pakin/Taobin-Recipe-Manager
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test update some permissions

Browse source
This commit is contained in:
Kenta420 2023-12-08 14:46:07 +07:00
parent ac64335d5b
commit 25ce65e425
15 changed files with 582 additions and 493 deletions
Download patch file Download diff file Expand all files Collapse all files

53
client/src/app/app-routing.module.ts
View file

@ -1,4 +1,4 @@
import { NgModule, inject } from '@angular/core';
import {inject, NgModule} from '@angular/core';
import {
ActivatedRouteSnapshot,
CanActivateFn,
@ -7,8 +7,9 @@ import {
RouterStateSnapshot,
Routes,
} from '@angular/router';
import { UserService } from './core/services/user.service';
import { map } from 'rxjs';
import {UserService} from './core/services/user.service';
import {map} from 'rxjs';
import {UserPermissions} from "./core/auth/userPermissions";
const authGuard: CanActivateFn = (
route: ActivatedRouteSnapshot,
@ -31,13 +32,38 @@ const authGuard: CanActivateFn = (
);
};
const loginGuard: CanActivateFn = (
const permissionsGuard: (...requiredPermissions: UserPermissions[]) => CanActivateFn = (...requiredPermissions) => (
route: ActivatedRouteSnapshot,
state: RouterStateSnapshot
) => {
const userService: UserService = inject(UserService);
const router: Router = inject(Router);
const user = userService.getCurrentUser()
if (user == null)
return router.createUrlTree(['/login'], {
queryParams: {
redirectUrl: state.url,
},
});
if (requiredPermissions.every(permission => user.permissions.includes(permission))) {
return true
}
return router.createUrlTree(['/unauthorized'], {
queryParams: {
redirectUrl: state.url,
},
});
}
const loginGuard: CanActivateFn = (
route: ActivatedRouteSnapshot
) => {
const userService: UserService = inject(UserService);
const router: Router = inject(Router);
return userService.isAuthenticated.pipe(
map((isAuth) => {
if (!isAuth) {
@ -83,15 +109,15 @@ const routes: Routes = [
import('./features/recipes/recipes.component').then(
(m) => m.RecipesComponent
),
canActivate: [authGuard],
canActivate: [authGuard, permissionsGuard(UserPermissions.THAI_PERMISSION, UserPermissions.SUPER_ADMIN)],
},
{
path: 'recipe/:productCode',
loadComponent: () =>
import(
'./features/recipes/recipe-details/recipe-details.component'
).then((m) => m.RecipeDetailsComponent),
canActivate: [authGuard],
).then((m) => m.RecipeDetailsComponent),
canActivate: [authGuard, permissionsGuard(UserPermissions.THAI_PERMISSION, UserPermissions.SUPER_ADMIN)],
},
// {
// path: 'log',
@ -100,9 +126,17 @@ const routes: Routes = [
// (m) => m.ChangelogComponent
// ),
// },
{
path: 'unauthorized',
loadComponent: () => import('./core/auth/unauthorized.component').then((m) => m.UnauthorizedComponent)
},
{
path: 'notfound',
loadComponent: () => import('./core/notfound.component').then((m) => m.NotfoundComponent)
},
{
path: '**',
redirectTo: 'recipes',
redirectTo: 'notfound',
},
],
},
@ -112,4 +146,5 @@ const routes: Routes = [
imports: [RouterModule.forRoot(routes)],
exports: [RouterModule],
})
export class AppRoutingModule {}
export class AppRoutingModule {
}

31
client/src/app/core/auth/unauthorized.component.ts Normal file
View file

@ -0,0 +1,31 @@
import { Component, OnInit } from '@angular/core';
import { Router, ActivatedRoute } from '@angular/router';
@Component({
selector: 'app-unauthorized',
standalone: true,
template: `
<div class="flex pt-[100px] justify-center h-screen">
<h1 class="text-2xl font-bold text-center text-red-500">
Unauthorized, You 🫵🏻 not have permissions
</h1>
</div>`
})
export class UnauthorizedComponent implements OnInit {
constructor(
private router: Router,
private activatedRoute: ActivatedRoute
) { }
ngOnInit(): void {
const redirectUrl = this.activatedRoute.snapshot.queryParams['redirectUrl'];
if (redirectUrl) {
this.router.navigate([redirectUrl]).catch(() => {
// redirect to login page
void this.router.navigate(['/login']);
});
}
}
}

