Added user permissions!

admin/admin.go

@@ -7,21 +7,22 @@
 package admin
 
 import (
+	"database/sql"
+	"encoding/json"
 	"fmt"
+	"golang.org/x/crypto/bcrypt"
 	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
 	"strings"
-	"encoding/json"
-	"golang.org/x/crypto/bcrypt"
-	"database/sql"
 
-	_ "github.com/mattn/go-sqlite3"
 	"github.com/gorilla/mux"
+	_ "github.com/mattn/go-sqlite3"
 
 	"github.com/gmemstr/pogo/common"
 )
+
 type User struct {
 	Id   int    `json:"id"`
 	Dbun string `json:"username"`
@@ -31,6 +32,7 @@ type User struct {
 type UserList struct {
 	Users []User
 }
+
 /*
  * The following is a set of admin commands
  * that the average user probably shouldn't be
@@ -328,7 +330,7 @@ func EditEpisode() common.Handler {
 		fmt.Println(filename)
 		description := strings.Join(r.Form["description"], "")
 
-		if ("./podcasts" + PreviousFilename + ".mp3" != filename) {
+		if "./podcasts"+PreviousFilename+".mp3" != filename {
 			err = os.Rename("./podcasts/"+PreviousFilename+".mp3", filename)
 			if err != nil {
 				return &common.HTTPError{

auth/auth.go

@@ -6,6 +6,7 @@ import (
 	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha256"
+	"database/sql"
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
@@ -13,8 +14,10 @@ import (
 	"fmt"
 	"log"
 	"net/http"
-	"strings"
 	"os"
+	"strings"
+
+	_ "github.com/mattn/go-sqlite3"
 
 	"github.com/gmemstr/pogo/common"
 )
@@ -27,7 +30,39 @@ const (
 	cookieExpiry = 60 * 60 * 24 * 30 // 30 days in seconds
 )
 
-func RequireAuthorization() common.Handler {
+func UserPermissions(username string, permission int) (bool, error) {
+
+	db, err := sql.Open("sqlite3", "assets/config/users.db")
+	defer db.Close()
+	isAllowed := false
+	if err != nil {
+		return isAllowed, err
+	}
+
+	statement, err := db.Prepare("SELECT permissions FROM users WHERE username=?")
+	if err != nil {
+		return isAllowed, err
+	}
+
+	rows, err := statement.Query(username)
+	if err != nil {
+		return isAllowed, err
+	}
+
+	var level int
+	for rows.Next() {
+		err = rows.Scan(&level)
+		if err != nil {
+			return isAllowed, err
+		}
+		if level >= permission {
+			isAllowed = true
+		}
+	}
+	return isAllowed, nil
+}
+
+func RequireAuthorization(permission int) common.Handler {
 	return func(rc *common.RouterContext, w http.ResponseWriter, r *http.Request) *common.HTTPError {
 		usr, err := DecryptCookie(r)
 		if err != nil {
@@ -46,6 +81,17 @@ func RequireAuthorization() common.Handler {
 		}
 
 		rc.User = usr
+
+		username := rc.User.Username
+
+		hasPermission, err := UserPermissions(string(username), permission)
+
+		if !hasPermission {
+			return &common.HTTPError{
+				Message:    "Unauthorized! Redirecting to /admin",
+				StatusCode: http.StatusUnauthorized,
+			}
+		}
 		return nil
 	}
 }

router/router.go

@@ -1,21 +1,21 @@
 package router
 
 import (
+	"database/sql"
 	"encoding/json"
 	"fmt"
+	"golang.org/x/crypto/bcrypt"
 	"io/ioutil"
 	"log"
 	"net/http"
 	"strings"
-	"golang.org/x/crypto/bcrypt"
-	"database/sql"
 
 	_ "github.com/mattn/go-sqlite3"
 
-	"github.com/gorilla/mux"
 	"github.com/gmemstr/pogo/admin"
 	"github.com/gmemstr/pogo/auth"
 	"github.com/gmemstr/pogo/common"
+	"github.com/gorilla/mux"
 )
 
 type NewConfig struct {
@@ -70,7 +70,7 @@ func Init() *mux.Router {
 	// Authenticated endpoints should be passed to BasicAuth()
 	// first
 	r.Handle("/admin", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(0),
 		adminHandler(),
 	)).Methods("GET", "POST")
 
@@ -79,45 +79,45 @@ func Init() *mux.Router {
 	)).Methods("GET", "POST")
 
 	r.Handle("/admin/publish", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(0),
 		admin.CreateEpisode(),
 	)).Methods("POST")
 
 	r.Handle("/admin/edituser", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(2),
 		admin.EditUser(),
 	)).Methods("POST")
 
 	r.Handle("/admin/newuser", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(2),
 		admin.AddUser(),
 	)).Methods("POST")
 	r.Handle("/admin/deleteuser/{id}", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(2),
 		admin.DeleteUser(),
 	)).Methods("GET")
 	r.Handle("/admin/edit", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(0),
 		admin.EditEpisode(),
 	)).Methods("POST")
 
 	r.Handle("/admin/delete", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(0),
 		admin.RemoveEpisode(),
 	)).Methods("GET")
 
 	r.Handle("/admin/css", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(2),
 		admin.CustomCss(),
 	)).Methods("GET", "POST")
 
 	r.Handle("/admin/adduser", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(1),
 		admin.AddUser(),
 	)).Methods("POST")
 
 	r.Handle("/admin/listusers", Handle(
-		auth.RequireAuthorization(),
+		auth.RequireAuthorization(1),
 		admin.ListUsers(),
 	)).Methods("GET")
 
@@ -174,8 +174,9 @@ func loginHandler() common.Handler {
 		var dbhsh string
 		var dbrn string
 		var dbem string
+		var dbperm int
 		for rows.Next() {
-			err := rows.Scan(&id,&dbun,&dbhsh,&dbrn,&dbem)
+			err := rows.Scan(&id, &dbun, &dbhsh, &dbrn, &dbem, &dbperm)
 			if err != nil {
 				return &common.HTTPError{
 					Message:    fmt.Sprintf("error in decoding sql data", err),
@@ -204,7 +205,6 @@ func loginHandler() common.Handler {
 			return nil
 		}
 
-
 		return &common.HTTPError{
 			Message:    "Invalid credentials!",
 			StatusCode: http.StatusUnauthorized,