512 lines
13 KiB
Go
512 lines
13 KiB
Go
|
package user
|
||
|
|
|
||
|
|
import (
|
||
|
|
"crypto/rand"
|
||
|
|
"crypto/sha256"
|
||
|
|
"encoding/hex"
|
||
|
|
"fmt"
|
||
|
|
"html"
|
||
|
|
"net/http"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
auth "donetick.com/core/internal/authorization"
|
||
|
|
cModel "donetick.com/core/internal/circle/model"
|
||
|
|
cRepo "donetick.com/core/internal/circle/repo"
|
||
|
|
"donetick.com/core/internal/email"
|
||
|
|
uModel "donetick.com/core/internal/user/model"
|
||
|
|
uRepo "donetick.com/core/internal/user/repo"
|
||
|
|
"donetick.com/core/internal/utils"
|
||
|
|
"donetick.com/core/logging"
|
||
|
|
jwt "github.com/appleboy/gin-jwt/v2"
|
||
|
|
"github.com/gin-gonic/gin"
|
||
|
|
limiter "github.com/ulule/limiter/v3"
|
||
|
|
"google.golang.org/api/googleapi"
|
||
|
|
"google.golang.org/api/oauth2/v1"
|
||
|
|
)
|
||
|
|
|
||
|
|
type Handler struct {
|
||
|
|
userRepo *uRepo.UserRepository
|
||
|
|
circleRepo *cRepo.CircleRepository
|
||
|
|
jwtAuth *jwt.GinJWTMiddleware
|
||
|
|
email *email.EmailSender
|
||
|
|
}
|
||
|
|
|
||
|
|
func NewHandler(ur *uRepo.UserRepository, cr *cRepo.CircleRepository, jwtAuth *jwt.GinJWTMiddleware, email *email.EmailSender) *Handler {
|
||
|
|
return &Handler{
|
||
|
|
userRepo: ur,
|
||
|
|
circleRepo: cr,
|
||
|
|
jwtAuth: jwtAuth,
|
||
|
|
email: email,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) GetAllUsers() gin.HandlerFunc {
|
||
|
|
return func(c *gin.Context) {
|
||
|
|
currentUser, ok := auth.CurrentUser(c)
|
||
|
|
if !ok {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error getting current user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
users, err := h.userRepo.GetAllUsers(c, currentUser.CircleID)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error getting users",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
c.JSON(200, gin.H{
|
||
|
|
"res": users,
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) signUp(c *gin.Context) {
|
||
|
|
|
||
|
|
type SignUpReq struct {
|
||
|
|
Username string `json:"username" binding:"required,min=4,max=20"`
|
||
|
|
Password string `json:"password" binding:"required,min=8,max=45"`
|
||
|
|
DisplayName string `json:"displayName"`
|
||
|
|
}
|
||
|
|
var signupReq SignUpReq
|
||
|
|
if err := c.BindJSON(&signupReq); err != nil {
|
||
|
|
c.JSON(400, gin.H{
|
||
|
|
"error": "Invalid request",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
if signupReq.DisplayName == "" {
|
||
|
|
signupReq.DisplayName = signupReq.Username
|
||
|
|
}
|
||
|
|
password, err := auth.EncodePassword(signupReq.Password)
|
||
|
|
signupReq.Username = html.EscapeString(signupReq.Username)
|
||
|
|
signupReq.DisplayName = html.EscapeString(signupReq.DisplayName)
|
||
|
|
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error encoding password",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
var insertedUser *uModel.User
|
||
|
|
if insertedUser, err = h.userRepo.CreateUser(c, &uModel.User{
|
||
|
|
Username: signupReq.Username,
|
||
|
|
Password: password,
|
||
|
|
DisplayName: signupReq.DisplayName,
|
||
|
|
CreatedAt: time.Now(),
|
||
|
|
UpdatedAt: time.Now(),
|
||
|
|
}); err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error creating user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
// var userCircle *circle.Circle
|
||
|
|
// var userRole string
|
||
|
|
userCircle, err := h.circleRepo.CreateCircle(c, &cModel.Circle{
|
||
|
|
Name: signupReq.DisplayName + "'s circle",
|
||
|
|
CreatedAt: time.Now(),
|
||
|
|
UpdatedAt: time.Now(),
|
||
|
|
InviteCode: utils.GenerateInviteCode(c),
|
||
|
|
})
|
||
|
|
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error creating circle",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if err := h.circleRepo.AddUserToCircle(c, &cModel.UserCircle{
|
||
|
|
UserID: insertedUser.ID,
|
||
|
|
CircleID: userCircle.ID,
|
||
|
|
Role: "admin",
|
||
|
|
IsActive: true,
|
||
|
|
CreatedAt: time.Now(),
|
||
|
|
UpdatedAt: time.Now(),
|
||
|
|
}); err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error adding user to circle",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
