Daniel Legt
d77f164900
All checks were successful
Build and Publish Docker Image / deploy (push) Successful in 1m8s
- Add environment variables to configure anonymous uploads, daily upload caps, and default user storage limits. - Update config loader to parse and validate the new settings. - Implement backend logic to track daily usage and active storage per user. - Update README and `.env.example` to document the new settings and admin panels.
477 lines
13 KiB
Go
477 lines
13 KiB
Go
package handlers
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"net/http"
|
|
"net/url"
|
|
"strconv"
|
|
"time"
|
|
|
|
"warpbox.dev/backend/libs/services"
|
|
"warpbox.dev/backend/libs/web"
|
|
)
|
|
|
|
const adminCookieName = "warpbox_admin"
|
|
|
|
type adminPageData struct {
|
|
Stats services.AdminStats
|
|
Boxes []adminBoxView
|
|
Users []adminUserView
|
|
Settings services.UploadPolicySettings
|
|
Section string
|
|
PageTitle string
|
|
LastInviteURL string
|
|
Error string
|
|
}
|
|
|
|
type adminBoxView struct {
|
|
ID string
|
|
Owner string
|
|
CreatedAt string
|
|
ExpiresAt string
|
|
FileCount int
|
|
TotalSizeLabel string
|
|
DownloadCount int
|
|
MaxDownloads int
|
|
Protected bool
|
|
Expired bool
|
|
}
|
|
|
|
type adminUserView struct {
|
|
ID string
|
|
Username string
|
|
Email string
|
|
Role string
|
|
Status string
|
|
StorageUsed string
|
|
StorageQuota string
|
|
DailyUsed string
|
|
CreatedAt string
|
|
}
|
|
|
|
func (a *App) AdminLogin(w http.ResponseWriter, r *http.Request) {
|
|
if a.isAdmin(r) {
|
|
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
|
return
|
|
}
|
|
a.renderAdminLogin(w, r, http.StatusOK, "")
|
|
}
|
|
|
|
func (a *App) AdminLoginPost(w http.ResponseWriter, r *http.Request) {
|
|
if err := r.ParseForm(); err != nil {
|
|
a.renderAdminLogin(w, r, http.StatusBadRequest, "Unable to read login form.")
|
|
return
|
|
}
|
|
if a.cfg.AdminToken == "" || r.FormValue("token") != a.cfg.AdminToken {
|
|
a.logger.Warn("admin login failed", "source", "admin", "severity", "warn", "code", 4301)
|
|
a.renderAdminLogin(w, r, http.StatusUnauthorized, "Invalid admin token.")
|
|
return
|
|
}
|
|
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: adminCookieName,
|
|
Value: adminCookieValue(a.cfg.AdminToken),
|
|
Path: "/admin",
|
|
HttpOnly: true,
|
|
SameSite: http.SameSiteLaxMode,
|
|
Secure: r.TLS != nil,
|
|
Expires: time.Now().Add(12 * time.Hour),
|
|
})
|
|
a.logger.Info("admin login", "source", "admin", "severity", "user_activity", "code", 2301)
|
|
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminLogout(w http.ResponseWriter, r *http.Request) {
|
|
a.clearUserSessionCookie(w)
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: adminCookieName,
|
|
Value: "",
|
|
Path: "/admin",
|
|
HttpOnly: true,
|
|
SameSite: http.SameSiteLaxMode,
|
|
MaxAge: -1,
|
|
})
|
|
http.Redirect(w, r, "/admin/login", http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminDashboard(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
|
|
stats, err := a.uploadService.AdminStats()
|
|
if err != nil {
|
|
http.Error(w, "unable to load admin stats", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
boxes, err := a.adminBoxes(8)
|
|
if err != nil {
|
|
http.Error(w, "unable to load recent boxes", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
a.renderPage(w, r, http.StatusOK, "admin.html", web.PageData{
|
|
Title: "Admin overview",
|
|
Description: "Warpbox admin overview.",
|
|
CurrentUser: a.currentPublicUser(r),
|
|
Data: adminPageData{
|
|
Stats: stats,
|
|
Boxes: boxes,
|
|
Section: "overview",
