diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 1563920..28436ce 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -22,10 +22,10 @@ go run ./cmd/server # run dev server on :8080 ## Admin CLI ```bash -go run ./cmd/admin user add [--upload] # Benutzer anlegen -go run ./cmd/admin user list # alle Benutzer -go run ./cmd/admin user delete # löschen -go run ./cmd/admin user set-upload +go run ./cmd/admin user add [--role reader|uploader|admin] # Standard: reader +go run ./cmd/admin user list +go run ./cmd/admin user delete +go run ./cmd/admin user set-role ``` ## Architecture @@ -33,11 +33,23 @@ go run ./cmd/admin user set-upload - `cmd/server/main.go` — entrypoint; wires `library.Service`, `users.Store` and `web.Handler` together and starts the HTTP server. - `internal/library` — core domain logic, no HTTP dependency (unchanged). -- `internal/users/store.go` — SQLite-backed user store (`modernc.org/sqlite`, - pure Go driver). Tables: `users` (id, username, password_hash bcrypt, - can_upload), `sessions` (token, user_id FK, expires_at unix timestamp). - Sessions TTL = 30 days. Key methods: `Authenticate`, `CreateSession`, - `LookupSession`, `DeleteSession`, `CreateUser`, `SetUpload`, `DeleteUser`, `ListUsers`. +- `internal/users/role.go` — `Role` type (`reader`, `uploader`, `admin`), + `roleLevel` map für Hierarchie, `AtLeast(min Role)`, `ParseRole(s)`. + Neue Rollen: in `roleLevel` eintragen und ggf. Routen anpassen — kein + Schema-Change nötig. +- `internal/users/store.go` — SQLite-backed user store. Migrations via + `_schema_version`-Tabelle (geordnete `migrations [][]string`); neue + Migrationen am Ende anhängen. `role TEXT` statt `can_upload INTEGER`. +- `internal/web/middleware.go` — `requireRole(minRole users.Role)` ist die + zentrale Middleware; `requireAuth` ist ein Spezialfall davon (implizit + `RoleReader`). +- Auth: `/login` und `/static/` sind die einzigen öffentlichen Routes. + Upload-Routes verwenden `requireRole(RoleUploader)`. + +**Rollen-Hierarchie:** +``` +reader (0) < uploader (1) < admin (2) +``` - `cmd/admin/main.go` — CLI binary for user management; reads `USERS_DB` env var. - `internal/web/handlers.go` — HTTP handlers including `loginPage`, `loginSubmit`, `logout`, `uploadPage`, `uploadSubmit`. diff --git a/README.md b/README.md index 45c9951..fa0fedf 100644 --- a/README.md +++ b/README.md @@ -65,11 +65,13 @@ Alternativ können Benutzer mit Upload-Recht Bücher direkt im Browser hochladen ## Benutzerverwaltung (CLI) +Rollen (aufsteigend): `reader` → `uploader` → `admin` + ```bash +go run ./cmd/admin user add [--role reader|uploader|admin] go run ./cmd/admin user list -go run ./cmd/admin user add [--upload] go run ./cmd/admin user delete -go run ./cmd/admin user set-upload +go run ./cmd/admin user set-role ``` ## Konfiguration diff --git a/cmd/admin/main.go b/cmd/admin/main.go index f995c7b..669fba2 100644 --- a/cmd/admin/main.go +++ b/cmd/admin/main.go @@ -3,7 +3,6 @@ package main import ( "fmt" "os" - "strconv" "strings" "syscall" @@ -40,10 +39,20 @@ func handleUser(store *users.Store, action string, args []string) { switch action { case "add": if len(args) < 1 { - fatalf("usage: user add [--upload]\n") + fatalf("usage: user add [--role reader|uploader|admin]\n") } username := args[0] - canUpload := len(args) > 1 && args[1] == "--upload" + role := users.RoleReader + if len(args) > 1 && args[1] == "--role" { + if len(args) < 3 { + fatalf("--role erwartet einen Wert: reader, uploader oder admin\n") + } + r, err := users.ParseRole(args[2]) + if err != nil { + fatalf("%v\n", err) + } + role = r + } password, err := readPassword(fmt.Sprintf("Passwort für '%s': ", username)) if err != nil { @@ -57,11 +66,11 @@ func handleUser(store *users.Store, action string, args []string) { fatalf("Passwörter stimmen nicht überein.