arnef/ebooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: replace can_upload boolean with role-based access control

Browse Source 
Introduces a three-tier role hierarchy: reader < uploader < admin.

- internal/users/role.go: Role type, roleLevel map, AtLeast(min),
  ParseRole() — new roles added by inserting into roleLevel only
- internal/users/store.go: versioned migrations via _schema_version table;
  v2 migration adds 'role' column and migrates existing can_upload data;
  SetRole() replaces SetUpload(); Session carries Role instead of CanUpload
- internal/web/middleware.go: generic requireRole(minRole) middleware
  replaces the ad-hoc requireUpload
- internal/web/handlers.go: upload routes use requireRole(RoleUploader);
  listBooks derives canUpload from sess.Role.AtLeast(RoleUploader)
- cmd/admin/main.go: user add --role <reader|uploader|admin>,
  user set-role replaces user set-upload
- README, copilot-instructions updated

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
arnef
2026-08-11 19:43:39 +02:00
co-authored by Copilot
parent a66c370de4
commit 817763887a
7 changed files with 201 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/users/store.go
+90 -62
View File
@@ -6,26 +6,27 @@ import (
"encoding/hex"
"errors"
"fmt"
"strings"
"time"
_ "modernc.org/sqlite"
"golang.org/x/crypto/bcrypt"
_ "modernc.org/sqlite"
)
var ErrNotFound = errors.New("user not found")
var ErrUserExists = errors.New("user already exists")
type User struct {
ID int64
Username string
CanUpload bool
ID int64
Username string
Role Role
}
type Session struct {
Token string
UserID int64
Username string
CanUpload bool
Role Role
ExpiresAt time.Time
}
@@ -49,32 +50,80 @@ func Open(path string) (*Store, error) {
func (s *Store) Close() error { return s.db.Close() }
func (s *Store) migrate() error {
_, err := s.db.Exec(`
CREATE TABLE IF NOT EXISTS users (
// migrations is an ordered list of schema changes. Each entry is a slice of
// SQL statements to execute in a transaction. Add new entries at the end only.
var migrations = [][]string{
// v1: initial schema
{
`CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT NOT NULL UNIQUE,
password_hash TEXT NOT NULL,
can_upload INTEGER NOT NULL DEFAULT 0
);
CREATE TABLE IF NOT EXISTS sessions (
)`,
`CREATE TABLE IF NOT EXISTS sessions (
token TEXT PRIMARY KEY,
user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
expires_at INTEGER NOT NULL
);
`)
return err
)`,
},
// v2: replace can_upload with role column; migrate existing data
{
`ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'reader'`,
`UPDATE users SET role = CASE WHEN can_upload = 1 THEN 'uploader' ELSE 'reader' END`,
},
}
// CreateUser adds a new user. Returns ErrUserExists if the username is taken.
func (s *Store) CreateUser(username, password string, canUpload bool) (*User, error) {
func (s *Store) migrate() error {
if _, err := s.db.Exec(
`CREATE TABLE IF NOT EXISTS _schema_version (version INTEGER NOT NULL)`,
); err != nil {
return err
}
var version int
if err := s.db.QueryRow(
`SELECT COALESCE(MAX(version), 0) FROM _schema_version`,
).Scan(&version); err != nil {
return err
}
for i, stmts := range migrations {
v := i + 1
if v <= version {
continue
}
tx, err := s.db.Begin()
if err != nil {
return err
}
for _, stmt := range stmts {
if _, err := tx.Exec(stmt); err != nil {
_ = tx.Rollback()
return fmt.Errorf("migration %d: %w", v, err)
}
}
if _, err := tx.Exec(`INSERT INTO _schema_version (version) VALUES (?)`, v); err != nil {
_ = tx.Rollback()
return err
}
if err := tx.Commit(); err != nil {
return err
}
}
return nil
}
// CreateUser adds a new user with the given role. Returns ErrUserExists if the
// username is already taken.
func (s *Store) CreateUser(username, password string, role Role) (*User, error) {
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
if err != nil {
return nil, err
}
res, err := s.db.Exec(
`INSERT INTO users (username, password_hash, can_upload) VALUES (?, ?, ?)`,
username, string(hash), boolToInt(canUpload),
`INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)`,
username, string(hash), role,
)
if err != nil {
if isUnique(err) {
@@ -83,14 +132,14 @@ func (s *Store) CreateUser(username, password string, canUpload bool) (*User, er
