mirror of
https://github.com/optim-enterprises-bv/databunker.git
synced 2025-10-30 17:37:50 +00:00
295 lines
8.5 KiB
Go
295 lines
8.5 KiB
Go
package main
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/julienschmidt/httprouter"
|
|
"github.com/securitybunker/databunker/src/utils"
|
|
)
|
|
|
|
// This function retrieves all requests that require admin approval. This function supports result pager.
|
|
func (e mainEnv) getUserRequests(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
|
|
if e.EnforceAuth(w, r, nil) == "" {
|
|
return
|
|
}
|
|
var offset int32
|
|
var limit int32 = 10
|
|
status := "open"
|
|
args := r.URL.Query()
|
|
if value, ok := args["offset"]; ok {
|
|
offset = utils.Atoi(value[0])
|
|
}
|
|
if value, ok := args["limit"]; ok {
|
|
limit = utils.Atoi(value[0])
|
|
}
|
|
if value, ok := args["status"]; ok {
|
|
status = value[0]
|
|
}
|
|
resultJSON, counter, err := e.db.getRequests(status, offset, limit)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, nil)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(200)
|
|
str := fmt.Sprintf(`{"status":"ok","total":%d,"rows":%s}`, counter, resultJSON)
|
|
w.Write([]byte(str))
|
|
}
|
|
|
|
// Get list of requests for specific user
|
|
func (e mainEnv) getCustomUserRequests(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
|
|
identity := ps.ByName("identity")
|
|
mode := ps.ByName("mode")
|
|
event := audit("get user privacy requests", identity, mode, identity)
|
|
defer func() { event.submit(e.db, e.conf) }()
|
|
|
|
if e.EnforceAuth(w, r, event) == "" {
|
|
return
|
|
}
|
|
userTOKEN := e.loadUserToken(w, r, mode, identity, event)
|
|
if userTOKEN == "" {
|
|
return
|
|
}
|
|
var offset int32
|
|
var limit int32 = 10
|
|
args := r.URL.Query()
|
|
if value, ok := args["offset"]; ok {
|
|
offset = utils.Atoi(value[0])
|
|
}
|
|
if value, ok := args["limit"]; ok {
|
|
limit = utils.Atoi(value[0])
|
|
}
|
|
resultJSON, counter, err := e.db.getUserRequests(userTOKEN, offset, limit)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, nil)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(200)
|
|
str := fmt.Sprintf(`{"status":"ok","total":%d,"rows":%s}`, counter, resultJSON)
|
|
w.Write([]byte(str))
|
|
}
|
|
|
|
func (e mainEnv) getUserRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
|
|
request := ps.ByName("request")
|
|
event := audit("get user request by request token", request, "request", request)
|
|
defer func() { event.submit(e.db, e.conf) }()
|
|
|
|
if EnforceUUID(w, request, event) == false {
|
|
return
|
|
}
|
|
requestInfo, err := e.db.getRequest(request)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, nil)
|
|
return
|
|
}
|
|
if len(requestInfo) == 0 {
|
|
ReturnError(w, r, "not found", 405, err, event)
|
|
return
|
|
}
|
|
var resultJSON []byte
|
|
action := utils.GetStringValue(requestInfo["action"])
|
|
userTOKEN := utils.GetStringValue(requestInfo["token"])
|
|
if len(userTOKEN) != 0 {
|
|
event.Record = userTOKEN
|
|
}
|
|
if e.EnforceAdmin(w, r, event) == "" {
|
|
return
|
|
}
|
|
change := utils.GetStringValue(requestInfo["change"])
|
|
appName := utils.GetStringValue(requestInfo["app"])
|
|
brief := utils.GetStringValue(requestInfo["brief"])
|
|
if strings.HasPrefix(action, "plugin") {
|
|
brief = ""
|
|
}
|
|
if len(appName) > 0 {
|
|
resultJSON, err = e.db.getUserApp(userTOKEN, appName, e.conf)
|
|
} else if len(brief) > 0 {
|
|
resultJSON, err = e.db.viewAgreementRecord(userTOKEN, brief)
|
|
} else {
|
|
resultJSON, err = e.db.getUserJSON(userTOKEN)
|
|
}
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
if resultJSON == nil {
|
|
ReturnError(w, r, "not found", 405, err, event)
|
|
return
|
|
}
|
|
//fmt.Printf("Full json: %s\n", resultJSON)
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(200)
|
|
var str string
|
|
|
|
if len(appName) > 0 {
|
|
str = fmt.Sprintf(`"status":"ok","app":"%s"`, appName)
|
|
} else {
|
|
str = fmt.Sprintf(`"status":"ok"`)
|
|
}
|
|
if len(resultJSON) > 0 {
|
|
str = fmt.Sprintf(`%s,"original":%s`, str, resultJSON)
|
|
}
|
|
if len(change) > 0 {
|
|
str = fmt.Sprintf(`%s,"change":%s`, str, change)
|
|
}
|
|
str = fmt.Sprintf(`{%s}`, str)
|
|
//fmt.Printf("result: %s\n", str)
|
|
w.Write([]byte(str))
|
|
}
|
|
|
|
func (e mainEnv) approveUserRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
|
|
request := ps.ByName("request")
|
|
event := audit("approve user request", request, "request", request)
|
|
defer func() { event.submit(e.db, e.conf) }()
