89 lines
2.3 KiB
Go
89 lines
2.3 KiB
Go
|
package database
|
||
|
|
|
||
|
|
import (
|
||
|
|
"database/sql"
|
||
|
|
"fmt"
|
||
|
|
"log/slog"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
"git.adyxax.org/adyxax/tfstated/pkg/model"
|
||
|
|
"go.n16f.net/uuid"
|
||
|
|
)
|
||
|
|
|
||
|
|
func (db *DB) LoadAccountByUsername(username string) (*model.Account, error) {
|
||
|
|
account := model.Account{
|
||
|
|
Username: username,
|
||
|
|
}
|
||
|
|
var (
|
||
|
|
encryptedPassword []byte
|
||
|
|
created int64
|
||
|
|
lastLogin int64
|
||
|
|
)
|
||
|
|
err := db.QueryRow(
|
||
|
|
`SELECT id, password, is_admin, created, last_login, settings
|
||
|
|
FROM accounts
|
||
|
|
WHERE username = ?;`,
|
||
|
|
username,
|
||
|
|
).Scan(&account.Id,
|
||
|
|
&encryptedPassword,
|
||
|
|
&account.IsAdmin,
|
||
|
|
&created,
|
||
|
|
&lastLogin,
|
||
|
|
&account.Settings,
|
||
|
|
)
|
||
|
|
if err != nil {
|
||
|
|
return nil, err
|
||
|
|
}
|
||
|
|
password, err := db.dataEncryptionKey.DecryptAES256(encryptedPassword)
|
||
|
|
if err != nil {
|
||
|
|
return nil, err
|
||
|
|
}
|
||
|
|
account.Password = string(password)
|
||
|
|
account.Created = time.Unix(created, 0)
|
||
|
|
account.LastLogin = time.Unix(lastLogin, 0)
|
||
|
|
return &account, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func (db *DB) InitAdminAccount() error {
|
||
|
|
tx, err := db.Begin()
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
defer func() {
|
||
|
|
if err != nil {
|
||
|
|
_ = tx.Rollback()
|
||
|
|
}
|
||
|
|
}()
|
||
|
|
var hasAdminAccount bool
|
||
|
|
if err = tx.QueryRowContext(db.ctx, `SELECT EXISTS (SELECT 1 FROM accounts WHERE is_admin);`).Scan(&hasAdminAccount); err != nil {
|
||
|
|
return fmt.Errorf("failed to select if there is an admin account in the database: %w", err)
|
||
|
|
}
|
||
|
|
if hasAdminAccount {
|
||
|
|
tx.Rollback()
|
||
|
|
} else {
|
||
|
|
var password uuid.UUID
|
||
|
|
if err = password.Generate(uuid.V4); err != nil {
|
||
|
|
return fmt.Errorf("failed to generate initial admin password: %w", err)
|
||
|
|
}
|
||
|
|
var encryptedPassword []byte
|
||
|
|
encryptedPassword, err = db.dataEncryptionKey.EncryptAES256([]byte(password.String()))
|
||
|
|
if err != nil {
|
||
|
|
return fmt.Errorf("failed to encrypt initial admin password: %w", err)
|
||
|
|
}
|
||
|
|
if _, err = tx.ExecContext(db.ctx,
|
||
|
|
`INSERT INTO accounts(username, password, is_admin)
|
||
|
|
VALUES ("admin", :password, TRUE)
|
||
|
|
ON CONFLICT DO UPDATE SET password = :password
|
||
|
|
WHERE username = "admin";`,
|
||
|
|
sql.Named("password", encryptedPassword),
|
||
|
|
); err != nil {
|
||
|
|
return fmt.Errorf("failed to set initial admin password: %w", err)
|
||
|
|
}
|
||
|
|
err = tx.Commit()
|
||
|
|
if err == nil {
|
||
|
|
slog.Info("Generated an initial admin password, please change it or delete the admin account after your first login", "password", password.String())
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return err
|
||
|
|
}
|