|
|
|
"errors"
|
|
|
|
"net/http"
|
2017-08-10 10:21:06 +00:00
|
|
|
"os"
|
2017-07-08 16:51:47 +00:00
|
|
|
"sort"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
|
|
|
|
|
|
|
"github.com/asdine/storm"
|
|
|
|
)
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
type modifyRequest struct {
|
|
|
|
What string `json:"what"` // Answer to: what data type?
|
|
|
|
Which string `json:"which"` // Answer to: which field?
|
|
|
|
}
|
|
|
|
|
|
|
|
type modifyUserRequest struct {
|
|
|
|
*modifyRequest
|
|
|
|
Data *User `json:"data"`
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// usersHandler is the entry point of the users API. It's just a router
|
|
|
|
// to send the request to its
|
2017-07-11 15:58:18 +00:00
|
|
|
func usersHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
|
2017-08-01 19:49:56 +00:00
|
|
|
// If the user isn't admin and isn't making a PUT
|
|
|
|
// request, then return forbidden.
|
|
|
|
if !c.User.Admin && r.Method != http.MethodPut {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusForbidden, nil
|
|
|
|
}
|
|
|
|
|
2017-07-08 16:51:47 +00:00
|
|
|
switch r.Method {
|
|
|
|
case http.MethodGet:
|
|
|
|
return usersGetHandler(c, w, r)
|
|
|
|
case http.MethodPost:
|
|
|
|
return usersPostHandler(c, w, r)
|
|
|
|
case http.MethodDelete:
|
|
|
|
return usersDeleteHandler(c, w, r)
|
|
|
|
case http.MethodPut:
|
|
|
|
return usersPutHandler(c, w, r)
|
|
|
|
}
|
|
|
|
|
|
|
|
return http.StatusNotImplemented, nil
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// getUserID returns the id from the user which is present
|
|
|
|
// in the request url. If the url is invalid and doesn't
|
|
|
|
// contain a valid ID, it returns an error.
|
|
|
|
func getUserID(r *http.Request) (int, error) {
|
|
|
|
// Obtains the ID in string from the URL and converts
|
|
|
|
// it into an integer.
|
|
|
|
sid := strings.TrimPrefix(r.URL.Path, "/")
|
|
|
|
sid = strings.TrimSuffix(sid, "/")
|
|
|
|
id, err := strconv.Atoi(sid)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusBadRequest, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return id, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// getUser returns the user which is present in the request
|
|
|
|
// body. If the body is empty or the JSON is invalid, it
|
|
|
|
// returns an error.
|
2017-08-01 19:49:56 +00:00
|
|
|
func getUser(r *http.Request) (*User, string, error) {
|
|
|
|
// Checks if the request body is empty.
|
2017-07-26 16:50:39 +00:00
|
|
|
if r.Body == nil {
|
2017-08-01 19:49:56 +00:00
|
|
|
return nil, "", errEmptyRequest
|
2017-07-26 16:50:39 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Parses the request body and checks if it's well formed.
|
|
|
|
mod := &modifyUserRequest{}
|
|
|
|
err := json.NewDecoder(r.Body).Decode(mod)
|
2017-07-26 16:50:39 +00:00
|
|
|
if err != nil {
|
2017-08-01 19:49:56 +00:00
|
|
|
return nil, "", err
|
2017-07-26 16:50:39 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Checks if the request type is right.
|
|
|
|
if mod.What != "user" {
|
|
|
|
return nil, "", errWrongDataType
|
|
|
|
}
|
|
|
|
|
|
|
|
return mod.Data, mod.Which, nil
|
2017-07-26 16:50:39 +00:00
|
|
|
}
|
|
|
|
|
2017-07-11 15:58:18 +00:00
|
|
|
func usersGetHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
|
2017-07-26 16:50:39 +00:00
|
|
|
// Request for the default user data.
|
|
|
|
if r.URL.Path == "/base" {
|
2017-08-01 19:49:56 +00:00
|
|
|
return renderJSON(w, c.DefaultUser)
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// Request for the listing of users.
|
2017-07-08 16:51:47 +00:00
|
|
|
if r.URL.Path == "/" {
|
|
|
|
users := []User{}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
for _, user := range c.Users {
|
2017-07-26 16:50:39 +00:00
|
|
|
// Copies the user info and removes its
|
|
|
|
// password so it won't be sent to the
|
|
|
|
// front-end.
|
2017-07-08 16:51:47 +00:00
|
|
|
u := *user
|
|
|
|
u.Password = ""
|
|
|
|
users = append(users, u)
|
|
|
|
}
|
|
|
|
|
|
|
|
sort.Slice(users, func(i, j int) bool {
|
|
|
|
return users[i].ID < users[j].ID
|
|
|
|
})
|
|
|
|
|
|
|
|
return renderJSON(w, users)
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
id, err := getUserID(r)
|
2017-07-08 16:51:47 +00:00
|
|
|
if err != nil {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusInternalServerError, err
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Searches for the user and prints the one who matches.
