Closer to lavender v2

Makefile

@@ -0,0 +1,10 @@
+SQL_SRC_DIR := database
+SQL_FILES := $(wildcard $(SQL_SRC_DIR)/{migrations,queries}/*.sql)
+
+all: sqlc
+
+sqlc: $(SQL_FILES)
+	sqlc generate
+
+build: sqlc
+	go build ./cmd/lavender

database/clientstore.go

@@ -1,14 +1,18 @@
 package database
 
-import "github.com/go-oauth2/oauth2/v4"
+import (
+	"bufio"
+	"github.com/go-oauth2/oauth2/v4"
+	"strings"
+)
 
 var _ oauth2.ClientInfo = &ClientStore{}
 
 func (c *ClientStore) GetID() string     { return c.Subject }
 func (c *ClientStore) GetSecret() string { return c.Secret }
 func (c *ClientStore) GetDomain() string { return c.Domain }
 func (c *ClientStore) IsPublic() bool    { return c.Public }
-func (c *ClientStore) GetUserID() string { return c.Owner }
+func (c *ClientStore) GetUserID() string { return c.OwnerSubject }
 
 // GetName is an extra field for the oauth handler to display the application
 // name
@@ -22,4 +26,12 @@ func (c *ClientStore) IsSSO() bool { return c.Sso }
 func (c *ClientStore) IsActive() bool { return c.Active }
 
 // UsePerms is an extra field for the userinfo handler to return user permissions matching the requested values
-func (c *ClientStore) UsePerms() string { return c.Perms }
+func (c *ClientStore) UsePerms() []string {
+	perms := make([]string, 0)
+	sc := bufio.NewScanner(strings.NewReader(c.Perms))
+	sc.Split(bufio.ScanWords)
+	if sc.Scan() {
+		perms = append(perms, sc.Text())
+	}
+	return perms
+}

database/migrations/20240820202502_init.down.sql

@@ -0,0 +1,5 @@
+DROP TABLE users;
+DROP INDEX username_index;
+DROP TABLE roles;
+DROP TABLE otp;
+DROP TABLE client_store;

database/migrations/20240820202502_init.up.sql

@@ -0,0 +1,69 @@
+CREATE TABLE users
+(
+    id             INTEGER  NOT NULL UNIQUE PRIMARY KEY AUTOINCREMENT,
+    subject        TEXT     NOT NULL UNIQUE,
+    password       TEXT     NOT NULL,
+
+    email          TEXT     NOT NULL,
+    email_verified BOOLEAN  NOT NULL DEFAULT 0,
+
+    updated_at     DATETIME NOT NULL,
+    registered     DATETIME NOT NULL,
+    active         BOOLEAN  NOT NULL DEFAULT 1
+);
+
+CREATE INDEX users_subject ON users (subject);
+
+CREATE TABLE profiles
+(
+    subject    TEXT     NOT NULL UNIQUE PRIMARY KEY,
+    name       TEXT     NOT NULL,
+    picture    TEXT     NOT NULL DEFAULT '',
+    website    TEXT     NOT NULL DEFAULT '',
+    pronouns   TEXT     NOT NULL DEFAULT 'they/them',
+    birthdate  DATE     NULL,
+    zone       TEXT     NOT NULL DEFAULT 'UTC',
+    locale     TEXT     NOT NULL DEFAULT 'en-US',
+    updated_at DATETIME NOT NULL
+);
+
+CREATE TABLE roles
+(
+    id   INTEGER NOT NULL UNIQUE PRIMARY KEY AUTOINCREMENT,
+    role TEXT    NOT NULL UNIQUE
+);
+
+CREATE TABLE users_roles
+(
+    role_id INTEGER NOT NULL,
+    user_id INTEGER NOT NULL,
+
+    FOREIGN KEY (role_id) REFERENCES roles (id),
+    FOREIGN KEY (user_id) REFERENCES users (id),
+
+    CONSTRAINT user_role UNIQUE (role_id, user_id)
+);
+
+CREATE TABLE otp
+(
+    subject INTEGER NOT NULL UNIQUE PRIMARY KEY,
+    secret  TEXT    NOT NULL,
+    digits  INTEGER NOT NULL,
+
+    FOREIGN KEY (subject) REFERENCES users (subject)
+);
+
+CREATE TABLE client_store
+(
+    subject       TEXT    NOT NULL UNIQUE PRIMARY KEY,
+    name          TEXT    NOT NULL,
+    secret        TEXT    NOT NULL UNIQUE,
+    domain        TEXT    NOT NULL,
+    owner_subject TEXT    NOT NULL,
+    perms         TEXT    NOT NULL,
+    public        BOOLEAN NOT NULL,
+    sso           BOOLEAN NOT NULL,
+    active        BOOLEAN NOT NULL DEFAULT 1,
+
+    FOREIGN KEY (owner_subject) REFERENCES users (subject)
+);