12
client/src/app/core/auth/userPermissions.ts Normal file
View file

@ -0,0 +1,12 @@
export enum UserPermissions {
NO_PERMISSION,
THAI_PERMISSION = 1 << 0,
MALAY_PERMISSION = 1 << 1,
AUS_PERMISSION = 1 << 2,
SUPER_ADMIN = 1 << 3
}
export function getPermissions(perms: number) : UserPermissions[] {
return Object.values(UserPermissions)
.filter(permission => typeof permission === 'number' && (perms & permission) !== 0) as UserPermissions[];
}

11
client/src/app/core/callback/callback.component.ts
View file

@ -1,7 +1,7 @@
import { Component, OnInit } from '@angular/core';
import { CommonModule } from '@angular/common';
import { ActivatedRoute, Params, Router } from '@angular/router';
import { ActivatedRoute, Router } from '@angular/router';
import { UserService } from '../services/user.service';
import {getPermissions} from "../auth/userPermissions";
@Component({
selector: 'app-callback',
@ -19,18 +19,19 @@ export class CallbackComponent implements OnInit {
this.route.queryParams.subscribe((params) => {
console.log(params);
if (params['email'] && params['name'] && params['picture']) {
if (params['email'] && params['name'] && params['picture'] && params['permissions']) {
this.userService.setAuth({
email: params['email'],
name: params['name'],
picture: params['picture'],
permissions: getPermissions(params['permissions'])
});
}
if (params['redirect_to']) {
this.router.navigate([params['redirect_to']]);
void this.router.navigate([params['redirect_to']]);
} else {
this.router.navigate(['/']);
void this.router.navigate(['/']);
}
});
}

3
client/src/app/core/models/user.model.ts
View file

@ -1,5 +1,8 @@
import {UserPermissions} from "../auth/userPermissions";
export interface User {
email: string;
name: string;
picture: string;
permissions: UserPermissions[];
}

10
client/src/app/core/notfound.component.ts Normal file
View file

@ -0,0 +1,10 @@
import { Component } from '@angular/core';
@Component({
selector: 'app-notfound',
standalone: true,
template: `<h1>Not Found!!!</h1>`
})
export class NotfoundComponent {
}

22
client/src/app/core/services/user.service.ts
View file

@ -2,10 +2,9 @@ import { Injectable } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import {
BehaviorSubject,
Observable,
distinctUntilChanged,
map,
tap,
} from 'rxjs';
import { User } from '../models/user.model';
import { Router } from '@angular/router';
@ -31,6 +30,10 @@ export class UserService {
}
}
getCurrentUser(): User | null {
return this.currentUserSubject.value
}
logout(): void {
this.purgeAuth();
// post to api /revoke with cookie
@ -43,21 +46,6 @@ export class UserService {
});
}
getCurrentUser(): Observable<{ user: User }> {
return this.http
.get<{ user: User }>(environment.api + '/auth/user', {
withCredentials: true,
})
.pipe(
tap({
next: ({ user }) => {
this.setAuth(user);
},
error: () => this.purgeAuth(),
})
);
}
setAuth(user: User): void {
window.localStorage.setItem('user', JSON.stringify(user));
void this.currentUserSubject.next(user);

18
client/src/app/features/recipes/recipe-details/recipe-details.component.ts
View file

@ -2,7 +2,7 @@ import { CommonModule, DatePipe } from '@angular/common';
import { Component, EventEmitter, OnInit } from '@angular/core';
import { FormBuilder, ReactiveFormsModule } from '@angular/forms';
import { ActivatedRoute, Router, RouterLink } from '@angular/router';
import { Observable, first } from 'rxjs';
import {Observable, first, map} from 'rxjs';
import { RecipeService } from 'src/app/core/services/recipe.service';
import { ConfirmModal } from 'src/app/shared/modal/confirm/confirm-modal.component';
import { animate, style, transition, trigger } from '@angular/animations';
@ -11,8 +11,7 @@ import {
RecipeDetail,
RecipeDetailMat,
} from 'src/app/core/models/recipe.model';
import { Action, ActionRecord } from 'src/app/shared/actionRecord/actionRecord';
import { isEqual } from 'lodash';
import { ActionRecord } from 'src/app/shared/actionRecord/actionRecord';
import { UserService } from 'src/app/core/services/user.service';
@Component({
@ -119,10 +118,9 @@ export class RecipeDetailsComponent implements OnInit {
// get username
let username:string = ""
this._userService.getCurrentUser().subscribe((user) => {
username = user.user.name;
this._userService.currentUser.pipe(map((user) => {
if (user)
username = user.name;
let to_send = {
edit_by: username,
@ -152,8 +150,8 @@ export class RecipeDetailsComponent implements OnInit {
}
);
console.log('Sending changes');
this._router.navigate(['/recipes']);
})
void this._router.navigate(['/recipes']);
}))
@ -198,6 +196,6 @@ export class RecipeDetailsComponent implements OnInit {
onRecipeListFormChange(repl: unknown[]) {
console.log('Recipe List Form Changed', repl);
this.repl = repl as never[];
this.isValueChanged ||= repl != undefined ? true : false;
this.isValueChanged ||= repl != undefined;
}
}

