arnef/nidus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 3 Activity

Move users, calendars, and address books from config.yaml into the database

Browse Source 
BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
  nidusctl user create <username>
  nidusctl calendar create <username> <name>
  nidusctl addressbook create <username> <name>

- internal/db: new users, calendars, addressbooks tables with FK cascade
  delete; foreign_keys pragma enabled; internal/db/users.go implements
  full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
  CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
  cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
  Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
  create/delete handlers for calendars/address books at
  /web/resources/{calendar,addressbook}; dashboard gained create forms
  and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
  interactive password prompt via golang.org/x/term) plus create/delete/
  list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
  startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
  new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
  new nidusctl commands and the DB-backed architecture.

Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
arnef
2026-08-19 12:43:34 +02:00
co-authored by Copilot
parent 3dc49b6b22
commit 7d4f28de3c
25 changed files with 1440 additions and 365 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/nidusctl/main.go
+152 -27
View File
@@ -1,10 +1,10 @@
// Command nidusctl is a small administrative CLI for the nidus DAV
// server. It currently manages calendar and address-book sharing grants
// stored in the SQLite database at <data_dir>/nidus.db; it doesn't talk
// to a running server, so the server should be restarted (or, in the
// future, will pick up changes automatically) after granting/revoking
// shares — the caldav/carddav backends read shares on every request, so
// no cache invalidation is needed, only an already-open DB connection.
// server. It manages user accounts, calendars, address books, and
// calendar/address-book sharing grants, all stored in the SQLite
// database at <data_dir>/nidus.db; it doesn't talk to a running server,
// so the server should be restarted after adding/removing users or
// resources so it picks up the change (every request re-reads from the
// database, so no cache invalidation is needed beyond that).
package main
import (
@@ -15,6 +15,7 @@ import (
"github.com/yourusername/caldav-server/internal/config"
"github.com/yourusername/caldav-server/internal/db"
"github.com/yourusername/caldav-server/internal/store"
)
func main() {
@@ -47,11 +48,19 @@ func run(args []string) int {
}
defer dbase.Close()
st, err := store.NewStore(cfg.Storage.DataDir)
if err != nil {
fmt.Fprintf(os.Stderr, "error opening store %q: %v\n", cfg.Storage.DataDir, err)
return 1
}
switch rest[0] {
case "user":
return runUser(dbase, rest[1:])
case "calendar", "cal":
return runCalendar(cfg, dbase, rest[1:])
return runCalendar(dbase, st, rest[1:])
case "addressbook", "card":
return runAddressBook(cfg, dbase, rest[1:])
return runAddressBook(dbase, st, rest[1:])
case "help", "-h", "--help":
usage()
return 0
@@ -63,39 +72,98 @@ func run(args []string) int {
}
func usage() {
fmt.Fprint(os.Stderr, `nidusctl - manage nidus DAV server sharing grants
fmt.Fprint(os.Stderr, `nidusctl - manage nidus DAV server users, resources, and sharing grants
Usage:
nidusctl [-config config.yaml] user create <username> [--display-name NAME] [--email EMAIL] [--password PW]
nidusctl [-config config.yaml] user delete <username>
nidusctl [-config config.yaml] user list
nidusctl [-config config.yaml] user passwd <username> [--password PW]
nidusctl [-config config.yaml] calendar create <owner> <calendar>
nidusctl [-config config.yaml] calendar delete <owner> <calendar>
nidusctl [-config config.yaml] calendar list <owner>
nidusctl [-config config.yaml] calendar share <owner> <calendar> <user> <read|write>
nidusctl [-config config.yaml] calendar unshare <owner> <calendar> <user>
nidusctl [-config config.yaml] calendar shares <owner> <calendar>
nidusctl [-config config.yaml] addressbook share <owner> <book> <user> <read|write>
nidusctl [-config config.yaml] calendar unshare <owner> <calendar> <user>
nidusctl [-config config.yaml] calendar shares <owner> <calendar>
nidusctl [-config config.yaml] addressbook create <owner> <book>
nidusctl [-config config.yaml] addressbook delete <owner> <book>
nidusctl [-config config.yaml] addressbook list <owner>
nidusctl [-config config.yaml] addressbook share <owner> <book> <user> <read|write>
nidusctl [-config config.yaml] addressbook unshare <owner> <book> <user>
nidusctl [-config config.yaml] addressbook shares <owner> <book>
nidusctl [-config config.yaml] addressbook shares <owner> <book>
Examples:
nidusctl user create alice --display-name "Alice Smith" --email alice@example.com
nidusctl calendar create alice work
nidusctl calendar share alice work bob write
nidusctl calendar shares alice work
nidusctl calendar unshare alice work bob
`)
}
// userExists reports whether username is a configured user, printing a
// warning (not a hard error) if not — the share is still recorded, since
// config.yaml and the share database are independent sources of truth and
// a user added after the fact shouldn't require re-running share commands.
