refactor: replace can_upload boolean with role-based access control

Introduces a three-tier role hierarchy: reader < uploader < admin. - internal/users/role.go: Role type, roleLevel map, AtLeast(min), ParseRole() — new roles added by inserting into roleLevel only - internal/users/store.go: versioned migrations via _schema_version table; v2 migration adds 'role' column and migrates existing can_upload data; SetRole() replaces SetUpload(); Session carries Role instead of CanUpload - internal/web/middleware.go: generic requireRole(minRole) middleware replaces the ad-hoc requireUpload - internal/web/handlers.go: upload routes use requireRole(RoleUploader); listBooks derives canUpload from sess.Role.AtLeast(RoleUploader) - cmd/admin/main.go: user add --role <reader|uploader|admin>, user set-role replaces user set-upload - README, copilot-instructions updated Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-08-11 19:43:39 +02:00
parent a66c370de4
commit 817763887a
7 changed files with 201 additions and 107 deletions
@@ -0,0 +1,43 @@
+package users
+
+import "fmt"
+
+// Role represents a user's access level. Roles are ordered hierarchically:
+// RoleReader < RoleUploader < RoleAdmin.
+// New roles can be inserted into roleLevel without changing existing code.
+type Role string
+
+const (
+	RoleReader   Role = "reader"
+	RoleUploader Role = "uploader"
+	RoleAdmin    Role = "admin"
+)
+
+// roleLevel defines the hierarchy. Higher = more permissions.
+var roleLevel = map[Role]int{
+	RoleReader:   0,
+	RoleUploader: 1,
+	RoleAdmin:    2,
+}
+
+// AtLeast reports whether r has at least the same privilege level as min.
+func (r Role) AtLeast(min Role) bool {
+	return roleLevel[r] >= roleLevel[min]
+}
+
+// IsValid reports whether r is a known role.
+func (r Role) IsValid() bool {
+	_, ok := roleLevel[r]
+	return ok
+}
+
+func (r Role) String() string { return string(r) }
+
+// ParseRole parses a role string. Returns an error for unknown values.
+func ParseRole(s string) (Role, error) {
+	r := Role(s)
+	if !r.IsValid() {
+		return "", fmt.Errorf("unbekannte Rolle %q, gültig: reader, uploader, admin", s)
+	}
+	return r, nil
+}
@@ -6,26 +6,27 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"strings"
 	"time"

-	_ "modernc.org/sqlite"
 	"golang.org/x/crypto/bcrypt"
+	_ "modernc.org/sqlite"
 )

 var ErrNotFound = errors.New("user not found")
 var ErrUserExists = errors.New("user already exists")

 type User struct {
-	ID        int64
-	Username  string
-	CanUpload bool
+	ID       int64
+	Username string
+	Role     Role
 }

 type Session struct {
 	Token     string
 	UserID    int64
 	Username  string
-	CanUpload bool
+	Role      Role
 	ExpiresAt time.Time
 }

@@ -49,32 +50,80 @@ func Open(path string) (*Store, error) {

 func (s *Store) Close() error { return s.db.Close() }

-func (s *Store) migrate() error {
-	_, err := s.db.Exec(`
-		CREATE TABLE IF NOT EXISTS users (
+// migrations is an ordered list of schema changes. Each entry is a slice of
+// SQL statements to execute in a transaction. Add new entries at the end only.
+var migrations = [][]string{
+	// v1: initial schema
+	{
+		`CREATE TABLE IF NOT EXISTS users (
 			id            INTEGER PRIMARY KEY AUTOINCREMENT,
 			username      TEXT    NOT NULL UNIQUE,
 			password_hash TEXT    NOT NULL,
 			can_upload    INTEGER NOT NULL DEFAULT 0
-		);
-		CREATE TABLE IF NOT EXISTS sessions (
+		)`,
+		`CREATE TABLE IF NOT EXISTS sessions (
 			token      TEXT    PRIMARY KEY,
 			user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
 			expires_at INTEGER NOT NULL
-		);
-	`)
-	return err
+		)`,
+	},
+	// v2: replace can_upload with role column; migrate existing data
+	{
+		`ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'reader'`,
+		`UPDATE users SET role = CASE WHEN can_upload = 1 THEN 'uploader' ELSE 'reader' END`,
+	},
 }

-// CreateUser adds a new user. Returns ErrUserExists if the username is taken.
-func (s *Store) CreateUser(username, password string, canUpload bool) (*User, error) {
+func (s *Store) migrate() error {
+	if _, err := s.db.Exec(
+		`CREATE TABLE IF NOT EXISTS _schema_version (version INTEGER NOT NULL)`,
+	); err != nil {
+		return err
+	}
+
+	var version int
+	if err := s.db.QueryRow(
+		`SELECT COALESCE(MAX(version), 0) FROM _schema_version`,
+	).Scan(&version); err != nil {
+		return err
+	}
+
+	for i, stmts := range migrations {
+		v := i + 1
+		if v <= version {
+			continue
+		}
+		tx, err := s.db.Begin()
+		if err != nil {
+			return err
+		}
+		for _, stmt := range stmts {
+			if _, err := tx.Exec(stmt); err != nil {
+				_ = tx.Rollback()
+				return fmt.Errorf("migration %d: %w", v, err)
+			}
+		}
+		if _, err := tx.Exec(`INSERT INTO _schema_version (version) VALUES (?)`, v); err != nil {
+			_ = tx.Rollback()
+			return err
+		}
+		if err := tx.Commit(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// CreateUser adds a new user with the given role. Returns ErrUserExists if the
+// username is already taken.
+func (s *Store) CreateUser(username, password string, role Role) (*User, error) {
 	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
 		return nil, err
 	}
 	res, err := s.db.Exec(
-		`INSERT INTO users (username, password_hash, can_upload) VALUES (?, ?, ?)`,
-		username, string(hash), boolToInt(canUpload),
+		`INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)`,
+		username, string(hash), role,
 	)
 	if err != nil {
 		if isUnique(err) {
@@ -83,14 +132,14 @@ func (s *Store) CreateUser(username, password string, canUpload bool) (*User, er
 		return nil, err
 	}
 	id, _ := res.LastInsertId()
-	return &User{ID: id, Username: username, CanUpload: canUpload}, nil
+	return &User{ID: id, Username: username, Role: role}, nil
 }

