feat: user roles - admins and users limited to the machines given to them, user editor with machines, password sign-in and its lock; direct address without Cloudflare as the agents' fallback and in the installer; version 0.1.2

internal/server/users.go

@@ -0,0 +1,89 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+)
+
+// GET /api/panel/users/{id}/agents - every machine, and which of them the
+// user may use, for the editor of a user's machines.
+func (s *Server) handleUserAgents(w http.ResponseWriter, r *http.Request) {
+	id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	u, _ := s.db.AdminByID(id)
+	if u == nil {
+		http.NotFound(w, r)
+		return
+	}
+	agents, _ := s.db.ListAgents()
+	mine := s.db.UserAgents(id)
+	type item struct {
+		ID       string `json:"id"`
+		Name     string `json:"name"`
+		Hostname string `json:"hostname"`
+		Online   bool   `json:"online"`
+		On       bool   `json:"on"`
+	}
+	out := make([]item, 0, len(agents))
+	for _, a := range agents {
+		out = append(out, item{a.ID, a.Name, a.Hostname, s.online(&a), mine[a.ID]})
+	}
+	writeJSON(w, map[string]any{"username": u.Username, "agents": out})
+}
+
+// POST /api/panel/users/{id} - change a user: the role, the machines, the
+// password sign-in, and whether they may switch it themselves. Fields left
+// out stay as they are.
+func (s *Server) handleUserEdit(w http.ResponseWriter, r *http.Request) {
+	me := s.currentAdmin(r)
+	id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	u, _ := s.db.AdminByID(id)
+	if u == nil {
+		writeJSON(w, map[string]any{"ok": false, "error": "нет такого пользователя"})
+		return
+	}
+	var in struct {
+		Role        *string   `json:"role"`
+		Agents      *[]string `json:"agents"`
+		PasswordOff *bool     `json:"password_off"`
+		PwLocked    *bool     `json:"pw_locked"`
+	}
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 64<<10)).Decode(&in); err != nil {
+		writeJSON(w, map[string]any{"ok": false, "error": "плохой запрос"})
+		return
+	}
+	fail := func(msg string) { writeJSON(w, map[string]any{"ok": false, "error": msg}) }
+	if in.Role != nil {
+		role := *in.Role
+		if role != RoleAdmin && role != RoleUser {
+			fail("нет такой роли")
+			return
+		}
+		if role == RoleUser && u.IsAdmin() && s.db.CountRole(RoleAdmin) <= 1 {
+			fail("это последний администратор")
+			return
+		}
+		_ = s.db.SetUserRole(id, role)
+		s.db.Audit(me.ID, "", "user_role:"+u.Username+":"+role)
+	}
+	if in.Agents != nil {
+		_ = s.db.SetUserAgents(id, *in.Agents)
+		s.db.Audit(me.ID, "", "user_agents:"+u.Username+":"+strconv.Itoa(len(*in.Agents)))
+	}
+	if in.PasswordOff != nil {
+		if *in.PasswordOff && s.db.CountAdminKeys(id) == 0 {
+			fail("у пользователя нет ключей доступа - без пароля он не войдёт")
+			return
+		}
+		_ = s.db.SetPasswordOff(id, *in.PasswordOff)
+		action := "password_on"
+		if *in.PasswordOff {
+			action = "password_off"
+		}
+		s.db.Audit(me.ID, "", action+":"+u.Username)
+	}
+	if in.PwLocked != nil {
+		_ = s.db.SetPwLocked(id, *in.PwLocked)
+	}
+	writeJSON(w, map[string]any{"ok": true})
+}