memos/server/user.go

186 lines
6.6 KiB
Go
Raw Normal View History

2022-02-03 10:32:03 +03:00
package server
import (
"encoding/json"
2022-05-02 21:05:43 +03:00
"fmt"
2022-02-03 10:32:03 +03:00
"net/http"
2022-05-19 13:32:04 +03:00
"strconv"
2022-02-03 10:32:03 +03:00
2022-06-27 17:09:06 +03:00
"github.com/usememos/memos/api"
"github.com/usememos/memos/common"
2022-02-03 10:32:03 +03:00
"github.com/labstack/echo/v4"
2022-02-06 11:19:20 +03:00
"golang.org/x/crypto/bcrypt"
2022-02-03 10:32:03 +03:00
)
func (s *Server) registerUserRoutes(g *echo.Group) {
g.POST("/user", func(c echo.Context) error {
userCreate := &api.UserCreate{}
if err := json.NewDecoder(c.Request().Body).Decode(userCreate); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted post user request").SetInternal(err)
}
passwordHash, err := bcrypt.GenerateFromPassword([]byte(userCreate.Password), bcrypt.DefaultCost)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
}
userCreate.PasswordHash = string(passwordHash)
user, err := s.Store.CreateUser(userCreate)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create user").SetInternal(err)
}
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
}
return nil
})
g.GET("/user", func(c echo.Context) error {
userList, err := s.Store.FindUserList(&api.UserFind{})
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user list").SetInternal(err)
}
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(userList)); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user list response").SetInternal(err)
}
return nil
})
2022-07-09 03:31:07 +03:00
g.GET("/user/:id", func(c echo.Context) error {
id, err := strconv.Atoi(c.Param("id"))
if err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted user id").SetInternal(err)
}
user, err := s.Store.FindUser(&api.UserFind{
ID: &id,
})
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user").SetInternal(err)
}
2022-07-09 16:01:09 +03:00
if user != nil {
// data desensitize
user.OpenID = ""
}
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
2022-07-09 03:31:07 +03:00
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
}
return nil
})
2022-03-29 02:30:29 +03:00
// GET /api/user/me is used to check if the user is logged in.
2022-02-03 10:32:03 +03:00
g.GET("/user/me", func(c echo.Context) error {
2022-05-02 21:05:43 +03:00
userSessionID := c.Get(getUserIDContextKey())
if userSessionID == nil {
return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
2022-02-04 13:54:24 +03:00
}
2022-05-02 21:05:43 +03:00
userID := userSessionID.(int)
2022-02-03 10:32:03 +03:00
userFind := &api.UserFind{
2022-05-02 21:05:43 +03:00
ID: &userID,
2022-02-03 10:32:03 +03:00
}
2022-05-16 02:37:23 +03:00
user, err := s.Store.FindUser(userFind)
2022-02-03 10:32:03 +03:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user").SetInternal(err)
}
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
2022-02-04 12:06:04 +03:00
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
2022-02-05 06:43:25 +03:00
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
return nil
})
2022-02-18 17:21:10 +03:00
2022-02-04 16:24:21 +03:00
g.PATCH("/user/me", func(c echo.Context) error {
2022-05-02 21:05:43 +03:00
userID := c.Get(getUserIDContextKey()).(int)
2022-02-03 10:32:03 +03:00
userPatch := &api.UserPatch{
2022-05-02 21:05:43 +03:00
ID: userID,
2022-02-03 10:32:03 +03:00
}
if err := json.NewDecoder(c.Request().Body).Decode(userPatch); err != nil {
2022-02-03 10:32:03 +03:00
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted patch user request").SetInternal(err)
}
2022-02-06 11:19:20 +03:00
if userPatch.Password != nil && *userPatch.Password != "" {
passwordHash, err := bcrypt.GenerateFromPassword([]byte(*userPatch.Password), bcrypt.DefaultCost)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
}
passwordHashStr := string(passwordHash)
userPatch.PasswordHash = &passwordHashStr
}
if userPatch.ResetOpenID != nil && *userPatch.ResetOpenID {
openID := common.GenUUID()
userPatch.OpenID = &openID
}
2022-05-16 02:37:23 +03:00
user, err := s.Store.PatchUser(userPatch)
2022-02-03 10:32:03 +03:00
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to patch user").SetInternal(err)
}
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
2022-02-04 12:06:04 +03:00
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
2022-02-05 06:43:25 +03:00
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
2022-02-03 10:32:03 +03:00
}
return nil
})
2022-05-19 13:32:04 +03:00
g.PATCH("/user/:userId", func(c echo.Context) error {
currentUserID := c.Get(getUserIDContextKey()).(int)
currentUser, err := s.Store.FindUser(&api.UserFind{
ID: &currentUserID,
})
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
}
if currentUser == nil {
return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Current session user not found with ID: %d", currentUserID)).SetInternal(err)
} else if currentUser.Role != api.Host {
2022-05-19 13:32:04 +03:00
return echo.NewHTTPError(http.StatusForbidden, "Access forbidden for current session user").SetInternal(err)
}
userID, err := strconv.Atoi(c.Param("userId"))
if err != nil {
return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("userId"))).SetInternal(err)
}
userPatch := &api.UserPatch{
ID: userID,
}
if err := json.NewDecoder(c.Request().Body).Decode(userPatch); err != nil {
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted patch user request").SetInternal(err)
}
if userPatch.Password != nil && *userPatch.Password != "" {
passwordHash, err := bcrypt.GenerateFromPassword([]byte(*userPatch.Password), bcrypt.DefaultCost)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
}
passwordHashStr := string(passwordHash)
userPatch.PasswordHash = &passwordHashStr
}
user, err := s.Store.PatchUser(userPatch)
if err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to patch user").SetInternal(err)
}
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
}
return nil
})
2022-02-03 10:32:03 +03:00
}