1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
|
package handlers
import (
"auth-proxy/config"
"auth-proxy/logging"
"auth-proxy/models"
"auth-proxy/types"
"encoding/json"
"net/http"
"strconv"
)
// AdminPageHandler serves the admin dashboard page.
func AdminPageHandler(w http.ResponseWriter, r *http.Request) {
// Fetch all users to render on the page
users, err := models.GetAllUsers()
if err != nil {
logging.AppLog.Error("Failed to retrieve users for admin page", "error", err)
http.Error(w, "Could not load user data.", http.StatusInternalServerError)
return
}
data := map[string]interface{}{
"Paths": config.Paths,
"Users": users,
}
templates.ExecuteTemplate(w, "admin.html", data)
}
// GetUsersHandler returns a list of all users.
func GetUsersHandler(w http.ResponseWriter, r *http.Request) {
ip := logging.GetClientIP(r)
users, err := models.GetAllUsers()
if err != nil {
logging.AppLog.Error("Failed to retrieve users", "error", err, "ip", ip)
http.Error(w, "Failed to retrieve users", http.StatusInternalServerError)
return
}
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(users)
}
// UpdateUserRoleHandler updates a user's role.
func UpdateUserRoleHandler(w http.ResponseWriter, r *http.Request) {
ip := logging.GetClientIP(r)
// Get admin user from context
adminUser, ok := r.Context().Value(types.SessionDataContextKey).(*models.User)
if !ok || adminUser == nil {
logging.AppLog.Error("Failed to get user from context for admin action", "ip", ip)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
adminUsername := adminUser.Username
id, err := strconv.ParseInt(r.URL.Path[len(config.Paths.AdminUsersAPI+"/"):len(r.URL.Path)-len("/role")], 10, 64)
if err != nil {
logging.AppLog.Warn("Invalid user ID in request", "path", r.URL.Path, "ip", ip)
http.Error(w, "Invalid user ID", http.StatusBadRequest)
return
}
var req struct {
Role string `json:"role"`
}
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
logging.AppLog.Warn("Invalid request body for role update", "error", err, "ip", ip)
http.Error(w, "Invalid request body", http.StatusBadRequest)
return
}
if req.Role != "admin" && req.Role != "user" {
logging.AppLog.Warn("Invalid role provided for update", "role", req.Role, "ip", ip)
http.Error(w, "Invalid role", http.StatusBadRequest)
return
}
if err := models.UpdateUserRole(id, req.Role); err != nil {
logging.AppLog.Error("Failed to update user role in database", "error", err, "target_user_id", id, "ip", ip)
http.Error(w, "Failed to update role", http.StatusInternalServerError)
return
}
logging.SecurityLog.Info("ADMIN ACTION", "action", "update_role", "performed_by", adminUsername, "target_user_id", id, "new_role", req.Role, "ip", ip)
w.WriteHeader(http.StatusOK)
}
// DeleteUserHandler deletes a user.
func DeleteUserHandler(w http.ResponseWriter, r *http.Request) {
ip := logging.GetClientIP(r)
// Get admin user from context
adminUser, ok := r.Context().Value(types.SessionDataContextKey).(*models.User)
if !ok || adminUser == nil {
logging.AppLog.Error("Failed to get user from context for admin action", "ip", ip)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
adminUsername := adminUser.Username
id, err := strconv.ParseInt(r.URL.Path[len(config.Paths.AdminUsersAPI+"/"):], 10, 64)
if err != nil {
logging.AppLog.Warn("Invalid user ID in request", "path", r.URL.Path, "ip", ip)
http.Error(w, "Invalid user ID", http.StatusBadRequest)
return
}
if err := models.DeleteUser(id); err != nil {
logging.AppLog.Error("Failed to delete user from database", "error", err, "target_user_id", id, "ip", ip)
http.Error(w, "Failed to delete user", http.StatusInternalServerError)
return
}
logging.SecurityLog.Info("ADMIN ACTION", "action", "delete_user", "performed_by", adminUsername, "target_user_id", id, "ip", ip)
w.WriteHeader(http.StatusOK)
}
// SetUserActiveStatusHandler updates a user's active status.
func SetUserActiveStatusHandler(w http.ResponseWriter, r *http.Request) {
ip := logging.GetClientIP(r)
// Get admin user from context
adminUser, ok := r.Context().Value(types.SessionDataContextKey).(*models.User)
if !ok || adminUser == nil {
logging.AppLog.Error("Failed to get user from context for admin action", "ip", ip)
http.Error(w, "Unauthorized", http.StatusUnauthorized)
return
}
adminUsername := adminUser.Username
id, err := strconv.ParseInt(r.URL.Path[len(config.Paths.AdminUsersAPI+"/"):len(r.URL.Path)-len("/status")], 10, 64)
if err != nil {
logging.AppLog.Warn("Invalid user ID in request", "path", r.URL.Path, "ip", ip)
http.Error(w, "Invalid user ID", http.StatusBadRequest)
return
}
var req struct {
IsActive bool `json:"is_active"`
}
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
logging.AppLog.Warn("Invalid request body for status update", "error", err, "ip", ip)
http.Error(w, "Invalid request body", http.StatusBadRequest)
return
}
if err := models.SetUserActiveStatus(id, req.IsActive); err != nil {
logging.AppLog.Error("Failed to update user status in database", "error", err, "target_user_id", id, "ip", ip)
http.Error(w, "Failed to update status", http.StatusInternalServerError)
return
}
logging.SecurityLog.Info("ADMIN ACTION", "action", "set_active_status", "performed_by", adminUsername, "target_user_id", id, "new_status", req.IsActive, "ip", ip)
w.WriteHeader(http.StatusOK)
}
|