-// SetUpload changes the upload permission of an existing user.
-func (s *Store) SetUpload(username string, canUpload bool) error {
+// SetRole changes the role of an existing user.
+func (s *Store) SetRole(username string, role Role) error {
 	res, err := s.db.Exec(
-		`UPDATE users SET can_upload = ? WHERE username = ?`,
-		boolToInt(canUpload), username,
+		`UPDATE users SET role = ? WHERE username = ?`,
+		role, username,
 	)
 	if err != nil {
 		return err
@@ -115,7 +164,7 @@ func (s *Store) DeleteUser(username string) error {

 // ListUsers returns all users ordered by username.
 func (s *Store) ListUsers() ([]User, error) {
-	rows, err := s.db.Query(`SELECT id, username, can_upload FROM users ORDER BY username`)
+	rows, err := s.db.Query(`SELECT id, username, role FROM users ORDER BY username`)
 	if err != nil {
 		return nil, err
 	}
@@ -124,25 +173,25 @@ func (s *Store) ListUsers() ([]User, error) {
 	var users []User
 	for rows.Next() {
 		var u User
-		var up int
-		if err := rows.Scan(&u.ID, &u.Username, &up); err != nil {
+		var roleStr string
+		if err := rows.Scan(&u.ID, &u.Username, &roleStr); err != nil {
 			return nil, err
 		}
-		u.CanUpload = up != 0
+		u.Role = Role(roleStr)
 		users = append(users, u)
 	}
 	return users, rows.Err()
 }

-// Authenticate verifies credentials and returns the matching user.
+// Authenticate verifies credentials and returns the matching user, or nil on
+// wrong username/password.
 func (s *Store) Authenticate(username, password string) (*User, error) {
 	var u User
-	var hash string
-	var up int
+	var hash, roleStr string
 	err := s.db.QueryRow(
-		`SELECT id, username, password_hash, can_upload FROM users WHERE username = ?`,
+		`SELECT id, username, password_hash, role FROM users WHERE username = ?`,
 		username,
-	).Scan(&u.ID, &u.Username, &hash, &up)
+	).Scan(&u.ID, &u.Username, &hash, &roleStr)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, nil
 	}
@@ -152,7 +201,7 @@ func (s *Store) Authenticate(username, password string) (*User, error) {
 	if bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
 		return nil, nil
 	}
-	u.CanUpload = up != 0
+	u.Role = Role(roleStr)
 	return &u, nil
 }

@@ -163,32 +212,31 @@ func (s *Store) CreateSession(u *User) (*Session, error) {
 		return nil, err
 	}
 	exp := time.Now().Add(30 * 24 * time.Hour)
-	_, err = s.db.Exec(
+	if _, err = s.db.Exec(
 		`INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)`,
 		token, u.ID, exp.Unix(),
-	)
-	if err != nil {
+	); err != nil {
 		return nil, err
 	}
 	return &Session{
 		Token:     token,
 		UserID:    u.ID,
 		Username:  u.Username,
-		CanUpload: u.CanUpload,
+		Role:      u.Role,
 		ExpiresAt: exp,
 	}, nil
 }

-// LookupSession returns the session if valid, nil if not found/expired.
+// LookupSession returns the session if valid, nil if not found or expired.
 func (s *Store) LookupSession(token string) (*Session, error) {
 	var sess Session
-	var up int
+	var roleStr string
 	var expUnix int64
 	err := s.db.QueryRow(`
-		SELECT s.token, s.user_id, u.username, u.can_upload, s.expires_at
+		SELECT s.token, s.user_id, u.username, u.role, s.expires_at
 		FROM sessions s JOIN users u ON u.id = s.user_id
 		WHERE s.token = ?
-	`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &up, &expUnix)
+	`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &roleStr, &expUnix)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, nil
 	}
@@ -200,7 +248,7 @@ func (s *Store) LookupSession(token string) (*Session, error) {
 		_, _ = s.db.Exec(`DELETE FROM sessions WHERE token = ?`, token)
 		return nil, nil
 	}
-	sess.CanUpload = up != 0
+	sess.Role = Role(roleStr)
 	return &sess, nil
 }

@@ -218,26 +266,6 @@ func randomToken() (string, error) {
 	return hex.EncodeToString(b), nil
 }

-func boolToInt(b bool) int {
-	if b {
-		return 1
-	}
-	return 0
-}
-
 func isUnique(err error) bool {
-	return err != nil && (contains(err.Error(), "UNIQUE") || contains(err.Error(), "unique"))
-}
-
-func contains(s, sub string) bool {
-	return len(s) >= len(sub) && (s == sub || len(s) > 0 && containsStr(s, sub))
-}
-
-func containsStr(s, sub string) bool {
-	for i := 0; i+len(sub) <= len(s); i++ {
-		if s[i:i+len(sub)] == sub {
-			return true
-		}
-	}
-	return false
+	return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
 }