refactor: replace can_upload boolean with role-based access control

Introduces a three-tier role hierarchy: reader < uploader < admin.

- internal/users/role.go: Role type, roleLevel map, AtLeast(min),
  ParseRole() — new roles added by inserting into roleLevel only
- internal/users/store.go: versioned migrations via _schema_version table;
  v2 migration adds 'role' column and migrates existing can_upload data;
  SetRole() replaces SetUpload(); Session carries Role instead of CanUpload
- internal/web/middleware.go: generic requireRole(minRole) middleware
  replaces the ad-hoc requireUpload
- internal/web/handlers.go: upload routes use requireRole(RoleUploader);
  listBooks derives canUpload from sess.Role.AtLeast(RoleUploader)
- cmd/admin/main.go: user add --role <reader|uploader|admin>,
  user set-role replaces user set-upload
- README, copilot-instructions updated

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/copilot-instructions.md

@@ -22,10 +22,10 @@ go run ./cmd/server          # run dev server on :8080
 ## Admin CLI
 
 ```bash
-go run ./cmd/admin user add <name> [--upload]   # Benutzer anlegen
-go run ./cmd/admin user list                     # alle Benutzer
-go run ./cmd/admin user delete <name>            # löschen
-go run ./cmd/admin user set-upload <name> <true|false>
+go run ./cmd/admin user add <name> [--role reader|uploader|admin]  # Standard: reader
+go run ./cmd/admin user list
+go run ./cmd/admin user delete <name>
+go run ./cmd/admin user set-role <name> <reader|uploader|admin>
 ```
 
 ## Architecture
@@ -33,11 +33,23 @@ go run ./cmd/admin user set-upload <name> <true|false>
 - `cmd/server/main.go` — entrypoint; wires `library.Service`, `users.Store` and
   `web.Handler` together and starts the HTTP server.
 - `internal/library` — core domain logic, no HTTP dependency (unchanged).
-- `internal/users/store.go` — SQLite-backed user store (`modernc.org/sqlite`,
-  pure Go driver). Tables: `users` (id, username, password_hash bcrypt,
-  can_upload), `sessions` (token, user_id FK, expires_at unix timestamp).
-  Sessions TTL = 30 days. Key methods: `Authenticate`, `CreateSession`,
-  `LookupSession`, `DeleteSession`, `CreateUser`, `SetUpload`, `DeleteUser`, `ListUsers`.
+- `internal/users/role.go` — `Role` type (`reader`, `uploader`, `admin`),
+  `roleLevel` map für Hierarchie, `AtLeast(min Role)`, `ParseRole(s)`.
+  Neue Rollen: in `roleLevel` eintragen und ggf. Routen anpassen — kein
+  Schema-Change nötig.
+- `internal/users/store.go` — SQLite-backed user store. Migrations via
+  `_schema_version`-Tabelle (geordnete `migrations [][]string`); neue
+  Migrationen am Ende anhängen. `role TEXT` statt `can_upload INTEGER`.
+- `internal/web/middleware.go` — `requireRole(minRole users.Role)` ist die
+  zentrale Middleware; `requireAuth` ist ein Spezialfall davon (implizit
+  `RoleReader`).
+- Auth: `/login` und `/static/` sind die einzigen öffentlichen Routes.
+  Upload-Routes verwenden `requireRole(RoleUploader)`.
+
+**Rollen-Hierarchie:**
+```
+reader (0) < uploader (1) < admin (2)
+```
 - `cmd/admin/main.go` — CLI binary for user management; reads `USERS_DB` env var.
 - `internal/web/handlers.go` — HTTP handlers including `loginPage`,
   `loginSubmit`, `logout`, `uploadPage`, `uploadSubmit`.

README.md

@@ -65,11 +65,13 @@ Alternativ können Benutzer mit Upload-Recht Bücher direkt im Browser hochladen
 
 ## Benutzerverwaltung (CLI)
 
+Rollen (aufsteigend): `reader` → `uploader` → `admin`
+
 ```bash
+go run ./cmd/admin user add <name> [--role reader|uploader|admin]
 go run ./cmd/admin user list
-go run ./cmd/admin user add <name> [--upload]
 go run ./cmd/admin user delete <name>
-go run ./cmd/admin user set-upload <name> <true|false>
+go run ./cmd/admin user set-role <name> <reader|uploader|admin>
 ```
 
 ## Konfiguration

cmd/admin/main.go

@@ -3,7 +3,6 @@ package main
 import (
 	"fmt"
 	"os"
-	"strconv"
 	"strings"
 	"syscall"
 
