gemma: pkg/controllers/user.go comparison

comparison pkg/controllers/user.go @ 5345:95dafb72a288 extented-report

Added a PATCH endpoint for /api/users/{user}

author	Sascha L. Teichmann <sascha.teichmann@intevation.de>
date	Sun, 20 Jun 2021 04:17:53 +0200
parents	b1b9b384540d
children	566c8063223b

comparison

equal deleted inserted replaced

-:7df6062a1371
+:95dafb72a288
 	"bytes"
 	"database/sql"
 	"fmt"
 	"log"
 	"net/http"
+	"strconv"
+	"strings"
 	"text/template"
 	"time"
 	"github.com/gorilla/mux"
 		}{"success"},
 	}
 	return
 }
+func patchUser(req *http.Request) (jr mw.JSONResult, err error) {
+	user := models.UserName(mux.Vars(req)["user"])
+	if !user.IsValid() {
+		err = mw.JSONError{
+			Code:    http.StatusBadRequest,
+			Message: "error: user invalid",
+		}
+		return
+	}
+	s, ok := auth.GetSession(req)
+	if !ok {
+		err = mw.JSONError{
+			Code:    http.StatusUnauthorized,
+			Message: "error: not logged in",
+		}
+		return
+	}
+	priv := s.Roles.Has("sys_admin")
+	if !priv && s.User != string(user) {
+		err = mw.JSONError{
+			Code:    http.StatusUnauthorized,
+			Message: "error: not allowed to modify someone else",
+		}
+		return
+	}
+	var (
+		columns   []string
+		positions []string
+		args      []interface{}
+	)
+	update := func(column string, value interface{}) {
+		columns = append(columns, column)
+		positions = append(positions, "$"+strconv.Itoa(len(positions)+1))
+		args = append(args, value)
+	}
+	updateBox := func(column string, extent *models.BoundingBox) {
+		columns = append(columns, column)
+		pos := len(positions)
+		position := fmt.Sprintf("ST_MakeBox2D(ST_Point($%d, $%d), ST_Point($%d, $%d))",
+			pos+1, pos+2, pos+3, pos+4)
+		positions = append(positions, position)
+		args = append(args, extent.X1, extent.Y1, extent.X2, extent.Y2)
+	}
+	patch := mw.JSONInput(req).(*models.UserPatch)
+	if patch.User != nil && priv {
+		update("user", *patch.User)
+	}
+	if patch.Role != nil && priv {
+		update("rolname", *patch.Role)
+	}
+	if patch.Password != nil {
+		update("pw", *patch.Password)
+	}
+	if patch.Email != nil {
+		update("email_address", *patch.Email)
+	}
+	if patch.Country != nil && priv {
+		update("country", *patch.Country)
+	}
+	if patch.Reports != nil && priv {
+		update("report_reciever", *patch.Reports)
+	}
+	if patch.Extent != nil {
+		updateBox("map_extent", patch.Extent)
+	}
+	var colsS, posS string
+	switch len(columns) {
+	case 0: // Nothing to do
+		jr = mw.JSONResult{
+			Code: http.StatusCreated,
+			Result: struct {
+				Result string `json:"result"`
+			}{"success"},
+		}
+		return
+	case 1: // No brackets if there is only one argument.
+		colsS = columns[0]
+		posS = positions[0]
+	default:
+		colsS = "(" + strings.Join(columns, ",") + ")"
+		posS = "(" + strings.Join(positions, ",") + ")"
+	}
+	stmt := fmt.Sprintf(
+		`UPDATE users.list_users SET %s = %s WHERE username = $%d`,
+		colsS,
+		posS,
+		len(positions)+1)
+	args = append(args, user)
+	db := mw.JSONConn(req)
+	var res sql.Result
+	if res, err = db.ExecContext(req.Context(), stmt, args...); err != nil {
+		return
+	}
+	if n, err2 := res.RowsAffected(); err2 == nil && n == 0 {
+		err = mw.JSONError{
+			Code:    http.StatusNotFound,
+			Message: fmt.Sprintf("Cannot find user %s.", user),
+		}
+		return
+	}
+	if patch.User != nil && *patch.User != user {
+		// Running in a go routine should not be necessary.
+		go func() { auth.Sessions.Logout(string(user)) }()
+	}
+	jr = mw.JSONResult{
+		Code: http.StatusCreated,
+		Result: struct {
+			Result string `json:"result"`
+		}{"success"},
+	}
+	return
+}
 func createUser(req *http.Request) (jr mw.JSONResult, err error) {
 	user := mw.JSONInput(req).(*models.User)
 	db := mw.JSONConn(req)

Mercurial > gemma

comparison pkg/controllers/user.go @ 5345:95dafb72a288 extented-report