Super-frpc/backend
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

chore: add Auth function to handle all permission verification; remove all old auth codes

Browse Source
This commit is contained in:
NanamiAdmin
2026-03-30 13:50:52 +08:00
parent 839bad3c94
commit 67bea968c6
6 changed files with 97 additions and 411 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frpAct.go
+35 -142
View File
@@ -23,9 +23,10 @@ func CloseFrpcDatabase() error {
}
func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[CreateInstanceHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[CreateInstanceHandler] Auth failed: %v", err))
return
}
@@ -74,13 +75,6 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
instanceInfo.Additional = additional
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
return
}
req := CreateInstanceRequest{
InstanceInfo: instanceInfo,
BootAtStart: bootAtStart,
@@ -88,12 +82,6 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
Additional: instanceInfo.Additional,
}
if err := CheckPermission(userID, "superuser", "admin"); err != nil {
postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to check permission: %v", err))
SendErrorResponse(w, http.StatusForbidden, err.Error())
return
}
if req.InstanceInfo.Name == "" || req.InstanceInfo.ServerAddr == "" ||
req.InstanceInfo.ServerPort == "" || req.InstanceInfo.AuthMethod == "" {
SendErrorResponse(w, http.StatusBadRequest, "Missing required fields in instanceInfo")
@@ -177,8 +165,10 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
}
func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[DeleteInstanceHandler] Auth failed: %v", err))
return
}
@@ -209,19 +199,6 @@ func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[DeleteInstanceHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
return
}
if err := CheckPermission(userID, "superuser", "admin"); err != nil {
postLog.Error(fmt.Sprintf("[DeleteInstanceHandler] Failed to check permission: %v", err))
SendErrorResponse(w, http.StatusForbidden, err.Error())
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -261,9 +238,10 @@ func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
}
func ModifyInstanceHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Invalid request method: %s", r.Method))
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ModifyInstanceHandler] Auth failed: %v", err))
return
}
@@ -311,19 +289,6 @@ func ModifyInstanceHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
return
}
if err := CheckPermission(userID, "superuser", "admin"); err != nil {
postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Failed to check permission: %v", err))
SendErrorResponse(w, http.StatusForbidden, err.Error())
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] User %d tried to modify a not existed instance: %d", userID, instanceID))
@@ -526,16 +491,10 @@ func getStringFromMap(m map[string]interface{}, key string) string {
}
func ListInstancesHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[ListInstancesHandler] Invalid request method: %s", r.Method))
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
userID, err := Auth(w, r, http.MethodGet)
if err != nil {
postLog.Error(fmt.Sprintf("[ListInstancesHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ListInstancesHandler] Auth failed: %v", err))
return
}
@@ -564,9 +523,10 @@ func ListInstancesHandler(w http.ResponseWriter, r *http.Request) {
}
func StartInstanceHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[StartInstanceHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[StartInstanceHandler] Auth failed: %v", err))
return
}
@@ -597,25 +557,6 @@ func StartInstanceHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[StartInstanceHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
userType, err := GetUserType(userID)
if err != nil {
postLog.Error(fmt.Sprintf("[StartInstanceHandler] Failed to get user type: %v", err))
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
return
}
if userType != "admin" && userType != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
postLog.Error(fmt.Sprintf("[StartInstanceHandler] Permission Denied for user %d (type: %s)", userID, userType))
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -678,9 +619,10 @@ func StartInstanceHandler(w http.ResponseWriter, r *http.Request) {
}
func StopInstanceHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[StopInstanceHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[StopInstanceHandler] Auth failed: %v", err))
return
}
@@ -711,25 +653,6 @@ func StopInstanceHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[StopInstanceHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
