331 lines
9.7 KiB
Go
331 lines
9.7 KiB
Go
package server
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"net/http"
|
|
"sort"
|
|
"strconv"
|
|
"strings"
|
|
"unicode"
|
|
"unicode/utf8"
|
|
|
|
"agent-system-backend/internal/store"
|
|
)
|
|
|
|
type adminSearchCursor struct {
|
|
KeyVersion int `json:"k"`
|
|
Version string `json:"v"`
|
|
Owner string `json:"o"`
|
|
UserID string `json:"u"`
|
|
}
|
|
|
|
func (s *Server) signAdminCursor(cursor adminSearchCursor) string {
|
|
cursor.KeyVersion = s.accountSearchKey.Version
|
|
data, _ := json.Marshal(cursor)
|
|
mac := hmac.New(sha256.New, s.accountSearchKey.Secret[:])
|
|
_, _ = mac.Write([]byte("iam-admin-search-cursor-v1\x00"))
|
|
_, _ = mac.Write(data)
|
|
return base64.RawURLEncoding.EncodeToString(data) + "." + base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
|
|
}
|
|
|
|
func (s *Server) parseAdminCursor(encoded, version string) (adminSearchCursor, bool) {
|
|
var cursor adminSearchCursor
|
|
payload, signature, found := strings.Cut(encoded, ".")
|
|
if !found {
|
|
return cursor, false
|
|
}
|
|
data, err := base64.RawURLEncoding.DecodeString(payload)
|
|
if err != nil || len(data) > 1024 {
|
|
return cursor, false
|
|
}
|
|
provided, err := base64.RawURLEncoding.DecodeString(signature)
|
|
if err != nil {
|
|
return cursor, false
|
|
}
|
|
mac := hmac.New(sha256.New, s.accountSearchKey.Secret[:])
|
|
_, _ = mac.Write([]byte("iam-admin-search-cursor-v1\x00"))
|
|
_, _ = mac.Write(data)
|
|
if !hmac.Equal(provided, mac.Sum(nil)) || json.Unmarshal(data, &cursor) != nil || cursor.KeyVersion != s.accountSearchKey.Version || cursor.Version != version || cursor.Owner == "" || cursor.UserID == "" {
|
|
return adminSearchCursor{}, false
|
|
}
|
|
return cursor, true
|
|
}
|
|
|
|
func searchAccountField(account store.Account, field string) string {
|
|
switch field {
|
|
case "userId":
|
|
return account.ID
|
|
case "owner":
|
|
return account.Owner
|
|
case "name":
|
|
return account.Profile.Name
|
|
case "phone":
|
|
return account.Profile.Phone
|
|
case "email":
|
|
return account.Profile.Email
|
|
case "staffNo":
|
|
return account.Profile.StaffNo
|
|
case "department":
|
|
return account.Profile.Department
|
|
case "notes":
|
|
return account.Profile.Notes
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func (s *Server) searchAdminUsers(w http.ResponseWriter, r *http.Request) {
|
|
if s.accountSearchKeyErr != nil || s.accountSearchKey.Version < 1 {
|
|
http.Error(w, "account directory signing unavailable", http.StatusServiceUnavailable)
|
|
return
|
|
}
|
|
actor, ok := s.requireSystemAction(w, r, "system.users.view")
|
|
if !ok {
|
|
return
|
|
}
|
|
params := r.URL.Query()
|
|
query := strings.TrimSpace(params.Get("query"))
|
|
if !utf8.ValidString(query) || utf8.RuneCountInString(query) > 128 {
|
|
http.Error(w, "invalid account search query", http.StatusBadRequest)
|
|
return
|
|
}
|
|
for _, ch := range query {
|
|
if unicode.IsControl(ch) {
|
|
http.Error(w, "invalid account search query", http.StatusBadRequest)
|
|
return
|
|
}
|
|
}
|
|
mode := params.Get("mode")
|
|
if mode == "" {
|
|
mode = "fuzzy"
|
|
}
|
|
if mode != "exact" && mode != "fuzzy" {
|
|
http.Error(w, "unknown account search mode", http.StatusBadRequest)
|
|
return
|
|
}
|
|
status := params.Get("status")
|
|
if status == "" {
|
|
status = "all"
|
|
}
|
|
if status != "all" && status != "enabled" && status != "disabled" {
|
|
http.Error(w, "unknown account status filter", http.StatusBadRequest)
|
|
return
|
|
}
|
|
limit := 20
|
|
if raw := params.Get("limit"); raw != "" {
|
|
parsed, err := strconv.Atoi(raw)
