package user import ( "crypto/rand" "crypto/sha256" "encoding/hex" "fmt" "html" "net/http" "time" auth "donetick.com/core/internal/authorization" cModel "donetick.com/core/internal/circle/model" cRepo "donetick.com/core/internal/circle/repo" "donetick.com/core/internal/email" uModel "donetick.com/core/internal/user/model" uRepo "donetick.com/core/internal/user/repo" "donetick.com/core/internal/utils" "donetick.com/core/logging" jwt "github.com/appleboy/gin-jwt/v2" "github.com/gin-gonic/gin" limiter "github.com/ulule/limiter/v3" "google.golang.org/api/googleapi" "google.golang.org/api/oauth2/v1" ) type Handler struct { userRepo *uRepo.UserRepository circleRepo *cRepo.CircleRepository jwtAuth *jwt.GinJWTMiddleware email *email.EmailSender } func NewHandler(ur *uRepo.UserRepository, cr *cRepo.CircleRepository, jwtAuth *jwt.GinJWTMiddleware, email *email.EmailSender) *Handler { return &Handler{ userRepo: ur, circleRepo: cr, jwtAuth: jwtAuth, email: email, } } func (h *Handler) GetAllUsers() gin.HandlerFunc { return func(c *gin.Context) { currentUser, ok := auth.CurrentUser(c) if !ok { c.JSON(500, gin.H{ "error": "Error getting current user", }) return } users, err := h.userRepo.GetAllUsers(c, currentUser.CircleID) if err != nil { c.JSON(500, gin.H{ "error": "Error getting users", }) return } c.JSON(200, gin.H{ "res": users, }) } } func (h *Handler) signUp(c *gin.Context) { type SignUpReq struct { Username string `json:"username" binding:"required,min=4,max=20"` Password string `json:"password" binding:"required,min=8,max=45"` DisplayName string `json:"displayName"` } var signupReq SignUpReq if err := c.BindJSON(&signupReq); err != nil { c.JSON(400, gin.H{ "error": "Invalid request", }) return } if signupReq.DisplayName == "" { signupReq.DisplayName = signupReq.Username } password, err := auth.EncodePassword(signupReq.Password) signupReq.Username = html.EscapeString(signupReq.Username) signupReq.DisplayName = html.EscapeString(signupReq.DisplayName) if err != nil { c.JSON(500, gin.H{ "error": "Error encoding password", }) return } var insertedUser *uModel.User if insertedUser, err = h.userRepo.CreateUser(c, &uModel.User{ Username: signupReq.Username, Password: password, DisplayName: signupReq.DisplayName, CreatedAt: time.Now(), UpdatedAt: time.Now(), }); err != nil { c.JSON(500, gin.H{ "error": "Error creating user", }) return } // var userCircle *circle.Circle // var userRole string userCircle, err := h.circleRepo.CreateCircle(c, &cModel.Circle{ Name: signupReq.DisplayName + "'s circle", CreatedAt: time.Now(), UpdatedAt: time.Now(), InviteCode: utils.GenerateInviteCode(c), }) if err != nil { c.JSON(500, gin.H{ "error": "Error creating circle", }) return } if err := h.circleRepo.AddUserToCircle(c, &cModel.UserCircle{ UserID: insertedUser.ID, CircleID: userCircle.ID, Role: "admin", IsActive: true, CreatedAt: time.Now(), UpdatedAt: time.Now(), }); err != nil { c.JSON(500, gin.H{ "error": "Error adding user to circle", }) return } insertedUser.CircleID = userCircle.ID if err := h.userRepo.UpdateUser(c, insertedUser); err != nil { c.JSON(500, gin.H{ "error": "Error updating user", }) return } c.JSON(201, gin.H{}) } func (h *Handler) GetUserProfile(c *gin.Context) { user, ok := auth.CurrentUser(c) if !ok { c.JSON(500, gin.H{ "error": "Error getting user", }) return } c.JSON(200, gin.H{ "res": user, }) } func (h *Handler) thirdPartyAuthCallback(c *gin.Context) { // read :provider from path param, if param is google check the token with google if it's valid and fetch the user details: logger := logging.FromContext(c) provider := c.Param("provider") logger.Infow("account.handler.thirdPartyAuthCallback", "provider", provider) if provider == "google" { c.Set("auth_provider", "3rdPartyAuth") type OAuthRequest struct { Token string `json:"token" binding:"required"` Provider string `json:"provider" binding:"required"` } var body OAuthRequest if err := c.ShouldBindJSON(&body); err != nil { logger.Errorw("account.handler.thirdPartyAuthCallback failed to bind", "err", err) c.JSON(http.StatusBadRequest, gin.H{ "error": "Invalid request", }) return } // logger.Infow("account.handler.thirdPartyAuthCallback", "token", token) service, err := oauth2.New(http.DefaultClient) // tokenInfo, err := service.Tokeninfo().AccessToken(token).Do() userinfo, err := service.Userinfo.Get().Do(googleapi.QueryParameter("access_token", body.Token)) logger.Infow("account.handler.thirdPartyAuthCallback", "tokenInfo", userinfo) if err != nil { logger.Errorw("account.handler.thirdPartyAuthCallback failed to get token info", "err", err) c.JSON(http.StatusBadRequest, gin.H{ "error": "Invalid token", }) return } acc, err := h.userRepo.FindByEmail(c, userinfo.Email) if err != nil { // create a random password for the user using crypto/rand: password := auth.GenerateRandomPassword(12) encodedPassword, err := auth.EncodePassword(password) acc = &uModel.User{ Username: userinfo.Id, Email: userinfo.Email, Image: userinfo.Picture, Password: encodedPassword, DisplayName: userinfo.GivenName, Provider: 2, } createdUser, err := h.userRepo.CreateUser(c, acc) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to create user", }) return } // Create Circle for the user: userCircle, err := h.circleRepo.CreateCircle(c, &cModel.Circle{ Name: userinfo.GivenName + "'s circle", CreatedAt: time.Now(), UpdatedAt: time.Now(), InviteCode: utils.GenerateInviteCode(c), }) if err != nil { c.JSON(500, gin.H{ "error": "Error creating circle", }) return } if err := h.circleRepo.AddUserToCircle(c, &cModel.UserCircle{ UserID: createdUser.ID, CircleID: userCircle.ID, Role: "admin", IsActive: true, CreatedAt: time.Now(), UpdatedAt: time.Now(), }); err != nil { c.JSON(500, gin.H{ "error": "Error adding user to circle", }) return } createdUser.CircleID = userCircle.ID if err := h.userRepo.UpdateUser(c, createdUser); err != nil { c.JSON(500, gin.H{ "error": "Error updating user", }) return } } // use auth to generate a token for the user: c.Set("user_account", acc) h.jwtAuth.Authenticator(c) tokenString, expire, err := h.jwtAuth.TokenGenerator(acc) if err != nil { logger.Errorw("Unable to Generate a Token") c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to Generate a Token", }) return } c.JSON(http.StatusOK, gin.H{"token": tokenString, "expire": expire}) return } } func (h *Handler) resetPassword(c *gin.Context) { log := logging.FromContext(c) type ResetPasswordReq struct { Email string `json:"email" binding:"required,email"` } var req ResetPasswordReq if err := c.ShouldBindJSON(&req); err != nil { c.JSON(http.StatusBadRequest, gin.H{ "error": "Invalid request", }) return } user, err := h.userRepo.FindByEmail(c, req.Email) if err != nil { c.JSON(http.StatusNotFound, gin.H{ "error": "User not found", }) return } if user.Provider != 0 { // user create account thought login with Gmail. they can reset the password they just need to login with google again c.JSON( http.StatusForbidden, gin.H{ "error": "User account created with google login. Please login with google", }, ) return } // generate a random password: token, err := auth.GenerateEmailResetToken(c) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to generate token", }) return } err = h.userRepo.SetPasswordResetToken(c, req.Email, token) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to generate password", }) return } // send an email to the user with the new password: err = h.email.SendResetPasswordEmail(c, req.Email, token) if err != nil { log.Errorw("account.handler.resetPassword failed to send email", "err", err) c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to send email", }) return } // send an email to the user with the new password: c.JSON(http.StatusOK, gin.H{}) } func (h *Handler) updateUserPassword(c *gin.Context) { logger := logging.FromContext(c) // read the code from query param: code := c.Query("c") email, code, err := email.DecodeEmailAndCode(code) if err != nil { logger.Errorw("account.handler.verify failed to decode email and code", "err", err) c.JSON(http.StatusBadRequest, gin.H{ "error": "Invalid code", }) return } // read password from body: type RequestBody struct { Password string `json:"password" binding:"required,min=8,max=32"` } var body RequestBody if err := c.ShouldBindJSON(&body); err != nil { logger.Errorw("user.handler.resetAccountPassword failed to bind", "err", err) c.JSON(http.StatusBadRequest, gin.H{ "error": "Invalid request", }) return } password, err := auth.EncodePassword(body.Password) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to process password", }) return } err = h.userRepo.UpdatePasswordByToken(c.Request.Context(), email, code, password) if err != nil { logger.Errorw("account.handler.resetAccountPassword failed to reset password", "err", err) c.JSON(http.StatusInternalServerError, gin.H{ "error": "Unable to reset password", }) return } c.JSON(http.StatusOK, gin.H{}) } func (h *Handler) UpdateUserDetails(c *gin.Context) { type UpdateUserReq struct { DisplayName *string `json:"displayName" binding:"omitempty"` ChatID *int64 `json:"chatID" binding:"omitempty"` Image *string `json:"image" binding:"omitempty"` } user, ok := auth.CurrentUser(c) if !ok { c.JSON(500, gin.H{ "error": "Error getting user", }) return } var req UpdateUserReq if err := c.ShouldBindJSON(&req); err != nil { c.JSON(400, gin.H{ "error": "Invalid request", }) return } // update non-nil fields: if req.DisplayName != nil { user.DisplayName = *req.DisplayName } if req.ChatID != nil { user.ChatID = *req.ChatID } if req.Image != nil { user.Image = *req.Image } if err := h.userRepo.UpdateUser(c, user); err != nil { c.JSON(500, gin.H{ "error": "Error updating user", }) return } c.JSON(200, user) } func (h *Handler) CreateLongLivedToken(c *gin.Context) { currentUser, ok := auth.CurrentUser(c) if !ok { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get current user"}) return } type TokenRequest struct { Name string `json:"name" binding:"required"` } var req TokenRequest if err := c.ShouldBindJSON(&req); err != nil { c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request"}) return } // Step 1: Generate a secure random number randomBytes := make([]byte, 16) // 128 bits are enough for strong randomness _, err := rand.Read(randomBytes) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate random part of the token"}) return } timestamp := time.Now().Unix() hashInput := fmt.Sprintf("%s:%d:%x", currentUser.Username, timestamp, randomBytes) hash := sha256.Sum256([]byte(hashInput)) token := hex.EncodeToString(hash[:]) tokenModel, err := h.userRepo.StoreAPIToken(c, currentUser.ID, req.Name, token) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to store the token"}) return } c.JSON(http.StatusOK, gin.H{"res": tokenModel}) } func (h *Handler) GetAllUserToken(c *gin.Context) { currentUser, ok := auth.CurrentUser(c) if !ok { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get current user"}) return } tokens, err := h.userRepo.GetAllUserTokens(c, currentUser.ID) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get user tokens"}) return } c.JSON(http.StatusOK, gin.H{"res": tokens}) } func (h *Handler) DeleteUserToken(c *gin.Context) { currentUser, ok := auth.CurrentUser(c) if !ok { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get current user"}) return } tokenID := c.Param("id") err := h.userRepo.DeleteAPIToken(c, currentUser.ID, tokenID) if err != nil { c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete the token"}) return } c.JSON(http.StatusOK, gin.H{}) } func Routes(router *gin.Engine, h *Handler, auth *jwt.GinJWTMiddleware, limiter *limiter.Limiter) { userRoutes := router.Group("users") userRoutes.Use(auth.MiddlewareFunc(), utils.RateLimitMiddleware(limiter)) { userRoutes.GET("/", h.GetAllUsers()) userRoutes.GET("/profile", h.GetUserProfile) userRoutes.PUT("", h.UpdateUserDetails) userRoutes.POST("/tokens", h.CreateLongLivedToken) userRoutes.GET("/tokens", h.GetAllUserToken) userRoutes.DELETE("/tokens/:id", h.DeleteUserToken) } authRoutes := router.Group("auth") authRoutes.Use(utils.RateLimitMiddleware(limiter)) { authRoutes.POST("/", h.signUp) authRoutes.POST("login", auth.LoginHandler) authRoutes.GET("refresh", auth.RefreshHandler) authRoutes.POST("/:provider/callback", h.thirdPartyAuthCallback) authRoutes.POST("reset", h.resetPassword) authRoutes.POST("password", h.updateUserPassword) } }