2022-02-03 10:32:03 +03:00
|
|
|
package server
|
|
|
|
|
|
|
|
import (
|
2022-02-04 11:51:48 +03:00
|
|
|
"encoding/json"
|
2022-05-02 21:05:43 +03:00
|
|
|
"fmt"
|
2022-02-03 10:32:03 +03:00
|
|
|
"net/http"
|
2022-05-19 13:32:04 +03:00
|
|
|
"strconv"
|
2022-10-26 18:00:09 +03:00
|
|
|
"time"
|
2022-02-03 10:32:03 +03:00
|
|
|
|
2023-01-02 18:18:12 +03:00
|
|
|
"github.com/pkg/errors"
|
2022-06-27 17:09:06 +03:00
|
|
|
"github.com/usememos/memos/api"
|
|
|
|
"github.com/usememos/memos/common"
|
|
|
|
|
2022-02-03 10:32:03 +03:00
|
|
|
"github.com/labstack/echo/v4"
|
2022-02-06 11:19:20 +03:00
|
|
|
"golang.org/x/crypto/bcrypt"
|
2022-02-03 10:32:03 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
func (s *Server) registerUserRoutes(g *echo.Group) {
|
2022-05-16 17:19:39 +03:00
|
|
|
g.POST("/user", func(c echo.Context) error {
|
2022-08-07 04:23:46 +03:00
|
|
|
ctx := c.Request().Context()
|
2022-08-20 16:03:15 +03:00
|
|
|
userID, ok := c.Get(getUserIDContextKey()).(int)
|
|
|
|
if !ok {
|
|
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
|
|
|
|
}
|
|
|
|
currentUser, err := s.Store.FindUser(ctx, &api.UserFind{
|
|
|
|
ID: &userID,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user by id").SetInternal(err)
|
|
|
|
}
|
|
|
|
if currentUser.Role != api.Host {
|
2022-12-28 15:22:52 +03:00
|
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Only Host user can create member")
|
2022-08-20 16:03:15 +03:00
|
|
|
}
|
|
|
|
|
2022-12-28 15:22:52 +03:00
|
|
|
userCreate := &api.UserCreate{}
|
2022-05-16 17:19:39 +03:00
|
|
|
if err := json.NewDecoder(c.Request().Body).Decode(userCreate); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted post user request").SetInternal(err)
|
|
|
|
}
|
2022-12-28 15:22:52 +03:00
|
|
|
if userCreate.Role == api.Host {
|
|
|
|
return echo.NewHTTPError(http.StatusForbidden, "Could not create host user")
|
|
|
|
}
|
|
|
|
userCreate.OpenID = common.GenUUID()
|
2022-05-16 17:19:39 +03:00
|
|
|
|
2022-08-20 16:03:15 +03:00
|
|
|
if err := userCreate.Validate(); err != nil {
|
2022-12-28 15:22:52 +03:00
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Invalid user create format").SetInternal(err)
|
2022-08-20 16:03:15 +03:00
|
|
|
}
|
|
|
|
|
2022-05-16 17:19:39 +03:00
|
|
|
passwordHash, err := bcrypt.GenerateFromPassword([]byte(userCreate.Password), bcrypt.DefaultCost)
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
userCreate.PasswordHash = string(passwordHash)
|
2022-08-07 04:23:46 +03:00
|
|
|
user, err := s.Store.CreateUser(ctx, userCreate)
|
2022-05-16 17:19:39 +03:00
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create user").SetInternal(err)
|
|
|
|
}
|
2023-01-02 18:18:12 +03:00
|
|
|
if err := s.createUserCreateActivity(c, user); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create activity").SetInternal(err)
|
|
|
|
}
|
2022-05-16 17:19:39 +03:00
|
|
|
|
|
|
|
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
|
|
|
|
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
|
|
|
g.GET("/user", func(c echo.Context) error {
|
2022-08-07 04:23:46 +03:00
|
|
|
ctx := c.Request().Context()
|
|
|
|
userList, err := s.Store.FindUserList(ctx, &api.UserFind{})
|
2022-05-16 17:19:39 +03:00
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user list").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
2022-07-26 16:41:20 +03:00
|
|
|
for _, user := range userList {
|
|
|
|
// data desensitize
|
|
|
|
user.OpenID = ""
|
2022-12-28 15:22:52 +03:00
|
|
|
user.Email = ""
|
2022-07-26 16:41:20 +03:00
|
|
|
}
|
|
|
|
|
2022-05-16 17:19:39 +03:00
|
|
|
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
|
|
|
|
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(userList)); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user list response").SetInternal(err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
2022-08-13 09:35:33 +03:00
|
|
|
// GET /api/user/me is used to check if the user is logged in.
