From f6577a24e66123535ade3c3810b2f78e801bdc9e Mon Sep 17 00:00:00 2001 From: nfel Date: Tue, 4 Aug 2026 22:31:24 +0330 Subject: [PATCH] user management added --- internal/app/server.go | 292 ++++++++++++++++++++++-------- internal/app/server_test.go | 21 +++ internal/app/static/style.css | 13 +- internal/app/store.go | 207 ++++++++++++++++++--- internal/app/templates/users.html | 15 ++ 5 files changed, 438 insertions(+), 110 deletions(-) diff --git a/internal/app/server.go b/internal/app/server.go index 22c5078..3f91a2e 100644 --- a/internal/app/server.go +++ b/internal/app/server.go @@ -71,36 +71,36 @@ type Server struct { } type PageData struct { - Title string - User *User - CSRF string - Flash string - Error string - Today string - TodayJalali string - Attendance *Attendance - Calendar Calendar - Requests []Request - PendingCount int - Stats Stats - OAuthGitHub bool - OAuthGoogle bool - ReportStart string - ReportEnd string - SelectedSection string - Users []User - Workspaces []Workspace - Workspace Workspace + Title string + User *User + CSRF string + Flash string + Error string + Today string + TodayJalali string + Attendance *Attendance + Calendar Calendar + Requests []Request + PendingCount int + Stats Stats + OAuthGitHub bool + OAuthGoogle bool + ReportStart string + ReportEnd string + SelectedSection string + Users []User + Workspaces []Workspace + Workspace Workspace WorkspaceMembers map[int64]bool - Day DayDetail - Week WeekDetail - WorkUpdates []WorkUpdate - ReportSummary []PersonReportSummary - ReportTotals ReportTotals - Board []BoardColumn - BoardTags []BoardTag - ArchivedTasks []BoardTask - BoardFilter BoardFilter + Day DayDetail + Week WeekDetail + WorkUpdates []WorkUpdate + ReportSummary []PersonReportSummary + ReportTotals ReportTotals + Board []BoardColumn + BoardTags []BoardTag + ArchivedTasks []BoardTask + BoardFilter BoardFilter } type Stats struct{ Present, Remote, Leave int } @@ -310,6 +310,8 @@ func (s *Server) routes(mux *http.ServeMux) { mux.HandleFunc("GET /admin/users", s.requireAdmin(s.usersPage)) mux.HandleFunc("POST /admin/users", s.requireAdmin(s.csrf(s.createUser))) mux.HandleFunc("POST /admin/users/{id}/status", s.requireAdmin(s.csrf(s.setUserStatus))) + mux.HandleFunc("POST /admin/users/{id}/password", s.requireAdmin(s.csrf(s.changeUserPassword))) + mux.HandleFunc("POST /admin/users/{id}/delete", s.requireAdmin(s.csrf(s.deleteUser))) mux.HandleFunc("GET /admin/workspaces", s.requireAdmin(s.workspacesPage)) mux.HandleFunc("POST /admin/workspaces", s.requireAdmin(s.csrf(s.createWorkspace))) mux.HandleFunc("POST /admin/workspaces/{id}/members", s.requireAdmin(s.csrf(s.setWorkspaceMembers))) @@ -495,8 +497,17 @@ func (s *Server) render(w http.ResponseWriter, name string, data PageData) { if data.User != nil { if workspaces, err := s.store.Workspaces(data.User.ID); err == nil { data.Workspaces = workspaces - if data.Workspace.ID == 0 && data.User.WorkspaceID > 0 { for _, ws := range workspaces { if ws.ID == data.User.WorkspaceID { data.Workspace = ws; break } } } - if data.Workspace.ID == 0 && len(workspaces) > 0 { data.Workspace = workspaces[0] } + if data.Workspace.ID == 0 && data.User.WorkspaceID > 0 { + for _, ws := range workspaces { + if ws.ID == data.User.WorkspaceID { + data.Workspace = ws + break + } + } + } + if data.Workspace.ID == 0 && len(workspaces) > 0 { + data.Workspace = workspaces[0] + } } } w.Header().Set("Content-Type", "text/html; charset=utf-8") @@ -660,18 +671,20 @@ func (s *Server) buildCalendar(userID int64, selected string) Calendar { func persianHoliday(year, month, day int) string { // Official public holidays for Solar Hijri 1405. Lunar holidays are // recorded using the dates published for this Persian calendar year. - if year != 1405 { return "" } + if year != 1405 { + return "" + } holidays := map[string]string{ - "1-1":"Nowruz", "1-2":"Nowruz", "1-3":"Nowruz", "1-4":"Nowruz", - "1-12":"Islamic Republic Day", "1-13":"Nature Day", - "2-6":"Eid al-Adha", "2-14":"Eid al-Ghadir", - "3-14":"Demise of Imam Khomeini", "3-15":"Khordad Uprising", - "4-3":"Tasua", "4-4":"Ashura", - "5-13":"Arbaeen", "5-21":"Demise of Prophet Muhammad", "5-23":"Martyrdom of Imam Hassan", "5-30":"Martyrdom of Imam Reza", - "6-8":"Prophet Muhammad's Birthday", - "9-3":"Martyrdom of Fatima", - "10-2":"Imam Ali's Birthday", - "11-22":"Revolution Day", "12-29":"Oil Nationalization