added adduser registeruser changepassword deluser changeuser

api/token.go

@@ -14,7 +14,7 @@ import (
 
 const defaultsecretkey = "secret"
 
-func createJWT(secretKey string, data map[string]interface{}, ttl time.Duration) (string, error) {
+func createJWT(secretKey string, data map[string]any, ttl time.Duration) (string, error) {
 	claims := jwt.MapClaims{
 		"exp": time.Now().Add(ttl).Unix(),
 		"iat": time.Now().Unix(),
@@ -29,10 +29,10 @@ func createJWT(secretKey string, data map[string]interface{}, ttl time.Duration)
 	return signedToken, nil
 }
 
-func VerifyJWT(tokenString string, secretKey string) (map[string]interface{}, error) {
+func VerifyJWT(tokenString string, secretKey string) (map[string]any, error) {
 	token, e := jwt.Parse(
 		tokenString,
-		func(token *jwt.Token) (interface{}, error) {
+		func(token *jwt.Token) (any, error) {
 			if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 				return nil, fmt.Errorf("unexpexted signing method: %v", token.Header["alg"])
 			}
@@ -43,7 +43,7 @@ func VerifyJWT(tokenString string, secretKey string) (map[string]interface{}, er
 		return nil, fmt.Errorf("token validation failed: %w", e)
 	}
 	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
-		result := make(map[string]interface{})
+		result := make(map[string]any)
 		for key, value := range claims {
 			if key == "exp" || key == "iat" || key == "nbf" {
 				continue
@@ -74,7 +74,7 @@ func Token(w http.ResponseWriter, req *http.Request) {
 			IsSuperuser: dbuser.IsSuperuser,
 		}
 		responseUserMarshal, _ := json.Marshal(responseUser)
-		responseUserUnmarshal := make(map[string]interface{})
+		responseUserUnmarshal := make(map[string]any)
 		json.Unmarshal(responseUserMarshal, &responseUserUnmarshal)
 		token, _ := createJWT(defaultsecretkey, responseUserUnmarshal, time.Duration(24*time.Hour))
 		fmt.Fprintf(w, "{\"token\":\"%s\"}", token)

api/users.go

@@ -6,6 +6,8 @@ import (
 	"form/database"
 	"form/model"
 	"net/http"
+
+	"github.com/google/uuid"
 )
 
 func GetAllUsers(w http.ResponseWriter, req *http.Request) {
@@ -65,25 +67,156 @@ func GetUser(w http.ResponseWriter, req *http.Request) {
 
 func ChangePassword(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-
+	var request model.ChangePasswordRequest
+	decoder := json.NewDecoder(req.Body)
+	decoder.Decode(&request)
+	claims, e := VerifyJWT(request.Token, defaultsecretkey)
+	if e != nil {
+		fmt.Fprintf(w, "{\"status\": 403}")
+		return
+	}
+	user, e := database.GetUserByUsername(fmt.Sprintf("%v", claims["username"]))
+	if e != nil {
+		fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+		return
+	}
+	if user.Password == request.OldPassword {
+		database.Db.Model(&user).Update("Password", request.NewPassword)
+		fmt.Fprint(w, "{\"status\":200}")
+		return
+	}
+	fmt.Fprintf(w, "{\"status\":403}")
 }
 
 func DelUser(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-
+	var request model.DelUserRequest
+	decoder := json.NewDecoder(req.Body)
+	decoder.Decode(&request)
+	claims, e := VerifyJWT(request.Token, defaultsecretkey)
+	if e != nil {
+		fmt.Fprintf(w, "{\"status\": 403}")
+		return
+	}
+	if claims["is_superuser"] == true || request.UserId != "" {
+		user, e := database.GetUserById(request.UserId)
+		if e != nil {
+			fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+			return
+		}
+		e = database.DeleteUser(user.Id)
+		if e != nil {
+			fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+			return
+		}
+		fmt.Fprintf(w, "{\"status\":200}")
+		return
+	}
+	e = database.DeleteUser(fmt.Sprintf("%v", claims["id"]))
+	if e != nil {
+		fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+		return
+	}
+	fmt.Fprint(w, "{\"status\":200}")
 }
 
 func AddUser(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-
+	var request model.AddUserRequest
+	decoder := json.NewDecoder(req.Body)
+	decoder.Decode(&request)
+	claims, e := VerifyJWT(request.Token, defaultsecretkey)
+	if e != nil {
+		fmt.Fprintf(w, "{\"status\": 403}")
+		return
+	}
+	if claims["is_superuser"] == true {
+		id, err := uuid.NewRandom()
+		if err != nil {
+			fmt.Fprintf(w, "{\"error\":\"%v\"}", err)
+			return
+		}
+		_, e := database.GetUserByUsername(request.Username)
+		if e != nil {
+			e = database.CreateUser(&model.User{
+				Id:          id.String(),
+				Username:    request.Username,
+				Email:       request.Email,
+				Password:    request.Password,
+				Group:       request.Group,
+				IsSuperuser: request.IsSuperuser,
+			})
+			if e != nil {
+				fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+				return
+			}
+			fmt.Fprintf(w, "{\"status\": 200}")
+			return
+		}
+		fmt.Fprintf(w, "{\"error\":\"username already exists\"}")
+		return
+	}
+	fmt.Fprintf(w, "{\"status\":403}")
 }
 
 func RegisterUser(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-
+	var request model.AddUserRequest
+	decoder := json.NewDecoder(req.Body)
+	decoder.Decode(&request)
+	if request.Username == "" {
+		fmt.Fprintf(w, "{\"error\":\"need more data\"}")
+		return
+	}
+	id, err := uuid.NewRandom()
+	if err != nil {
+		fmt.Fprintf(w, "{\"error\":\"%v\"}", err)
+		return
+	}
+	group := "users"
+	if request.Group != "" {
+		group = request.Group
+	}
+	_, e := database.GetUserByUsername(request.Username)
+	if e != nil {
+		e = database.CreateUser(&model.User{
+			Id:          id.String(),
+			Username:    request.Username,
+			Email:       request.Email,
+			Password:    request.Password,
+			Group:       group,
+			IsSuperuser: request.IsSuperuser,
+		})
+		if e != nil {
+			fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+			return
+		}
+		fmt.Fprintf(w, "{\"status\": 200}")
+		return
+	}
+	fmt.Fprintf(w, "{\"error\":\"username already exists\"}")
 }
 
 func ChangeUser(w http.ResponseWriter, req *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-
+	var request model.ChangeUserRequest
+	decoder := json.NewDecoder(req.Body)
+	decoder.Decode(&request)
+	claims, e := VerifyJWT(request.Token, defaultsecretkey)
+	if e != nil {
+		fmt.Fprintf(w, "{\"status\": 403}")
+		return
+	}
+	user, e := database.GetUserByUsername(fmt.Sprintf("%v", claims["username"]))
+	if e != nil {
+		fmt.Fprintf(w, "{\"error\":\"%v\"}", e)
+		return
+	}
+	database.Db.Model(&user).Updates(map[string]any{
+		"Username":    request.Username,
+		"Email":       request.Email,
+		"Group":       request.Group,
+		"IsSuperuser": request.IsSuperuser,
+	})
+	fmt.Fprint(w, "{\"status\":200}")
 }