|
|
|
|
g.GET("/user/me", func(c echo.Context) error {
|
2022-08-07 04:23:46 +03:00
|
|
|
ctx := c.Request().Context()
|
2022-08-13 09:35:33 +03:00
|
|
|
userID, ok := c.Get(getUserIDContextKey()).(int)
|
|
|
|
if !ok {
|
|
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
|
2022-07-07 15:22:36 +03:00
|
|
|
}
|
|
|
|
|
2022-08-13 09:35:33 +03:00
|
|
|
userFind := &api.UserFind{
|
|
|
|
ID: &userID,
|
|
|
|
}
|
|
|
|
user, err := s.Store.FindUser(ctx, userFind)
|
2022-07-07 15:22:36 +03:00
|
|
|
if err != nil {
|
2022-08-13 09:35:33 +03:00
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
|
2022-07-07 15:22:36 +03:00
|
|
|
}
|
2022-07-08 18:38:24 +03:00
|
|
|
|
2022-08-13 09:35:33 +03:00
|
|
|
userSettingList, err := s.Store.FindUserSettingList(ctx, &api.UserSettingFind{
|
|
|
|
UserID: userID,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find userSettingList").SetInternal(err)
|
2022-07-09 16:01:09 +03:00
|
|
|
}
|
2022-08-13 09:35:33 +03:00
|
|
|
user.UserSettingList = userSettingList
|
2022-07-09 16:01:09 +03:00
|
|
|
|
2022-07-07 15:22:36 +03:00
|
|
|
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
|
2022-07-09 03:31:07 +03:00
|
|
|
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
|
2022-07-07 15:22:36 +03:00
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
2022-08-13 09:35:33 +03:00
|
|
|
g.POST("/user/setting", func(c echo.Context) error {
|
2022-08-07 04:23:46 +03:00
|
|
|
ctx := c.Request().Context()
|
2022-07-27 14:45:37 +03:00
|
|
|
userID, ok := c.Get(getUserIDContextKey()).(int)
|
|
|
|
if !ok {
|
2022-05-02 21:05:43 +03:00
|
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
|
2022-02-04 13:54:24 +03:00
|
|
|
}
|
|
|
|
|
2022-08-13 09:35:33 +03:00
|
|
|
userSettingUpsert := &api.UserSettingUpsert{}
|
|
|
|
if err := json.NewDecoder(c.Request().Body).Decode(userSettingUpsert); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted post user setting upsert request").SetInternal(err)
|
2022-02-03 10:32:03 +03:00
|
|
|
}
|
2022-08-20 16:51:28 +03:00
|
|
|
if err := userSettingUpsert.Validate(); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Invalid user setting format").SetInternal(err)
|
2022-08-13 09:35:33 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
userSettingUpsert.UserID = userID
|
|
|
|
userSetting, err := s.Store.UpsertUserSetting(ctx, userSettingUpsert)
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to upsert user setting").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
|
|
|
|
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(userSetting)); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user setting response").SetInternal(err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
|
|
|
g.GET("/user/:id", func(c echo.Context) error {
|
|
|
|
ctx := c.Request().Context()
|
|
|
|
id, err := strconv.Atoi(c.Param("id"))
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted user id").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
user, err := s.Store.FindUser(ctx, &api.UserFind{
|
|
|
|
ID: &id,
|
|
|
|
})
|
2022-02-03 10:32:03 +03:00
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