insertedUser.CircleID = userCircle.ID
|
||
|
|
if err := h.userRepo.UpdateUser(c, insertedUser); err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error updating user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
c.JSON(201, gin.H{})
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) GetUserProfile(c *gin.Context) {
|
||
|
|
user, ok := auth.CurrentUser(c)
|
||
|
|
if !ok {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error getting user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
c.JSON(200, gin.H{
|
||
|
|
"res": user,
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) thirdPartyAuthCallback(c *gin.Context) {
|
||
|
|
|
||
|
|
// read :provider from path param, if param is google check the token with google if it's valid and fetch the user details:
|
||
|
|
logger := logging.FromContext(c)
|
||
|
|
provider := c.Param("provider")
|
||
|
|
logger.Infow("account.handler.thirdPartyAuthCallback", "provider", provider)
|
||
|
|
|
||
|
|
if provider == "google" {
|
||
|
|
c.Set("auth_provider", "3rdPartyAuth")
|
||
|
|
type OAuthRequest struct {
|
||
|
|
Token string `json:"token" binding:"required"`
|
||
|
|
Provider string `json:"provider" binding:"required"`
|
||
|
|
}
|
||
|
|
var body OAuthRequest
|
||
|
|
if err := c.ShouldBindJSON(&body); err != nil {
|
||
|
|
logger.Errorw("account.handler.thirdPartyAuthCallback failed to bind", "err", err)
|
||
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
||
|
|
"error": "Invalid request",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
// logger.Infow("account.handler.thirdPartyAuthCallback", "token", token)
|
||
|
|
service, err := oauth2.New(http.DefaultClient)
|
||
|
|
|
||
|
|
// tokenInfo, err := service.Tokeninfo().AccessToken(token).Do()
|
||
|
|
userinfo, err := service.Userinfo.Get().Do(googleapi.QueryParameter("access_token", body.Token))
|
||
|
|
logger.Infow("account.handler.thirdPartyAuthCallback", "tokenInfo", userinfo)
|
||
|
|
if err != nil {
|
||
|
|
logger.Errorw("account.handler.thirdPartyAuthCallback failed to get token info", "err", err)
|
||
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
||
|
|
"error": "Invalid token",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
acc, err := h.userRepo.FindByEmail(c, userinfo.Email)
|
||
|
|
|
||
|
|
if err != nil {
|
||
|
|
// create a random password for the user using crypto/rand:
|
||
|
|
password := auth.GenerateRandomPassword(12)
|
||
|
|
encodedPassword, err := auth.EncodePassword(password)
|
||
|
|
acc = &uModel.User{
|
||
|
|
Username: userinfo.Id,
|
||
|
|
Email: userinfo.Email,
|
||
|
|
Image: userinfo.Picture,
|
||
|
|
Password: encodedPassword,
|
||
|
|
DisplayName: userinfo.GivenName,
|
||
|
|
Provider: 2,
|
||
|
|
}
|
||
|
|
createdUser, err := h.userRepo.CreateUser(c, acc)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to create user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
|
||
|
|
}
|
||
|
|
// Create Circle for the user:
|
||
|
|
userCircle, err := h.circleRepo.CreateCircle(c, &cModel.Circle{
|
||
|
|
Name: userinfo.GivenName + "'s circle",
|
||
|
|
CreatedAt: time.Now(),
|
||
|
|
UpdatedAt: time.Now(),
|
||
|
|
InviteCode: utils.GenerateInviteCode(c),
|
||
|
|
})
|
||
|
|
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error creating circle",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if err := h.circleRepo.AddUserToCircle(c, &cModel.UserCircle{
|
||
|
|
UserID: createdUser.ID,
|
||
|
|
CircleID: userCircle.ID,
|
||
|
|
Role: "admin",
|
||
|
|
IsActive: true,
|
||
|
|
CreatedAt: time.Now(),
|
||
|
|
UpdatedAt: time.Now(),
|
||
|
|
}); err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error adding user to circle",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
createdUser.CircleID = userCircle.ID
|
||
|
|
if err := h.userRepo.UpdateUser(c, createdUser); err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error updating user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// use auth to generate a token for the user:
|
||
|
|
c.Set("user_account", acc)
|
||
|
|
h.jwtAuth.Authenticator(c)
|
||
|
|
tokenString, expire, err := h.jwtAuth.TokenGenerator(acc)
|
||
|
|
if err != nil {
|
||
|
|