|
|
if err != nil || parsed < 1 || parsed > 100 {
|
|
http.Error(w, "invalid account search limit", http.StatusBadRequest)
|
|
return
|
|
}
|
|
limit = parsed
|
|
}
|
|
fields := []string{"owner", "name", "userId"}
|
|
if raw := params.Get("fields"); raw != "" {
|
|
fields = strings.Split(raw, ",")
|
|
}
|
|
allowed := map[string]bool{"owner": true, "name": true, "userId": true, "phone": true, "email": true,
|
|
"staffNo": true, "department": true, "notes": true}
|
|
seen := map[string]bool{}
|
|
for _, field := range fields {
|
|
if !allowed[field] || seen[field] {
|
|
http.Error(w, "unknown or duplicate account search field", http.StatusBadRequest)
|
|
return
|
|
}
|
|
seen[field] = true
|
|
}
|
|
sort.Strings(fields)
|
|
accounts, revision, err := s.st.ListAdminAccountsForActor(actor)
|
|
if err != nil {
|
|
writeStoreErr(w, err)
|
|
return
|
|
}
|
|
visibleRevision := sha256.Sum256([]byte(revision.Private))
|
|
directoryVersion := hex.EncodeToString(visibleRevision[:])
|
|
fingerprint, _ := json.Marshal(struct {
|
|
Actor, Query, Mode, Status, Revision string
|
|
Fields []string
|
|
}{actor, query, mode, status, directoryVersion, fields})
|
|
digest := sha256.Sum256(fingerprint)
|
|
version := hex.EncodeToString(digest[:])
|
|
var after adminSearchCursor
|
|
if token := params.Get("cursor"); token != "" {
|
|
var valid bool
|
|
after, valid = s.parseAdminCursor(token, version)
|
|
if !valid {
|
|
http.Error(w, "account search cursor expired or invalid", http.StatusConflict)
|
|
return
|
|
}
|
|
}
|
|
page := make([]store.Account, 0, limit+1)
|
|
for _, account := range accounts {
|
|
if status == "enabled" && !account.Enabled || status == "disabled" && account.Enabled {
|
|
continue
|
|
}
|
|
if after.Owner != "" && (account.Owner < after.Owner || account.Owner == after.Owner && account.ID <= after.UserID) {
|
|
continue
|
|
}
|
|
if query != "" {
|
|
matched := false
|
|
for _, field := range fields {
|
|
value := searchAccountField(account, field)
|
|
if mode == "exact" && strings.EqualFold(value, query) || mode == "fuzzy" && strings.Contains(strings.ToLower(value), strings.ToLower(query)) {
|
|
matched = true
|
|
break
|
|
}
|
|
}
|
|
if !matched {
|
|
continue
|
|
}
|
|
}
|
|
page = append(page, account)
|
|
if len(page) > limit {
|
|
break
|
|
}
|
|
}
|
|
more := len(page) > limit
|
|
if more {
|
|
page = page[:limit]
|
|
}
|
|
items := make([]map[string]any, 0, len(page))
|
|
for _, account := range page {
|
|
items = append(items, accountProfileJSON(account))
|
|
}
|
|
if s.systemActionAllowed(actor, "system.roles.view") {
|
|
userIDs := make([]string, 0, len(page))
|
|
for _, account := range page {
|
|
userIDs = append(userIDs, account.ID)
|
|
}
|
|
roles, err := s.st.ActiveRolesForUsers(userIDs)
|
|
if err != nil {
|
|
writeStoreErr(w, err)
|
|
return
|
|
}
|
|
for i, account := range page {
|
|
var role *store.UserRoleSummary
|
|
if found, ok := roles[account.ID]; ok {
|
|
role = &found
|
|
}
|
|
items[i]["role"] = role
|
|
}
|
|
}
|
|
next := ""
|
|
if more {
|
|
last := page[len(page)-1]
|
|
next = s.signAdminCursor(adminSearchCursor{Version: version, Owner: last.Owner, UserID: last.ID})
|
|
}
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
writeJSON(w, http.StatusOK, map[string]any{"accounts": items, "nextCursor": next, "directoryVersion": directoryVersion})
|
|
}
|
|
|
|
// listRoleMembers filters a role's active members before paging them in owner
|
|
// order. The signed cursor is bound to the role, the filter, and the account
|
|
// directory revision so it cannot be replayed across roles or parameters.