2022-08-13 09:35:33 +03:00
|
|
|
if user != nil {
|
|
|
|
// data desensitize
|
|
|
|
user.OpenID = ""
|
2022-12-28 15:22:52 +03:00
|
|
|
user.Email = ""
|
2022-08-13 09:35:33 +03:00
|
|
|
}
|
|
|
|
|
2022-02-03 10:32:03 +03:00
|
|
|
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
|
2022-02-04 12:06:04 +03:00
|
|
|
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
|
2022-02-05 06:43:25 +03:00
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
|
2022-02-03 10:32:03 +03:00
|
|
|
}
|
2022-02-04 11:51:48 +03:00
|
|
|
return nil
|
|
|
|
})
|
2022-02-18 17:21:10 +03:00
|
|
|
|
2022-07-26 17:32:26 +03:00
|
|
|
g.PATCH("/user/:id", func(c echo.Context) error {
|
2022-08-07 04:23:46 +03:00
|
|
|
ctx := c.Request().Context()
|
2022-07-26 17:32:26 +03:00
|
|
|
userID, err := strconv.Atoi(c.Param("id"))
|
2022-02-03 10:32:03 +03:00
|
|
|
if err != nil {
|
2022-07-26 17:32:26 +03:00
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
|
2022-02-03 10:32:03 +03:00
|
|
|
}
|
2022-07-28 15:09:25 +03:00
|
|
|
currentUserID, ok := c.Get(getUserIDContextKey()).(int)
|
|
|
|
if !ok {
|
|
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
|
|
|
|
}
|
2022-08-07 04:23:46 +03:00
|
|
|
currentUser, err := s.Store.FindUser(ctx, &api.UserFind{
|
2022-05-19 13:32:04 +03:00
|
|
|
ID: ¤tUserID,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
|
|
|
|
}
|
|
|
|
if currentUser == nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Current session user not found with ID: %d", currentUserID)).SetInternal(err)
|
2022-07-26 17:32:26 +03:00
|
|
|
} else if currentUser.Role != api.Host && currentUserID != userID {
|
2022-05-19 13:32:04 +03:00
|
|
|
return echo.NewHTTPError(http.StatusForbidden, "Access forbidden for current session user").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
2022-10-26 18:00:09 +03:00
|
|
|
currentTs := time.Now().Unix()
|
2022-05-19 13:32:04 +03:00
|
|
|
userPatch := &api.UserPatch{
|
2022-10-26 18:00:09 +03:00
|
|
|
UpdatedTs: ¤tTs,
|
2022-05-19 13:32:04 +03:00
|
|
|
}
|
|
|
|
if err := json.NewDecoder(c.Request().Body).Decode(userPatch); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Malformatted patch user request").SetInternal(err)
|
|
|
|
}
|
2022-12-28 15:22:52 +03:00
|
|
|
userPatch.ID = userID
|
2022-12-27 16:51:43 +03:00
|
|
|
if err := userPatch.Validate(); err != nil {
|
2022-12-28 15:22:52 +03:00
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, "Invalid user patch format").SetInternal(err)
|
2022-08-20 16:51:28 +03:00
|
|
|
}
|
|
|
|
|
2022-05-19 13:32:04 +03:00
|
|
|
if userPatch.Password != nil && *userPatch.Password != "" {
|
|
|
|
passwordHash, err := bcrypt.GenerateFromPassword([]byte(*userPatch.Password), bcrypt.DefaultCost)
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
passwordHashStr := string(passwordHash)
|
|
|
|
userPatch.PasswordHash = &passwordHashStr
|
|
|
|
}
|
|
|
|
|
2022-07-26 17:32:26 +03:00
|
|
|
if userPatch.ResetOpenID != nil && *userPatch.ResetOpenID {
|
|
|
|
openID := common.GenUUID()
|
|
|
|
userPatch.OpenID = &openID
|
|
|
|
}
|
|
|
|
|
2022-08-07 04:23:46 +03:00
|
|
|
user, err := s.Store.PatchUser(ctx, userPatch)
|
