277 lines
7.1 KiB
Go
277 lines
7.1 KiB
Go
package db
|
|
|
|
import (
|
|
"database/sql"
|
|
"errors"
|
|
"strings"
|
|
"time"
|
|
|
|
_ "modernc.org/sqlite"
|
|
)
|
|
|
|
var ErrUserNotFound = errors.New("user not found")
|
|
var ErrUserExists = errors.New("username already exists")
|
|
|
|
// User represents a local account stored in SQLite.
|
|
type User struct {
|
|
ID int64
|
|
Username string
|
|
PassHash string
|
|
Role string
|
|
CreatedAt time.Time
|
|
}
|
|
|
|
// DB wraps the SQLite connection.
|
|
type DB struct {
|
|
sql *sql.DB
|
|
}
|
|
|
|
// New opens (or creates) the SQLite database at path and runs migrations.
|
|
func New(path string) (*DB, error) {
|
|
sqldb, err := sql.Open("sqlite", path+"?_journal=WAL&_timeout=5000")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
d := &DB{sql: sqldb}
|
|
if err := d.init(); err != nil {
|
|
sqldb.Close()
|
|
return nil, err
|
|
}
|
|
return d, nil
|
|
}
|
|
|
|
func (d *DB) Close() error {
|
|
return d.sql.Close()
|
|
}
|
|
|
|
func (d *DB) init() error {
|
|
_, err := d.sql.Exec(`
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
username TEXT NOT NULL UNIQUE,
|
|
pass_hash TEXT NOT NULL,
|
|
role TEXT NOT NULL DEFAULT 'user',
|
|
is_ldap BOOLEAN NOT NULL DEFAULT 0,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS groups (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
name TEXT NOT NULL UNIQUE,
|
|
is_ldap BOOLEAN NOT NULL DEFAULT 0,
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
|
);
|
|
CREATE TABLE IF NOT EXISTS user_groups (
|
|
user_id INTEGER NOT NULL,
|
|
group_id INTEGER NOT NULL,
|
|
PRIMARY KEY(user_id, group_id),
|
|
FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE,
|
|
FOREIGN KEY(group_id) REFERENCES groups(id) ON DELETE CASCADE
|
|
);
|
|
CREATE TABLE IF NOT EXISTS acl (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
path TEXT NOT NULL,
|
|
subject_type TEXT NOT NULL CHECK(subject_type IN ('user', 'group')),
|
|
subject_id INTEGER NOT NULL,
|
|
can_search BOOLEAN NOT NULL DEFAULT 0,
|
|
can_view BOOLEAN NOT NULL DEFAULT 0,
|
|
can_read BOOLEAN NOT NULL DEFAULT 0,
|
|
can_edit BOOLEAN NOT NULL DEFAULT 0,
|
|
can_create BOOLEAN NOT NULL DEFAULT 0,
|
|
can_delete BOOLEAN NOT NULL DEFAULT 0,
|
|
can_move BOOLEAN NOT NULL DEFAULT 0,
|
|
UNIQUE(path, subject_type, subject_id)
|
|
);
|
|
`)
|
|
return err
|
|
}
|
|
|
|
// HasUsers returns true if at least one user account exists.
|
|
func (d *DB) HasUsers() bool {
|
|
var n int
|
|
d.sql.QueryRow(`SELECT COUNT(*) FROM users`).Scan(&n)
|
|
return n > 0
|
|
}
|
|
|
|
// CreateUser inserts a new user. Returns ErrUserExists if the username is taken.
|
|
func (d *DB) CreateUser(username, passHash, role string) error {
|
|
_, err := d.sql.Exec(
|
|
`INSERT INTO users (username, pass_hash, role) VALUES (?, ?, ?)`,
|
|
username, passHash, role,
|
|
)
|
|
if err != nil && strings.Contains(err.Error(), "UNIQUE constraint failed") {
|
|
return ErrUserExists
|
|
}
|
|
return err
|
|
}
|
|
|
|
// GetUser fetches a single user by username.
|
|
func (d *DB) GetUser(username string) (*User, error) {
|
|
row := d.sql.QueryRow(
|
|
`SELECT id, username, pass_hash, role, created_at FROM users WHERE username = ?`,
|
|
username,
|
|
)
|
|
u := &User{}
|
|
var createdAt string
|
|
err := row.Scan(&u.ID, &u.Username, &u.PassHash, &u.Role, &createdAt)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return nil, ErrUserNotFound
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
u.CreatedAt, _ = time.Parse("2006-01-02 15:04:05", createdAt)
|
|
return u, nil
|
|
}
|
|
|
|
// ListUsers returns all users ordered by id.
|
|
func (d *DB) ListUsers() ([]*User, error) {
|
|
rows, err := d.sql.Query(
|
|
`SELECT id, username, role, created_at FROM users ORDER BY id`,
|
|
)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
var users []*User
|
|
for rows.Next() {
|
|
u := &User{}
|
|
var createdAt string
|
|
if err := rows.Scan(&u.ID, &u.Username, &u.Role, &createdAt); err != nil {
|
|
return nil, err
|
|
}
|
|
u.CreatedAt, _ = time.Parse("2006-01-02 15:04:05", createdAt)
|
|
users = append(users, u)
|
|
}
|
|
return users, rows.Err()
|
|
}
|
|
|
|
// DeleteUser removes a user. Returns ErrUserNotFound if they don't exist.
