diff --git a/build.sh b/build.sh index 5a692b5..f109eda 100755 --- a/build.sh +++ b/build.sh @@ -3,7 +3,7 @@ go build -ldflags "-w" -o databunker ./src/bunker.go ./src/qldb.go ./src/xtokens ./src/utils.go ./src/cryptor.go ./src/notify.go \ ./src/audit_db.go ./src/audit_api.go \ ./src/sms.go ./src/email.go \ - ./src/requests_db.go \ + ./src/requests_db.go ./src/requests_api.go \ ./src/users_db.go ./src/users_api.go \ ./src/userapps_db.go ./src/userapps_api.go \ ./src/sessions_db.go ./src/sessions_api.go \ diff --git a/src/bunker.go b/src/bunker.go index 7f68602..7283f7a 100644 --- a/src/bunker.go +++ b/src/bunker.go @@ -172,6 +172,9 @@ func (e mainEnv) setupRouter() *httprouter.Router { router.POST("/v1/sharedrecord/token/:token", e.newSharedRecord) router.GET("/v1/get/:record", e.getRecord) + router.GET("/v1/request/:request", e.getUserRequest) + router.GET("/v1/requests", e.getUserRequests) + router.GET("/v1/consent/:mode/:address", e.consentAllUserRecords) router.GET("/v1/consent/:mode/:address/:brief", e.consentUserRecord) router.GET("/v1/consents/:brief", e.consentFilterRecords) diff --git a/src/qldb.go b/src/qldb.go index 5bb16b3..e82bb18 100644 --- a/src/qldb.go +++ b/src/qldb.go @@ -987,6 +987,10 @@ func initRequests(db *sql.DB) error { if err != nil { return err } + _, err = tx.Exec(`CREATE INDEX requests_status ON requests (status);`) + if err != nil { + return err + } if err = tx.Commit(); err != nil { return err } diff --git a/src/requests_api.go b/src/requests_api.go new file mode 100644 index 0000000..2981bb7 --- /dev/null +++ b/src/requests_api.go @@ -0,0 +1,101 @@ +package main + +import ( + "fmt" + "net/http" + + "github.com/julienschmidt/httprouter" +) + +func (e mainEnv) getUserRequests(w http.ResponseWriter, r *http.Request, ps httprouter.Params) { + if e.enforceAuth(w, r, nil) == "" { + return + } + var offset int32 + var limit int32 = 10 + status := "open" + args := r.URL.Query() + if value, ok := args["offset"]; ok { + offset = atoi(value[0]) + } + if value, ok := args["limit"]; ok { + limit = atoi(value[0]) + } + if value, ok := args["status"]; ok { + status = value[0] + } + resultJSON, counter, err := e.db.getRequests(status, offset, limit) + if err != nil { + returnError(w, r, "internal error", 405, err, nil) + return + } + fmt.Printf("Total count of user requests: %d\n", counter) + //fmt.Fprintf(w, "title") + w.Header().Set("Access-Control-Allow-Origin", "*") + w.Header().Set("Content-Type", "application/json; charset=utf-8") + w.WriteHeader(200) + str := fmt.Sprintf(`{"status":"ok","total":%d,"rows":%s}`, counter, resultJSON) + w.Write([]byte(str)) +} + +func (e mainEnv) getUserRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params) { + request := ps.ByName("request") + event := audit("get request by request token", request, "request", request) + defer func() { event.submit(e.db) }() + + if enforceUUID(w, request, event) == false { + return + } + requestInfo, err := e.db.getRequest(request) + if err != nil { + fmt.Printf("%d access denied for: %s\n", http.StatusForbidden, request) + w.WriteHeader(http.StatusForbidden) + w.Write([]byte("Access denied")) + return + } + var resultJSON []byte + userTOKEN := "" + appName := "" + change := "" + if value, ok := requestInfo["token"]; ok { + userTOKEN = value.(string) + } + if value, ok := requestInfo["change"]; ok { + change = value.(string) + } + if value, ok := requestInfo["app"]; ok { + appName = value.(string) + } + if len(appName) > 0 { + resultJSON, err = e.db.getUserApp(userTOKEN, appName) + } else { + resultJSON, err = e.db.getUser(userTOKEN) + } + if err != nil { + returnError(w, r, "internal error", 405, err, event) + return + } + if resultJSON == nil { + returnError(w, r, "not found", 405, err, event) + return + } + fmt.Printf("Full json: %s\n", resultJSON) + w.Header().Set("Content-Type", "application/json; charset=utf-8") + w.WriteHeader(200) + var str string + + if len(appName) > 0 { + str = fmt.Sprintf(`"status":"ok","app":"%s"`, appName) + } else { + str = fmt.Sprintf(`"status":"ok"`) + } + if len(resultJSON) > 0 { + str = fmt.Sprintf(`%s,"original":%s`, str, resultJSON) + } + if len(change) > 0 { + str = fmt.Sprintf(`%s,"change":%s`, str, change) + } + str = fmt.Sprintf(`{%s}`, str) + fmt.Printf("result: %s\n", str) + w.Write([]byte(str)) +} diff --git a/src/requests_db.go b/src/requests_db.go index ce14b3d..7a66560 100644 --- a/src/requests_db.go +++ b/src/requests_db.go @@ -1,6 +1,9 @@ package main import ( + "encoding/json" + "fmt" + "log" "time" uuid "github.com/hashicorp/go-uuid" @@ -38,3 +41,55 @@ func (dbobj dbcon) saveUserRequest(action string, token string, app string, chan _, err := dbobj.createRecord(TblName.Requests, &bdoc) return rtoken, err } + +func (dbobj dbcon) getRequests(status string, offset int32, limit int32) ([]byte, int64, error) { + //var results []*auditEvent + count, err := dbobj.countRecords(TblName.Requests, "status", status) + if err != nil { + return nil, 0, err + } + var results []bson.M + records, err := dbobj.getList(TblName.Requests, "status", status, offset, limit) + if err != nil { + return nil, 0, err + } + for _, element := range records { + element["more"] = false + if _, ok := element["change"]; ok { + element["more"] = true + element["change"] = "" + } + results = append(results, element) + } + + resultJSON, err := json.Marshal(records) + if err != nil { + return nil, 0, err + } + //fmt.Printf("Found multiple documents (array of pointers): %+v\n", results) + return resultJSON, count, nil +} + +func (dbobj dbcon) getRequest(rtoken string) (bson.M, error) { + //var results []*auditEvent + record, err := dbobj.getRecord(TblName.Requests, "rtoken", rtoken) + if err != nil { + return record, err + } + fmt.Printf("request record: %s\n", record) + userTOKEN := "" + change := "" + if value, ok := record["token"]; ok { + userTOKEN = value.(string) + } + if value, ok := record["change"]; ok { + change = value.(string) + } + //recBson := bson.M{} + if len(change) > 0 { + change2, _ := dbobj.userDecrypt(userTOKEN, change) + log.Printf("change: %s", change2) + record["change"] = change2 + } + return record, nil +} diff --git a/ui/site/admin-view-requests.html b/ui/site/admin-view-requests.html new file mode 100644 index 0000000..c7aa038 --- /dev/null +++ b/ui/site/admin-view-requests.html @@ -0,0 +1,185 @@ + + + + + + + Data Bunker - admin / view user requests + + + + + + + + + + + + + + + + + + + + + +
+
+
+ +
+
+

User requests

+

All open requests listed below.

+ + + + + + + + + +
TimeUser Record IdentifierActivityMore
+
+
+
+ + + \ No newline at end of file