2022-05-19 13:32:04 +03:00
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to patch user").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
2022-11-28 14:38:44 +03:00
|
|
|
userSettingList, err := s.Store.FindUserSettingList(ctx, &api.UserSettingFind{
|
|
|
|
UserID: userID,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find userSettingList").SetInternal(err)
|
|
|
|
}
|
|
|
|
user.UserSettingList = userSettingList
|
|
|
|
|
2022-05-19 13:32:04 +03:00
|
|
|
c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
|
|
|
|
if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
})
|
2022-07-26 16:12:20 +03:00
|
|
|
|
2022-07-26 17:32:26 +03:00
|
|
|
g.DELETE("/user/:id", func(c echo.Context) error {
|
2022-08-07 04:23:46 +03:00
|
|
|
ctx := c.Request().Context()
|
2022-07-28 15:09:25 +03:00
|
|
|
currentUserID, ok := c.Get(getUserIDContextKey()).(int)
|
|
|
|
if !ok {
|
|
|
|
return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
|
|
|
|
}
|
2022-08-07 04:23:46 +03:00
|
|
|
currentUser, err := s.Store.FindUser(ctx, &api.UserFind{
|
2022-07-26 16:12:20 +03:00
|
|
|
ID: ¤tUserID,
|
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
|
|
|
|
}
|
|
|
|
if currentUser == nil {
|
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Current session user not found with ID: %d", currentUserID)).SetInternal(err)
|
|
|
|
} else if currentUser.Role != api.Host {
|
|
|
|
return echo.NewHTTPError(http.StatusForbidden, "Access forbidden for current session user").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
2022-07-26 17:32:26 +03:00
|
|
|
userID, err := strconv.Atoi(c.Param("id"))
|
2022-07-26 16:12:20 +03:00
|
|
|
if err != nil {
|
2022-07-26 17:32:26 +03:00
|
|
|
return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
|
2022-07-26 16:12:20 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
userDelete := &api.UserDelete{
|
|
|
|
ID: userID,
|
|
|
|
}
|
2022-08-07 04:23:46 +03:00
|
|
|
if err := s.Store.DeleteUser(ctx, userDelete); err != nil {
|
2022-09-03 13:54:22 +03:00
|
|
|
if common.ErrorCode(err) == common.NotFound {
|
|
|
|
return echo.NewHTTPError(http.StatusNotFound, fmt.Sprintf("User ID not found: %d", userID))
|
|
|
|
}
|
2022-07-26 16:12:20 +03:00
|
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Failed to delete user").SetInternal(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return c.JSON(http.StatusOK, true)
|
|
|
|
})
|
2022-02-03 10:32:03 +03:00
|
|
|
}
|
2023-01-02 18:18:12 +03:00
|
|
|
|
|
|
|
func (s *Server) createUserCreateActivity(c echo.Context, user *api.User) error {
|
|
|
|
ctx := c.Request().Context()
|
|
|
|
payload := api.ActivityUserCreatePayload{
|
|
|
|
UserID: user.ID,
|
|
|
|
Username: user.Username,
|
|
|
|
Role: user.Role,
|
|
|
|
}
|
|
|
|
payloadStr, err := json.Marshal(payload)
|
|
|
|
if err != nil {
|
|
|
|
return errors.Wrap(err, "failed to marshal activity payload")
|
|
|
|
}
|
|
|
|
_, err = s.Store.CreateActivity(ctx, &api.ActivityCreate{
|
|
|
|
CreatorID: user.ID,
|
|
|
|
Type: api.ActivityUserCreate,
|
|
|
|
Level: api.ActivityInfo,
|
|
|
|
Payload: string(payloadStr),
|
|
|
|
})
|
|
|
|
return err
|
|
|
|
}
|