return nil, err
}
id, _ := res.LastInsertId()
return &User{ID: id, Username: username, CanUpload: canUpload}, nil
return &User{ID: id, Username: username, Role: role}, nil
}
// SetUpload changes the upload permission of an existing user.
func (s *Store) SetUpload(username string, canUpload bool) error {
// SetRole changes the role of an existing user.
func (s *Store) SetRole(username string, role Role) error {
res, err := s.db.Exec(
`UPDATE users SET can_upload = ? WHERE username = ?`,
boolToInt(canUpload), username,
`UPDATE users SET role = ? WHERE username = ?`,
role, username,
)
if err != nil {
return err
@@ -115,7 +164,7 @@ func (s *Store) DeleteUser(username string) error {
// ListUsers returns all users ordered by username.
func (s *Store) ListUsers() ([]User, error) {
rows, err := s.db.Query(`SELECT id, username, can_upload FROM users ORDER BY username`)
rows, err := s.db.Query(`SELECT id, username, role FROM users ORDER BY username`)
if err != nil {
return nil, err
}
@@ -124,25 +173,25 @@ func (s *Store) ListUsers() ([]User, error) {
var users []User
for rows.Next() {
var u User
var up int
if err := rows.Scan(&u.ID, &u.Username, &up); err != nil {
var roleStr string
if err := rows.Scan(&u.ID, &u.Username, &roleStr); err != nil {
return nil, err
}
u.CanUpload = up != 0
u.Role = Role(roleStr)
users = append(users, u)
}
return users, rows.Err()
}
// Authenticate verifies credentials and returns the matching user.
// Authenticate verifies credentials and returns the matching user, or nil on
// wrong username/password.
func (s *Store) Authenticate(username, password string) (*User, error) {
var u User
var hash string
var up int
var hash, roleStr string
err := s.db.QueryRow(
`SELECT id, username, password_hash, can_upload FROM users WHERE username = ?`,
`SELECT id, username, password_hash, role FROM users WHERE username = ?`,
username,
).Scan(&u.ID, &u.Username, &hash, &up)
).Scan(&u.ID, &u.Username, &hash, &roleStr)
if errors.Is(err, sql.ErrNoRows) {
return nil, nil
}
@@ -152,7 +201,7 @@ func (s *Store) Authenticate(username, password string) (*User, error) {
if bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
return nil, nil
}
u.CanUpload = up != 0
u.Role = Role(roleStr)
return &u, nil
}
@@ -163,32 +212,31 @@ func (s *Store) CreateSession(u *User) (*Session, error) {
return nil, err
}
exp := time.Now().Add(30 * 24 * time.Hour)
_, err = s.db.Exec(
if _, err = s.db.Exec(
`INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)`,
token, u.ID, exp.Unix(),
)
if err != nil {
); err != nil {
return nil, err
}
return &Session{
Token: token,
UserID: u.ID,
Username: u.Username,
CanUpload: u.CanUpload,
Role: u.Role,
ExpiresAt: exp,
}, nil
}
// LookupSession returns the session if valid, nil if not found/expired.
// LookupSession returns the session if valid, nil if not found or expired.
func (s *Store) LookupSession(token string) (*Session, error) {
var sess Session
var up int
var roleStr string
var expUnix int64
err := s.db.QueryRow(`
SELECT s.token, s.user_id, u.username, u.can_upload, s.expires_at
SELECT s.token, s.user_id, u.username, u.role, s.expires_at
FROM sessions s JOIN users u ON u.id = s.user_id
WHERE s.token = ?
`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &up, &expUnix)
`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &roleStr, &expUnix)
if errors.Is(err, sql.ErrNoRows) {
return nil, nil
}
@@ -200,7 +248,7 @@ func (s *Store) LookupSession(token string) (*Session, error) {
_, _ = s.db.Exec(`DELETE FROM sessions WHERE token = ?`, token)
return nil, nil
}
sess.CanUpload = up != 0
sess.Role = Role(roleStr)
return &sess, nil
}
@@ -218,26 +266,6 @@ func randomToken() (string, error) {
return hex.EncodeToString(b), nil
}
func boolToInt(b bool) int {
if b {
return 1
}
return 0
}
func isUnique(err error) bool {
return err != nil && (contains(err.Error(), "UNIQUE") || contains(err.Error(), "unique"))
}
func contains(s, sub string) bool {
return len(s) >= len(sub) && (s == sub || len(s) > 0 && containsStr(s, sub))
}
func containsStr(s, sub string) bool {
for i := 0; i+len(sub) <= len(s); i++ {
if s[i:i+len(sub)] == sub {
return true
}
}
return false
return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
}