userType, err := GetUserType(userID)
if err != nil {
postLog.Error(fmt.Sprintf("[StopInstanceHandler] Failed to get user type: %v", err))
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
return
}
if userType != "admin" && userType != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
postLog.Error(fmt.Sprintf("[StopInstanceHandler] Permission Denied for user %d (type: %s)", userID, userType))
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -792,9 +715,10 @@ func StopInstanceHandler(w http.ResponseWriter, r *http.Request) {
}
func RestartInstanceHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[RestartInstanceHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[RestartInstanceHandler] Auth failed: %v", err))
return
}
@@ -825,25 +749,6 @@ func RestartInstanceHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[RestartInstanceHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
userType, err := GetUserType(userID)
if err != nil {
postLog.Error(fmt.Sprintf("[RestartInstanceHandler] Failed to get user type: %v", err))
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
return
}
if userType != "admin" && userType != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
postLog.Error(fmt.Sprintf("[RestartInstanceHandler] Permission Denied for user %d (type: %s)", userID, userType))
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -906,9 +811,10 @@ func RestartInstanceHandler(w http.ResponseWriter, r *http.Request) {
}
func GetInstanceStatusHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[GetInstanceStatusHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodGet)
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[GetInstanceStatusHandler] Auth failed: %v", err))
return
}
@@ -925,13 +831,6 @@ func GetInstanceStatusHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[GetInstanceStatusHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
SendErrorResponse(w, http.StatusNotFound, "Instance not found")
@@ -974,9 +873,10 @@ func GetInstanceStatusHandler(w http.ResponseWriter, r *http.Request) {
}
func GetInstanceInfoHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[GetInstanceInfoHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodGet)
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[GetInstanceInfoHandler] Auth failed: %v", err))
return
}
@@ -993,13 +893,6 @@ func GetInstanceInfoHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[GetInstanceInfoHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
instance, err := DBQueryFrpcInstanceByID(instanceID)
if err == sql.ErrNoRows {
SendErrorResponse(w, http.StatusNotFound, "Instance not found")
frpLogger/initd.go
-3
View File
@@ -1,6 +1,3 @@
//go:build linux
// +build linux
package frpLogger
import (
frpLogger/systemd.go
-3
View File
@@ -1,6 +1,3 @@
//go:build linux
// +build linux
package frpLogger
import (
frpcProxyAct.go
+12 -50
View File
@@ -13,9 +13,10 @@ import (
)
func CreateProxyHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[CreateProxyHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[CreateProxyHandler] Auth failed: %v", err))
return
}
@@ -63,23 +64,6 @@ func CreateProxyHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[CreateProxyHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
userType, err := GetUserType(userID)
if err != nil {
postLog.Error(fmt.Sprintf("[CreateProxyHandler] Failed to get user type: %v", err))
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
return
} else if userType != "admin" && userType != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
return
}
var instance FrpcInstance
instanceIDInt, _ := strconv.Atoi(instanceID)
instance, err = DBQueryFrpcInstanceByID(instanceIDInt)
@@ -124,9 +108,10 @@ func CreateProxyHandler(w http.ResponseWriter, r *http.Request) {
}
func DeleteProxyHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[DeleteProxyHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodPost, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[DeleteProxyHandler] Auth failed: %v", err))
return
}
@@ -159,23 +144,6 @@ func DeleteProxyHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[DeleteProxyHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
userType, err := GetUserType(userID)
if err != nil {
postLog.Error(fmt.Sprintf("[DeleteProxyHandler] Failed to get user type: %v", err))
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user type")
return
} else if userType != "admin" && userType != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission Denied")
return
}
var instance FrpcInstance
instanceIDInt, _ := strconv.Atoi(instanceID)
instance, err = DBQueryFrpcInstanceByID(instanceIDInt)