@@ -40,10 +39,20 @@ func handleUser(store *users.Store, action string, args []string) {
 	switch action {
 	case "add":
 		if len(args) < 1 {
-			fatalf("usage: user add <username> [--upload]\n")
+			fatalf("usage: user add <username> [--role reader|uploader|admin]\n")
 		}
 		username := args[0]
-		canUpload := len(args) > 1 && args[1] == "--upload"
+		role := users.RoleReader
+		if len(args) > 1 && args[1] == "--role" {
+			if len(args) < 3 {
+				fatalf("--role erwartet einen Wert: reader, uploader oder admin\n")
+			}
+			r, err := users.ParseRole(args[2])
+			if err != nil {
+				fatalf("%v\n", err)
+			}
+			role = r
+		}
 
 		password, err := readPassword(fmt.Sprintf("Passwort für '%s': ", username))
 		if err != nil {
@@ -57,11 +66,11 @@ func handleUser(store *users.Store, action string, args []string) {
 			fatalf("Passwörter stimmen nicht überein.\n")
 		}
 
-		u, err := store.CreateUser(username, password, canUpload)
+		u, err := store.CreateUser(username, password, role)
 		if err != nil {
 			fatalf("user anlegen: %v\n", err)
 		}
-		fmt.Printf("✓ Benutzer '%s' angelegt (upload: %s)\n", u.Username, yesNo(u.CanUpload))
+		fmt.Printf("✓ Benutzer '%s' angelegt (rolle: %s)\n", u.Username, u.Role)
 
 	case "list":
 		list, err := store.ListUsers()
@@ -72,10 +81,10 @@ func handleUser(store *users.Store, action string, args []string) {
 			fmt.Println("Keine Benutzer vorhanden.")
 			return
 		}
-		fmt.Printf("%-20s  %s\n", "BENUTZERNAME", "UPLOAD")
+		fmt.Printf("%-20s  %s\n", "BENUTZERNAME", "ROLLE")
 		fmt.Println(strings.Repeat("-", 32))
 		for _, u := range list {
-			fmt.Printf("%-20s  %s\n", u.Username, yesNo(u.CanUpload))
+			fmt.Printf("%-20s  %s\n", u.Username, u.Role)
 		}
 
 	case "delete":
@@ -87,18 +96,18 @@ func handleUser(store *users.Store, action string, args []string) {
 		}
 		fmt.Printf("✓ Benutzer '%s' gelöscht.\n", args[0])
 
-	case "set-upload":
+	case "set-role":
 		if len(args) < 2 {
-			fatalf("usage: user set-upload <username> <true|false>\n")
+			fatalf("usage: user set-role <username> <reader|uploader|admin>\n")
 		}
-		val, err := strconv.ParseBool(args[1])
+		role, err := users.ParseRole(args[1])
 		if err != nil {
-			fatalf("ungültiger Wert '%s', erwartet true oder false\n", args[1])
+			fatalf("%v\n", err)
 		}
-		if err := store.SetUpload(args[0], val); err != nil {
-			fatalf("upload-recht setzen: %v\n", err)
+		if err := store.SetRole(args[0], role); err != nil {
+			fatalf("rolle setzen: %v\n", err)
 		}
-		fmt.Printf("✓ Upload-Recht für '%s' auf %s gesetzt.\n", args[0], yesNo(val))
+		fmt.Printf("✓ Rolle für '%s' auf '%s' gesetzt.\n", args[0], role)
 
 	default:
 		usage()
@@ -116,13 +125,6 @@ func readPassword(prompt string) (string, error) {
 	return string(b), nil
 }
 
-func yesNo(b bool) string {
-	if b {
-		return "ja"
-	}
-	return "nein"
-}
-
 func getenv(key, fallback string) string {
 	if v := os.Getenv(key); v != "" {
 		return v
@@ -138,11 +140,16 @@ func fatalf(format string, args ...any) {
 func usage() {
 	fmt.Fprintln(os.Stderr, `ebooks-admin – Benutzerverwaltung
 
+Rollen (aufsteigend):
+  reader    Lesen und Herunterladen
+  uploader  Zusätzlich: Bücher hochladen
+  admin     Alle Rechte
+
 Befehle:
-  user add <name> [--upload]          Benutzer anlegen (optional: Upload-Recht)
-  user list                           Alle Benutzer auflisten
-  user delete <name>                  Benutzer löschen
-  user set-upload <name> <true|false> Upload-Recht ändern
+  user add <name> [--role reader|uploader|admin]   Benutzer anlegen (Standard: reader)
+  user list                                         Alle Benutzer auflisten
+  user delete <name>                                Benutzer löschen
+  user set-role <name> <reader|uploader|admin>      Rolle ändern
 