func warnIfUnknownUser(cfg *config.Config, username string) {
if _, ok := cfg.Users[username]; !ok {
fmt.Fprintf(os.Stderr, "warning: %q is not a user in config.yaml (continuing anyway)\n", username)
}
// newFlagSet creates a flag.FlagSet configured for subcommand parsing
// (flags may appear before or after positional args, since callers parse
// flags first with fs.Parse then read fs.Args() for the rest).
func newFlagSet(name string) *flag.FlagSet {
return flag.NewFlagSet(name, flag.ContinueOnError)
}
func runCalendar(cfg *config.Config, dbase *db.DB, args []string) int {
func runCalendar(dbase *db.DB, st *store.Store, args []string) int {
if len(args) < 1 {
usage()
return 2
}
switch args[0] {
case "create":
if len(args) != 3 {
fmt.Fprintln(os.Stderr, "usage: nidusctl calendar create <owner> <calendar>")
return 2
}
owner, calName := args[1], args[2]
if err := dbase.CreateCalendar(owner, calName); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
if err := st.EnsureCollection(owner, "cal-"+calName); err != nil {
fmt.Fprintf(os.Stderr, "warning: creating storage directory: %v\n", err)
}
fmt.Printf("created calendar %q for %s\n", calName, owner)
return 0
case "delete":
if len(args) != 3 {
fmt.Fprintln(os.Stderr, "usage: nidusctl calendar delete <owner> <calendar>")
return 2
}
owner, calName := args[1], args[2]
if err := dbase.DeleteCalendar(owner, calName); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
if err := st.DeleteCollection(owner, "cal-"+calName); err != nil {
fmt.Fprintf(os.Stderr, "warning: removing storage directory: %v\n", err)
}
fmt.Printf("deleted calendar %q for %s\n", calName, owner)
return 0
case "list":
if len(args) != 2 {
fmt.Fprintln(os.Stderr, "usage: nidusctl calendar list <owner>")
return 2
}
owner := args[1]
names, err := dbase.ListCalendars(owner)
if err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
for _, n := range names {
fmt.Println(n)
}
return 0
case "share":
if len(args) != 5 {
fmt.Fprintln(os.Stderr, "usage: nidusctl calendar share <owner> <calendar> <user> <read|write>")
@@ -107,8 +175,8 @@ func runCalendar(cfg *config.Config, dbase *db.DB, args []string) int {
fmt.Fprintf(os.Stderr, "invalid permission %q: must be %q or %q\n", permStr, db.PermRead, db.PermWrite)
return 2
}
warnIfUnknownUser(cfg, owner)
warnIfUnknownUser(cfg, user)
warnIfUnknownUser(dbase, owner)
warnIfUnknownUser(dbase, user)
if err := dbase.ShareCalendar(owner, calName, user, perm); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
@@ -155,12 +223,60 @@ func runCalendar(cfg *config.Config, dbase *db.DB, args []string) int {
}
}
func runAddressBook(cfg *config.Config, dbase *db.DB, args []string) int {
func runAddressBook(dbase *db.DB, st *store.Store, args []string) int {
if len(args) < 1 {
usage()
return 2
}
switch args[0] {
case "create":
if len(args) != 3 {
fmt.Fprintln(os.Stderr, "usage: nidusctl addressbook create <owner> <book>")
return 2
}
owner, bookName := args[1], args[2]
if err := dbase.CreateAddressBook(owner, bookName); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
if err := st.EnsureCollection(owner, "card-"+bookName); err != nil {
fmt.Fprintf(os.Stderr, "warning: creating storage directory: %v\n", err)
}
fmt.Printf("created address book %q for %s\n", bookName, owner)
return 0
case "delete":
if len(args) != 3 {
fmt.Fprintln(os.Stderr, "usage: nidusctl addressbook delete <owner> <book>")
return 2
}
owner, bookName := args[1], args[2]
if err := dbase.DeleteAddressBook(owner, bookName); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
if err := st.DeleteCollection(owner, "card-"+bookName); err != nil {
fmt.Fprintf(os.Stderr, "warning: removing storage directory: %v\n", err)
}
fmt.Printf("deleted address book %q for %s\n", bookName, owner)
return 0
case "list":
if len(args) != 2 {
fmt.Fprintln(os.Stderr, "usage: nidusctl addressbook list <owner>")
return 2
}
owner := args[1]
names, err := dbase.ListAddressBooks(owner)
if err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
for _, n := range names {
fmt.Println(n)
}
return 0
case "share":
if len(args) != 5 {
fmt.Fprintln(os.Stderr, "usage: nidusctl addressbook share <owner> <book> <user> <read|write>")
@@ -172,8 +288,8 @@ func runAddressBook(cfg *config.Config, dbase *db.DB, args []string) int {
fmt.Fprintf(os.Stderr, "invalid permission %q: must be %q or %q\n", permStr, db.PermRead, db.PermWrite)
return 2
}
warnIfUnknownUser(cfg, owner)
warnIfUnknownUser(cfg, user)
warnIfUnknownUser(dbase, owner)
warnIfUnknownUser(dbase, user)
if err := dbase.ShareAddressBook(owner, bookName, user, perm); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
@@ -219,3 +335,12 @@ func runAddressBook(cfg *config.Config, dbase *db.DB, args []string) int {
return 2
}
}
// warnIfUnknownUser reports (without failing) if username is not a
// registered user — the share is still recorded, since a user could be
// created afterwards.