@@ -220,9 +188,10 @@ func DeleteProxyHandler(w http.ResponseWriter, r *http.Request) {
}
func ListProxiesHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Debug(fmt.Sprintf("[ListProxiesHandler] Invalid request method: %s", r.Method))
userID, err := Auth(w, r, http.MethodGet)
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ListProxiesHandler] Auth failed: %v", err))
return
}
@@ -234,13 +203,6 @@ func ListProxiesHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, _, err := ValidateRequestWithHeader(w, r)
if err != nil {
postLog.Error(fmt.Sprintf("[ListProxiesHandler] Failed to validate request header: %v", err))
SendErrorResponse(w, http.StatusBadRequest, "Invalid request header")
return
}
var instance FrpcInstance
instanceIDInt, _ := strconv.Atoi(instanceID)
instance, err = DBQueryFrpcInstanceByID(instanceIDInt)
handlers.go
+28 -82
View File
@@ -3,7 +3,6 @@ package main
import (
"encoding/json"
"fmt"
"io"
"net/http"
"strconv"
"super-frpc/postLog"
@@ -50,80 +49,42 @@ func SendSuccessResponse(w http.ResponseWriter, message string, data interface{}
w.Write(jsonResp)
}
func ValidateRequest(w http.ResponseWriter, r *http.Request, requiredFields ...string) (int, string, error) { // ValidateRequest validates the request body and header
body, err := io.ReadAll(r.Body)
func Auth(w http.ResponseWriter, r *http.Request, targetMethod string, allowedUserLevels ...string) (int, error) {
if r.Method != targetMethod {
return 0, fmt.Errorf("Method not allowed: %s", targetMethod)
}
if !isDebug && !ValidateTimeStamp(r.Header) {
return 0, fmt.Errorf("Invalid or missing X-Timestamp in header")
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
if err != nil {
return 0, "", fmt.Errorf("Failed to read request body: %w", err)
}
defer r.Body.Close()
return ValidateRequestWithBody(w, r, body, requiredFields...)
}
func ValidateRequestWithBody(w http.ResponseWriter, r *http.Request, body []byte, requiredFields ...string) (int, string, error) {
var reqMap map[string]interface{}
if err := json.Unmarshal(body, &reqMap); err != nil {
return 0, "", fmt.Errorf("Invalid request format: %w", err)
return 0, fmt.Errorf("Invalid token format: %w", err)
}
token := r.Header.Get("X-Token")
if token == "" {
return 0, "", fmt.Errorf("Token is required in header: %s", token)
if err := ValidateToken(userID, r.Header.Get("X-Token")); err != nil {
return 0, fmt.Errorf("Token validation failed: %w", err)
}
if !isDebug {
if !ValidateTimeStamp(r.Header) {
return 0, "", fmt.Errorf("Invalid or missing X-Timestamp in header")
if len(allowedUserLevels) > 0 {
currentUser, err := DBQuerySpecificUser(userID)
if err != nil {
return 0, fmt.Errorf("Failed to query user: %w", err)
}
allowed := false
for _, level := range allowedUserLevels {
if currentUser.Type == level {
allowed = true
break
}
}
if !allowed {
return 0, fmt.Errorf("User level not allowed: required one of %v, got %s", allowedUserLevels, currentUser.Type)
}
}
userID, err := extractUserIDFromToken(token)
if err != nil {
return 0, "", fmt.Errorf("Invalid token format: %w", err)
}
if err := ValidateToken(userID, token); err != nil {
return 0, "", fmt.Errorf("Token validation failed: %w", err)
}
for _, field := range requiredFields {
if _, ok := reqMap[field]; !ok {
return 0, "", fmt.Errorf("required field %s is missing: %s", field, reqMap[field])
}
}
return userID, token, nil
}
func ValidateRequestWithHeader(w http.ResponseWriter, r *http.Request, requiredFields ...string) (int, string, error) {
token := r.Header.Get("X-Token")
if token == "" {
return 0, "", fmt.Errorf("Token is required in header: %s", token)
}
if !isDebug {
if !ValidateTimeStamp(r.Header) {
return 0, "", fmt.Errorf("Invalid or missing X-Timestamp in header")
}
}
userID, err := extractUserIDFromToken(token)
if err != nil {
return 0, "", fmt.Errorf("Invalid token format in header: %w", err)
}
if err := ValidateToken(userID, token); err != nil {
return 0, "", fmt.Errorf("Token validation failed in header: %w", err)
}
for _, field := range requiredFields {
headerValue := r.Header.Get(fmt.Sprintf("X-%s", field))
if headerValue == "" {
return 0, "", fmt.Errorf("required field %s is missing in header: %s", field, headerValue)
}
}
return userID, token, nil
return userID, nil
}
func GetUserType(userID int) (string, error) {
@@ -134,21 +95,6 @@ func GetUserType(userID int) (string, error) {
return user.Type, nil
}
func CheckPermission(userID int, requiredTypes ...string) error {
userType, err := GetUserType(userID)
if err != nil {
return fmt.Errorf("Failed to check permission: %w", err)
}
for _, t := range requiredTypes {
if userType == t {
return nil
}
}
return fmt.Errorf("Permission denied for user type %s", userType)
}