database/password-wrapper.go

@@ -0,0 +1,78 @@
+package database
+
+import (
+	"context"
+	"github.com/1f349/lavender/database/types"
+	"github.com/1f349/lavender/password"
+	"github.com/google/uuid"
+	"time"
+)
+
+type AddUserParams struct {
+	Name      string         `json:"name"`
+	Username  string         `json:"username"`
+	Password  string         `json:"password"`
+	Email     string         `json:"email"`
+	Role      types.UserRole `json:"role"`
+	UpdatedAt time.Time      `json:"updated_at"`
+	Active    bool           `json:"active"`
+}
+
+func (q *Queries) AddUser(ctx context.Context, arg AddUserParams) (string, error) {
+	pwHash, err := password.HashPassword(arg.Password)
+	if err != nil {
+		return "", err
+	}
+	n := time.Now()
+	a := addUserParams{
+		Subject:       uuid.NewString(),
+		Password:      pwHash,
+		Email:         arg.Email,
+		EmailVerified: false,
+		UpdatedAt:     n,
+		Registered:    n,
+		Active:        true,
+	}
+	return a.Subject, q.addUser(ctx, a)
+}
+
+type CheckLoginResult struct {
+	Subject       string `json:"subject"`
+	HasOtp        bool   `json:"has_otp"`
+	Email         string `json:"email"`
+	EmailVerified bool   `json:"email_verified"`
+}
+
+func (q *Queries) CheckLogin(ctx context.Context, un, pw string) (CheckLoginResult, error) {
+	login, err := q.checkLogin(ctx, un)
+	if err != nil {
+		return CheckLoginResult{}, err
+	}
+	err = password.CheckPasswordHash(login.Password, pw)
+	if err != nil {
+		return CheckLoginResult{}, err
+	}
+	return CheckLoginResult{
+		Subject:       login.Subject,
+		HasOtp:        login.HasOtp,
+		Email:         login.Email,
+		EmailVerified: login.EmailVerified,
+	}, nil
+}
+
+func (q *Queries) ChangePassword(ctx context.Context, subject, newPw string) error {
+	userPassword, err := q.getUserPassword(ctx, subject)
+	if err != nil {
+		return err
+	}
+	newPwHash, err := password.HashPassword(newPw)
+	if err != nil {
+		return err
+	}
+	return q.changeUserPassword(ctx, changeUserPasswordParams{
+		Password:   newPwHash,
+		UpdatedAt:  time.Now(),
+		Subject:    subject,
+		Password_2: userPassword,
+	})
+}

database/profile-patch.go

@@ -0,0 +1,62 @@
+package database
+
+import (
+	"fmt"
+	"github.com/1f349/lavender/database/types"
+	"github.com/hardfinhq/go-date"
+	"github.com/mrmelon54/pronouns"
+	"golang.org/x/text/language"
+	"net/url"
+	"time"
+)
+
+type ProfilePatch struct {
+	Name      string            `json:"name"`
+	Picture   string            `json:"picture"`
+	Website   string            `json:"website"`
+	Pronouns  types.UserPronoun `json:"pronouns"`
+	Birthdate date.NullDate     `json:"birthdate"`
+	Zone      types.UserZone    `json:"zone"`
+	Locale    types.UserLocale  `json:"locale"`
+}
+
+func (p *ProfilePatch) ParseFromForm(v url.Values) (safeErrs []error) {
+	var err error
+	p.Name = v.Get("name")
+	p.Picture = v.Get("picture")
+	p.Website = v.Get("website")
+	if v.Has("reset_pronouns") {
+		p.Pronouns.Pronoun = pronouns.TheyThem
+	} else {
+		p.Pronouns.Pronoun, err = pronouns.FindPronoun(v.Get("pronouns"))
+		if err != nil {
+			safeErrs = append(safeErrs, fmt.Errorf("invalid pronoun selected"))
+		}
+	}
+	if v.Has("reset_birthdate") || v.Get("birthdate") == "" {
+		p.Birthdate = date.NullDate{}
+	} else {
+		p.Birthdate = date.NullDate{Valid: true}
+		p.Birthdate.Date, err = date.FromString(v.Get("birthdate"))
+		if err != nil {
+			safeErrs = append(safeErrs, fmt.Errorf("invalid time selected"))
+		}
+	}
+	if v.Has("reset_zoneinfo") {
+		p.Zone.Location = time.UTC
+	} else {
+		p.Zone.Location, err = time.LoadLocation(v.Get("zoneinfo"))
+		if err != nil {
+			safeErrs = append(safeErrs, fmt.Errorf("invalid timezone selected"))
+		}
+	}
+	if v.Has("reset_locale") {
+		p.Locale.Tag = language.AmericanEnglish
+	} else {
+		p.Locale.Tag, err = language.Parse(v.Get("locale"))
+		if err != nil {
+			safeErrs = append(safeErrs, fmt.Errorf("invalid language selected"))
+		}
+	}
+	return
+}