logger.Errorw("Unable to Generate a Token")
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to Generate a Token",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
c.JSON(http.StatusOK, gin.H{"token": tokenString, "expire": expire})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) resetPassword(c *gin.Context) {
|
||
|
|
log := logging.FromContext(c)
|
||
|
|
type ResetPasswordReq struct {
|
||
|
|
Email string `json:"email" binding:"required,email"`
|
||
|
|
}
|
||
|
|
var req ResetPasswordReq
|
||
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
||
|
|
"error": "Invalid request",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
user, err := h.userRepo.FindByEmail(c, req.Email)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusNotFound, gin.H{
|
||
|
|
"error": "User not found",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
if user.Provider != 0 {
|
||
|
|
// user create account thought login with Gmail. they can reset the password they just need to login with google again
|
||
|
|
c.JSON(
|
||
|
|
http.StatusForbidden,
|
||
|
|
gin.H{
|
||
|
|
"error": "User account created with google login. Please login with google",
|
||
|
|
},
|
||
|
|
)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
// generate a random password:
|
||
|
|
token, err := auth.GenerateEmailResetToken(c)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to generate token",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
err = h.userRepo.SetPasswordResetToken(c, req.Email, token)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to generate password",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
// send an email to the user with the new password:
|
||
|
|
err = h.email.SendResetPasswordEmail(c, req.Email, token)
|
||
|
|
if err != nil {
|
||
|
|
log.Errorw("account.handler.resetPassword failed to send email", "err", err)
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to send email",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
// send an email to the user with the new password:
|
||
|
|
c.JSON(http.StatusOK, gin.H{})
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) updateUserPassword(c *gin.Context) {
|
||
|
|
logger := logging.FromContext(c)
|
||
|
|
// read the code from query param:
|
||
|
|
code := c.Query("c")
|
||
|
|
email, code, err := email.DecodeEmailAndCode(code)
|
||
|
|
if err != nil {
|
||
|
|
logger.Errorw("account.handler.verify failed to decode email and code", "err", err)
|
||
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
||
|
|
"error": "Invalid code",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
|
||
|
|
}
|
||
|
|
// read password from body:
|
||
|
|
type RequestBody struct {
|
||
|
|
Password string `json:"password" binding:"required,min=8,max=32"`
|
||
|
|
}
|
||
|
|
var body RequestBody
|
||
|
|
if err := c.ShouldBindJSON(&body); err != nil {
|
||
|
|
logger.Errorw("user.handler.resetAccountPassword failed to bind", "err", err)
|
||
|
|
c.JSON(http.StatusBadRequest, gin.H{
|
||
|
|
"error": "Invalid request",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
|
||
|
|
}
|
||
|
|
password, err := auth.EncodePassword(body.Password)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to process password",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
err = h.userRepo.UpdatePasswordByToken(c.Request.Context(), email, code, password)
|
||
|
|
if err != nil {
|
||
|
|
logger.Errorw("account.handler.resetAccountPassword failed to reset password", "err", err)
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{
|
||
|
|
"error": "Unable to reset password",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
c.JSON(http.StatusOK, gin.H{})
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) UpdateUserDetails(c *gin.Context) {
|
||
|
|
type UpdateUserReq struct {
|
||
|
|
DisplayName *string `json:"displayName" binding:"omitempty"`
|
||
|
|
ChatID *int64 `json:"chatID" binding:"omitempty"`
|
||
|
|
Image *string `json:"image" binding:"omitempty"`
|
||
|
|
}
|
||
|
|
user, ok := auth.CurrentUser(c)
|
||
|
|
if !ok {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error getting user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