|
|
PageTitle: "Admin overview",
|
|
},
|
|
})
|
|
}
|
|
|
|
func (a *App) AdminFiles(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
|
|
stats, err := a.uploadService.AdminStats()
|
|
if err != nil {
|
|
http.Error(w, "unable to load admin stats", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
boxes, err := a.adminBoxes(100)
|
|
if err != nil {
|
|
http.Error(w, "unable to load boxes", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
a.renderPage(w, r, http.StatusOK, "admin.html", web.PageData{
|
|
Title: "Admin files",
|
|
Description: "Manage Warpbox uploads.",
|
|
CurrentUser: a.currentPublicUser(r),
|
|
Data: adminPageData{
|
|
Stats: stats,
|
|
Boxes: boxes,
|
|
Section: "files",
|
|
PageTitle: "Admin files",
|
|
},
|
|
})
|
|
}
|
|
|
|
func (a *App) AdminUsers(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
stats, err := a.uploadService.AdminStats()
|
|
if err != nil {
|
|
http.Error(w, "unable to load admin stats", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
users, err := a.authService.ListUsers()
|
|
if err != nil {
|
|
http.Error(w, "unable to load users", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
rows := make([]adminUserView, 0, len(users))
|
|
settings, err := a.settingsService.UploadPolicy()
|
|
if err != nil {
|
|
http.Error(w, "unable to load settings", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
for _, user := range users {
|
|
storageUsed, _ := a.uploadService.UserActiveStorageUsed(user.ID)
|
|
usage, _ := a.settingsService.UsageForUser(user.ID, time.Now().UTC())
|
|
quotaMB := settings.DefaultUserStorageMB
|
|
if user.StorageQuotaMB != nil {
|
|
quotaMB = *user.StorageQuotaMB
|
|
}
|
|
rows = append(rows, adminUserView{
|
|
ID: user.ID,
|
|
Username: user.Username,
|
|
Email: user.Email,
|
|
Role: user.Role,
|
|
Status: user.Status,
|
|
StorageUsed: services.FormatMegabytesFromBytes(storageUsed),
|
|
StorageQuota: formatMB(quotaMB),
|
|
DailyUsed: services.FormatMegabytesFromBytes(usage.UploadedBytes),
|
|
CreatedAt: user.CreatedAt.Format("Jan 2 15:04"),
|
|
})
|
|
}
|
|
a.renderPage(w, r, http.StatusOK, "admin_users.html", web.PageData{
|
|
Title: "Admin users",
|
|
Description: "Manage Warpbox users and invites.",
|
|
CurrentUser: a.currentPublicUser(r),
|
|
Data: adminPageData{
|
|
Stats: stats,
|
|
Users: rows,
|
|
Section: "users",
|
|
PageTitle: "Users",
|
|
LastInviteURL: r.URL.Query().Get("invite"),
|
|
},
|
|
})
|
|
}
|
|
|
|
func (a *App) AdminSettings(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
settings, err := a.settingsService.UploadPolicy()
|
|
if err != nil {
|
|
http.Error(w, "unable to load settings", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
a.renderPage(w, r, http.StatusOK, "admin_settings.html", web.PageData{
|
|
Title: "Admin settings",
|
|
Description: "Manage Warpbox upload policy.",
|
|
CurrentUser: a.currentPublicUser(r),
|
|
Data: adminPageData{
|
|
Settings: settings,
|
|
Section: "settings",
|
|
PageTitle: "Settings",
|
|
},
|
|
})
|
|
}
|
|
|
|
func (a *App) AdminSettingsPost(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
if err := r.ParseForm(); err != nil {
|
|
http.Redirect(w, r, "/admin/settings", http.StatusSeeOther)
|
|
return
|
|
}
|
|
settings := services.UploadPolicySettings{
|
|
AnonymousUploadsEnabled: r.FormValue("anonymous_uploads_enabled") == "on",
|
|
UsageRetentionDays: parsePositiveInt(r.FormValue("usage_retention_days")),
|
|
}
|
|
var err error
|
|
if settings.AnonymousMaxUploadMB, err = services.ParseMegabytesValue(r.FormValue("anonymous_max_upload_mb")); err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
