Stage 2: users, API key auth, bootstrap endpoint

- Migration 002: users and api_keys tables (Unix timestamps, FK cascade) - POST /api/bootstrap — creates first user + key when DB is empty - POST/GET/DELETE /api/users — user CRUD - POST/DELETE /api/users/{id}/api-keys — key issuance and revocation - AuthMiddleware: SHA-256 bearer token lookup, last_used_at tracking - Raw key returned once on creation; only SHA-256 hash stored
2026-05-20 21:51:09 +02:00
parent 0387e1e017
commit 7c3c28b23c
6 changed files with 373 additions and 3 deletions
@@ -0,0 +1,240 @@
+package api
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/yeniklas/terdut-server/internal/models"
+)
+
+func handleBootstrap(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req struct {
+			Username string `json:"username"`
+			Email    string `json:"email"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		if req.Username == "" || req.Email == "" {
+			respond(w, http.StatusBadRequest, errResp("username and email are required"))
+			return
+		}
+
+		var count int
+		if err := db.QueryRowContext(r.Context(), "SELECT COUNT(*) FROM users").Scan(&count); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		if count > 0 {
+			respond(w, http.StatusForbidden, errResp("bootstrap already completed"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"INSERT INTO users (username, email) VALUES (?, ?)", req.Username, req.Email)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		userID, _ := res.LastInsertId()
+
+		raw, hash, err := newAPIKey()
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		keyRes, err := db.ExecContext(r.Context(),
+			"INSERT INTO api_keys (user_id, key_hash, name) VALUES (?, ?, ?)", userID, hash, "bootstrap")
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		keyID, _ := keyRes.LastInsertId()
+
+		user, _ := fetchUser(r.Context(), db, userID)
+		key := models.APIKey{ID: keyID, UserID: userID, Name: "bootstrap", Key: raw, CreatedAt: user.CreatedAt}
+		respond(w, http.StatusCreated, map[string]any{"user": user, "api_key": key})
+	}
+}
+
+func handleListUsers(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		rows, err := db.QueryContext(r.Context(),
+			"SELECT id, username, email, created_at FROM users ORDER BY id")
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		defer rows.Close()
+
+		users := []models.User{}
+		for rows.Next() {
+			var u models.User
+			var ts int64
+			if err := rows.Scan(&u.ID, &u.Username, &u.Email, &ts); err != nil {
+				respond(w, http.StatusInternalServerError, errResp("internal error"))
+				return
+			}
+			u.CreatedAt = time.Unix(ts, 0).UTC()
+			users = append(users, u)
+		}
+		respond(w, http.StatusOK, users)
+	}
+}
+
+func handleCreateUser(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		var req struct {
+			Username string `json:"username"`
+			Email    string `json:"email"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		if req.Username == "" || req.Email == "" {
+			respond(w, http.StatusBadRequest, errResp("username and email are required"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"INSERT INTO users (username, email) VALUES (?, ?)", req.Username, req.Email)
+		if err != nil {
+			if strings.Contains(err.Error(), "UNIQUE constraint failed") {
+				respond(w, http.StatusConflict, errResp("username or email already exists"))
+				return
+			}
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		id, _ := res.LastInsertId()
+		user, _ := fetchUser(r.Context(), db, id)
+		respond(w, http.StatusCreated, user)
+	}
+}
+
+func handleDeleteUser(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+		res, err := db.ExecContext(r.Context(), "DELETE FROM users WHERE id = ?", id)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		n, _ := res.RowsAffected()
+		if n == 0 {
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+func handleCreateAPIKey(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		userID, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+
+		var req struct {
+			Name string `json:"name"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		if req.Name == "" {
+			respond(w, http.StatusBadRequest, errResp("name is required"))
+			return
+		}
+
+		var exists int
+		if err := db.QueryRowContext(r.Context(), "SELECT 1 FROM users WHERE id = ?", userID).Scan(&exists); err != nil {
+			respond(w, http.StatusNotFound, errResp("user not found"))
+			return
+		}
+
+		raw, hash, err := newAPIKey()
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		res, err := db.ExecContext(r.Context(),
+			"INSERT INTO api_keys (user_id, key_hash, name) VALUES (?, ?, ?)", userID, hash, req.Name)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		keyID, _ := res.LastInsertId()
+		key := models.APIKey{ID: keyID, UserID: userID, Name: req.Name, Key: raw, CreatedAt: time.Now().UTC()}
+		respond(w, http.StatusCreated, key)
+	}
+}
+
+func handleDeleteAPIKey(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		userID, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid user id"))
+			return
+		}
+		keyID, err := strconv.ParseInt(chi.URLParam(r, "keyID"), 10, 64)
+		if err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid key id"))
+			return
+		}
+
+		res, err := db.ExecContext(r.Context(),
+			"DELETE FROM api_keys WHERE id = ? AND user_id = ?", keyID, userID)
+		if err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		n, _ := res.RowsAffected()
+		if n == 0 {
+			respond(w, http.StatusNotFound, errResp("api key not found"))
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// newAPIKey generates a random 32-byte key encoded as hex, plus its SHA-256 hash for storage.
+func newAPIKey() (raw, hash string, err error) {
+	b := make([]byte, 32)
+	if _, err = rand.Read(b); err != nil {
+		return
+	}
+	raw = hex.EncodeToString(b)
+	h := sha256.Sum256([]byte(raw))
+	hash = hex.EncodeToString(h[:])
+	return
+}
+
+func fetchUser(ctx context.Context, db *sql.DB, id int64) (models.User, error) {
+	var u models.User
+	var ts int64
+	err := db.QueryRowContext(ctx, "SELECT id, username, email, created_at FROM users WHERE id = ?", id).
+		Scan(&u.ID, &u.Username, &u.Email, &ts)
+	if err != nil {
+		return u, err
+	}
+	u.CreatedAt = time.Unix(ts, 0).UTC()
+	return u, nil
+}