1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
package api
import (
"errors"
"net/http"
"time"
"codeberg.org/snonux/player/internal/service"
)
type bootstrapRequest struct {
Username string `json:"username"`
Password string `json:"password"`
}
type loginRequest struct {
Username string `json:"username"`
Password string `json:"password"`
}
// ------------------------------------------------------------------
// Bootstrap & Auth
// ------------------------------------------------------------------
func (s *Server) handleBootstrap(w http.ResponseWriter, r *http.Request) {
if !requireService(w, s.authSvc) {
return
}
var req bootstrapRequest
if err := readJSON(r, &req); err != nil {
badRequest(w, "invalid request body")
return
}
if req.Username == "" || req.Password == "" {
badRequest(w, "username and password required")
return
}
res, err := s.authSvc.Bootstrap(r.Context(), req.Username, req.Password)
if err != nil {
if errors.Is(err, service.ErrAlreadyBootstrapped) {
forbidden(w, "bootstrap already complete")
return
}
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
return
}
s.setSessionCookie(w, res.SessionID)
writeJSON(w, http.StatusOK, map[string]interface{}{"id": res.User.ID, "username": res.User.Username, "is_admin": res.User.IsAdmin})
}
func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
if !requireService(w, s.authSvc) {
return
}
var req loginRequest
if err := readJSON(r, &req); err != nil {
badRequest(w, "invalid request body")
return
}
if req.Username == "" || req.Password == "" {
badRequest(w, "username and password required")
return
}
res, err := s.authSvc.Login(r.Context(), req.Username, req.Password)
if err != nil {
if errors.Is(err, service.ErrInvalidCredentials) {
writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
return
}
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
return
}
s.setSessionCookie(w, res.SessionID)
writeJSON(w, http.StatusOK, map[string]interface{}{"id": res.User.ID, "username": res.User.Username, "is_admin": res.User.IsAdmin})
}
func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
cookie, err := r.Cookie("session")
if err == nil && cookie.Value != "" {
_ = s.sm.DeleteSession(r.Context(), cookie.Value)
}
s.clearSessionCookie(w)
w.WriteHeader(http.StatusNoContent)
}
func (s *Server) handleHealthz(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
}
func (s *Server) handleReadyz(w http.ResponseWriter, r *http.Request) {
if err := s.pingStore(r.Context()); err != nil {
http.Error(w, "not ready", http.StatusServiceUnavailable)
return
}
w.WriteHeader(http.StatusOK)
}
func (s *Server) setSessionCookie(w http.ResponseWriter, value string) {
http.SetCookie(w, &http.Cookie{
Name: "session",
Value: value,
Path: "/",
HttpOnly: true,
Secure: s.cfg.SecureCookies,
SameSite: http.SameSiteStrictMode,
Expires: time.Now().Add(time.Duration(s.cfg.SessionTimeoutHours) * time.Hour),
})
}
func (s *Server) clearSessionCookie(w http.ResponseWriter) {
http.SetCookie(w, &http.Cookie{
Name: "session",
Value: "",
Path: "/",
HttpOnly: true,
Secure: s.cfg.SecureCookies,
SameSite: http.SameSiteStrictMode,
MaxAge: -1,
Expires: time.Unix(0, 0),
})
}
|