func GetClientIP(r *http.Request) string {
forwarded := r.Header.Get("X-Forwarded-For")
if forwarded != "" {
userAct.go
+22 -131
View File
@@ -181,21 +181,10 @@ func LoginHandler(w http.ResponseWriter, r *http.Request) {
}
func LogoutHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[LogoutHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := GetUserIDFromToken(r.Header.Get("X-Token"))
userID, err := Auth(w, r, http.MethodGet)
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[LogoutHandler] Invalid or missing token: %v", err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[LogoutHandler] Auth failed: %v", err))
return
}
@@ -226,15 +215,10 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
}
func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
postLog.Warning("[RemoveSessionHandler] Invalid or missing X-Timestamp in header")
userID, err := Auth(w, r, http.MethodPost, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Auth failed: %v", err))
return
}
@@ -259,19 +243,6 @@ func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid or missing token: %v", err))
return
}
if err := CheckPermission(userID, "superuser"); err != nil {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if err := RemoveSession(req.SessionID); err != nil {
SendErrorResponse(w, http.StatusInternalServerError, fmt.Sprintf("Failed to remove session: %v", err))
postLog.Error(fmt.Sprintf("[RemoveSessionHandler] Failed to remove session %s: %v", req.SessionID, err))
@@ -283,31 +254,10 @@ func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
}
func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
_, err := Auth(w, r, http.MethodPost, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid or missing token: %v", err))
return
}
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if user.Type != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[CreateUserHandler] Auth failed: %v", err))
return
}
@@ -338,14 +288,14 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
return
}
userID, err = AddUser(req.Username, req.Passwd, req.Type)
userID, err := AddUser(req.Username, req.Passwd, req.Type)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, err.Error())
postLog.Error(fmt.Sprintf("[RegisterHandler] Failed to register user \"%s\": %v", req.Username, err))
return
}
user, err = GetUserByID(userID)
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to retrieve user after creation")
postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to retrieve user \"%s\" after creation: %v", req.Username, err))
@@ -361,31 +311,10 @@ func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
}
func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
_, err := Auth(w, r, http.MethodPost, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Invalid or missing token: %v", err))
return
}
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
postLog.Error(fmt.Sprintf("[RemoveUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if user.Type != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[RemoveUserHandler] Auth failed: %v", err))
return
}
@@ -417,33 +346,13 @@ func RemoveUserHandler(w http.ResponseWriter, r *http.Request) {
}
func ListUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid request method: %s", r.Method))
_, err := Auth(w, r, http.MethodGet, "superuser")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ListUserHandler] Auth failed: %v", err))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[ListUserHandler] Invalid or missing token: %v", err))
return
}
user, err := GetUserByID(userID)
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
postLog.Error(fmt.Sprintf("[ListUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if user.Type != "superuser" {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[ListUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
return
}
userList, err := DBQueryUsers()
if err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to list users")
@@ -454,28 +363,10 @@ func ListUserHandler(w http.ResponseWriter, r *http.Request) {
}
func ListActiveSessionsHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
postLog.Warning("[ListActiveSessionsHandler] Invalid or missing X-Timestamp in header")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
userID, err := Auth(w, r, http.MethodGet, "superuser", "admin")
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Invalid or missing token: %v", err))
return
}
if err := CheckPermission(userID, "superuser"); err != nil {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
SendErrorResponse(w, http.StatusUnauthorized, err.Error())
postLog.Warning(fmt.Sprintf("[ListActiveSessionsHandler] Auth failed: %v", err))
return
}