BIN
server/data/database.db
View file

Binary file not shown.

2
server/helpers/misc.go
View file

@ -42,7 +42,7 @@ func DynamicCompare(s interface{}, u interface{}) (bool, error) {
return t == u, nil
case float64:
u, ok := u.(float64)
// Log.Debug("[helpers] DynamicCompare", zap.Any("u", u), zap.Any("ok", ok), zap.Any("test_compare*(t==u)", t == u))
// Log.Debug("[helpers] DynamicCompare", zap.Any("user", u), zap.Any("ok", ok), zap.Any("test_compare*(t==u)", t == u))
if t == u {
return t == u, nil

3
server/main.go
View file

@ -2,6 +2,7 @@ package main
import (
"context"
"errors"
"log"
"os"
"os/signal"
@ -22,7 +23,7 @@ func main() {
go func() {
<-shutdownCtx.Done()
if shutdownCtx.Err() == context.DeadlineExceeded {
if errors.Is(shutdownCtx.Err(), context.DeadlineExceeded) {
log.Println("Shutdown timeout, force exit")
cancel()
}

82
server/middlewares/authorized.go
View file

@ -1,19 +1,87 @@
package middlewares
import (
"context"
"encoding/json"
"fmt"
"github.com/go-chi/chi/v5"
"golang.org/x/oauth2"
"net/http"
"recipe-manager/enums/permissions"
"recipe-manager/models"
"recipe-manager/services/oauth"
"recipe-manager/services/user"
)
func Authorize(p []permissions.Permission, nextRoute http.HandlerFunc) http.HandlerFunc {
// ========================== ValidatePermissions =========================================
func Authorize(oauthService oauth.OAuthService, userService user.UserService, nextRoute http.Handler) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
user := r.Context().Value("user").(*models.User)
token := &oauth2.Token{}
if cookie, err := r.Cookie("access_token"); err == nil {
token.AccessToken = cookie.Value
}
userInfo, err := oauthService.GetUserInfo(r.Context(), token)
if err != nil {
// if have refresh token, set refresh token to token
if cookie, err := r.Cookie("refresh_token"); err == nil {
token.RefreshToken = cookie.Value
}
newToken, err := oauthService.RefreshToken(r.Context(), token)
if err != nil {
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
userInfo, err = oauthService.GetUserInfo(r.Context(), newToken)
if err != nil {
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
// set new token to cookie
w.Header().Add("set-cookie", fmt.Sprintf("access_token=%s; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=3600", newToken.AccessToken))
}
if userInfo != nil {
userFromDB, err := userService.GetUserByEmail(r.Context(), userInfo.Email)
if err != nil {
if err != nil {
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
}
if userFromDB != nil {
userInfo.ID = userFromDB.ID
userInfo.Name = userFromDB.Name
if userFromDB.Picture != "" {
userInfo.Picture = userFromDB.Picture
}
userInfo.Permissions = userFromDB.Permissions
}
}
ctx := context.WithValue(r.Context(), "user", userInfo)
nextRoute.ServeHTTP(w, r.WithContext(ctx))
}
}
// ========================== Permissions =========================================
func ValidatePermissions(p []permissions.Permission, nextRoute http.HandlerFunc) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
u := r.Context().Value("user").(*models.User)
for _, pm := range p {
if !user.Permissions.IsHavePermission(pm) {
if !u.Permissions.IsHavePermission(pm) {
// If not have permission response unauthorized
w.WriteHeader(http.StatusUnauthorized)
err := json.NewEncoder(w).Encode("Unauthorized")
@ -28,10 +96,10 @@ func Authorize(p []permissions.Permission, nextRoute http.HandlerFunc) http.Hand
}
}
func OwnOrAuthorize(p []permissions.Permission, nextRoute http.HandlerFunc) http.HandlerFunc {
func ValidateOwnerOrPermissions(p []permissions.Permission, nextRoute http.HandlerFunc) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
reqUserID := chi.URLParam(r, "id")
user := r.Context().Value("user").(*models.User)
u := r.Context().Value("user").(*models.User)
if reqUserID == "" {
// If not have permission response unauthorized
@ -43,11 +111,11 @@ func OwnOrAuthorize(p []permissions.Permission, nextRoute http.HandlerFunc) http
return
}
if reqUserID == user.ID {
if reqUserID == u.ID {
nextRoute.ServeHTTP(w, r)
return
}
Authorize(p, nextRoute)
ValidatePermissions(p, nextRoute)
}
}