\n") } - u, err := store.CreateUser(username, password, canUpload) + u, err := store.CreateUser(username, password, role) if err != nil { fatalf("user anlegen: %v\n", err) } - fmt.Printf("✓ Benutzer '%s' angelegt (upload: %s)\n", u.Username, yesNo(u.CanUpload)) + fmt.Printf("✓ Benutzer '%s' angelegt (rolle: %s)\n", u.Username, u.Role) case "list": list, err := store.ListUsers() @@ -72,10 +81,10 @@ func handleUser(store *users.Store, action string, args []string) { fmt.Println("Keine Benutzer vorhanden.") return } - fmt.Printf("%-20s %s\n", "BENUTZERNAME", "UPLOAD") + fmt.Printf("%-20s %s\n", "BENUTZERNAME", "ROLLE") fmt.Println(strings.Repeat("-", 32)) for _, u := range list { - fmt.Printf("%-20s %s\n", u.Username, yesNo(u.CanUpload)) + fmt.Printf("%-20s %s\n", u.Username, u.Role) } case "delete": @@ -87,18 +96,18 @@ func handleUser(store *users.Store, action string, args []string) { } fmt.Printf("✓ Benutzer '%s' gelöscht.\n", args[0]) - case "set-upload": + case "set-role": if len(args) < 2 { - fatalf("usage: user set-upload \n") + fatalf("usage: user set-role \n") } - val, err := strconv.ParseBool(args[1]) + role, err := users.ParseRole(args[1]) if err != nil { - fatalf("ungültiger Wert '%s', erwartet true oder false\n", args[1]) + fatalf("%v\n", err) } - if err := store.SetUpload(args[0], val); err != nil { - fatalf("upload-recht setzen: %v\n", err) + if err := store.SetRole(args[0], role); err != nil { + fatalf("rolle setzen: %v\n", err) } - fmt.Printf("✓ Upload-Recht für '%s' auf %s gesetzt.\n", args[0], yesNo(val)) + fmt.Printf("✓ Rolle für '%s' auf '%s' gesetzt.\n", args[0], role) default: usage() @@ -116,13 +125,6 @@ func readPassword(prompt string) (string, error) { return string(b), nil } -func yesNo(b bool) string { - if b { - return "ja" - } - return "nein" -} - func getenv(key, fallback string) string { if v := os.Getenv(key); v != "" { return v @@ -138,11 +140,16 @@ func fatalf(format string, args ...any) { func usage() { fmt.Fprintln(os.Stderr, `ebooks-admin – Benutzerverwaltung +Rollen (aufsteigend): + reader Lesen und Herunterladen + uploader Zusätzlich: Bücher hochladen + admin Alle Rechte + Befehle: - user add [--upload] Benutzer anlegen (optional: Upload-Recht) - user list Alle Benutzer auflisten - user delete Benutzer löschen - user set-upload Upload-Recht ändern + user add [--role reader|uploader|admin] Benutzer anlegen (Standard: reader) + user list Alle Benutzer auflisten + user delete Benutzer löschen + user set-role Rolle ändern Umgebungsvariablen: USERS_DB Pfad zur SQLite-Datenbank (Standard: users.db)`) diff --git a/internal/users/role.go b/internal/users/role.go new file mode 100644 index 0000000..d96380d --- /dev/null +++ b/internal/users/role.go @@ -0,0 +1,43 @@ +package users + +import "fmt" + +// Role represents a user's access level. Roles are ordered hierarchically: +// RoleReader < RoleUploader < RoleAdmin. +// New roles can be inserted into roleLevel without changing existing code. +type Role string + +const ( + RoleReader Role = "reader" + RoleUploader Role = "uploader" + RoleAdmin Role = "admin" +) + +// roleLevel defines the hierarchy. Higher = more permissions. +var roleLevel = map[Role]int{ + RoleReader: 0, + RoleUploader: 1, + RoleAdmin: 2, +} + +// AtLeast reports whether r has at least the same privilege level as min. +func (r Role) AtLeast(min Role) bool { + return