func warnIfUnknownUser(dbase *db.DB, username string) {
if _, err := dbase.GetUser(username); err != nil {
fmt.Fprintf(os.Stderr, "warning: %q is not a registered user (continuing anyway)\n", username)
}
}
tools/nidusctl/users.go
+167
View File
@@ -0,0 +1,167 @@
package main
import (
"bufio"
"fmt"
"os"
"strings"
"github.com/yourusername/caldav-server/internal/db"
"golang.org/x/term"
)
func runUser(dbase *db.DB, args []string) int {
if len(args) < 1 {
usage()
return 2
}
switch args[0] {
case "create":
return userCreate(dbase, args[1:])
case "delete":
return userDelete(dbase, args[1:])
case "list":
return userList(dbase, args[1:])
case "passwd":
return userPasswd(dbase, args[1:])
default:
fmt.Fprintf(os.Stderr, "unknown user subcommand %q\n", args[0])
return 2
}
}
func userCreate(dbase *db.DB, args []string) int {
fs := newFlagSet("nidusctl user create")
displayName := fs.String("display-name", "", "display name shown in DAV clients")
email := fs.String("email", "", "email address")
password := fs.String("password", "", "password (omit to be prompted, recommended)")
if err := fs.Parse(args); err != nil {
return 2
}
rest := fs.Args()
if len(rest) != 1 {
fmt.Fprintln(os.Stderr, "usage: nidusctl user create <username> [--display-name NAME] [--email EMAIL] [--password PASSWORD]")
return 2
}
username := rest[0]
pw := *password
if pw == "" {
var err error
pw, err = promptPassword(username)
if err != nil {
fmt.Fprintf(os.Stderr, "error reading password: %v\n", err)
return 1
}
}
if err := dbase.CreateUser(username, pw, *displayName, *email); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
fmt.Printf("created user %q\n", username)
return 0
}
func userDelete(dbase *db.DB, args []string) int {
if len(args) != 1 {
fmt.Fprintln(os.Stderr, "usage: nidusctl user delete <username>")
return 2
}
username := args[0]
if err := dbase.DeleteUser(username); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
fmt.Printf("deleted user %q (and its calendars, address books, and shares)\n", username)
return 0
}
func userList(dbase *db.DB, args []string) int {
if len(args) != 0 {
fmt.Fprintln(os.Stderr, "usage: nidusctl user list")
return 2
}
users, err := dbase.ListUsers()
if err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
if len(users) == 0 {
fmt.Println("no users")
return 0
}
for _, u := range users {
fmt.Printf("%s\t%s\t%s\n", u.Username, u.DisplayName, u.Email)
}
return 0
}
func userPasswd(dbase *db.DB, args []string) int {
fs := newFlagSet("nidusctl user passwd")
password := fs.String("password", "", "new password (omit to be prompted, recommended)")
if err := fs.Parse(args); err != nil {
return 2
}
rest := fs.Args()
if len(rest) != 1 {
fmt.Fprintln(os.Stderr, "usage: nidusctl user passwd <username> [--password PASSWORD]")
return 2
}
username := rest[0]
pw := *password
if pw == "" {
var err error
pw, err = promptPassword(username)
if err != nil {
fmt.Fprintf(os.Stderr, "error reading password: %v\n", err)
return 1
}
}
if err := dbase.SetPassword(username, pw); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
return 1
}
fmt.Printf("updated password for %q\n", username)
return 0
}
// promptPassword reads a password twice from the terminal (without echo,
// if stdin is a TTY) and confirms both entries match.
func promptPassword(username string) (string, error) {
if term.IsTerminal(int(os.Stdin.Fd())) {
fmt.Fprintf(os.Stderr, "password for %s: ", username)
pw1, err := term.ReadPassword(int(os.Stdin.Fd()))
fmt.Fprintln(os.Stderr)
if err != nil {
return "", err
}
fmt.Fprint(os.Stderr, "confirm password: ")
pw2, err := term.ReadPassword(int(os.Stdin.Fd()))
fmt.Fprintln(os.Stderr)
if err != nil {
return "", err
}
if string(pw1) != string(pw2) {
return "", fmt.Errorf("passwords do not match")
}
if len(pw1) == 0 {
return "", fmt.Errorf("password must not be empty")
}
return string(pw1), nil
}
// Not a TTY (e.g. piped input in scripts/tests) — read a single line.
reader := bufio.NewReader(os.Stdin)
line, err := reader.ReadString('\n')
if err != nil && line == "" {
return "", err
}
pw := strings.TrimRight(line, "\r\n")
if pw == "" {
return "", fmt.Errorf("password must not be empty")
}
return pw, nil
}