Initial commit

internal/web/user.go

@@ -0,0 +1,93 @@
+package web
+
+import (
+	"net/http"
+	"strconv"
+
+	"uPortal/internal/auth"
+)
+
+// HandleUsers lists every user in the system. Requires a super user.
+func (s *WebService) HandleUsers(w http.ResponseWriter, r *http.Request) {
+	data, ok := s.basicViewData(w, r, "Users")
+	if !ok {
+		http.Redirect(w, r, "/signin", http.StatusSeeOther)
+		return
+	}
+
+	users, err := s.users.GetUsers(r.Context(), 1000, 0)
+	if err != nil {
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	data.Users = users
+
+	s.render(w, r, "user/view.html", data)
+}
+
+// HandleUserResetPassword lets a super admin reset another user's password.
+func (s *WebService) HandleUserResetPassword(w http.ResponseWriter, r *http.Request) {
+	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	userIdStr := r.FormValue("user_id")
+	newPassword := r.FormValue("new_password")
+
+	userId, err := strconv.ParseInt(userIdStr, 10, 64)
+	if err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	if len(newPassword) < 6 {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	user, err := s.users.GetUserById(r.Context(), userId)
+	if err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	hashedPassword, err := auth.HashPassword(newPassword)
+	if err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	user.Password = hashedPassword
+	s.users.UpdateUser(r.Context(), user)
+
+	http.Redirect(w, r, "/users", http.StatusSeeOther)
+}
+
+// HandleUserEndSessions ends all sessions for a given user. Requires a super user.
+func (s *WebService) HandleUserEndSessions(w http.ResponseWriter, r *http.Request) {
+	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	userIdStr := r.FormValue("user_id")
+	userId, err := strconv.ParseInt(userIdStr, 10, 64)
+	if err != nil {
+		http.Redirect(w, r, "/users", http.StatusSeeOther)
+		return
+	}
+
+	s.auths.DeleteSessionsByUserId(r.Context(), userId)
+	http.Redirect(w, r, "/users", http.StatusSeeOther)
+}