 Umgebungsvariablen:
   USERS_DB  Pfad zur SQLite-Datenbank (Standard: users.db)`)

internal/users/role.go

@@ -0,0 +1,43 @@
+package users
+
+import "fmt"
+
+// Role represents a user's access level. Roles are ordered hierarchically:
+// RoleReader < RoleUploader < RoleAdmin.
+// New roles can be inserted into roleLevel without changing existing code.
+type Role string
+
+const (
+	RoleReader   Role = "reader"
+	RoleUploader Role = "uploader"
+	RoleAdmin    Role = "admin"
+)
+
+// roleLevel defines the hierarchy. Higher = more permissions.
+var roleLevel = map[Role]int{
+	RoleReader:   0,
+	RoleUploader: 1,
+	RoleAdmin:    2,
+}
+
+// AtLeast reports whether r has at least the same privilege level as min.
+func (r Role) AtLeast(min Role) bool {
+	return roleLevel[r] >= roleLevel[min]
+}
+
+// IsValid reports whether r is a known role.
+func (r Role) IsValid() bool {
+	_, ok := roleLevel[r]
+	return ok
+}
+
+func (r Role) String() string { return string(r) }
+
+// ParseRole parses a role string. Returns an error for unknown values.
+func ParseRole(s string) (Role, error) {
+	r := Role(s)
+	if !r.IsValid() {
+		return "", fmt.Errorf("unbekannte Rolle %q, gültig: reader, uploader, admin", s)
+	}
+	return r, nil
+}

internal/users/store.go

@@ -6,26 +6,27 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
-	_ "modernc.org/sqlite"
 	"golang.org/x/crypto/bcrypt"
+	_ "modernc.org/sqlite"
 )
 
 var ErrNotFound = errors.New("user not found")
 var ErrUserExists = errors.New("user already exists")
 
 type User struct {
-	ID        int64
-	Username  string
-	CanUpload bool
+	ID       int64
+	Username string
+	Role     Role
 }
 
 type Session struct {
 	Token     string
 	UserID    int64
 	Username  string
-	CanUpload bool
+	Role      Role
 	ExpiresAt time.Time
 }
 
@@ -49,32 +50,80 @@ func Open(path string) (*Store, error) {
 
 func (s *Store) Close() error { return s.db.Close() }
 
-func (s *Store) migrate() error {
-	_, err := s.db.Exec(`
-		CREATE TABLE IF NOT EXISTS users (
+// migrations is an ordered list of schema changes. Each entry is a slice of
+// SQL statements to execute in a transaction. Add new entries at the end only.
+var migrations = [][]string{
+	// v1: initial schema
+	{
+		`CREATE TABLE IF NOT EXISTS users (
 			id            INTEGER PRIMARY KEY AUTOINCREMENT,
 			username      TEXT    NOT NULL UNIQUE,
 			password_hash TEXT    NOT NULL,
 			can_upload    INTEGER NOT NULL DEFAULT 0
-		);
-		CREATE TABLE IF NOT EXISTS sessions (
+		)`,
+		`CREATE TABLE IF NOT EXISTS sessions (
 			token      TEXT    PRIMARY KEY,
 			user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
 			expires_at INTEGER NOT NULL
-		);
-	`)
-	return err
+		)`,
+	},
+	// v2: replace can_upload with role column; migrate existing data
+	{
+		`ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'reader'`,
+		`UPDATE users SET role = CASE WHEN can_upload = 1 THEN 'uploader' ELSE 'reader' END`,
+	},
 }
 