roleLevel[r] >= roleLevel[min] +} + +// IsValid reports whether r is a known role. +func (r Role) IsValid() bool { + _, ok := roleLevel[r] + return ok +} + +func (r Role) String() string { return string(r) } + +// ParseRole parses a role string. Returns an error for unknown values. +func ParseRole(s string) (Role, error) { + r := Role(s) + if !r.IsValid() { + return "", fmt.Errorf("unbekannte Rolle %q, gültig: reader, uploader, admin", s) + } + return r, nil +} diff --git a/internal/users/store.go b/internal/users/store.go index 4cb5d0c..d367a3e 100644 --- a/internal/users/store.go +++ b/internal/users/store.go @@ -6,26 +6,27 @@ import ( "encoding/hex" "errors" "fmt" + "strings" "time" - _ "modernc.org/sqlite" "golang.org/x/crypto/bcrypt" + _ "modernc.org/sqlite" ) var ErrNotFound = errors.New("user not found") var ErrUserExists = errors.New("user already exists") type User struct { - ID int64 - Username string - CanUpload bool + ID int64 + Username string + Role Role } type Session struct { Token string UserID int64 Username string - CanUpload bool + Role Role ExpiresAt time.Time } @@ -49,32 +50,80 @@ func Open(path string) (*Store, error) { func (s *Store) Close() error { return s.db.Close() } -func (s *Store) migrate() error { - _, err := s.db.Exec(` - CREATE TABLE IF NOT EXISTS users ( +// migrations is an ordered list of schema changes. Each entry is a slice of +// SQL statements to execute in a transaction. Add new entries at the end only. +var migrations = [][]string{ + // v1: initial schema + { + `CREATE TABLE IF NOT EXISTS users ( id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT NOT NULL UNIQUE, password_hash TEXT NOT NULL, can_upload INTEGER NOT NULL DEFAULT 0 - ); - CREATE TABLE IF NOT EXISTS sessions ( + )`, + `CREATE TABLE IF NOT EXISTS sessions ( token TEXT PRIMARY KEY, user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE, expires_at INTEGER NOT NULL - ); - `) - return err + )`, + }, + // v2: replace can_upload with role column; migrate existing data + { + `ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'reader'`, + `UPDATE users SET role = CASE WHEN can_upload = 1 THEN 'uploader' ELSE 'reader' END`, + }, } -// CreateUser adds a new user. Returns ErrUserExists if the username is taken. -func (s *Store) CreateUser(username, password string, canUpload bool) (*User, error) { +func (s *Store) migrate() error { + if _, err := s.db.Exec( + `CREATE TABLE IF NOT EXISTS _schema_version (version INTEGER NOT NULL)`, + ); err != nil { + return err + } + + var version int + if err := s.db.QueryRow( + `SELECT COALESCE(MAX(version), 0) FROM _schema_version`, + ).Scan(&version); err != nil { + return err + } + + for i, stmts := range migrations { + v := i + 1 + if v <= version { + continue + } + tx, err := s.db.Begin() + if err != nil { + return err + } + for _, stmt := range stmts { + if _, err := tx.Exec(stmt); err != nil { + _ = tx.Rollback() + return fmt.Errorf("migration %d: %w", v, err) + } + } + if _, err := tx.Exec(`INSERT INTO _schema_version (version) VALUES (?)`, v); err != nil { + _ = tx.Rollback() + return err + } + if err := tx.Commit(); err != nil { + return err + } + } + return nil +} + +// CreateUser adds a new user with the given role. Returns ErrUserExists if the +// username is already taken. +func (s *Store) CreateUser(username, password string, role Role) (*User, error) { hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) if err != nil { return nil, err } res, err := s.db.Exec( - `INSERT INTO users (username, password_hash, can_upload) VALUES (?, ?, ?)