database/queries/manage-oauth.sql

@@ -5,14 +5,21 @@ WHERE subject = ?
 LIMIT 1;
 
 -- name: GetAppList :many
-SELECT subject, name, domain, owner, perms, public, sso, active
+SELECT subject,
+       name,
+       domain,
+       owner_subject,
+       perms,
+       public,
+       sso,
+       active
 FROM client_store
-WHERE owner = ?
+WHERE owner_subject = ?
    OR ? = 1
 LIMIT 25 OFFSET ?;
 
 -- name: InsertClientApp :exec
-INSERT INTO client_store (subject, name, secret, domain, owner, perms, public, sso, active)
+INSERT INTO client_store (subject, name, secret, domain, perms, public, sso, active, owner_subject)
 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?);
 
 -- name: UpdateClientApp :exec
@@ -24,10 +31,10 @@ SET name   = ?,
     sso    = ?,
     active = ?
 WHERE subject = ?
-  AND owner = ?;
+  AND owner_subject = ?;
 
 -- name: ResetClientAppSecret :exec
 UPDATE client_store
 SET secret = ?
 WHERE subject = ?
-  AND owner = ?;
+  AND owner_subject = ?;

database/queries/manage-users.sql

@@ -1,17 +1,27 @@
 -- name: GetUserList :many
-SELECT subject,
+SELECT users.subject,
+       name,
+       picture,
+       website,
        email,
        email_verified,
-       roles,
-       updated_at,
+       users.updated_at as user_updated_at,
+       p.updated_at     as profile_updated_at,
        active
 FROM users
-LIMIT 25 OFFSET ?;
+         INNER JOIN main.profiles p on users.subject = p.subject
+LIMIT 50 OFFSET ?;
 
--- name: UpdateUser :exec
+-- name: GetUsersRoles :many
+SELECT r.role, u.id
+FROM users_roles
+         INNER JOIN roles r on r.id = users_roles.role_id
+         INNER JOIN users u on u.id = users_roles.user_id
+WHERE u.id in sqlc.slice(user_ids);
+
+-- name: ChangeUserActive :exec
 UPDATE users
-SET active = ?,
-    roles=?
+SET active = cast(? as boolean)
 WHERE subject = ?;
 
 -- name: UserEmailExists :one

database/queries/otp.sql

@@ -0,0 +1,23 @@
+-- name: SetOtp :exec
+INSERT OR
+REPLACE
+INTO otp (subject, secret, digits)
+VALUES (?, ?, ?);
+
+-- name: DeleteOtp :exec
+DELETE
+FROM otp
+WHERE otp.subject = ?;
+
+-- name: GetOtp :one
+SELECT secret, digits
+FROM otp
+WHERE subject = ?;
+
+-- name: HasOtp :one
+SELECT EXISTS(SELECT 1 FROM otp WHERE subject = ?) == 1 as hasOtp;
+
+-- name: GetUserEmail :one
+SELECT email
+FROM users
+WHERE subject = ?;

database/queries/profiles.sql

@@ -0,0 +1,16 @@
+-- name: GetProfile :one
+SELECT profiles.*
+FROM profiles
+WHERE subject = ?;
+
+-- name: ModifyProfile :exec
+UPDATE profiles
+SET name       = ?,
+    picture    = ?,
+    website    = ?,
+    pronouns   = ?,
+    birthdate  = ?,
+    zone       = ?,
+    locale     = ?,
+    updated_at = ?
+WHERE subject = ?;

database/queries/users.sql

@@ -2,42 +2,45 @@
 SELECT count(subject) > 0 AS hasUser
 FROM users;
 
