Add user authorization

controllers/AdminController.cc

@@ -20,6 +20,19 @@ std::optional<visione::auth::UserContext> requireUser(
     return user;
 }
 
+bool blockPasswordChangeRequired(
+    const visione::auth::UserContext &user,
+    std::function<void(const HttpResponsePtr &)> &callback)
+{
+    if (!visione::auth::mustChangePassword(user))
+    {
+        return false;
+    }
+    callback(visione::http::error("password_change_required",
+                                  drogon::k403Forbidden));
+    return true;
+}
+
 void sendAdmin(Json::Value body,
                std::function<void(const HttpResponsePtr &)> &&callback)
 {
@@ -28,6 +41,7 @@ void sendAdmin(Json::Value body,
         callback(visione::http::json(std::move(body)));
         return;
     }
+
     const auto error = body.get("error", "").asString();
     const auto status = error == "forbidden" ? drogon::k403Forbidden
                                              : drogon::k400BadRequest;
@@ -48,7 +62,7 @@ void AdminController::createCategory(
     std::function<void(const HttpResponsePtr &)> &&callback)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -70,7 +84,7 @@ void AdminController::createArea(
     std::function<void(const HttpResponsePtr &)> &&callback)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -92,7 +106,7 @@ void AdminController::createTeam(
     std::function<void(const HttpResponsePtr &)> &&callback)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -106,7 +120,7 @@ void AdminController::overviewStats(
     std::function<void(const HttpResponsePtr &)> &&callback)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -114,3 +128,46 @@ void AdminController::overviewStats(
     sendAdmin(service.overviewStats(*user), std::move(callback));
 }
 
+void AdminController::listUsers(
+    const drogon::HttpRequestPtr &req,
+    std::function<void(const HttpResponsePtr &)> &&callback)
+{
+    auto user = requireUser(req, callback);
+    if (!user || blockPasswordChangeRequired(*user, callback))
+    {
+        return;
+    }
+    visione::services::AdminService service;
+    sendAdmin(service.listUsers(*user), std::move(callback));
+}
+
+void AdminController::updateUserRoles(
+    const drogon::HttpRequestPtr &req,
+    std::function<void(const HttpResponsePtr &)> &&callback,
+    long long userId)
+{
+    auto user = requireUser(req, callback);
+    if (!user || blockPasswordChangeRequired(*user, callback))
+    {
+        return;
+    }
+    visione::services::AdminService service;
+    sendAdmin(service.updateUserRoles(*user, userId, visione::http::requireJson(req)),
+              std::move(callback));
+}
+
+void AdminController::updateUserBan(
+    const drogon::HttpRequestPtr &req,
+    std::function<void(const HttpResponsePtr &)> &&callback,
+    long long userId)
+{
+    auto user = requireUser(req, callback);
+    if (!user || blockPasswordChangeRequired(*user, callback))
+    {
+        return;
+    }
+    visione::services::AdminService service;
+    sendAdmin(service.updateUserBan(*user, userId, visione::http::requireJson(req)),
+              std::move(callback));
+}
+

controllers/AdminController.h

@@ -19,6 +19,13 @@ class AdminController : public drogon::HttpController<AdminController>
     ADD_METHOD_TO(AdminController::overviewStats,
                   "/api/v1/admin/stats/overview",
                   drogon::Get);
+    ADD_METHOD_TO(AdminController::listUsers, "/api/v1/admin/users", drogon::Get);
+    ADD_METHOD_TO(AdminController::updateUserRoles,
+                  "/api/v1/admin/users/{1}/roles",
+                  drogon::Patch);
+    ADD_METHOD_TO(AdminController::updateUserBan,
+                  "/api/v1/admin/users/{1}/ban",
+                  drogon::Patch);
     METHOD_LIST_END
 
     void listCategories(
@@ -42,5 +49,16 @@ class AdminController : public drogon::HttpController<AdminController>
     void overviewStats(
         const drogon::HttpRequestPtr &req,
         std::function<void(const drogon::HttpResponsePtr &)> &&callback);
+    void listUsers(
+        const drogon::HttpRequestPtr &req,
+        std::function<void(const drogon::HttpResponsePtr &)> &&callback);
+    void updateUserRoles(
+        const drogon::HttpRequestPtr &req,
+        std::function<void(const drogon::HttpResponsePtr &)> &&callback,
+        long long userId);
+    void updateUserBan(
+        const drogon::HttpRequestPtr &req,
+        std::function<void(const drogon::HttpResponsePtr &)> &&callback,
+        long long userId);
 };
 

controllers/AuthController.cc

@@ -81,6 +81,28 @@ void AuthController::loginWithPassword(
     serviceResponse(service.loginWithPassword(body), std::move(callback));
 }
 