-// CreateUser adds a new user. Returns ErrUserExists if the username is taken.
-func (s *Store) CreateUser(username, password string, canUpload bool) (*User, error) {
+func (s *Store) migrate() error {
+	if _, err := s.db.Exec(
+		`CREATE TABLE IF NOT EXISTS _schema_version (version INTEGER NOT NULL)`,
+	); err != nil {
+		return err
+	}
+
+	var version int
+	if err := s.db.QueryRow(
+		`SELECT COALESCE(MAX(version), 0) FROM _schema_version`,
+	).Scan(&version); err != nil {
+		return err
+	}
+
+	for i, stmts := range migrations {
+		v := i + 1
+		if v <= version {
+			continue
+		}
+		tx, err := s.db.Begin()
+		if err != nil {
+			return err
+		}
+		for _, stmt := range stmts {
+			if _, err := tx.Exec(stmt); err != nil {
+				_ = tx.Rollback()
+				return fmt.Errorf("migration %d: %w", v, err)
+			}
+		}
+		if _, err := tx.Exec(`INSERT INTO _schema_version (version) VALUES (?)`, v); err != nil {
+			_ = tx.Rollback()
+			return err
+		}
+		if err := tx.Commit(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// CreateUser adds a new user with the given role. Returns ErrUserExists if the
+// username is already taken.
+func (s *Store) CreateUser(username, password string, role Role) (*User, error) {
 	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
 		return nil, err
 	}
 	res, err := s.db.Exec(
-		`INSERT INTO users (username, password_hash, can_upload) VALUES (?, ?, ?)`,
-		username, string(hash), boolToInt(canUpload),
+		`INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)`,
+		username, string(hash), role,
 	)
 	if err != nil {
 		if isUnique(err) {
@@ -83,14 +132,14 @@ func (s *Store) CreateUser(username, password string, canUpload bool) (*User, er
 		return nil, err
 	}
 	id, _ := res.LastInsertId()
-	return &User{ID: id, Username: username, CanUpload: canUpload}, nil
+	return &User{ID: id, Username: username, Role: role}, nil
 }
 
-// SetUpload changes the upload permission of an existing user.
-func (s *Store) SetUpload(username string, canUpload bool) error {
+// SetRole changes the role of an existing user.
+func (s *Store) SetRole(username string, role Role) error {
 	res, err := s.db.Exec(
-		`UPDATE users SET can_upload = ? WHERE username = ?`,
-		boolToInt(canUpload), username,
+		`UPDATE users SET role = ? WHERE username = ?`,
+		role, username,
 	)
 	if err != nil {
 		return err
@@ -115,7 +164,7 @@ func (s *Store) DeleteUser(username string) error {
 
 // ListUsers returns all users ordered by username.
 func (s *Store) ListUsers() ([]User, error) {
-	rows, err := s.db.Query(`SELECT id, username, can_upload FROM users ORDER BY username`)
+	rows, err := s.db.Query(`SELECT id, username, role FROM users ORDER BY username`)
 	if err != nil {
 		return nil, err
 	}
@@ -124,25 +173,25 @@ func (s *Store) ListUsers() ([]User, error) {
 	var users []User
 	for rows.Next() {
 		var u User
-		var up int
-		if err := rows.Scan(&u.ID, &u.Username, &up); err != nil {
+		var roleStr string
+		if err := rows.Scan(&u.ID, &u.Username, &roleStr); err != nil {
 			return nil, err
 		}
-		u.CanUpload = up != 0
+		u.Role = Role(roleStr)
 		users = append(users, u)
 	}
 	return users, rows.Err()
 }
 
-// Authenticate verifies credentials and returns the matching user.
+// Authenticate verifies credentials and returns the matching user, or nil on
+// wrong username/password.
 func (s *Store) Authenticate(username, password string) (*User, error) {
 	var u User
-	var hash string
-	var up int
+	var hash, roleStr string
 	err := s.db.QueryRow(
-		`SELECT id, username, password_hash, can_upload FROM users WHERE username = ?`,
+		`SELECT id, username, password_hash, role FROM users WHERE username = ?`,
 		username,
-	).Scan(&u.ID, &u.Username, &hash, &up)
+	).Scan(&u.ID, &u.Username, &hash, &roleStr)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, nil
 	}
@@ -152,7 +201,7 @@ func (s *Store) Authenticate(username, password string) (*User, error) {
 	if bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
 		return nil, nil
 	}
-	u.CanUpload = up != 0
+	u.Role = Role(roleStr)
 	return &u, nil
 }
 
@@ -163,32 +212,31 @@ func (s *Store) CreateSession(u *User) (*Session, error) {
 		return nil, err
 	}
 	exp := time.Now().Add(30 * 24 * time.Hour)
-	_, err = s.db.Exec(
+	if _, err = s.db.Exec(
 		`INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)`,
 		token, u.ID, exp.Unix(),
-	)
-	if err != nil {
+	); err != nil {
 		return nil, err
 	}
 	return &Session{
 		Token:     token,
 		UserID:    u.ID,
 		Username:  u.Username,
-		CanUpload: u.CanUpload,
+		Role:      u.Role,
 		ExpiresAt: exp,
 	}, nil
 }
 