--- name: AddUser :exec
-INSERT INTO users (subject, email, email_verified, roles, userinfo, updated_at, active)
+-- name: addUser :exec
+INSERT INTO users (subject, password, email, email_verified, updated_at, registered, active)
 VALUES (?, ?, ?, ?, ?, ?, ?);
 
--- name: UpdateUserInfo :exec
-UPDATE users
-SET email          = ?,
-    email_verified = ?,
-    userinfo       = ?
-WHERE subject = ?;
-
--- name: GetUserRoles :one
-SELECT roles
+-- name: checkLogin :one
+SELECT subject, password, EXISTS(SELECT 1 FROM otp WHERE otp.subject = users.subject) == 1 AS has_otp, email, email_verified
 FROM users
-WHERE subject = ?;
+WHERE users.subject = ?
+LIMIT 1;
 
 -- name: GetUser :one
 SELECT *
 FROM users
 WHERE subject = ?
 LIMIT 1;
 
--- name: UpdateUserToken :exec
-UPDATE users
-SET access_token  = ?,
-    refresh_token = ?,
-    expiry        = ?
-WHERE subject = ?;
+-- name: GetUserRoles :many
+SELECT r.role
+FROM users_roles
+         INNER JOIN roles r on r.id = users_roles.role_id
+         INNER JOIN users u on u.id = users_roles.user_id
+WHERE u.subject = ?;
 
--- name: GetUserToken :one
-SELECT access_token, refresh_token, expiry
-FROM users
-WHERE subject = ?
-LIMIT 1;
+-- name: UserHasRole :one
+SELECT 1
+FROM roles
+         INNER JOIN users_roles on users_roles.user_id = roles.id
+         INNER JOIN users u on u.id = users_roles.user_id = u.id
+WHERE roles.role = ?
+  AND u.subject = ?;
 
--- name: GetUserEmail :one
-SELECT email
+-- name: getUserPassword :one
+SELECT password
 FROM users
 WHERE subject = ?;
+
+-- name: changeUserPassword :exec
+UPDATE users
+SET password  = ?,
+    updated_at=?
+WHERE subject = ?
+  AND password = ?;

go.mod

@@ -17,6 +17,7 @@ require (
 	github.com/golang-migrate/migrate/v4 v4.17.1
 	github.com/google/subcommands v1.2.0
 	github.com/google/uuid v1.6.0
+	github.com/hardfinhq/go-date v1.20240411.1
 	github.com/julienschmidt/httprouter v1.3.0
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/mrmelon54/pronouns v1.0.3

go.sum

@@ -83,6 +83,8 @@ github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORR
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/hardfinhq/go-date v1.20240411.1 h1:UskRXxgD+4eCEa8CpiiWLiv2/Vnf1eB90Bojkf7AQ64=
+github.com/hardfinhq/go-date v1.20240411.1/go.mod h1:7oxaI9XX4W3/MRDeQXec0fLXFnSJDS7BrazIY2XqPXA=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=

issuer/manager_test.go

@@ -26,10 +26,9 @@ func TestManager_CheckNamespace(t *testing.T) {
 	httpGet = func(url string) (resp *http.Response, err error) {
 		return &http.Response{StatusCode: http.StatusOK, Body: testBody()}, nil
 	}
-	manager, err := NewManager([]SsoConfig{
-		{
-			Addr:      testAddrUrl,
-			Namespace: "example.com",
+	manager, err := NewManager(map[string]SsoConfig{
+		"example.com": {
+			Addr: testAddrUrl,
 		},
 	})
 	assert.NoError(t, err)
@@ -41,10 +40,9 @@ func TestManager_FindServiceFromLogin(t *testing.T) {
 	httpGet = func(url string) (resp *http.Response, err error) {
 		return &http.Response{StatusCode: http.StatusOK, Body: testBody()}, nil
 	}
-	manager, err := NewManager([]SsoConfig{
-		{
-			Addr:      testAddrUrl,
-			Namespace: "example.com",
+	manager, err := NewManager(map[string]SsoConfig{
+		"example.com": {
+			Addr: testAddrUrl,
 		},
 	})
 	assert.NoError(t, err)