var req UpdateUserReq
|
||
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||
|
|
c.JSON(400, gin.H{
|
||
|
|
"error": "Invalid request",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
// update non-nil fields:
|
||
|
|
if req.DisplayName != nil {
|
||
|
|
user.DisplayName = *req.DisplayName
|
||
|
|
}
|
||
|
|
if req.ChatID != nil {
|
||
|
|
user.ChatID = *req.ChatID
|
||
|
|
}
|
||
|
|
if req.Image != nil {
|
||
|
|
user.Image = *req.Image
|
||
|
|
}
|
||
|
|
|
||
|
|
if err := h.userRepo.UpdateUser(c, user); err != nil {
|
||
|
|
c.JSON(500, gin.H{
|
||
|
|
"error": "Error updating user",
|
||
|
|
})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
c.JSON(200, user)
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) CreateLongLivedToken(c *gin.Context) {
|
||
|
|
currentUser, ok := auth.CurrentUser(c)
|
||
|
|
if !ok {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get current user"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
type TokenRequest struct {
|
||
|
|
Name string `json:"name" binding:"required"`
|
||
|
|
}
|
||
|
|
var req TokenRequest
|
||
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
||
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
// Step 1: Generate a secure random number
|
||
|
|
randomBytes := make([]byte, 16) // 128 bits are enough for strong randomness
|
||
|
|
_, err := rand.Read(randomBytes)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate random part of the token"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
timestamp := time.Now().Unix()
|
||
|
|
hashInput := fmt.Sprintf("%s:%d:%x", currentUser.Username, timestamp, randomBytes)
|
||
|
|
hash := sha256.Sum256([]byte(hashInput))
|
||
|
|
|
||
|
|
token := hex.EncodeToString(hash[:])
|
||
|
|
|
||
|
|
tokenModel, err := h.userRepo.StoreAPIToken(c, currentUser.ID, req.Name, token)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to store the token"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
c.JSON(http.StatusOK, gin.H{"res": tokenModel})
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) GetAllUserToken(c *gin.Context) {
|
||
|
|
currentUser, ok := auth.CurrentUser(c)
|
||
|
|
if !ok {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get current user"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
tokens, err := h.userRepo.GetAllUserTokens(c, currentUser.ID)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get user tokens"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
c.JSON(http.StatusOK, gin.H{"res": tokens})
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
func (h *Handler) DeleteUserToken(c *gin.Context) {
|
||
|
|
currentUser, ok := auth.CurrentUser(c)
|
||
|
|
if !ok {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get current user"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
tokenID := c.Param("id")
|
||
|
|
|
||
|
|
err := h.userRepo.DeleteAPIToken(c, currentUser.ID, tokenID)
|
||
|
|
if err != nil {
|
||
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete the token"})
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
c.JSON(http.StatusOK, gin.H{})
|
||
|
|
}
|
||
|
|
|
||
|
|
func Routes(router *gin.Engine, h *Handler, auth *jwt.GinJWTMiddleware, limiter *limiter.Limiter) {
|
||
|
|
|
||
|
|
userRoutes := router.Group("users")
|
||
|
|
userRoutes.Use(auth.MiddlewareFunc(), utils.RateLimitMiddleware(limiter))
|
||
|
|
{
|
||
|
|
userRoutes.GET("/", h.GetAllUsers())
|
||
|
|
userRoutes.GET("/profile", h.GetUserProfile)
|
||
|
|
userRoutes.PUT("", h.UpdateUserDetails)
|
||
|
|
userRoutes.POST("/tokens", h.CreateLongLivedToken)
|
||
|
|
userRoutes.GET("/tokens", h.GetAllUserToken)
|
||
|
|
userRoutes.DELETE("/tokens/:id", h.DeleteUserToken)
|
||
|
|
}
|
||
|
|
|
||
|
|
authRoutes := router.Group("auth")
|
||
|
|
authRoutes.Use(utils.RateLimitMiddleware(limiter))
|
||
|
|
{
|
||
|
|
authRoutes.POST("/", h.signUp)
|
||
|
|
authRoutes.POST("login", auth.LoginHandler)
|
||
|
|
authRoutes.GET("refresh", auth.RefreshHandler)
|
||
|
|
authRoutes.POST("/:provider/callback", h.thirdPartyAuthCallback)
|
||
|
|
authRoutes.POST("reset", h.resetPassword)
|
||
|
|
authRoutes.POST("password", h.updateUserPassword)
|
||
|
|
}
|
||
|
|
}
|