feat: v2 (#599)

Read https://github.com/filebrowser/filebrowser/pull/575.

http/users.go

@@ -0,0 +1,186 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/filebrowser/filebrowser/v2/errors"
+	"github.com/filebrowser/filebrowser/v2/users"
+	"github.com/gorilla/mux"
+)
+
+type modifyUserRequest struct {
+	modifyRequest
+	Data *users.User `json:"data"`
+}
+
+func getUserID(r *http.Request) (uint, error) {
+	vars := mux.Vars(r)
+	i, err := strconv.ParseUint(vars["id"], 10, 0)
+	if err != nil {
+		return 0, err
+	}
+	return uint(i), err
+}
+
+func getUser(w http.ResponseWriter, r *http.Request) (*modifyUserRequest, error) {
+	if r.Body == nil {
+		return nil, errors.ErrEmptyRequest
+	}
+
+	req := &modifyUserRequest{}
+	err := json.NewDecoder(r.Body).Decode(req)
+	if err != nil {
+		return nil, err
+	}
+
+	if req.What != "user" {
+		return nil, errors.ErrInvalidDataType
+	}
+
+	return req, nil
+}
+
+func withSelfOrAdmin(fn handleFunc) handleFunc {
+	return withUser(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+		id, err := getUserID(r)
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		if d.user.ID != id && !d.user.Perm.Admin {
+			return http.StatusForbidden, nil
+		}
+
+		d.raw = id
+		return fn(w, r, d)
+	})
+}
+
+var usersGetHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	users, err := d.store.Users.Gets()
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	for _, u := range users {
+		u.Password = ""
+	}
+
+	sort.Slice(users, func(i, j int) bool {
+		return users[i].ID < users[j].ID
+	})
+
+	return renderJSON(w, r, users)
+})
+
+var userGetHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	u, err := d.store.Users.Get(d.raw.(uint))
+	if err == errors.ErrNotExist {
+		return http.StatusNotFound, err
+	}
+
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	u.Password = ""
+	return renderJSON(w, r, u)
+})
+
+var userDeleteHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	err := d.store.Users.Delete(d.raw.(uint))
+	if err == errors.ErrNotExist {
+		return http.StatusNotFound, err
+	}
+
+	return http.StatusOK, nil
+})
+
+var userPostHandler = withAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	req, err := getUser(w, r)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	if len(req.Which) != 0 {
+		return http.StatusBadRequest, nil
+	}
+
+	if req.Data.Password == "" {
+		return http.StatusBadRequest, errors.ErrEmptyPassword
+	}
+
+	req.Data.Password, err = users.HashPwd(req.Data.Password)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	err = d.store.Users.Save(req.Data)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	w.Header().Set("Location", "/settings/users/"+strconv.FormatUint(uint64(req.Data.ID), 10))
+	return http.StatusCreated, nil
+})
+
+var userPutHandler = withSelfOrAdmin(func(w http.ResponseWriter, r *http.Request, d *data) (int, error) {
+	req, err := getUser(w, r)
+	if err != nil {
+		return http.StatusBadRequest, err
+	}
+
+	if req.Data.ID != d.raw.(uint) {
+		return http.StatusBadRequest, nil
+	}
+
+	if len(req.Which) == 1 && req.Which[0] == "all" {
+		if !d.user.Perm.Admin {
+			return http.StatusForbidden, err
+		}
+
+		if req.Data.Password != "" {
+			req.Data.Password, err = users.HashPwd(req.Data.Password)
+		} else {
+			var suser *users.User
+			suser, err = d.store.Users.Get(d.raw.(uint))
+			req.Data.Password = suser.Password
+		}
+
+		if err != nil {
+			return http.StatusInternalServerError, err
+		}
+
+		req.Which = []string{}
+	}
+
+	for k, v := range req.Which {
+		if v == "password" {
+			if !d.user.Perm.Admin && d.user.LockPassword {
+				return http.StatusForbidden, nil
+			}
+
+			req.Data.Password, err = users.HashPwd(req.Data.Password)
+			if err != nil {
+				return http.StatusInternalServerError, err
+			}
+		}
+
+		if !d.user.Perm.Admin && (v == "scope" || v == "perm" || v == "username") {
+			return http.StatusForbidden, nil
+		}
+
+		req.Which[k] = strings.Title(v)
+	}
+
+	err = d.store.Users.Update(req.Data, req.Which...)
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+
+	return http.StatusOK, nil
+})