Initial commit

internal/web/invite.go

@@ -0,0 +1,84 @@
+package web
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"uPortal/internal/auth"
+)
+
+// HandleInvites lists all invite codes. Requires a super user.
+func (s *WebService) HandleInvites(w http.ResponseWriter, r *http.Request) {
+	data, ok := s.basicViewData(w, r, "Invites")
+	if !ok {
+		http.Redirect(w, r, "/signin", http.StatusSeeOther)
+		return
+	}
+
+	invites, err := s.auths.GetInvites(r.Context(), 1000, 0)
+	if err != nil {
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	data.Invites = invites
+
+	s.render(w, r, "invite/view.html", data)
+}
+
+// HandleInviteCreate renders the creation form on GET and mints an invite on POST.
+func (s *WebService) HandleInviteCreate(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		data, ok := s.basicViewData(w, r, "Create Invite")
+		if !ok {
+			http.Redirect(w, r, "/signin", http.StatusSeeOther)
+			return
+		}
+		s.render(w, r, "invite/create.html", data)
+
+	case http.MethodPost:
+		if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
+			s.render(w, r, "invite/create.html", &ViewData{Error: "Invalid form, please try again"})
+			return
+		}
+
+		uses := int64(1)
+		hours := int64(24)
+		if v, err := strconv.ParseInt(r.FormValue("uses"), 10, 64); err == nil && v > 0 {
+			uses = v
+		}
+		if v, err := strconv.ParseInt(r.FormValue("expires_hours"), 10, 64); err == nil && v > 0 {
+			hours = v
+		}
+
+		expiresAt := time.Now().UTC().Add(time.Duration(hours) * time.Hour)
+
+		token, err := auth.GenerateToken(32)
+		if err != nil {
+			s.render(w, r, "invite/create.html", &ViewData{Error: "Could not generate invite token"})
+			return
+		}
+
+		if _, err := s.auths.CreateInvite(r.Context(), token, uses, expiresAt); err != nil {
+			s.render(w, r, "invite/create.html", &ViewData{Error: "Could not create invite"})
+			return
+		}
+
+		http.Redirect(w, r, "/invites", http.StatusSeeOther)
+	}
+}
+
+// HandleInviteDelete removes the invite identified by the form field "token".
+func (s *WebService) HandleInviteDelete(w http.ResponseWriter, r *http.Request) {
+	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
+		http.Redirect(w, r, "/invites", http.StatusSeeOther)
+		return
+	}
+
+	token := r.FormValue("token")
+	if token != "" {
+		_ = s.auths.DeleteInvite(r.Context(), token)
+	}
+	http.Redirect(w, r, "/invites", http.StatusSeeOther)
+}