if settings.AnonymousDailyUploadMB, err = services.ParseMegabytesValue(r.FormValue("anonymous_daily_upload_mb")); err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
if settings.UserDailyUploadMB, err = services.ParseMegabytesValue(r.FormValue("user_daily_upload_mb")); err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
if settings.DefaultUserStorageMB, err = services.ParseMegabytesValue(r.FormValue("default_user_storage_mb")); err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
if settings.UsageRetentionDays <= 0 {
|
|
http.Error(w, "usage retention days must be positive", http.StatusBadRequest)
|
|
return
|
|
}
|
|
if err := a.settingsService.UpdateUploadPolicy(settings); err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/settings", http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminUpdateUserQuota(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
if err := r.ParseForm(); err != nil {
|
|
http.Redirect(w, r, "/admin/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
var quota *float64
|
|
if r.FormValue("storage_quota_mb") != "" {
|
|
parsed, err := services.ParseMegabytesValue(r.FormValue("storage_quota_mb"))
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
return
|
|
}
|
|
quota = &parsed
|
|
}
|
|
if err := a.authService.SetUserStorageQuota(r.PathValue("userID"), quota); err != nil {
|
|
http.Error(w, "unable to update quota", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/users", http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminCreateInvite(w http.ResponseWriter, r *http.Request) {
|
|
admin, ok := a.requireAdminUser(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := r.ParseForm(); err != nil {
|
|
http.Redirect(w, r, "/admin/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
result, err := a.authService.CreateInvite(r.FormValue("email"), r.FormValue("role"), admin.ID, 7*24*time.Hour)
|
|
if err != nil {
|
|
http.Redirect(w, r, "/admin/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
a.logger.Info("invite created", "source", "admin", "severity", "user_activity", "code", 2404, "admin_id", admin.ID)
|
|
http.Redirect(w, r, "/admin/users?invite="+url.QueryEscape(result.URL), http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminDisableUser(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
disabled := r.URL.Query().Get("disabled") != "false"
|
|
if err := a.authService.DisableUser(r.PathValue("userID"), disabled); err != nil {
|
|
http.Error(w, "unable to update user", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/users", http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminResetUser(w http.ResponseWriter, r *http.Request) {
|
|
admin, ok := a.requireAdminUser(w, r)
|
|
if !ok {
|
|
return
|
|
}
|
|
result, err := a.authService.CreatePasswordResetInvite(r.PathValue("userID"), admin.ID)
|
|
if err != nil {
|
|
http.Error(w, "unable to create reset link", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/users?invite="+url.QueryEscape(result.URL), http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminDeleteBox(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
|
|
boxID := r.PathValue("boxID")
|
|
if err := a.uploadService.DeleteBox(boxID); err != nil {
|
|
a.logger.Warn("admin delete failed", "source", "admin", "severity", "warn", "code", 4302, "box_id", boxID, "error", err.Error())
|
|
http.Error(w, "unable to delete box", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/admin/files", http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) AdminViewBox(w http.ResponseWriter, r *http.Request) {