`, - username, string(hash), boolToInt(canUpload), + `INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)`, + username, string(hash), role, ) if err != nil { if isUnique(err) { @@ -83,14 +132,14 @@ func (s *Store) CreateUser(username, password string, canUpload bool) (*User, er return nil, err } id, _ := res.LastInsertId() - return &User{ID: id, Username: username, CanUpload: canUpload}, nil + return &User{ID: id, Username: username, Role: role}, nil } -// SetUpload changes the upload permission of an existing user. -func (s *Store) SetUpload(username string, canUpload bool) error { +// SetRole changes the role of an existing user. +func (s *Store) SetRole(username string, role Role) error { res, err := s.db.Exec( - `UPDATE users SET can_upload = ? WHERE username = ?`, - boolToInt(canUpload), username, + `UPDATE users SET role = ? WHERE username = ?`, + role, username, ) if err != nil { return err @@ -115,7 +164,7 @@ func (s *Store) DeleteUser(username string) error { // ListUsers returns all users ordered by username. func (s *Store) ListUsers() ([]User, error) { - rows, err := s.db.Query(`SELECT id, username, can_upload FROM users ORDER BY username`) + rows, err := s.db.Query(`SELECT id, username, role FROM users ORDER BY username`) if err != nil { return nil, err } @@ -124,25 +173,25 @@ func (s *Store) ListUsers() ([]User, error) { var users []User for rows.Next() { var u User - var up int - if err := rows.Scan(&u.ID, &u.Username, &up); err != nil { + var roleStr string + if err := rows.Scan(&u.ID, &u.Username, &roleStr); err != nil { return nil, err } - u.CanUpload = up != 0 + u.Role = Role(roleStr) users = append(users, u) } return users, rows.Err() } -// Authenticate verifies credentials and returns the matching user. +// Authenticate verifies credentials and returns the matching user, or nil on +// wrong username/password. func (s *Store) Authenticate(username, password string) (*User, error) { var u User - var hash string - var up int + var hash, roleStr string err := s.db.QueryRow( - `SELECT id, username, password_hash, can_upload FROM users WHERE username = ?`, + `SELECT id, username, password_hash, role FROM users WHERE username = ?`, username, - ).Scan(&u.ID, &u.Username, &hash, &up) + ).Scan(&u.ID, &u.Username, &hash, &roleStr) if errors.Is(err, sql.ErrNoRows) { return nil, nil } @@ -152,7 +201,7 @@ func (s *Store) Authenticate(username, password string) (*User, error) { if bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil { return nil, nil } - u.CanUpload = up != 0 + u.Role = Role(roleStr) return &u, nil } @@ -163,32 +212,31 @@ func (s *Store) CreateSession(u *User) (*Session, error) { return nil, err } exp := time.Now().Add(30 * 24 * time.Hour) - _, err = s.db.Exec( + if _, err = s.db.Exec( `INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)`, token, u.ID, exp.Unix(), - ) - if err != nil { + ); err != nil { return nil, err } return &Session{ Token: token, UserID: u.ID, Username: u.Username, - CanUpload: u.CanUpload, + Role: u.Role, ExpiresAt: exp, }, nil } -// LookupSession returns the session if valid, nil if not found/expired. +// LookupSession returns the session if valid, nil if not found or expired. func (s *Store) LookupSession(token string) (*Session, error) { var sess Session - var up int + var roleStr string var expUnix int64 err := s.db.QueryRow(` - SELECT s.token, s.user_id, u.username, u.can_upload, s.expires_at + SELECT s.token, s.user_id, u.username, u.role, s.expires_at FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token = ? - `, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &up, &expUnix) + `, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &roleStr, &expUnix) if errors.Is(err, sql.ErrNoRows) { return nil, nil } @@ -200,7 +248,7 @@ func (s *Store) LookupSession(token string) (*Session, error) { _, _ = s.db.Exec(`DELETE FROM sessions WHERE token = ?