Day", + "1-1": "Nowruz", "1-2": "Nowruz", "1-3": "Nowruz", "1-4": "Nowruz", + "1-12": "Islamic Republic Day", "1-13": "Nature Day", + "2-6": "Eid al-Adha", "2-14": "Eid al-Ghadir", + "3-14": "Demise of Imam Khomeini", "3-15": "Khordad Uprising", + "4-3": "Tasua", "4-4": "Ashura", + "5-13": "Arbaeen", "5-21": "Demise of Prophet Muhammad", "5-23": "Martyrdom of Imam Hassan", "5-30": "Martyrdom of Imam Reza", + "6-8": "Prophet Muhammad's Birthday", + "9-3": "Martyrdom of Fatima", + "10-2": "Imam Ali's Birthday", + "11-22": "Revolution Day", "12-29": "Oil Nationalization Day", } return holidays[fmt.Sprintf("%d-%d", month, day)] } @@ -860,8 +873,12 @@ func (s *Server) boardPage(w http.ResponseWriter, r *http.Request) { } func (s *Server) archivedBoardPage(w http.ResponseWriter, r *http.Request) { - tasks, err := s.store.ArchivedBoardTasksInWorkspace(requestWorkspaceID(r)); if err != nil { http.Error(w, "could not load archived cards", http.StatusInternalServerError); return } - s.render(w, "archived.html", PageData{Title:"Archived cards", User:currentUser(r), CSRF:csrfToken(r), ArchivedTasks:tasks, Error:r.URL.Query().Get("error"), Flash:r.URL.Query().Get("flash"), SelectedSection:"board"}) + tasks, err := s.store.ArchivedBoardTasksInWorkspace(requestWorkspaceID(r)) + if err != nil { + http.Error(w, "could not load archived cards", http.StatusInternalServerError) + return + } + s.render(w, "archived.html", PageData{Title: "Archived cards", User: currentUser(r), CSRF: csrfToken(r), ArchivedTasks: tasks, Error: r.URL.Query().Get("error"), Flash: r.URL.Query().Get("flash"), SelectedSection: "board"}) } func validBoardPriority(priority string) bool { @@ -903,7 +920,10 @@ func (s *Server) createBoardTask(w http.ResponseWriter, r *http.Request) { workspaceID := requestWorkspaceID(r) if raw := r.FormValue("workspace_id"); raw != "" { if selected, err := strconv.ParseInt(raw, 10, 64); err == nil { - if _, err := s.store.WorkspaceMember(selected, currentUser(r).ID); err != nil { http.Redirect(w,r,"/board?error=You+do+not+have+access+to+that+workspace",http.StatusSeeOther); return } + if _, err := s.store.WorkspaceMember(selected, currentUser(r).ID); err != nil { + http.Redirect(w, r, "/board?error=You+do+not+have+access+to+that+workspace", http.StatusSeeOther) + return + } workspaceID = selected } } @@ -1095,61 +1115,148 @@ func (s *Server) usersPage(w http.ResponseWriter, r *http.Request) { func (s *Server) profilePage(w http.ResponseWriter, r *http.Request) { u := currentUser(r) - s.render(w, "profile.html", PageData{Title:"Profile", User:u, CSRF:csrfToken(r), Flash:r.URL.Query().Get("flash"), Error:r.URL.Query().Get("error"), SelectedSection:"profile"}) + s.render(w, "profile.html", PageData{Title: "Profile", User: u, CSRF: csrfToken(r), Flash: r.URL.Query().Get("flash"), Error: r.URL.Query().Get("error"), SelectedSection: "profile"}) } func (s *Server) uploadAvatar(w http.ResponseWriter, r *http.Request) { - if err := r.ParseMultipartForm(3 << 20); err != nil { http.Redirect(w,r,"/profile?error=Choose+an+image+up+to+2MB",http.StatusSeeOther); return } - file, header, err := r.FormFile("avatar"); if err != nil || header.Size > 2<<20 { http.Redirect(w,r,"/profile?error=Choose+an+image+up+to+2MB",http.StatusSeeOther); return }; defer file.Close() - buf := make([]byte,512); n,_ := file.Read(buf); kind := http.DetectContentType(buf[:n]); ext := map[string]string{"image/jpeg":".jpg","image/png":".png","image/webp":".webp"}[kind]; if ext=="" { http.Redirect(w,r,"/profile?error=Only+JPG,+PNG,+or+WebP+images+are+supported",http.StatusSeeOther); return } - if _, err := file.Seek(0,0); err != nil { http.Redirect(w,r,"/profile?error=Could+not+read+image",http.StatusSeeOther); return } - dir := filepath.Join(filepath.Dir(s.cfg.DatabasePath),"avatars"); if err := os.MkdirAll(dir,0755); err != nil { http.Error(w,"could not save avatar",500); return } - name := fmt.Sprintf("%d%s", currentUser(r).ID, ext); dst, err := os.Create(filepath.Join(dir,name)); if err != nil { http.Error(w,"could not save avatar",500); return }; defer dst.Close(); if _,err=io.Copy(dst,file); err != nil { http.Error(w,"could not save avatar",500); return } - if err := s.store.SetUserAvatar(currentUser(r).ID,"/uploads/avatars/"+name); err != nil { http.Error(w,"could not save avatar",500); return } - http.Redirect(w,r,"/profile?flash=Profile+photo+updated",http.StatusSeeOther) + if err := r.ParseMultipartForm(3 << 20); err != nil { + http.Redirect(w, r, "/profile?error=Choose+an+image+up+to+2MB", http.StatusSeeOther) + return + } + file, header, err := r.FormFile("avatar") + if err != nil || header.Size > 2<<20 { + http.Redirect(w, r, "/profile?error=Choose+an+image+up+to+2MB", http.StatusSeeOther) + return + } + defer file.Close() + buf := make([]byte, 512) + n, _ := file.Read(buf) + kind := http.DetectContentType(buf[:n]) + ext := map[string]string{"image/jpeg": ".jpg", "image/png": ".png", "image/webp": ".webp"}[kind] + if ext == "" { + http.Redirect(w, r, "/profile?error=Only+JPG,+PNG,+or+WebP+images+are+supported", http.StatusSeeOther) + return + } + if _, err := file.Seek(0, 0); err != nil { + http.Redirect(w, r, "/profile?error=Could+not+read+image", http.StatusSeeOther) + return + } + dir := filepath.Join(filepath.Dir(s.cfg.DatabasePath), "avatars") + if err := os.MkdirAll(dir, 0755); err != nil { + http.Error(w, "could not save avatar", 500) + return + } + name := fmt.Sprintf("%d%s", currentUser(r).ID, ext) + dst, err := os.Create(filepath.Join(dir, name)) + if err != nil { + http.Error(w, "could not save avatar", 500) + return + } + defer dst.Close() + if _, err = io.Copy(dst, file); err != nil { + http.Error(w, "could not save avatar", 500) + return + } + if err := s.store.SetUserAvatar(currentUser(r).ID, "/uploads/avatars/"+name); err != nil { + http.Error(w, "could not save avatar", 500) + return + } + http.Redirect(w, r, "/profile?flash=Profile+photo+updated", http.StatusSeeOther) } func (s *Server) workspacesPage(w http.ResponseWriter, r *http.Request) { u := currentUser(r) workspaces, err := s.store.AllWorkspaces() - if err != nil { http.Error(w, "could not load workspaces", http.StatusInternalServerError); return } - users, err := s.store.Users(); if err != nil { http.Error(w,"could not load users",500); return } - selected := int64(0); if len(workspaces)>0 { selected=workspaces[0].ID } - if raw:=r.URL.Query().Get("workspace"); raw!="" { selected,_=strconv.ParseInt(raw,10,64) } + if err != nil { + http.Error(w, "could not load workspaces", http.StatusInternalServerError) + return + } + users, err := s.store.Users() + if err != nil { + http.Error(w, "could not load users", 500) + return + } + selected := int64(0) + if len(workspaces) > 0 { + selected = workspaces[0].ID + } + if raw := r.URL.Query().Get("workspace"); raw != "" { + selected, _ = strconv.ParseInt(raw, 10, 64) + } members, _ := s.store.WorkspaceMemberIDs(selected) - selectedWorkspace := Workspace{ID:selected}; for _, ws := range workspaces { if ws.ID == selected { selectedWorkspace = ws; break } } - s.render(w, "workspaces.html", PageData{Title:"Workspaces", User:u, CSRF:csrfToken(r), Workspaces:workspaces, Users:users, Workspace:selectedWorkspace, Error:r.URL.Query().Get("error"), Flash:r.URL.Query().Get("flash"), SelectedSection:"workspaces", WorkspaceMembers:members}) + selectedWorkspace := Workspace{ID: selected} + for _, ws := range workspaces { + if ws.ID == selected { + selectedWorkspace = ws + break + } + } + s.render(w, "workspaces.html", PageData{Title: "Workspaces", User: u, CSRF: csrfToken(r), Workspaces: workspaces, Users: users, Workspace: selectedWorkspace, Error: r.URL.Query().Get("error"), Flash: r.URL.Query().Get("flash"), SelectedSection: "workspaces", WorkspaceMembers: members}) } func (s *Server) setWorkspaceMembers(w http.ResponseWriter, r *http.Request) { - id,_ := strconv.ParseInt(r.PathValue("id"),10,64); var ids []int64; seen := map[int64]bool{} - for _, raw := range r.Form["user_ids"] { if userID,err:=strconv.ParseInt(raw,10,64); err==nil && !seen[userID] { ids=append(ids,userID); seen[userID]=true } } + id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64) + var ids []int64 + seen := map[int64]bool{} + for _, raw := range r.Form["user_ids"] { + if userID, err := strconv.ParseInt(raw, 10, 64); err == nil && !seen[userID] { + ids = append(ids, userID) + seen[userID] = true + } + } // The admin editing access must retain access to the workspace being managed. adminID := currentUser(r).ID foundAdmin := false - for _, id := range ids { if id == adminID { foundAdmin = true; break } } - if !foundAdmin { ids = append(ids, adminID) } - if err:=s.store.SetWorkspaceMembers(id,ids); err!