panels/services/gateway-service/internal/api/v1/user.go

// Copyright 2023 Declan Teevan
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package v1

import (
	"context"
	"time"

	"github.com/gofiber/fiber/v2"

	"github.com/hexolan/panels/gateway-service/internal/api/handlers"
	"github.com/hexolan/panels/gateway-service/internal/rpc"
	"github.com/hexolan/panels/gateway-service/internal/rpc/userv1"
)

type userSignupForm struct {
	Username string
	Password string
}

func getCurrentUser(c *fiber.Ctx) (*userv1.User, error) {
	// access token claims
	tokenClaims, err := handlers.GetTokenClaims(c)
	if err != nil {
		return nil, err
	}

	// fetch current user
	return getUserById(tokenClaims.Subject)
}

func getUserById(id string) (*userv1.User, error) {
	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	user, err := rpc.Svcs.GetUserSvc().GetUser(
		ctx,
		&userv1.GetUserByIdRequest{Id: id},
	)

	return user, err
}

func getUserByUsername(username string) (*userv1.User, error) {
	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	user, err := rpc.Svcs.GetUserSvc().GetUserByName(
		ctx,
		&userv1.GetUserByNameRequest{Username: username},
	)

	return user, err
}

func GetUserById(c *fiber.Ctx) error {
	user, err := getUserById(c.Params("id"))
	if err != nil {
		return err
	}

	return c.JSON(fiber.Map{"status": "success", "data": user})
}

func GetUserByUsername(c *fiber.Ctx) error {
	user, err := getUserByUsername(c.Params("username"))
	if err != nil {
		return err
	}

	return c.JSON(fiber.Map{"status": "success", "data": user})
}

func GetCurrentUser(c *fiber.Ctx) error {
	user, err := getCurrentUser(c)
	if err != nil {
		return err
	}

	return c.JSON(fiber.Map{"status": "success", "data": user})
}

func DeleteUserById(c *fiber.Ctx) error {
	// get current user info
	currentUser, err := getCurrentUser(c)
	if err != nil {
		return err
	}

	// check current user has permission to delete user
	if currentUser.Id != c.Params("id") && !currentUser.IsAdmin {
		return fiber.NewError(fiber.StatusForbidden, "no permissions to delete that user")
	}

	// delete the user
	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
	defer cancel()
	_, err = rpc.Svcs.GetUserSvc().DeleteUser(
		ctx,
		&userv1.DeleteUserByIdRequest{Id: c.Params("id")},
	)
	if err != nil {
		return err
	}

	return c.JSON(fiber.Map{"status": "success", "msg": "user deleted"})
}

func DeleteUserByUsername(c *fiber.Ctx) error {
	// get current user info
	currentUser, err := getCurrentUser(c)
	if err != nil {
		return err
	}

	// check current user has permission to delete user
	if currentUser.Id != c.Params("id") && !currentUser.IsAdmin {
		return fiber.NewError(fiber.StatusForbidden, "no permissions to delete that user")
	}

	// delete the user
	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
	defer cancel()
	_, err = rpc.Svcs.GetUserSvc().DeleteUserByName(
		ctx,
		&userv1.DeleteUserByNameRequest{Username: c.Params("username")},
	)
	if err != nil {
		return err
	}

	return c.JSON(fiber.Map{"status": "success", "msg": "user deleted"})
}

func DeleteCurrentUser(c *fiber.Ctx) error {
	// View access token claims
	tokenClaims, err := handlers.GetTokenClaims(c)
	if err != nil {
		return err
	}

	// RPC call
	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	_, err = rpc.Svcs.GetUserSvc().DeleteUser(
		ctx,
		&userv1.DeleteUserByIdRequest{Id: tokenClaims.Subject},
	)
	if err != nil {
		return err
	}

	return c.JSON(fiber.Map{"status": "success", "msg": "user deleted"})
}

func UserSignup(c *fiber.Ctx) error {
	// Parse the body data
	form := new(userSignupForm)
	if err := c.BodyParser(form); err != nil {
		fiber.NewError(fiber.StatusBadRequest, "malformed request")
	}

	// Attempt to create the user
	// todo: defer this logic away from gateway-service in future (potentially into seperate registration-service)
	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
	defer cancel()
	user, err := rpc.Svcs.GetUserSvc().CreateUser(
		ctx,
		&userv1.CreateUserRequest{
			Data: &userv1.UserMutable{
				Username: &form.Username,
			},
		},
	)
	if err != nil {
		return err
	}

	// Attempt to set password auth method for the user
	err = setAuthMethod(user.Id, form.Password)
	if err != nil {
		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
		defer cancel()
		_, _ = rpc.Svcs.GetUserSvc().DeleteUser(
			ctx,
			&userv1.DeleteUserByIdRequest{Id: user.Id},
		)
		return err
	}

	// Signup success - attempt to get auth token
	token, _ := authWithPassword(user.Id, form.Password)
	return c.JSON(fiber.Map{
		"status": "success",
		"data": fiber.Map{
			"user":  user,
			"token": token,
		},
	})
}