|
2017-08-01 19:49:56 +00:00
|
|
|
for _, user := range c.Users {
|
2017-07-08 16:51:47 +00:00
|
|
|
if user.ID != id {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
u := *user
|
|
|
|
u.Password = ""
|
|
|
|
return renderJSON(w, u)
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// If there aren't any matches, return not found.
|
|
|
|
return http.StatusNotFound, errUserNotExist
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-11 15:58:18 +00:00
|
|
|
func usersPostHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
|
2017-07-08 16:51:47 +00:00
|
|
|
if r.URL.Path != "/" {
|
|
|
|
return http.StatusMethodNotAllowed, nil
|
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
u, _, err := getUser(r)
|
2017-07-08 16:51:47 +00:00
|
|
|
if err != nil {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusBadRequest, err
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Checks if username isn't empty.
|
|
|
|
if u.Username == "" {
|
|
|
|
return http.StatusBadRequest, errEmptyUsername
|
|
|
|
}
|
|
|
|
|
|
|
|
// Checks if filesystem isn't empty.
|
|
|
|
if u.FileSystem == "" {
|
|
|
|
return http.StatusBadRequest, errEmptyScope
|
|
|
|
}
|
|
|
|
|
|
|
|
// Checks if password isn't empty.
|
|
|
|
if u.Password == "" {
|
|
|
|
return http.StatusBadRequest, errEmptyPassword
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// The username, password and scope cannot be empty.
|
2017-07-08 16:51:47 +00:00
|
|
|
if u.Username == "" || u.Password == "" || u.FileSystem == "" {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusBadRequest, errors.New("username, password or scope is empty")
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Initialize rules if they're not initialized.
|
|
|
|
if u.Rules == nil {
|
|
|
|
u.Rules = []*Rule{}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Initialize commands if not initialized.
|
|
|
|
if u.Commands == nil {
|
|
|
|
u.Commands = []string{}
|
|
|
|
}
|
|
|
|
|
|
|
|
// It's a new user so the ID will be auto created.
|
|
|
|
if u.ID != 0 {
|
|
|
|
u.ID = 0
|
|
|
|
}
|
|
|
|
|
2017-08-10 10:21:06 +00:00
|
|
|
// Checks if the scope exists.
|
|
|
|
if code, err := checkFS(string(u.FileSystem)); err != nil {
|
|
|
|
return code, err
|
|
|
|
}
|
|
|
|
|
2017-07-08 16:51:47 +00:00
|
|
|
// Hashes the password.
|
|
|
|
pw, err := hashPassword(u.Password)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
|
|
|
u.Password = pw
|
|
|
|
|
|
|
|
// Saves the user to the database.
|
2017-08-01 19:49:56 +00:00
|
|
|
err = c.db.Save(u)
|
2017-07-08 16:51:47 +00:00
|
|
|
if err == storm.ErrAlreadyExists {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusConflict, errUserExist
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Saves the user to the memory.
|
2017-08-01 19:49:56 +00:00
|
|
|
c.Users[u.Username] = u
|
2017-07-08 16:51:47 +00:00
|
|
|
|
|
|
|
// Set the Location header and return.
|
|
|
|
w.Header().Set("Location", "/users/"+strconv.Itoa(u.ID))
|
|
|
|
w.WriteHeader(http.StatusCreated)
|
|
|
|
return 0, nil
|
|
|
|
}
|
|
|
|
|
2017-08-10 10:21:06 +00:00
|
|
|
func checkFS(path string) (int, error) {
|
|
|
|
info, err := os.Stat(path)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
if !os.IsNotExist(err) {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
|
|
|
err = os.MkdirAll(path, 0666)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
if !info.IsDir() {
|
|
|
|
return http.StatusBadRequest, errors.New("Scope is not a dir")
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0, nil
|
|
|
|
}
|
|
|
|
|
2017-07-11 15:58:18 +00:00
|
|
|
func usersDeleteHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
|
2017-07-08 16:51:47 +00:00
|
|
|
if r.URL.Path == "/" {
|
|
|
|
return http.StatusMethodNotAllowed, nil
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
id, err := getUserID(r)
|
2017-07-08 16:51:47 +00:00
|
|
|
if err != nil {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusInternalServerError, err
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// Deletes the user from the database.
|
2017-08-01 19:49:56 +00:00
|
|
|
err = c.db.DeleteStruct(&User{ID: id})
|
2017-07-08 16:51:47 +00:00
|
|
|
if err == storm.ErrNotFound {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusNotFound, errUserNotExist
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
2017-07-26 16:50:39 +00:00
|
|
|
// Delete the user from the in-memory users map.
|
2017-08-01 19:49:56 +00:00
|
|
|
for _, user := range c.Users {
|
2017-07-08 16:51:47 +00:00
|
|
|
if user.ID == id {
|
2017-08-01 19:49:56 +00:00
|
|
|
delete(c.Users, user.Username)
|
2017-07-26 16:50:39 +00:00
|
|
|
break
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return http.StatusOK, nil
|
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
func usersPutHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
|
|
|
|
// New users should be created on /api/users.