|
|
func (d *DB) DeleteUser(username string) error {
|
|
res, err := d.sql.Exec(`DELETE FROM users WHERE username = ?`, username)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, _ := res.RowsAffected()
|
|
if n == 0 {
|
|
return ErrUserNotFound
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// UpdatePassword replaces the stored hash for a user.
|
|
func (d *DB) UpdatePassword(username, passHash string) error {
|
|
res, err := d.sql.Exec(
|
|
`UPDATE users SET pass_hash = ? WHERE username = ?`,
|
|
passHash, username,
|
|
)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, _ := res.RowsAffected()
|
|
if n == 0 {
|
|
return ErrUserNotFound
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// UserCount returns the total number of local accounts.
|
|
func (d *DB) UserCount() (int, error) {
|
|
var n int
|
|
err := d.sql.QueryRow(`SELECT COUNT(*) FROM users`).Scan(&n)
|
|
return n, err
|
|
}
|
|
|
|
// --- LDAP & Roles ---
|
|
|
|
// CreateOrUpdateLDAPUser inserts or updates an LDAP user (without password, role='user').
|
|
func (d *DB) CreateOrUpdateLDAPUser(username string) error {
|
|
_, err := d.sql.Exec(`
|
|
INSERT INTO users (username, pass_hash, role, is_ldap)
|
|
VALUES (?, '', 'user', 1)
|
|
ON CONFLICT(username) DO UPDATE SET is_ldap=1;
|
|
`, username)
|
|
return err
|
|
}
|
|
|
|
// CreateOrUpdateGroup inserts or updates a group (local or LDAP).
|
|
func (d *DB) CreateOrUpdateGroup(name string, isLdap bool) error {
|
|
ldVal := 0
|
|
if isLdap {
|
|
ldVal = 1
|
|
}
|
|
_, err := d.sql.Exec(`
|
|
INSERT INTO groups (name, is_ldap)
|
|
VALUES (?, ?)
|
|
ON CONFLICT(name) DO UPDATE SET is_ldap=excluded.is_ldap;
|
|
`, name, ldVal)
|
|
return err
|
|
}
|
|
|
|
// --- ACL Methods ---
|
|
|
|
type ACLEntry struct {
|
|
ID int64
|
|
Path string
|
|
SubjectType string
|
|
SubjectID int64
|
|
CanSearch bool
|
|
CanView bool
|
|
CanRead bool
|
|
CanEdit bool
|
|
CanCreate bool
|
|
CanDelete bool
|
|
CanMove bool
|
|
}
|
|
|
|
// SetACL inserts or replaces an ACL entry.
|
|
func (d *DB) SetACL(entry ACLEntry) error {
|
|
_, err := d.sql.Exec(`
|
|
INSERT INTO acl (path, subject_type, subject_id, can_search, can_view, can_read, can_edit, can_create, can_delete, can_move)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
|
|
ON CONFLICT(path, subject_type, subject_id) DO UPDATE SET
|
|
can_search = excluded.can_search,
|
|
can_view = excluded.can_view,
|
|
can_read = excluded.can_read,
|
|
can_edit = excluded.can_edit,
|
|
can_create = excluded.can_create,
|
|
can_delete = excluded.can_delete,
|
|
can_move = excluded.can_move;
|
|
`, entry.Path, entry.SubjectType, entry.SubjectID,
|
|
entry.CanSearch, entry.CanView, entry.CanRead, entry.CanEdit,
|
|
entry.CanCreate, entry.CanDelete, entry.CanMove)
|
|
return err
|
|
}
|
|
|
|
// RemoveACL deletes an ACL entry by ID.
|
|
func (d *DB) RemoveACL(id int64) error {
|
|
_, err := d.sql.Exec(`DELETE FROM acl WHERE id = ?`, id)
|
|
return err
|
|
}
|
|
|
|
// GetACLsForPath retrieves all ACL definitions for a specific document or folder.
|
|
func (d *DB) GetACLsForPath(path string) ([]ACLEntry, error) {
|
|
rows, err := d.sql.Query(`
|
|
SELECT id, path, subject_type, subject_id, can_search, can_view, can_read, can_edit, can_create, can_delete, can_move
|
|
FROM acl WHERE path = ?
|
|
`, path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
|
|
var entries []ACLEntry
|
|
for rows.Next() {
|
|
var e ACLEntry
|
|
if err := rows.Scan(
|
|
&e.ID, &e.Path, &e.SubjectType, &e.SubjectID,
|
|
&e.CanSearch, &e.CanView, &e.CanRead, &e.CanEdit,
|
|
&e.CanCreate, &e.CanDelete, &e.CanMove,
|
|
); err != nil {
|
|
return nil, err
|
|
}
|
|
entries = append(entries, e)
|
|
}
|
|
return entries, nil
|
|
}
|