-// LookupSession returns the session if valid, nil if not found/expired.
+// LookupSession returns the session if valid, nil if not found or expired.
 func (s *Store) LookupSession(token string) (*Session, error) {
 	var sess Session
-	var up int
+	var roleStr string
 	var expUnix int64
 	err := s.db.QueryRow(`
-		SELECT s.token, s.user_id, u.username, u.can_upload, s.expires_at
+		SELECT s.token, s.user_id, u.username, u.role, s.expires_at
 		FROM sessions s JOIN users u ON u.id = s.user_id
 		WHERE s.token = ?
-	`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &up, &expUnix)
+	`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &roleStr, &expUnix)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, nil
 	}
@@ -200,7 +248,7 @@ func (s *Store) LookupSession(token string) (*Session, error) {
 		_, _ = s.db.Exec(`DELETE FROM sessions WHERE token = ?`, token)
 		return nil, nil
 	}
-	sess.CanUpload = up != 0
+	sess.Role = Role(roleStr)
 	return &sess, nil
 }
 
@@ -218,26 +266,6 @@ func randomToken() (string, error) {
 	return hex.EncodeToString(b), nil
 }
 
-func boolToInt(b bool) int {
-	if b {
-		return 1
-	}
-	return 0
-}
-
 func isUnique(err error) bool {
-	return err != nil && (contains(err.Error(), "UNIQUE") || contains(err.Error(), "unique"))
-}
-
-func contains(s, sub string) bool {
-	return len(s) >= len(sub) && (s == sub || len(s) > 0 && containsStr(s, sub))
-}
-
-func containsStr(s, sub string) bool {
-	for i := 0; i+len(sub) <= len(s); i++ {
-		if s[i:i+len(sub)] == sub {
-			return true
-		}
-	}
-	return false
+	return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
 }

internal/web/handlers.go

@@ -34,15 +34,15 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("POST /logout", h.logout)
 	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
 
-	// Authenticated
+	// Authenticated (any role)
 	mux.HandleFunc("GET /", h.requireAuth(h.listBooks))
 	mux.HandleFunc("GET /book/{id}", h.requireAuth(h.bookDetails))
 	mux.HandleFunc("GET /download/{id}", h.requireAuth(h.downloadBook))
 	mux.HandleFunc("GET /cover/{id}", h.requireAuth(h.bookCover))
 
-	// Upload (authenticated + can_upload)
-	mux.HandleFunc("GET /upload", h.requireUpload(h.uploadPage))
-	mux.HandleFunc("POST /upload", h.requireUpload(h.uploadSubmit))
+	// Uploader and above
+	mux.HandleFunc("GET /upload", h.requireRole(users.RoleUploader, h.uploadPage))
+	mux.HandleFunc("POST /upload", h.requireRole(users.RoleUploader, h.uploadSubmit))
 }
 
 func (h *Handler) listBooks(w http.ResponseWriter, r *http.Request) {
@@ -52,7 +52,7 @@ func (h *Handler) listBooks(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	sess := sessionFrom(r)
-	canUpload := sess != nil && sess.CanUpload
+	canUpload := sess != nil && sess.Role.AtLeast(users.RoleUploader)
 	render(w, r.Context(), views.IndexPage(books, canUpload))
 }
 

internal/web/middleware.go

@@ -17,7 +17,7 @@ func sessionFrom(r *http.Request) *users.Session {
 	return s
 }
 
-// requireAuth is middleware that redirects unauthenticated requests to /login.
+// requireAuth redirects unauthenticated requests to /login.
 func (h *Handler) requireAuth(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		sess, err := h.sessionFromRequest(r)
@@ -30,11 +30,13 @@ func (h *Handler) requireAuth(next http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
-// requireUpload is middleware that returns 403 if the user lacks upload permission.
-func (h *Handler) requireUpload(next http.HandlerFunc) http.HandlerFunc {
+// requireRole returns middleware that allows access only to users whose role is
+// at least minRole. Unknown sessions are redirected to /login; insufficient
+// role yields 403.
+func (h *Handler) requireRole(minRole users.Role, next http.HandlerFunc) http.HandlerFunc {
 	return h.requireAuth(func(w http.ResponseWriter, r *http.Request) {
 		sess := sessionFrom(r)
-		if !sess.CanUpload {
+		if !sess.Role.AtLeast(minRole) {
 			http.Error(w, "Keine Berechtigung", http.StatusForbidden)
 			return
 		}