`, token) return nil, nil } - sess.CanUpload = up != 0 + sess.Role = Role(roleStr) return &sess, nil } @@ -218,26 +266,6 @@ func randomToken() (string, error) { return hex.EncodeToString(b), nil } -func boolToInt(b bool) int { - if b { - return 1 - } - return 0 -} - func isUnique(err error) bool { - return err != nil && (contains(err.Error(), "UNIQUE") || contains(err.Error(), "unique")) -} - -func contains(s, sub string) bool { - return len(s) >= len(sub) && (s == sub || len(s) > 0 && containsStr(s, sub)) -} - -func containsStr(s, sub string) bool { - for i := 0; i+len(sub) <= len(s); i++ { - if s[i:i+len(sub)] == sub { - return true - } - } - return false + return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique") } diff --git a/internal/web/handlers.go b/internal/web/handlers.go index 5686e5e..5baf668 100644 --- a/internal/web/handlers.go +++ b/internal/web/handlers.go @@ -34,15 +34,15 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) { mux.HandleFunc("POST /logout", h.logout) mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static")))) - // Authenticated + // Authenticated (any role) mux.HandleFunc("GET /", h.requireAuth(h.listBooks)) mux.HandleFunc("GET /book/{id}", h.requireAuth(h.bookDetails)) mux.HandleFunc("GET /download/{id}", h.requireAuth(h.downloadBook)) mux.HandleFunc("GET /cover/{id}", h.requireAuth(h.bookCover)) - // Upload (authenticated + can_upload) - mux.HandleFunc("GET /upload", h.requireUpload(h.uploadPage)) - mux.HandleFunc("POST /upload", h.requireUpload(h.uploadSubmit)) + // Uploader and above + mux.HandleFunc("GET /upload", h.requireRole(users.RoleUploader, h.uploadPage)) + mux.HandleFunc("POST /upload", h.requireRole(users.RoleUploader, h.uploadSubmit)) } func (h *Handler) listBooks(w http.ResponseWriter, r *http.Request) { @@ -52,7 +52,7 @@ func (h *Handler) listBooks(w http.ResponseWriter, r *http.Request) { return } sess := sessionFrom(r) - canUpload := sess != nil && sess.CanUpload + canUpload := sess != nil && sess.Role.AtLeast(users.RoleUploader) render(w, r.Context(), views.IndexPage(books, canUpload)) } diff --git a/internal/web/middleware.go b/internal/web/middleware.go index 1c9d374..f53ff9a 100644 --- a/internal/web/middleware.go +++ b/internal/web/middleware.go @@ -17,7 +17,7 @@ func sessionFrom(r *http.Request) *users.Session { return s } -// requireAuth is middleware that redirects unauthenticated requests to /login. +// requireAuth redirects unauthenticated requests to /login. func (h *Handler) requireAuth(next http.HandlerFunc) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { sess, err := h.sessionFromRequest(r) @@ -30,11 +30,13 @@ func (h *Handler) requireAuth(next http.HandlerFunc) http.HandlerFunc { } } -// requireUpload is middleware that returns 403 if the user lacks upload permission. -func (h *Handler) requireUpload(next http.HandlerFunc) http.HandlerFunc { +// requireRole returns middleware that allows access only to users whose role is +// at least minRole. Unknown sessions are redirected to /login; insufficient +// role yields 403. +func (h *Handler) requireRole(minRole users.Role, next http.HandlerFunc) http.HandlerFunc { return h.requireAuth(func(w http.ResponseWriter, r *http.Request) { sess := sessionFrom(r) - if !sess.CanUpload { + if !sess.Role.AtLeast(minRole) { http.Error(w, "Keine Berechtigung", http.StatusForbidden) return }