+void AuthController::changePassword(
+    const drogon::HttpRequestPtr &req,
+    std::function<void(const HttpResponsePtr &)> &&callback)
+{
+    const auto user = visione::auth::authenticate(req);
+    if (!user)
+    {
+        callback(visione::http::error("unauthorized", drogon::k401Unauthorized));
+        return;
+    }
+
+    const auto body = visione::http::requireJson(req);
+    if (body.isNull())
+    {
+        callback(visione::http::error("invalid_json", drogon::k400BadRequest));
+        return;
+    }
+
+    visione::services::AuthService service;
+    serviceResponse(service.changePassword(*user, body), std::move(callback));
+}
+
 void AuthController::me(
     const drogon::HttpRequestPtr &req,
     std::function<void(const HttpResponsePtr &)> &&callback)
@@ -95,4 +117,3 @@ void AuthController::me(
     visione::services::AuthService service;
     callback(visione::http::json(service.currentUser(*user)));
 }
-

controllers/AuthController.h

@@ -18,6 +18,9 @@ class AuthController : public drogon::HttpController<AuthController>
     ADD_METHOD_TO(AuthController::loginWithPassword,
                   "/api/v1/auth/login/password",
                   drogon::Post);
+    ADD_METHOD_TO(AuthController::changePassword,
+                  "/api/v1/auth/change-password",
+                  drogon::Post);
     ADD_METHOD_TO(AuthController::me, "/api/v1/me", drogon::Get);
     METHOD_LIST_END
 
@@ -33,7 +36,9 @@ class AuthController : public drogon::HttpController<AuthController>
     void loginWithPassword(
         const drogon::HttpRequestPtr &req,
         std::function<void(const drogon::HttpResponsePtr &)> &&callback);
+    void changePassword(
+        const drogon::HttpRequestPtr &req,
+        std::function<void(const drogon::HttpResponsePtr &)> &&callback);
     void me(const drogon::HttpRequestPtr &req,
             std::function<void(const drogon::HttpResponsePtr &)> &&callback);
 };
-

controllers/ReportController.cc

@@ -36,6 +36,19 @@ std::optional<visione::auth::UserContext> requireUser(
     return user;
 }
 
+bool blockPasswordChangeRequired(
+    const visione::auth::UserContext &user,
+    std::function<void(const HttpResponsePtr &)> &callback)
+{
+    if (!visione::auth::mustChangePassword(user))
+    {
+        return false;
+    }
+    callback(visione::http::error("password_change_required",
+                                  drogon::k403Forbidden));
+    return true;
+}
+
 void sendService(Json::Value body,
                  std::function<void(const HttpResponsePtr &)> &&callback)
 {
@@ -56,7 +69,7 @@ void ReportController::create(
     std::function<void(const HttpResponsePtr &)> &&callback)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -76,7 +89,7 @@ void ReportController::list(
     std::function<void(const HttpResponsePtr &)> &&callback)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -95,7 +108,7 @@ void ReportController::detail(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -109,7 +122,7 @@ void ReportController::updateStatus(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -124,7 +137,7 @@ void ReportController::addMessage(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -139,7 +152,7 @@ void ReportController::listMessages(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -153,7 +166,7 @@ void ReportController::assignTeam(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -168,7 +181,7 @@ void ReportController::addFeedback(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }
@@ -183,7 +196,7 @@ void ReportController::uploadPhotos(
     long long reportId)
 {
     auto user = requireUser(req, callback);
-    if (!user)
+    if (!user || blockPasswordChangeRequired(*user, callback))
     {
         return;
     }