arnefandCopilot
7d4f28de3c
BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
nidusctl user create <username>
nidusctl calendar create <username> <name>
nidusctl addressbook create <username> <name>
- internal/db: new users, calendars, addressbooks tables with FK cascade
delete; foreign_keys pragma enabled; internal/db/users.go implements
full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
create/delete handlers for calendars/address books at
/web/resources/{calendar,addressbook}; dashboard gained create forms
and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
interactive password prompt via golang.org/x/term) plus create/delete/
list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
new nidusctl commands and the DB-backed architecture.
Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
107 lines
2.9 KiB
Go
107 lines
2.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"net/http"
|
|
|
|
"github.com/yourusername/caldav-server/internal/config"
|
|
"github.com/yourusername/caldav-server/internal/db"
|
|
)
|
|
|
|
type contextKey string
|
|
|
|
const userContextKey contextKey = "authenticated_user"
|
|
|
|
// Middleware wraps an http.Handler with HTTP Basic Auth enforcement.
|
|
type Middleware struct {
|
|
cfg *config.Config
|
|
dbase *db.DB
|
|
logger *slog.Logger
|
|
}
|
|
|
|
func NewMiddleware(cfg *config.Config, dbase *db.DB, logger *slog.Logger) *Middleware {
|
|
return &Middleware{cfg: cfg, dbase: dbase, logger: logger}
|
|
}
|
|
|
|
// Wrap returns an http.Handler that requires valid Basic Auth credentials
|
|
// before delegating to next.
|
|
func (m *Middleware) Wrap(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
username, password, ok := r.BasicAuth()
|
|
if !ok {
|
|
m.challenge(w)
|
|
return
|
|
}
|
|
|
|
user, err := m.authenticate(username, password)
|
|
if err != nil {
|
|
m.logger.Warn("authentication failed",
|
|
"username", username,
|
|
"remote_addr", r.RemoteAddr,
|
|
"error", err)
|
|
m.challenge(w)
|
|
return
|
|
}
|
|
|
|
m.logger.Debug("authenticated request",
|
|
"username", username,
|
|
"method", r.Method,
|
|
"path", r.URL.Path)
|
|
|
|
ctx := context.WithValue(r.Context(), userContextKey, &Principal{
|
|
Username: username,
|
|
DisplayName: user.DisplayName,
|
|
Email: user.Email,
|
|
})
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
})
|
|
}
|
|
|
|
// challenge sends a 401 response requesting Basic Auth.
|
|
func (m *Middleware) challenge(w http.ResponseWriter) {
|
|
w.Header().Set("WWW-Authenticate", `Basic realm="`+m.cfg.Auth.Realm+`"`)
|
|
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
_, _ = w.Write([]byte("Unauthorized"))
|
|
}
|
|
|
|
// authenticate validates username/password against the database.
|
|
func (m *Middleware) authenticate(username, password string) (*db.User, error) {
|
|
user, err := m.dbase.GetUser(username)
|
|
if err != nil {
|
|
return nil, errUnauthorized
|
|
}
|
|
if !m.dbase.VerifyPassword(username, password) {
|
|
return nil, errUnauthorized
|
|
}
|
|
return user, nil
|
|
}
|
|
|
|
// Principal holds the authenticated user's identity.
|
|
type Principal struct {
|
|
Username string
|
|
DisplayName string
|
|
Email string
|
|
}
|
|
|
|
// FromContext extracts the Principal from a request context.
|
|
// Returns nil if the request was not authenticated.
|
|
func FromContext(ctx context.Context) *Principal {
|
|
p, _ := ctx.Value(userContextKey).(*Principal)
|
|
return p
|
|
}
|
|
|
|
// NewContext returns a copy of ctx carrying p, retrievable via FromContext.
|
|
// This is primarily useful for tests of downstream packages that need an
|
|
// authenticated context without going through the Basic Auth handshake.
|
|
func NewContext(ctx context.Context, p *Principal) context.Context {
|
|
return context.WithValue(ctx, userContextKey, p)
|
|
}
|
|
|
|
var errUnauthorized = &authError{msg: "invalid credentials"}
|
|
|
|
type authError struct{ msg string }
|
|
|
|
func (e *authError) Error() string { return e.msg }
|