|
|
|
|
if r.URL.Path == "/" {
|
2017-07-26 16:50:39 +00:00
|
|
|
return http.StatusMethodNotAllowed, nil
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Gets the user ID from the URL and checks if it's valid.
|
|
|
|
id, err := getUserID(r)
|
2017-07-26 16:50:39 +00:00
|
|
|
if err != nil {
|
2017-08-01 19:49:56 +00:00
|
|
|
return http.StatusInternalServerError, err
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Checks if the user has permission to access this page.
|
|
|
|
if !c.User.Admin && id != c.User.ID {
|
|
|
|
return http.StatusForbidden, nil
|
2017-07-26 16:50:39 +00:00
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Gets the user from the request body.
|
|
|
|
u, which, err := getUser(r)
|
2017-07-26 16:50:39 +00:00
|
|
|
if err != nil {
|
2017-08-01 19:49:56 +00:00
|
|
|
return http.StatusBadRequest, err
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Updates the CSS and locale.
|
|
|
|
if which == "partial" {
|
|
|
|
c.User.CSS = u.CSS
|
|
|
|
c.User.Locale = u.Locale
|
|
|
|
err = c.db.UpdateField(&User{ID: c.User.ID}, "CSS", u.CSS)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
err = c.db.UpdateField(&User{ID: c.User.ID}, "Locale", u.Locale)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
return http.StatusOK, nil
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Updates the Password.
|
|
|
|
if which == "password" {
|
|
|
|
if u.Password == "" {
|
|
|
|
return http.StatusBadRequest, errEmptyPassword
|
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
pw, err := hashPassword(u.Password)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
c.User.Password = pw
|
|
|
|
err = c.db.UpdateField(&User{ID: c.User.ID}, "Password", pw)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
return http.StatusOK, nil
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// If can only be all.
|
|
|
|
if which != "all" {
|
|
|
|
return http.StatusBadRequest, errInvalidUpdateField
|
2017-07-26 16:50:39 +00:00
|
|
|
}
|
2017-07-08 16:51:47 +00:00
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Checks if username isn't empty.
|
|
|
|
if u.Username == "" {
|
|
|
|
return http.StatusBadRequest, errEmptyUsername
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Checks if filesystem isn't empty.
|
|
|
|
if u.FileSystem == "" {
|
|
|
|
return http.StatusBadRequest, errEmptyScope
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
2017-08-10 10:21:06 +00:00
|
|
|
// Checks if the scope exists.
|
|
|
|
if code, err := checkFS(string(u.FileSystem)); err != nil {
|
|
|
|
return code, err
|
|
|
|
}
|
|
|
|
|
2017-07-08 16:51:47 +00:00
|
|
|
// Initialize rules if they're not initialized.
|
|
|
|
if u.Rules == nil {
|
|
|
|
u.Rules = []*Rule{}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Initialize commands if not initialized.
|
|
|
|
if u.Commands == nil {
|
|
|
|
u.Commands = []string{}
|
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Gets the current saved user from the in-memory map.
|
|
|
|
var suser *User
|
|
|
|
for _, user := range c.Users {
|
2017-07-19 06:55:58 +00:00
|
|
|
if user.ID == id {
|
2017-08-01 19:49:56 +00:00
|
|
|
suser = user
|
2017-07-19 06:55:58 +00:00
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
2017-08-01 19:49:56 +00:00
|
|
|
if suser == nil {
|
2017-07-08 16:51:47 +00:00
|
|
|
return http.StatusNotFound, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
u.ID = id
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
// Changes the password if the request wants it.
|
|
|
|
if u.Password != "" {
|
2017-07-08 16:51:47 +00:00
|
|
|
pw, err := hashPassword(u.Password)
|
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
|
|
|
u.Password = pw
|
2017-08-01 19:49:56 +00:00
|
|
|
} else {
|
|
|
|
u.Password = suser.Password
|
2017-07-08 16:51:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Updates the whole User struct because we always are supposed
|
|
|
|
// to send a new entire object.
|
2017-08-01 19:49:56 +00:00
|
|
|
err = c.db.Save(u)
|
2017-07-08 16:51:47 +00:00
|
|
|
if err != nil {
|
|
|
|
return http.StatusInternalServerError, err
|
|
|
|
}
|
|
|
|
|
2017-07-19 06:55:58 +00:00
|
|
|
// If the user changed the username, delete the old user
|
|
|
|
// from the in-memory user map.
|
2017-08-01 19:49:56 +00:00
|
|
|
if suser.Username != u.Username {
|
|
|
|
delete(c.Users, suser.Username)
|
2017-07-19 06:55:58 +00:00
|
|
|
}
|
|
|
|
|
2017-08-01 19:49:56 +00:00
|
|
|
c.Users[u.Username] = u
|
2017-07-08 16:51:47 +00:00
|
|
|
return http.StatusOK, nil
|
|
|
|
}
|