=nil { http.Redirect(w,r,"/admin/workspaces?error="+url.QueryEscape(err.Error()),http.StatusSeeOther); return } - http.Redirect(w,r,"/admin/workspaces?workspace="+strconv.FormatInt(id,10)+"&flash=Workspace+members+updated",http.StatusSeeOther) + for _, id := range ids { + if id == adminID { + foundAdmin = true + break + } + } + if !foundAdmin { + ids = append(ids, adminID) + } + if err := s.store.SetWorkspaceMembers(id, ids); err != nil { + http.Redirect(w, r, "/admin/workspaces?error="+url.QueryEscape(err.Error()), http.StatusSeeOther) + return + } + http.Redirect(w, r, "/admin/workspaces?workspace="+strconv.FormatInt(id, 10)+"&flash=Workspace+members+updated", http.StatusSeeOther) } func (s *Server) createWorkspace(w http.ResponseWriter, r *http.Request) { u := currentUser(r) - if _, err := s.store.CreateWorkspace(r.FormValue("name"), r.FormValue("slug"), u.ID); err != nil { http.Redirect(w,r,"/admin/workspaces?error="+url.QueryEscape(err.Error()),http.StatusSeeOther); return } - http.Redirect(w,r,"/admin/workspaces?flash=Workspace+created",http.StatusSeeOther) + if _, err := s.store.CreateWorkspace(r.FormValue("name"), r.FormValue("slug"), u.ID); err != nil { + http.Redirect(w, r, "/admin/workspaces?error="+url.QueryEscape(err.Error()), http.StatusSeeOther) + return + } + http.Redirect(w, r, "/admin/workspaces?flash=Workspace+created", http.StatusSeeOther) } func (s *Server) switchWorkspace(w http.ResponseWriter, r *http.Request) { - id, err := strconv.ParseInt(r.FormValue("workspace_id"),10,64) - if err != nil { http.Error(w,"invalid workspace",http.StatusBadRequest); return } - if _, err := s.store.WorkspaceMember(id,currentUser(r).ID); err != nil { http.Error(w,"workspace access denied",http.StatusForbidden); return } - http.SetCookie(w,&http.Cookie{Name:"teammate_workspace",Value:strconv.FormatInt(id,10),Path:"/",HttpOnly:true,SameSite:http.SameSiteLaxMode,MaxAge:31536000}) - w.Header().Set("Cache-Control", "no-store") - returnTo := r.FormValue("return_to"); if returnTo == "" || !strings.HasPrefix(returnTo,"/") { returnTo = "/admin/workspaces?workspace="+strconv.FormatInt(id,10) } - if r.FormValue("return_to") == "" { - if ref, err := url.Parse(r.Referer()); err == nil && ref.Path != "" && ref.Path != "/workspace/switch" { returnTo = ref.Path; if ref.RawQuery != "" { returnTo += "?" + ref.RawQuery } } + id, err := strconv.ParseInt(r.FormValue("workspace_id"), 10, 64) + if err != nil { + http.Error(w, "invalid workspace", http.StatusBadRequest) + return } - http.Redirect(w,r,returnTo,http.StatusSeeOther) + if _, err := s.store.WorkspaceMember(id, currentUser(r).ID); err != nil { + http.Error(w, "workspace access denied", http.StatusForbidden) + return + } + http.SetCookie(w, &http.Cookie{Name: "teammate_workspace", Value: strconv.FormatInt(id, 10), Path: "/", HttpOnly: true, SameSite: http.SameSiteLaxMode, MaxAge: 31536000}) + w.Header().Set("Cache-Control", "no-store") + returnTo := r.FormValue("return_to") + if returnTo == "" || !strings.HasPrefix(returnTo, "/") { + returnTo = "/admin/workspaces?workspace=" + strconv.FormatInt(id, 10) + } + if r.FormValue("return_to") == "" { + if ref, err := url.Parse(r.Referer()); err == nil && ref.Path != "" && ref.Path != "/workspace/switch" { + returnTo = ref.Path + if ref.RawQuery != "" { + returnTo += "?" + ref.RawQuery + } + } + } + http.Redirect(w, r, returnTo, http.StatusSeeOther) } func (s *Server) createUser(w http.ResponseWriter, r *http.Request) { @@ -1180,6 +1287,29 @@ func (s *Server) setUserStatus(w http.ResponseWriter, r *http.Request) { http.Redirect(w, r, "/admin/users?flash="+message, http.StatusSeeOther) } +func (s *Server) changeUserPassword(w http.ResponseWriter, r *http.Request) { + id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64) + password := r.FormValue("password") + if password == "" || password != r.FormValue("password_confirm") { + http.Redirect(w, r, "/admin/users?error=Passwords+must+match", http.StatusSeeOther) + return + } + if err := s.store.SetUserPassword(id, password); err != nil { + http.Redirect(w, r, "/admin/users?error="+url.QueryEscape(err.Error()), http.StatusSeeOther) + return + } + http.Redirect(w, r, "/admin/users?flash=Password+updated", http.StatusSeeOther) +} + +func (s *Server) deleteUser(w http.ResponseWriter, r *http.Request) { + id, _ := strconv.ParseInt(r.PathValue("id"), 10, 64) + if err := s.store.DeleteUser(id, currentUser(r).ID); err != nil { + http.Redirect(w, r, "/admin/users?error="+url.QueryEscape(err.Error()), http.StatusSeeOther) + return + } + http.Redirect(w, r, "/admin/users?flash=Account+deleted", http.StatusSeeOther) +} + func (s *Server) reportPage(w http.ResponseWriter, r *http.Request) { now := time.Now() start := now.AddDate(0, -1, 0).Format("2006-01-02") @@ -1313,7 +1443,9 @@ func currentUser(r *http.Request) *User { func requestWorkspaceID(r *http.Request) int64 { if c, err := r.Cookie("teammate_workspace"); err == nil { - if id, err := strconv.ParseInt(c.Value, 10, 64); err == nil && id > 0 { return id } + if id, err := strconv.ParseInt(c.Value, 10, 64); err == nil && id > 0 { + return id + } } return 1 } @@ -1330,7 +1462,9 @@ func (s *Server) withUser(next http.Handler) http.Handler { if u, csrf, err := s.store.Session(c.Value); err == nil { u.WorkspaceID = requestWorkspaceID(r) if _, err := s.store.WorkspaceMember(u.WorkspaceID, u.ID); err != nil { - if available, lookupErr := s.store.Workspaces(u.ID); lookupErr == nil && len(available) > 0 { u.WorkspaceID = available[0].ID } + if available, lookupErr := s.store.Workspaces(u.ID); lookupErr == nil && len(available) > 0 { + u.WorkspaceID = available[0].ID + } } ctx := r.Context() ctx = context.WithValue(ctx, userKey, u) diff --git a/internal/app/server_test.go b/internal/app/server_test.go index 90a7def..50c3ed9 100644 --- a/internal/app/server_test.go +++ b/internal/app/server_test.go @@ -215,6 +215,27 @@ func TestLoginAttendanceAndReportFlow(t *testing.T) { if _, err := s.store.Authenticate("navid", "temporary-password"); err != nil { t.Fatalf("unlocked teammate could not authenticate: %v", err) } + newPassword := formRequest(t, s.http.Handler, "/admin/users/"+strconv.FormatInt(testuser.ID, 10)+"/password", url.Values{ + "csrf": {csrf}, + "password": {"changed-password"}, + "password_confirm": {"changed-password"}, + }, session) + if newPassword.Code != http.StatusSeeOther || newPassword.Header().Get("Location") != "/admin/users?flash=Password+updated" { + t.Fatalf("change password: got %d location %q", newPassword.Code, newPassword.Header().Get("Location")) + } + if _, err := s.store.Authenticate("navid", "temporary-password"); err == nil { + t.Fatal("old password still authenticates after reset") + } + if _, err := s.store.Authenticate("navid", "changed-password"); err != nil { + t.Fatalf("new password does not authenticate: %v", err) + } + deleteUser := formRequest(t, s.http.Handler, "/admin/users/"+strconv.FormatInt(testuser.ID, 10)+"/delete", url.Values{"csrf": {csrf}}, session) + if deleteUser.Code != http.StatusSeeOther || deleteUser.Header().Get("Location") != "/admin/users?flash=Account+deleted" { + t.Fatalf("delete user: got %d location %q", deleteUser.Code, deleteUser.Header().Get("Location")) + } + if _, err := s.store.Authenticate("navid", "changed-password"); err == nil { + t.Fatal("deleted account still authenticates") + } checkIn := formRequest(t, s.http.Handler, "/attendance/check-in", url.Values{ "csrf": {csrf}, diff --git a/internal/app/static/style.css b/internal/app/static/style.css index 8c43092..0455b59 100644 --- a/internal/app/static/style.css +++ b/internal/app/static/style.css @@ -227,6 +227,17 @@ textarea { resize: vertical; } .account-status-form .text-button, .current-account { font-size: .6rem; font-weight: 700; } .account-status-form .lock-account { color: var(--red); } .account-status-form .unlock-account { color: var(--green); } +.account-actions { display:flex; align-items:center; justify-content:flex-end; gap:10px; } +.account-manage { position:relative; } +.account-manage > summary { cursor:pointer; list-style:none; font-size:.6rem; font-weight:700; } +.account-manage > summary::-webkit-details-marker { display:none; } +.account-manage[open] > summary { color:var(--green); } +.account-manage > form { position:absolute; z-index:5; right:0; top:calc(100% + 6px); display:grid; gap:8px; width:210px; padding:12px; border:1px solid var(--line); border-radius:10px; background:var(--white); box-shadow:var(--shadow); } +.account-manage .account-password-form { grid-template-columns:1fr; } +.account-manage label { display:grid; gap:4px; color:var(--muted); font-size:.6rem; font-weight:700; } +.account-manage input { width:100%; box-sizing:border-box; padding:7px 8px; font:inherit; font-size:.68rem; } +.account-manage .account-delete-form { top:calc(100% + 180px); } +.account-manage .delete-account { color:var(--red); } .current-account { text-align: right; } .filter-tabs { display: flex; gap: 4px; padding: 4px; border: 1px solid var(--line); border-radius: 10px; background: #fff; } @@ -380,7 +391,7 @@ blockquote { margin: 10px 0; padding-left: 12px; border-left: 2px solid #d8dfdb; .card-tags { display: flex; flex-wrap: wrap; gap: 4px; } .card-topline { display: flex; justify-content: space-between; gap: 8px; align-items: start; min-height: 21px; margin-bottom: 7px; } .card-signals { display: flex; flex-wrap: wrap; gap: 5px; justify-content: flex-end; } -.task-due { padding: 3px 5px; border-radius: 6px; background: var(--sand); color: #786039; font-size: .53rem; font-weight: 700; } +.task-due { display: inline-flex; min-height: 21px; box-sizing: border-box; align-items: center; justify-content: center; padding: 3px 7px; border-radius: 6px; background: var(--sand); color: #786039; font-size: .53rem; font-weight: 700; line-height: 1; text-align: center; } .todo-progress { padding: 3px 5px; border-radius: 6px; background: var(--mint); color: var(--green-2); font-size: .53rem; font-weight: 800; } .importance-emoji { display: grid; width: 21px; height: 21px; place-items: center; border-radius: 6px; background: var(--paper); font-size: .66rem; line-height: 1; } .importance-emoji i { font-size: .68rem; } diff --git a/internal/app/store.go b/internal/app/store.go index 6cb4295..cb7f907 100644 --- a/internal/app/store.go +++ b/internal/app/store.go @@ -32,18 +32,18 @@ type User struct { } type Workspace struct { - ID int64 - Name string - Slug string + ID int64 + Name string + Slug string CreatedAt string } type WorkspaceMember struct { WorkspaceID int64 - UserID int64 - Role string - Workspace Workspace - User User + UserID int64 + Role string + Workspace Workspace + User User } type Attendance struct { @@ -317,7 +317,9 @@ CREATE INDEX IF NOT EXISTS idx_board_task_tags_tag ON board_task_tags(tag_id,tas if err := s.ensureColumn("board_tasks", "importance", "importance TEXT NOT NULL DEFAULT 'normal' CHECK(importance IN ('low','normal','high','urgent'))"); err != nil { return err } - if err := s.ensureColumn("board_tasks", "workspace_id", "workspace_id INTEGER NOT NULL DEFAULT 1"); err != nil { return err } + if err := s.ensureColumn("board_tasks", "workspace_id", "workspace_id INTEGER NOT NULL DEFAULT 1"); err != nil { + return err + } if err := s.ensureBoardTaskTodoStatus(); err != nil { return err } @@ -343,14 +345,22 @@ CREATE INDEX IF NOT EXISTS idx_board_task_tags_tag ON board_task_tags(tag_id,tas } _, err = s.db.Exec(`INSERT INTO users(username,password_hash,display_name,email,role) VALUES(?,?,?,?,?)`, "admin", hash, "Workspace Admin", "admin@localhost", "admin") - if err != nil { return err } + if err != nil { + return err + } } var workspaceCount int - if err := s.db.QueryRow(`SELECT COUNT(*) FROM workspaces`).Scan(&workspaceCount); err != nil { return err } - if workspaceCount == 0 { - if _, err := s.db.Exec(`INSERT INTO workspaces(name,slug) VALUES(?,?)`, "Hamkar workspace", "hamkar"); err != nil { return err } + if err := s.db.QueryRow(`SELECT COUNT(*) FROM workspaces`).Scan(&workspaceCount); err != nil { + return err + } + if workspaceCount == 0 { + if _, err := s.db.Exec(`INSERT INTO workspaces(name,slug) VALUES(?,?)`, "Hamkar workspace", "hamkar"); err != nil { + return err + } + } + if _, err := s.db.Exec(`INSERT OR IGNORE INTO workspace_members(workspace_id,user_id,role) SELECT w.id,u.id,u.role FROM workspaces w CROSS JOIN users u`); err != nil { + return err } - if _, err := s.db.Exec(`INSERT OR IGNORE INTO workspace_members(workspace_id,user_id,role) SELECT w.id,u.id,u.role FROM workspaces w CROSS JOIN users u`); err != nil { return err } return nil } @@ -568,45 +578,89 @@ func (s *Store) Users() ([]User, error) { func (s *Store) Workspaces(userID int64) ([]Workspace, error) { rows, err := s.db.Query(`SELECT w.id,w.name,w.slug,w.created_at FROM workspaces w JOIN workspace_members m ON m.workspace_id=w.id WHERE m.user_id=? ORDER BY w.name`, userID) - if err != nil { return nil, err } + if err != nil { + return nil, err + } defer rows.Close() var out []Workspace - for rows.Next() { var w Workspace; if err := rows.Scan(&w.ID,&w.Name,&w.Slug,&w.CreatedAt); err != nil { return nil, err }; out = append(out,w) } + for rows.Next() { + var w Workspace + if err := rows.Scan(&w.ID, &w.Name, &w.Slug, &w.CreatedAt); err != nil { + return nil, err + } + out = append(out, w) + } return out, rows.Err() } func (s *Store) AllWorkspaces() ([]Workspace, error) { - rows, err := s.db.Query(`SELECT id,name,slug,created_at FROM workspaces ORDER BY name`); if err != nil { return nil,err }; defer rows.Close() - var out []Workspace; for rows.Next() { var w Workspace; if err:=rows.Scan(&w.ID,&w.Name,&w.Slug,&w.CreatedAt); err!