8
server/routers/user.go
View file

@ -27,14 +27,14 @@ func (ur *UserRouter) Route(r chi.Router) {
// Users
r.Route("/users", func(r chi.Router) {
r.Get("/", middlewares.Authorize([]permissions.Permission{permissions.SuperAdmin}, ur.getUsers))
r.Get("/", middlewares.ValidatePermissions([]permissions.Permission{permissions.SuperAdmin}, ur.getUsers))
r.Post("/", middlewares.Authorize([]permissions.Permission{permissions.SuperAdmin}, ur.createUser))
r.Post("/", middlewares.ValidatePermissions([]permissions.Permission{permissions.SuperAdmin}, ur.createUser))
})
// User
r.Route("/user", func(r chi.Router) {
r.Get("/{id}", middlewares.OwnOrAuthorize([]permissions.Permission{permissions.SuperAdmin}, ur.getUser))
r.Get("/{id}", middlewares.ValidateOwnerOrPermissions([]permissions.Permission{permissions.SuperAdmin}, ur.getUser))
})
}
@ -56,7 +56,7 @@ func (ur *UserRouter) createUser(w http.ResponseWriter, r *http.Request) {
ur.taoLogger.Log.Error("UserRouter.CreateUser", zap.Error(err))
}
ur.taoLogger.Log.Info("UserRouter.CreateUser", zap.Reflect("u", u))
ur.taoLogger.Log.Info("UserRouter.CreateUser", zap.Reflect("user", u))
if err := ur.userService.CreateNewUser(ctx, u.Name, u.Email, u.Picture, u.Permissions); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)

70
server/server.go
View file

@ -14,6 +14,7 @@ import (
"recipe-manager/config"
"recipe-manager/data"
"recipe-manager/enums/permissions"
"recipe-manager/middlewares"
"recipe-manager/models"
"recipe-manager/routers"
"recipe-manager/services/logger"
@ -29,7 +30,6 @@ import (
"github.com/go-chi/cors"
"github.com/spf13/viper"
"go.uber.org/zap"
"golang.org/x/oauth2"
)
var (
@ -116,7 +116,7 @@ func (s *Server) createHandler() {
}))
// Recipe Service
recipeService := recipe.NewRecipeService(s.data)
recipeService := recipe.NewRecipeService(s.data, s.taoLogger)
// User Service
userService := user.NewUserService(s.cfg, s.database, s.taoLogger)
@ -134,63 +134,7 @@ func (s *Server) createHandler() {
r.Group(func(r chi.Router) {
r.Use(func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
token := &oauth2.Token{}
if cookie, err := r.Cookie("access_token"); err == nil {
token.AccessToken = cookie.Value
}
userInfo, err := s.oauth.GetUserInfo(r.Context(), token)
if err != nil {
// if have refresh token, set refresh token to token
if cookie, err := r.Cookie("refresh_token"); err == nil {
token.RefreshToken = cookie.Value
}
newToken, err := s.oauth.RefreshToken(r.Context(), token)
if err != nil {
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
userInfo, err = s.oauth.GetUserInfo(r.Context(), newToken)
if err != nil {
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
// set new token to cookie
w.Header().Add("set-cookie", fmt.Sprintf("access_token=%s; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=3600", newToken.AccessToken))
}
if userInfo != nil {
userFromDB, err := userService.GetUserByEmail(r.Context(), userInfo.Email)
if err != nil {
if err != nil {
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
}
if userFromDB != nil {
userInfo.ID = userFromDB.ID
userInfo.Name = userFromDB.Name
if userFromDB.Picture != "" {
userInfo.Picture = userFromDB.Picture
}
userInfo.Permissions = userFromDB.Permissions
}
}
ctx := context.WithValue(r.Context(), "user", userInfo)
next.ServeHTTP(w, r.WithContext(ctx))
})
return middlewares.Authorize(s.oauth, userService, next)
})
r.Post("/merge", func(w http.ResponseWriter, r *http.Request) {
@ -198,10 +142,10 @@ func (s *Server) createHandler() {
// locking
if !pyAPIhandler(w, r) {
s.taoLogger.Log.Warn("Merge - u tried to access while another u is requesting merge",
zap.String("u", r.Context().Value("u").(*models.User).Name))
zap.String("user", r.Context().Value("user").(*models.User).Name))
return
} else {
s.taoLogger.Log.Debug("Merge - u has access", zap.String("u", r.Context().Value("u").(*models.User).Name))
s.taoLogger.Log.Debug("Merge - u has access", zap.String("user", r.Context().Value("user").(*models.User).Name))
}
var targetMap map[string]interface{}
@ -234,8 +178,8 @@ func (s *Server) createHandler() {
dev_path := repo_path + dev_version + ".json"
// Get who's requesting
u := r.Context().Value("u").(*models.User)
s.taoLogger.Log.Info("Request merge by", zap.String("u", u.Name))
u := r.Context().Value("user").(*models.User)
s.taoLogger.Log.Info("Request merge by", zap.String("user", u.Name))
// lookup for python exec
pyExec, err := exec.LookPath("python")