|
|
func (s *Server) listRoleMembers(w http.ResponseWriter, r *http.Request) {
|
|
if s.accountSearchKeyErr != nil || s.accountSearchKey.Version < 1 {
|
|
http.Error(w, "account directory signing unavailable", http.StatusServiceUnavailable)
|
|
return
|
|
}
|
|
actor, ok := s.requireSystemAction(w, r, "system.users.view")
|
|
if !ok {
|
|
return
|
|
}
|
|
if _, ok := s.requireSystemAction(w, r, "system.roles.view"); !ok {
|
|
return
|
|
}
|
|
params := r.URL.Query()
|
|
query := strings.TrimSpace(params.Get("query"))
|
|
if !utf8.ValidString(query) || utf8.RuneCountInString(query) > 128 {
|
|
http.Error(w, "invalid account search query", http.StatusBadRequest)
|
|
return
|
|
}
|
|
for _, ch := range query {
|
|
if unicode.IsControl(ch) {
|
|
http.Error(w, "invalid account search query", http.StatusBadRequest)
|
|
return
|
|
}
|
|
}
|
|
mode := params.Get("mode")
|
|
if mode == "" {
|
|
mode = "fuzzy"
|
|
}
|
|
if mode != "exact" && mode != "fuzzy" {
|
|
http.Error(w, "unknown account search mode", http.StatusBadRequest)
|
|
return
|
|
}
|
|
status := params.Get("status")
|
|
if status == "" {
|
|
status = "all"
|
|
}
|
|
if status != "all" && status != "enabled" && status != "disabled" {
|
|
http.Error(w, "unknown account status filter", http.StatusBadRequest)
|
|
return
|
|
}
|
|
limit := 20
|
|
if raw := params.Get("limit"); raw != "" {
|
|
parsed, err := strconv.Atoi(raw)
|
|
if err != nil || parsed < 1 || parsed > 100 {
|
|
http.Error(w, "invalid account search limit", http.StatusBadRequest)
|
|
return
|
|
}
|
|
limit = parsed
|
|
}
|
|
roleID := r.PathValue("roleId")
|
|
members, revision, err := s.st.ListRoleMembersForActor(actor, roleID)
|
|
if err != nil {
|
|
writeStoreErr(w, err)
|
|
return
|
|
}
|
|
visibleRevision := sha256.Sum256([]byte(revision.Private))
|
|
fingerprint, _ := json.Marshal(struct {
|
|
Kind, Actor, RoleID, Query, Mode, Status, Revision string
|
|
}{"role-members", actor, roleID, query, mode, status, hex.EncodeToString(visibleRevision[:])})
|
|
digest := sha256.Sum256(fingerprint)
|
|
version := hex.EncodeToString(digest[:])
|
|
var after adminSearchCursor
|
|
if token := params.Get("cursor"); token != "" {
|
|
var valid bool
|
|
after, valid = s.parseAdminCursor(token, version)
|
|
if !valid {
|
|
http.Error(w, "role member cursor expired or invalid", http.StatusConflict)
|
|
return
|
|
}
|
|
}
|
|
page := make([]store.RoleMember, 0, limit+1)
|
|
matches := func(value string) bool {
|
|
if query == "" {
|
|
return true
|
|
}
|
|
if mode == "exact" {
|
|
return strings.EqualFold(value, query)
|
|
}
|
|
return strings.Contains(strings.ToLower(value), strings.ToLower(query))
|
|
}
|
|
for _, member := range members {
|
|
if status == "enabled" && !member.Enabled || status == "disabled" && member.Enabled {
|
|
continue
|
|
}
|
|
if after.Owner != "" && (member.Owner < after.Owner || member.Owner == after.Owner && member.UserID <= after.UserID) {
|
|
continue
|
|
}
|
|
if query != "" && !matches(member.Owner) && !matches(member.Name) && !matches(member.UserID) {
|
|
continue
|
|
}
|
|
page = append(page, member)
|
|
if len(page) > limit {
|
|
break
|
|
}
|
|
}
|
|
next := ""
|
|
if len(page) > limit {
|
|
page = page[:limit]
|
|
last := page[len(page)-1]
|
|
next = s.signAdminCursor(adminSearchCursor{Version: version, Owner: last.Owner, UserID: last.UserID})
|
|
}
|
|
w.Header().Set("Cache-Control", "no-store")
|
|
writeJSON(w, http.StatusOK, map[string]any{"members": page, "nextCursor": next})
|
|
}
|