arnefandCopilot
7d4f28de3c
BREAKING CHANGE: the users:/config-based collection setup is gone. All
user, calendar, and address-book data now lives in the SQLite DB
(internal/db) and is managed exclusively via nidusctl or the web UI.
Existing deployments must recreate their users after upgrading:
nidusctl user create <username>
nidusctl calendar create <username> <name>
nidusctl addressbook create <username> <name>
- internal/db: new users, calendars, addressbooks tables with FK cascade
delete; foreign_keys pragma enabled; internal/db/users.go implements
full CRUD + bcrypt auth (CreateUser, VerifyPassword, ListUsers,
CreateCalendar/AddressBook, etc).
- internal/config: removed Users/UserConfig entirely.
- internal/auth: Basic Auth now checks credentials via db.DB instead of
cfg.Users.
- internal/caldav, internal/carddav: ListCalendars/ListAddressBooks and
Create/Delete now backed by the DB.
- internal/web: login uses db.VerifyPassword; new resources.go adds
create/delete handlers for calendars/address books at
/web/resources/{calendar,addressbook}; dashboard gained create forms
and per-card delete buttons (templ + htmx, no hyperscript).
- tools/nidusctl: new user create/delete/list/passwd commands (masked
interactive password prompt via golang.org/x/term) plus create/delete/
list subcommands for calendar/addressbook.
- cmd/server/main.go: pre-creates on-disk collections from the DB at
startup instead of cfg.Users; warns when no users exist yet.
- Updated tests to seed data via the DB; added resources_test.go for the
new web UI handlers.
- README.md and .github/copilot-instructions.md updated to document the
new nidusctl commands and the DB-backed architecture.
Verified end-to-end against a live test server: nidusctl user/calendar/
addressbook create, DAV Basic Auth PROPFIND, web login, dashboard
rendering, and web UI create/delete of resources all confirmed working.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
111 lines
3.3 KiB
Go
111 lines
3.3 KiB
Go
// Package db provides a lightweight SQLite-backed store for data that
|
|
// doesn't fit the plain-file model used by internal/store — currently
|
|
// calendar/address-book sharing grants. It's intentionally small: no ORM,
|
|
// just database/sql with hand-written queries, so it stays easy to
|
|
// extend when user management and the web UI are added later.
|
|
package db
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
_ "modernc.org/sqlite"
|
|
)
|
|
|
|
// DB wraps a SQLite connection and exposes typed helpers for the
|
|
// application's tables.
|
|
type DB struct {
|
|
conn *sql.DB
|
|
}
|
|
|
|
// Open opens (creating if necessary) the SQLite database at path and runs
|
|
// schema migrations. The parent directory of path is created if it
|
|
// doesn't already exist.
|
|
func Open(path string) (*DB, error) {
|
|
if dir := filepath.Dir(path); dir != "" && dir != "." {
|
|
if err := os.MkdirAll(dir, 0o755); err != nil {
|
|
return nil, fmt.Errorf("creating database directory %q: %w", dir, err)
|
|
}
|
|
}
|
|
|
|
conn, err := sql.Open("sqlite", path+"?_pragma=foreign_keys(1)")
|
|
if err != nil {
|
|
return nil, fmt.Errorf("opening database %q: %w", path, err)
|
|
}
|
|
// SQLite only supports one writer at a time; a single connection avoids
|
|
// "database is locked" errors under concurrent access.
|
|
conn.SetMaxOpenConns(1)
|
|
|
|
d := &DB{conn: conn}
|
|
if err := d.migrate(); err != nil {
|
|
conn.Close()
|
|
return nil, fmt.Errorf("migrating database: %w", err)
|
|
}
|
|
return d, nil
|
|
}
|
|
|
|
// Close closes the underlying connection.
|
|
func (d *DB) Close() error {
|
|
return d.conn.Close()
|
|
}
|
|
|
|
func (d *DB) migrate() error {
|
|
const schema = `
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
username TEXT PRIMARY KEY,
|
|
password_hash TEXT NOT NULL,
|
|
display_name TEXT NOT NULL DEFAULT '',
|
|
email TEXT NOT NULL DEFAULT '',
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS calendars (
|
|
owner TEXT NOT NULL REFERENCES users (username) ON DELETE CASCADE,
|
|
name TEXT NOT NULL,
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
PRIMARY KEY (owner, name)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS addressbooks (
|
|
owner TEXT NOT NULL REFERENCES users (username) ON DELETE CASCADE,
|
|
name TEXT NOT NULL,
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
PRIMARY KEY (owner, name)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS calendar_shares (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
owner TEXT NOT NULL,
|
|
calendar_name TEXT NOT NULL,
|
|
shared_with TEXT NOT NULL,
|
|
permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (owner, calendar_name, shared_with)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS addressbook_shares (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
owner TEXT NOT NULL,
|
|
addressbook_name TEXT NOT NULL,
|
|
shared_with TEXT NOT NULL,
|
|
permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (owner, addressbook_name, shared_with)
|
|
);
|
|
|
|
-- Web UI login sessions. Sessions are opaque random tokens stored server
|
|
-- side (not JWTs) so they can be revoked instantly by deleting the row.
|
|
CREATE TABLE IF NOT EXISTS web_sessions (
|
|
token TEXT PRIMARY KEY,
|
|
username TEXT NOT NULL,
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
expires_at DATETIME NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_web_sessions_expires_at ON web_sessions (expires_at);
|
|
`
|
|
_, err := d.conn.Exec(schema)
|
|
return err
|
|
}
|