|
|
if !a.requireAdmin(w, r) {
|
|
return
|
|
}
|
|
|
|
box, err := a.uploadService.GetBox(r.PathValue("boxID"))
|
|
if err != nil {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
|
|
if a.uploadService.IsProtected(box) {
|
|
http.SetCookie(w, &http.Cookie{
|
|
Name: unlockCookieName(box.ID),
|
|
Value: a.uploadService.UnlockToken(box),
|
|
Path: "/d/" + box.ID,
|
|
HttpOnly: true,
|
|
SameSite: http.SameSiteLaxMode,
|
|
Secure: r.TLS != nil,
|
|
Expires: box.ExpiresAt,
|
|
})
|
|
a.logger.Info("admin bypassed box password", "source", "admin", "severity", "user_activity", "code", 2302, "box_id", box.ID)
|
|
}
|
|
|
|
http.Redirect(w, r, "/d/"+box.ID, http.StatusSeeOther)
|
|
}
|
|
|
|
func (a *App) renderAdminLogin(w http.ResponseWriter, r *http.Request, status int, message string) {
|
|
a.renderPage(w, r, status, "admin_login.html", web.PageData{
|
|
Title: "Admin login",
|
|
Description: "Sign in to the Warpbox admin console.",
|
|
Data: adminPageData{
|
|
Error: message,
|
|
},
|
|
})
|
|
}
|
|
|
|
func (a *App) adminBoxes(limit int) ([]adminBoxView, error) {
|
|
boxes, err := a.uploadService.AdminBoxes(limit)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
rows := make([]adminBoxView, 0, len(boxes))
|
|
for _, box := range boxes {
|
|
owner := "Anonymous"
|
|
if box.OwnerID != "" {
|
|
if user, err := a.authService.UserByID(box.OwnerID); err == nil {
|
|
owner = user.Email
|
|
} else {
|
|
owner = "User"
|
|
}
|
|
}
|
|
rows = append(rows, adminBoxView{
|
|
ID: box.ID,
|
|
Owner: owner,
|
|
CreatedAt: box.CreatedAt.Format("Jan 2 15:04"),
|
|
ExpiresAt: box.ExpiresAt.Format("Jan 2 15:04"),
|
|
FileCount: box.FileCount,
|
|
TotalSizeLabel: box.TotalSizeLabel,
|
|
DownloadCount: box.DownloadCount,
|
|
MaxDownloads: box.MaxDownloads,
|
|
Protected: box.Protected,
|
|
Expired: box.Expired,
|
|
})
|
|
}
|
|
return rows, nil
|
|
}
|
|
|
|
func (a *App) requireAdmin(w http.ResponseWriter, r *http.Request) bool {
|
|
if a.isAdmin(r) {
|
|
return true
|
|
}
|
|
http.Redirect(w, r, "/admin/login", http.StatusSeeOther)
|
|
return false
|
|
}
|
|
|
|
func (a *App) isAdmin(r *http.Request) bool {
|
|
if user, ok := a.currentUser(r); ok && user.Role == services.UserRoleAdmin {
|
|
return true
|
|
}
|
|
if a.cfg.AdminToken == "" {
|
|
return false
|
|
}
|
|
cookie, err := r.Cookie(adminCookieName)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return cookie.Value == adminCookieValue(a.cfg.AdminToken)
|
|
}
|
|
|
|
func (a *App) requireAdminUser(w http.ResponseWriter, r *http.Request) (services.User, bool) {
|
|
user, ok := a.currentUser(r)
|
|
if ok && user.Role == services.UserRoleAdmin {
|
|
return user, true
|
|
}
|
|
if a.cfg.AdminToken != "" && a.isAdmin(r) {
|
|
return services.User{ID: "env-admin", Role: services.UserRoleAdmin, Status: services.UserStatusActive}, true
|
|
}
|
|
http.Redirect(w, r, "/login?next="+r.URL.Path, http.StatusSeeOther)
|
|
return services.User{}, false
|
|
}
|
|
|
|
func (a *App) currentPublicUser(r *http.Request) any {
|
|
if user, ok := a.currentUser(r); ok {
|
|
return a.authService.PublicUser(user)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func adminCookieValue(token string) string {
|
|
sum := sha256.Sum256([]byte("warpbox-admin:" + token))
|
|
return hex.EncodeToString(sum[:])
|
|
}
|
|
|
|
func parsePositiveInt(value string) int {
|
|
parsed, err := strconv.Atoi(value)
|
|
if err != nil {
|
|
return 0
|
|
}
|
|
return parsed
|
|
}
|
|
|
|
func formatMB(value float64) string {
|
|
return strconv.FormatFloat(value, 'f', -1, 64) + " MB"
|
|
}
|