gmbase/app/operator/account.go

package operator

import (
	"context"
	"fmt"
	"time"

	"mbase/pkg/auxpwd"
	"mbase/pkg/auxuuid"
	"mbase/pkg/descr"
	"mbase/pkg/mbctl"
)

func (oper *Operator) ValidateAccount(ctx context.Context, username, password string) (bool, string, error) {
	var err error
	var accountID string
	var valid bool

	oper.WaitRestoring()

	accountExists, accountDescr, err := oper.db.GetAccountByUsername(ctx, username)
	if !accountExists {
		err := fmt.Errorf("Account not exists")
		return valid, accountID, err
	}
	if !auxpwd.PasswordMatchCompat([]byte(password), accountDescr.Passhash) {
		err := fmt.Errorf("Login data mismatch")
		return valid, accountID, err
	}
	valid = true
	accountID = accountDescr.ID
	return valid, accountID, err
}

func (oper *Operator) CreateAccount(ctx context.Context, accountID string, params *mbctl.CreateAccountParams) (*mbctl.CreateAccountResult, error) {
	var err error
	res := &mbctl.CreateAccountResult{}

	oper.WaitDumping()
	oper.WaitRestoring()

	grantExists, _, err := oper.db.GetGrant(ctx, accountID, descr.GrantModifyUsers)
	if err != nil {
		return res, err
	}
	if !grantExists {
		err := fmt.Errorf("Operation not allowed for the user")
		return res, err
	}
	if params.Username == "" {
		err := fmt.Errorf("Empty username parameters")
		return res, err
	}

	if params.Password == "" {
		err := fmt.Errorf("Empty password parameter")
		return res, err
	}

	accountExists, _, err := oper.db.GetAccountByUsername(ctx, params.Username)
	if err != nil {
		return res, err
	}
	if accountExists {
		err := fmt.Errorf("Account with thist name already exists")
		return res, err
	}
	now := time.Now().Format(time.RFC3339)
	passhash := auxpwd.MakeSHA256Hash([]byte(params.Password))
	accountDescr := &descr.Account{
		ID:        auxuuid.NewUUID(),
		Username:  params.Username,
		Passhash:  passhash,
		Disabled:  false,
		CreatedAt: now,
		UpdatedAt: now,
	}
	err = oper.db.InsertAccount(ctx, accountDescr)
	if err != nil {
		return res, err
	}
	res.AccountID = accountDescr.ID
	return res, err
}

func (oper *Operator) UpdateAccount(ctx context.Context, accountID string, params *mbctl.UpdateAccountParams) (*mbctl.UpdateAccountResult, error) {
	var err error
	res := &mbctl.UpdateAccountResult{}

	oper.WaitRestoring()
	oper.WaitDumping()

	grantExists, _, err := oper.db.GetGrant(ctx, accountID, descr.GrantModifyUsers)
	if err != nil {
		return res, err
	}
	if !grantExists {
		err := fmt.Errorf("Operation not allowed for the user")
		return res, err
	}

	var accountDescr *descr.Account
	var accountExists bool
	switch {
	case params.AccountID != "":
		accountExists, accountDescr, err = oper.db.GetAccountByID(ctx, params.AccountID)
		if err != nil {
			return res, err
		}
	case params.Username != "":
		accountExists, accountDescr, err = oper.db.GetAccountByUsername(ctx, params.Username)
		if err != nil {
			return res, err
		}
	}
	if !accountExists {
		err := fmt.Errorf("Account with this is or name dont exists")
		return res, err
	}
	now := time.Now().Format(time.RFC3339)
	if params.NewUsername != "" {
		accountDescr.UpdatedAt = now
		accountDescr.Username = params.NewUsername
	}
	if params.NewPassword != "" {
		passhash := auxpwd.MakeSHA256Hash([]byte(params.NewPassword))

		accountDescr.UpdatedAt = now
		accountDescr.Passhash = passhash
	}
	if params.Disabled != accountDescr.Disabled {
		accountDescr.UpdatedAt = now
		accountDescr.Disabled = params.Disabled
	}

	err = oper.db.UpdateAccountByID(ctx, accountDescr.ID, accountDescr)
	if err != nil {
		return res, err
	}
	return res, err
}

func (oper *Operator) DeleteAccount(ctx context.Context, accountID string, params *mbctl.DeleteAccountParams) (*mbctl.DeleteAccountResult, error) {
	var err error
	res := &mbctl.DeleteAccountResult{}

	oper.WaitDumping()
	oper.WaitRestoring()

	grantExists, _, err := oper.db.GetGrant(ctx, accountID, descr.GrantModifyUsers)
	if err != nil {
		return res, err
	}
	if !grantExists {
		err := fmt.Errorf("Operation not allowed for the user")
		return res, err
	}

	var accountDescr *descr.Account
	var accountExists bool
	switch {
	case params.AccountID != "":
		accountExists, accountDescr, err = oper.db.GetAccountByID(ctx, params.AccountID)
		if err != nil {
			return res, err
		}
	case params.Username != "":
		accountExists, accountDescr, err = oper.db.GetAccountByUsername(ctx, params.Username)
		if err != nil {
			return res, err
		}
	}
	if !accountExists {
		err := fmt.Errorf("Account with this is or name dont exists")
		return res, err
	}

	err = oper.db.DeleteAllGrantsForAccountID(ctx, accountDescr.ID)
	if err != nil {
		return res, err
	}
	err = oper.db.DeleteAccountByID(ctx, accountDescr.ID)
	if err != nil {
		return res, err
	}
	return res, err
}

func (oper *Operator) ListAccounts(ctx context.Context, accountID string, params *mbctl.ListAccountsParams) (*mbctl.ListAccountsResult, error) {
	var err error
	res := &mbctl.ListAccountsResult{
		Accounts: make([]*mbctl.AccountShortDescr, 0),
	}

	oper.WaitRestoring()

	grantExists, _, err := oper.db.GetGrant(ctx, accountID, descr.GrantModifyUsers)
	if err != nil {
		return res, err
	}
	if !grantExists {
		err := fmt.Errorf("Operation not allowed for the user")
		return res, err
	}

	accountDescrs, err := oper.db.ReducedListAccounts(ctx)
	if err != nil {
		return res, err
	}
	for _, accountDescr := range accountDescrs {
		accountShortDescr := &mbctl.AccountShortDescr{
			Username:  accountDescr.Username,
			Disabled:  accountDescr.Disabled,
			CreatedAt: accountDescr.CreatedAt,
			UpdatedAt: accountDescr.UpdatedAt,
			Grants:    make([]*mbctl.GrantShortDescr, 0),
		}
		grantDescrs, err := oper.db.ListGrantsByAccountID(ctx, accountDescr.ID)
		if err != nil {
			return res, err
		}
		for _, grantDescrs := range grantDescrs {
			grantShortDescrs := &mbctl.GrantShortDescr{
				Operation: grantDescrs.Operation,
				CreatedAt: grantDescrs.CreatedAt,
			}
			accountShortDescr.Grants = append(accountShortDescr.Grants, grantShortDescrs)
		}
		res.Accounts = append(res.Accounts, accountShortDescr)
	}
	return res, err
}