refactor: flatten repository structure to root and archive research notes

internal/auth/users.go

@@ -0,0 +1,207 @@
+package auth
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"sync"
+)
+
+type UserStore struct {
+	Path string
+	Mu   sync.Mutex
+}
+
+type userRecord struct {
+	Username string     `json:"username"`
+	Password string     `json:"passwordHash"`
+	Home     string     `json:"home"`
+	Enabled  *bool      `json:"enabled,omitempty"`
+	Rules    []userRule `json:"rules,omitempty"`
+}
+
+type userRule struct {
+	Dir          string `json:"dir"`
+	Mask         string `json:"mask"`
+	Deny         bool   `json:"deny,omitempty"`
+	ChildrenOnly bool   `json:"childrenOnly,omitempty"`
+}
+
+var validUsername = regexp.MustCompile("^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$")
+
+func ValidateUsername(username string) error {
+	if !validUsername.MatchString(username) {
+		return fmt.Errorf("invalid username")
+	}
+	return nil
+}
+
+func unsafeUserPath(p string) bool {
+	p = strings.ReplaceAll(p, "\\", "/")
+	return p == ".." || strings.HasPrefix(p, "../") || strings.Contains(p, "/../") || strings.HasPrefix(p, "/")
+}
+
+func (u *UserStore) Load(m *Manager, homeRoot string) error {
+	if u.Path == "" {
+		return nil
+	}
+	data, err := os.ReadFile(u.Path)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	var records []userRecord
+	if err := json.Unmarshal(data, &records); err != nil {
+		return fmt.Errorf("invalid user store: %w", err)
+	}
+	for _, rec := range records {
+		if err := ValidateUsername(rec.Username); err != nil || rec.Password == "" {
+			continue
+		}
+		if _, exists := m.Accounts[rec.Username]; exists {
+			continue
+		}
+		home := filepath.ToSlash(strings.Trim(strings.TrimSpace(rec.Home), "/"))
+		if home == "" {
+			home = filepath.ToSlash(filepath.Join(homeRoot, rec.Username))
+		}
+		enabled := true
+		if rec.Enabled != nil {
+			enabled = *rec.Enabled
+		}
+		a := &Account{Username: rec.Username, PasswordHash: rec.Password, Mask: None, Home: home, Enabled: enabled}
+		if len(rec.Rules) == 0 {
+			a.Rules = append(a.Rules, PathRule{Dir: home, Mask: Read | Write | Delete})
+		} else {
+			for _, rr := range rec.Rules {
+				dir := strings.Trim(strings.ReplaceAll(rr.Dir, "\\", "/"), "/")
+				if dir == "" || unsafeUserPath(dir) {
+					continue
+				}
+				a.Rules = append(a.Rules, PathRule{Dir: dir, Mask: ParseMask(rr.Mask), Deny: rr.Deny, ChildrenOnly: rr.ChildrenOnly})
+			}
+		}
+		m.Accounts[rec.Username] = a
+	}
+	return nil
+}
+
+func (u *UserStore) Save(m *Manager) error {
+	if u.Path == "" {
+		return nil
+	}
+	u.Mu.Lock()
+	defer u.Mu.Unlock()
+	records := make([]userRecord, 0)
+	for _, a := range m.Accounts {
+		if a.PasswordHash == "" || a.Home == "" || a.Admin {
+			continue
+		}
+		rec := userRecord{Username: a.Username, Password: a.PasswordHash, Home: a.Home, Enabled: &a.Enabled}
+		for _, rr := range a.Rules {
+			rec.Rules = append(rec.Rules, userRule{Dir: rr.Dir, Mask: maskString(rr.Mask), Deny: rr.Deny, ChildrenOnly: rr.ChildrenOnly})
+		}
+		records = append(records, rec)
+	}
+	data, err := json.MarshalIndent(records, "", "  ")
+	if err != nil {
+		return err
+	}
+	if dir := filepath.Dir(u.Path); dir != "." {
+		if err := os.MkdirAll(dir, 0700); err != nil {
+			return err
+		}
+	}
+	tmp := u.Path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, u.Path)
+}
+
+func (u *UserStore) Add(m *Manager, username, password, home string) (*Account, error) {
+	if err := ValidateUsername(username); err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(password) == "" {
+		return nil, fmt.Errorf("password required")
+	}
+	if _, ok := m.Accounts[username]; ok {
+		return nil, fmt.Errorf("user already exists")
+	}
+	home = strings.Trim(home, "/")
+	a := &Account{Username: username, PasswordHash: PasswordHash(password), Mask: None, Home: home, Enabled: true}
+	a.Rules = append(a.Rules, PathRule{Dir: home, Mask: Read | Write | Delete})
+	m.Accounts[username] = a
+	return a, u.Save(m)
+}
+
+func maskString(p PermMask) string {
+	var b strings.Builder
+	if p.HasRead() {
+		b.WriteByte('r')
+	}
+	if p.HasWrite() {
+		b.WriteByte('w')
+	}
+	if p.HasDelete() {
+		b.WriteByte('d')
+	}
+	return b.String()
+}
+
+func (u *UserStore) Update(m *Manager, username, password string, enabled *bool, rules []PathRule) error {
+	a, ok := m.Accounts[username]
+	if !ok || a.PasswordHash == "" || a.Admin {
+		return fmt.Errorf("managed user not found")
+	}
+	if strings.TrimSpace(password) != "" {
+		a.PasswordHash = PasswordHash(password)
+		a.Password = ""
+	}
+	if enabled != nil {
+		a.Enabled = *enabled
+	}
+	if rules != nil {
+		// A managed user's home is always their private working area. Keep the
+		// base RWD rule even when an administrator replaces the extra rules.
+		// Additional rules can grant or deny access elsewhere.
+		next := make([]PathRule, 0, len(rules)+1)
+		next = append(next, PathRule{Dir: a.Home, Mask: Read | Write | Delete})
+		for _, rule := range rules {
+			if strings.Trim(rule.Dir, "/") == strings.Trim(a.Home, "/") {
+				continue
+			}
+			next = append(next, rule)
+		}
+		a.Rules = next
+	}
+	return u.Save(m)
+}
+
+func (u *UserStore) UpdatePassword(m *Manager, username, password string) error {
+	if strings.TrimSpace(password) == "" {
+		return fmt.Errorf("password required")
+	}
+	a, ok := m.Accounts[username]
+	if !ok || a.PasswordHash == "" {
+		return fmt.Errorf("managed user not found")
+	}
+	a.PasswordHash = PasswordHash(password)
+	a.Password = ""
+	return u.Save(m)
+}
+
+func (u *UserStore) Delete(m *Manager, username string) error {
+	a, ok := m.Accounts[username]
+	if !ok || a.Admin || a.PasswordHash == "" {
+		return fmt.Errorf("managed user not found")
+	}
+	delete(m.Accounts, username)
+	return u.Save(m)
+}