20
server/services/recipe/recipe.go
View file

@ -12,10 +12,6 @@ import (
"go.uber.org/zap"
)
var (
Log = logger.GetInstance()
)
type RecipeService interface {
GetRecipeDashboard(request *contracts.RecipeDashboardRequest) (contracts.RecipeDashboardResponse, error)
GetRecipeOverview(request *contracts.RecipeOverviewRequest) (contracts.RecipeOverviewResponse, error)
@ -25,13 +21,14 @@ type RecipeService interface {
}
type recipeService struct {
db *data.Data
db *data.Data
taoLogger *logger.TaoLogger
}
// GetRecipeDetail implements RecipeService.
func (rs *recipeService) GetRecipeDetail(request *contracts.RecipeDetailRequest) (contracts.RecipeDetailResponse, error) {
Log.Debug("GetRecipeDetail", zap.Any("request", request))
rs.taoLogger.Log.Debug("GetRecipeDetail", zap.Any("request", request))
recipe, err := rs.db.GetRecipe01ByProductCode(request.Filename, request.Country, request.ProductCode)
@ -40,7 +37,7 @@ func (rs *recipeService) GetRecipeDetail(request *contracts.RecipeDetailRequest)
}
// DEBUG: picture
Log.Debug("GetRecipeDetail", zap.String("picture", recipe.UriData))
rs.taoLogger.Log.Debug("GetRecipeDetail", zap.String("picture", recipe.UriData))
result := contracts.RecipeDetailResponse{
Name: recipe.Name,
@ -143,7 +140,7 @@ func (rs *recipeService) GetRecipeOverview(request *contracts.RecipeOverviewRequ
result := contracts.RecipeOverviewResponse{}
if request.Search != "" {
searchResult := []models.Recipe01{}
var searchResult []models.Recipe01
for _, v := range recipeFilter {
if strings.Contains(strings.ToLower(v.ProductCode), strings.ToLower(request.Search)) ||
strings.Contains(strings.ToLower(v.Name), strings.ToLower(request.Search)) ||
@ -155,7 +152,7 @@ func (rs *recipeService) GetRecipeOverview(request *contracts.RecipeOverviewRequ
}
if len(request.MatIds) > 0 {
matIdsFiltered := []models.Recipe01{}
var matIdsFiltered []models.Recipe01
for _, v := range recipeFilter {
for _, matID := range request.MatIds {
for _, recipe := range v.Recipes {
@ -197,8 +194,9 @@ func (rs *recipeService) GetRecipeOverview(request *contracts.RecipeOverviewRequ
return result, nil
}
func NewRecipeService(db *data.Data) RecipeService {
func NewRecipeService(db *data.Data, taoLogger *logger.TaoLogger) RecipeService {
return &recipeService{
db: db,
db: db,
taoLogger: taoLogger,
}
}