|
|
|
|
if EnforceUUID(w, request, event) == false {
|
|
return
|
|
}
|
|
authResult := e.EnforceAdmin(w, r, event)
|
|
if authResult == "" {
|
|
return
|
|
}
|
|
records, err := utils.GetJSONPostMap(r)
|
|
if err != nil {
|
|
ReturnError(w, r, "failed to decode request body", 405, err, event)
|
|
return
|
|
}
|
|
reason := utils.GetStringValue(records["reason"])
|
|
requestInfo, err := e.db.getRequest(request)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
if len(requestInfo) == 0 {
|
|
ReturnError(w, r, "not found", 405, err, event)
|
|
return
|
|
}
|
|
userTOKEN := utils.GetStringValue(requestInfo["token"])
|
|
if len(userTOKEN) != 0 {
|
|
event.Record = userTOKEN
|
|
}
|
|
action := utils.GetStringValue(requestInfo["action"])
|
|
status := utils.GetStringValue(requestInfo["status"])
|
|
if status != "open" {
|
|
ReturnError(w, r, "wrong status: "+status, 405, err, event)
|
|
return
|
|
}
|
|
userJSON, userBSON, err := e.db.getUser(userTOKEN)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
if userJSON == nil {
|
|
ReturnError(w, r, "not found", 405, err, event)
|
|
return
|
|
}
|
|
if action == "forget-me" {
|
|
email := utils.GetStringValue(userBSON["email"])
|
|
if len(email) > 0 {
|
|
e.globalUserDelete(email)
|
|
}
|
|
result, err := e.db.deleteUserRecord(userJSON, userTOKEN, e.conf)
|
|
if result == false || err != nil {
|
|
// user deleted
|
|
event.Status = "failed"
|
|
event.Msg = "failed to delete"
|
|
}
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
notifyURL := e.conf.Notification.NotificationURL
|
|
notifyForgetMe(notifyURL, userJSON, "token", userTOKEN)
|
|
} else if action == "change-profile" {
|
|
oldJSON, newJSON, lookupErr, err := e.db.updateUserRecord(requestInfo["change"].([]uint8), userTOKEN, userBSON, event, e.conf)
|
|
if lookupErr {
|
|
ReturnError(w, r, "internal error", 405, errors.New("not found"), event)
|
|
return
|
|
}
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
utils.ReturnUUID(w, userTOKEN)
|
|
notifyURL := e.conf.Notification.NotificationURL
|
|
notifyProfileChange(notifyURL, oldJSON, newJSON, "token", userTOKEN)
|
|
} else if action == "change-app-data" {
|
|
app := requestInfo["app"].(string)
|
|
_, err = e.db.updateAppRecord(requestInfo["change"].([]uint8), userTOKEN, app, event, e.conf)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
} else if action == "agreement-withdraw" {
|
|
brief := requestInfo["brief"].(string)
|
|
mode := "token"
|
|
lastmodifiedby := "admin"
|
|
e.db.withdrawAgreement(userTOKEN, brief, mode, userTOKEN, lastmodifiedby)
|
|
} else if action == "plugin-delete" {
|
|
pluginid := requestInfo["brief"].(string)
|
|
e.pluginUserDelete(pluginid, userTOKEN)
|
|
}
|
|
e.db.updateRequestStatus(request, "approved", reason)
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(200)
|
|
fmt.Fprintf(w, `{"status":"ok","result":"done"}`)
|
|
}
|
|
|
|
func (e mainEnv) cancelUserRequest(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
|
|
request := ps.ByName("request")
|
|
event := audit("cancel user request", request, "request", request)
|
|
defer func() { event.submit(e.db, e.conf) }()
|
|
|
|
if EnforceUUID(w, request, event) == false {
|
|
return
|
|
}
|
|
records, err := utils.GetJSONPostMap(r)
|
|
if err != nil {
|
|
ReturnError(w, r, "failed to decode request body", 405, err, event)
|
|
return
|
|
}
|
|
reason := utils.GetStringValue(records["reason"])
|
|
requestInfo, err := e.db.getRequest(request)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
if len(requestInfo) == 0 {
|
|
ReturnError(w, r, "not found", 405, err, event)
|
|
return
|
|
}
|
|
userTOKEN := utils.GetStringValue(requestInfo["token"])
|
|
if len(userTOKEN) != 0 {
|
|
event.Record = userTOKEN
|
|
}
|
|
authResult := e.EnforceAuth(w, r, event)
|
|
if authResult == "" {
|
|
return
|
|
}
|
|
if requestInfo["status"].(string) != "open" {
|
|
ReturnError(w, r, "wrong status: "+requestInfo["status"].(string), 405, err, event)
|
|
return
|
|
}
|
|
resultJSON, err := e.db.getUserJSON(userTOKEN)
|
|
if err != nil {
|
|
ReturnError(w, r, "internal error", 405, err, event)
|
|
return
|
|
}
|
|
if resultJSON == nil {
|
|
ReturnError(w, r, "not found", 405, err, event)
|
|
return
|
|
}
|
|
if len(reason) == 0 && authResult == "login" {
|
|
reason = "user operation"
|
|
}
|
|
e.db.updateRequestStatus(request, "canceled", reason)
|
|
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(200)
|
|
fmt.Fprintf(w, `{"status":"ok","result":"done"}`)
|
|
}
|