issuer/sso.go

@@ -62,6 +62,7 @@ func (s SsoConfig) FetchConfig() (*WellKnownOIDC, error) {
 }
 
 type WellKnownOIDC struct {
+	Namespace              string        `json:"-"`
 	Config                 SsoConfig     `json:"-"`
 	Issuer                 string        `json:"issuer"`
 	AuthorizationEndpoint  string        `json:"authorization_endpoint"`

server/auth.go

@@ -23,7 +23,7 @@ var ErrAuthHttpError = errors.New("auth http error")
 
 func (h *HttpServer) RequireAdminAuthentication(next UserHandler) httprouter.Handle {
 	return h.RequireAuthentication(func(rw http.ResponseWriter, req *http.Request, params httprouter.Params, auth UserAuth) {
-		var roles string
+		var roles []string
 		if h.DbTx(rw, func(tx *database.Queries) (err error) {
 			roles, err = tx.GetUserRoles(req.Context(), auth.Subject)
 			return

server/home.go

@@ -30,9 +30,9 @@ func (h *HttpServer) Home(rw http.ResponseWriter, req *http.Request, _ httproute
 
 	var isAdmin bool
 	h.DbTx(rw, func(tx *database.Queries) (err error) {
-		roles, err := tx.GetUserRoles(req.Context(), auth.Subject)
-		isAdmin = HasRole(roles, "lavender:admin")
-		return err
+		_, err = tx.UserHasRole(req.Context(), database.UserHasRoleParams{Role: "lavender:admin", Subject: auth.Subject})
+		isAdmin = err == nil
+		return nil
 	})
 
 	pages.RenderPageTemplate(rw, "index", map[string]any{

server/jwt.go

@@ -30,9 +30,12 @@ func (j *JWTAccessGenerate) Token(ctx context.Context, data *oauth2.GenerateBasi
 		return "", "", err
 	}
 
-	ps := auth.ParsePermStorage(roles)
+	ps := auth.NewPermStorage()
+	for _, role := range roles {
+		ps.Set(role)
+	}
 	out := auth.NewPermStorage()
-	ForEachRole(data.Client.(interface{ UsePerms() string }).UsePerms(), func(role string) {
+	ForEachRole(data.Client.(interface{ UsePerms() []string }).UsePerms(), func(role string) {
 		for _, i := range ps.Filter(strings.Split(role, " ")).Dump() {
 			out.Set(i)
 		}

server/roles.go

@@ -1,25 +1,16 @@
 package server
 
-import (
-	"bufio"
-	"strings"
-)
-
-func HasRole(roles, test string) bool {
-	sc := bufio.NewScanner(strings.NewReader(roles))
-	sc.Split(bufio.ScanWords)
-	for sc.Scan() {
-		if sc.Text() == test {
+func HasRole(roles []string, test string) bool {
+	for _, role := range roles {
+		if role == test {
 			return true
 		}
 	}
 	return false
 }
 
-func ForEachRole(roles string, next func(role string)) {
-	sc := bufio.NewScanner(strings.NewReader(roles))
-	sc.Split(bufio.ScanWords)
-	for sc.Scan() {
-		next(sc.Text())
+func ForEachRole(roles []string, next func(role string)) {
+	for _, role := range roles {
+		next(role)
 	}
 }

sqlc.yaml

@@ -10,14 +10,14 @@ sql:
         emit_json_tags: true
         overrides:
           - column: "users.password"
-            go_type: "github.com/1f349/tulip/password.HashString"
+            go_type: "github.com/1f349/lavender/password.HashString"
           - column: "users.birthdate"
             go_type: "github.com/hardfinhq/go-date.NullDate"
           - column: "users.role"
-            go_type: "github.com/1f349/tulip/database/types.UserRole"
+            go_type: "github.com/1f349/lavender/database/types.UserRole"
           - column: "users.pronouns"
-            go_type: "github.com/1f349/tulip/database/types.UserPronoun"
+            go_type: "github.com/1f349/lavender/database/types.UserPronoun"
           - column: "users.zoneinfo"
-            go_type: "github.com/1f349/tulip/database/types.UserZone"
+            go_type: "github.com/1f349/lavender/database/types.UserZone"
           - column: "users.locale"
-            go_type: "github.com/1f349/tulip/database/types.UserLocale"
+            go_type: "github.com/1f349/lavender/database/types.UserLocale"