=nil{return nil,err}; out=append(out,w) }; return out,rows.Err() + rows, err := s.db.Query(`SELECT id,name,slug,created_at FROM workspaces ORDER BY name`) + if err != nil { + return nil, err + } + defer rows.Close() + var out []Workspace + for rows.Next() { + var w Workspace + if err := rows.Scan(&w.ID, &w.Name, &w.Slug, &w.CreatedAt); err != nil { + return nil, err + } + out = append(out, w) + } + return out, rows.Err() } func (s *Store) CreateWorkspace(name, slug string, ownerID int64) (int64, error) { result, err := s.db.Exec(`INSERT INTO workspaces(name,slug) VALUES(?,?)`, strings.TrimSpace(name), strings.TrimSpace(strings.ToLower(slug))) - if err != nil { return 0, err } - id, err := result.LastInsertId(); if err != nil { return 0, err } + if err != nil { + return 0, err + } + id, err := result.LastInsertId() + if err != nil { + return 0, err + } _, err = s.db.Exec(`INSERT INTO workspace_members(workspace_id,user_id,role) VALUES(?,?, 'admin')`, id, ownerID) return id, err } func (s *Store) WorkspaceMember(workspaceID, userID int64) (WorkspaceMember, error) { var m WorkspaceMember - err := s.db.QueryRow(`SELECT w.id,w.name,w.slug,w.created_at,u.id,u.username,u.display_name,u.email,u.role,u.avatar_url,u.active,m.role FROM workspaces w JOIN workspace_members m ON m.workspace_id=w.id JOIN users u ON u.id=m.user_id WHERE w.id=? AND u.id=?`, workspaceID,userID).Scan(&m.Workspace.ID,&m.Workspace.Name,&m.Workspace.Slug,&m.Workspace.CreatedAt,&m.User.ID,&m.User.Username,&m.User.DisplayName,&m.User.Email,&m.User.Role,&m.User.AvatarURL,&m.User.Active,&m.Role) + err := s.db.QueryRow(`SELECT w.id,w.name,w.slug,w.created_at,u.id,u.username,u.display_name,u.email,u.role,u.avatar_url,u.active,m.role FROM workspaces w JOIN workspace_members m ON m.workspace_id=w.id JOIN users u ON u.id=m.user_id WHERE w.id=? AND u.id=?`, workspaceID, userID).Scan(&m.Workspace.ID, &m.Workspace.Name, &m.Workspace.Slug, &m.Workspace.CreatedAt, &m.User.ID, &m.User.Username, &m.User.DisplayName, &m.User.Email, &m.User.Role, &m.User.AvatarURL, &m.User.Active, &m.Role) return m, err } func (s *Store) SetWorkspaceMembers(workspaceID int64, userIDs []int64) error { - tx, err := s.db.Begin(); if err != nil { return err } + tx, err := s.db.Begin() + if err != nil { + return err + } defer tx.Rollback() - if _, err = tx.Exec(`DELETE FROM workspace_members WHERE workspace_id=?`, workspaceID); err != nil { return err } + if _, err = tx.Exec(`DELETE FROM workspace_members WHERE workspace_id=?`, workspaceID); err != nil { + return err + } for _, userID := range userIDs { - if _, err = tx.Exec(`INSERT INTO workspace_members(workspace_id,user_id,role) SELECT ?,id,CASE WHEN role='admin' THEN 'admin' ELSE 'member' END FROM users WHERE id=?`, workspaceID,userID); err != nil { return err } + if _, err = tx.Exec(`INSERT INTO workspace_members(workspace_id,user_id,role) SELECT ?,id,CASE WHEN role='admin' THEN 'admin' ELSE 'member' END FROM users WHERE id=?`, workspaceID, userID); err != nil { + return err + } } return tx.Commit() } func (s *Store) WorkspaceMemberIDs(workspaceID int64) (map[int64]bool, error) { - rows, err := s.db.Query(`SELECT user_id FROM workspace_members WHERE workspace_id=?`, workspaceID); if err != nil { return nil, err }; defer rows.Close() - out := map[int64]bool{}; for rows.Next() { var id int64; if err:=rows.Scan(&id); err != nil { return nil,err }; out[id]=true }; return out, rows.Err() + rows, err := s.db.Query(`SELECT user_id FROM workspace_members WHERE workspace_id=?`, workspaceID) + if err != nil { + return nil, err + } + defer rows.Close() + out := map[int64]bool{} + for rows.Next() { + var id int64 + if err := rows.Scan(&id); err != nil { + return nil, err + } + out[id] = true + } + return out, rows.Err() } func (s *Store) ActiveUsers() ([]User, error) { @@ -615,8 +669,19 @@ func (s *Store) ActiveUsers() ([]User, error) { func (s *Store) ActiveUsersInWorkspace(workspaceID int64) ([]User, error) { rows, err := s.db.Query(`SELECT u.id,u.username,u.display_name,COALESCE(u.email,''),u.role,u.avatar_url,u.active FROM users u JOIN workspace_members m ON m.user_id=u.id WHERE m.workspace_id=? AND u.active=1 ORDER BY u.display_name`, workspaceID) - if err != nil { return nil, err }; defer rows.Close() - var out []User; for rows.Next() { var u User; if err:=rows.Scan(&u.ID,&u.Username,&u.DisplayName,&u.Email,&u.Role,&u.AvatarURL,&u.Active); err!