feat: add multi-user auth and permission schema

main.go

@@ -15,12 +15,13 @@ func main() {
 	_ = os.MkdirAll(filepath.Dir(dbPath), 0755)
 	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
 	must(err)
-	must(db.AutoMigrate(&Task{}, &Setting{}))
+	must(db.AutoMigrate(&Task{}, &Setting{}, &User{}, &UserPermission{}, &CreditAccount{}, &CreditTransaction{}, &CreditReservation{}, &RedeemBatch{}, &RedeemCode{}, &RedeemRecord{}, &WebDAVConfig{}, &Session{}, &AuditLog{}))
 
 	client := &http.Client{Timeout: 2 * 60 * 1e9}
 	cfg := loadConfig(db)
 	a := &App{db: db, cfg: cfg, queue: make(chan uint, 100), httpClient: client}
 	a.loadSettings()
+	a.bootstrapAdmin()
 	normalizeConfig(&a.cfg)
 	a.am = &AMAPIClient{BaseURL: a.cfg.AMAPI, HTTP: client}
 	if a.cfg.WebDAVURL != "" {
@@ -31,14 +32,19 @@ func main() {
 	r := gin.Default()
 	r.StaticFile("/", "/app/index.html")
 	api := r.Group("/api")
-	api.GET("/search", a.search)
-	api.GET("/tasks", a.listTasks)
-	api.POST("/tasks", a.addTask)
-	api.POST("/tasks/:id/retry", a.retryTask)
-	api.DELETE("/tasks/:id", a.deleteTask)
-	api.GET("/settings", a.getSettings)
-	api.PUT("/settings", a.putSettings)
-	api.POST("/webdav/test", a.testWebDAV)
+	api.POST("/auth/login", a.login)
+	api.POST("/auth/logout", a.requireAuth, a.logout)
+	api.GET("/auth/me", a.requireAuth, a.me)
+	auth := api.Group("", a.requireAuth)
+	auth.GET("/search", a.requirePermission(PermDownload), a.search)
+	auth.GET("/tasks", a.requirePermission(PermDownload), a.listTasks)
+	auth.POST("/tasks", a.requirePermission(PermDownload), a.addTask)
+	auth.POST("/tasks/:id/retry", a.requirePermission(PermDownload), a.retryTask)
+	auth.DELETE("/tasks/:id", a.requirePermission(PermDownload), a.deleteTask)
+	admin := api.Group("/admin", a.requireAuth, a.requireAdmin)
+	admin.GET("/settings", a.getSettings)
+	admin.PUT("/settings", a.putSettings)
+	admin.POST("/webdav/test", a.testWebDAV)
 	must(r.Run(":" + getenv("PORT", "9540")))
 }