=nil{return nil,err}; out=append(out,u) }; return out,rows.Err() + if err != nil { + return nil, err + } + defer rows.Close() + var out []User + for rows.Next() { + var u User + if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Email, &u.Role, &u.AvatarURL, &u.Active); err != nil { + return nil, err + } + out = append(out, u) + } + return out, rows.Err() } func (s *Store) users(activeOnly bool) ([]User, error) { @@ -796,6 +861,74 @@ func (s *Store) SetUserActive(userID, actorID int64, active bool) error { return tx.Commit() } +func (s *Store) SetUserPassword(userID int64, password string) error { + if userID < 1 { + return errors.New("account was not found") + } + if len(password) < 8 { + return errors.New("password must be at least 8 characters") + } + hash, err := hashPassword(password) + if err != nil { + return err + } + tx, err := s.db.Begin() + if err != nil { + return err + } + defer tx.Rollback() + result, err := tx.Exec(`UPDATE users SET password_hash=? WHERE id=?`, hash, userID) + if err != nil { + return err + } + if count, _ := result.RowsAffected(); count == 0 { + return errors.New("account was not found") + } + if _, err := tx.Exec(`DELETE FROM sessions WHERE user_id=?`, userID); err != nil { + return err + } + return tx.Commit() +} + +func (s *Store) DeleteUser(userID, actorID int64) error { + if userID < 1 { + return errors.New("account was not found") + } + if userID == actorID { + return errors.New("you cannot delete your own account") + } + tx, err := s.db.Begin() + if err != nil { + return err + } + defer tx.Rollback() + var role string + if err := tx.QueryRow(`SELECT role FROM users WHERE id=?`, userID).Scan(&role); err != nil { + if errors.Is(err, sql.ErrNoRows) { + return errors.New("account was not found") + } + return err + } + if role == "admin" { + var admins int + if err := tx.QueryRow(`SELECT COUNT(*) FROM users WHERE role='admin'`).Scan(&admins); err != nil { + return err + } + if admins <= 1 { + return errors.New("the last administrator cannot be deleted") + } + } + // Keep historical request records when removing an administrator, while + // clearing the optional reviewer reference that has no cascade action. + if _, err := tx.Exec(`UPDATE requests SET reviewed_by=NULL WHERE reviewed_by=?`, userID); err != nil { + return err + } + if _, err := tx.Exec(`DELETE FROM users WHERE id=?`, userID); err != nil { + return err + } + return tx.Commit() +} + func (s *Store) SetUserAvatar(userID int64, avatarURL string) error { _, err := s.db.Exec(`UPDATE users SET avatar_url=? WHERE id=?`, avatarURL, userID) return err @@ -1163,17 +1296,31 @@ func (s *Store) boardTasks(archived bool, workspaceID int64) ([]BoardTask, error FROM board_tasks t JOIN users c ON c.id=t.creator_id` if archived { - query += ` WHERE t.archived_at IS NOT NULL` + func() string { if workspaceID > 0 { return ` AND t.workspace_id=?` }; return `` }() + ` + query += ` WHERE t.archived_at IS NOT NULL` + func() string { + if workspaceID > 0 { + return ` AND t.workspace_id=?` + } + return `` + }() + ` ORDER BY t.archived_at DESC,t.id DESC` } else { - query += ` WHERE t.archived_at IS NULL` + func() string { if workspaceID > 0 { return ` AND t.workspace_id=?` }; return `` }() + ` + query += ` WHERE t.archived_at IS NULL` + func() string { + if workspaceID > 0 { + return ` AND t.workspace_id=?` + } + return `` + }() + ` ORDER BY CASE t.status WHEN 'backlog' THEN 0 WHEN 'todo' THEN 1 WHEN 'in_progress' THEN 2 WHEN 'blocked' THEN 3 ELSE 4 END, t.created_at DESC` } var rows *sql.Rows var err error - if workspaceID > 0 { rows, err = s.db.Query(query, workspaceID) } else { rows, err = s.db.Query(query) } + if workspaceID > 0 { + rows, err = s.db.Query(query, workspaceID) + } else { + rows, err = s.db.Query(query) + } if err != nil { return nil, err } diff --git a/internal/app/templates/users.html b/internal/app/templates/users.html index 1716327..524fd37 100644 --- a/internal/app/templates/users.html +++ b/internal/app/templates/users.html @@ -36,6 +36,7 @@ {{if eq .ID $current.ID}} Current account {{else}} +
+ +
{{end}} {{end}}