574 lines
19 KiB
Rust
574 lines
19 KiB
Rust
use cot::auth::PasswordHash;
|
|
use cot::common_types::Password;
|
|
use cot::db::{Auto, Database, LimitedString, Model};
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// User model
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[derive(Debug, Clone)]
|
|
#[cot::db::model]
|
|
pub struct User {
|
|
#[model(primary_key)]
|
|
id: Auto<i64>,
|
|
#[model(unique)]
|
|
username: LimitedString<255>,
|
|
password: Option<String>,
|
|
email: Option<String>,
|
|
display_name: Option<String>,
|
|
avatar_url: Option<String>,
|
|
telegram_id: Option<String>,
|
|
telegram_link_code: Option<String>,
|
|
telegram_link_code_created_at: Option<i64>,
|
|
role: LimitedString<32>,
|
|
is_active: bool,
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// User helper methods
|
|
// ---------------------------------------------------------------------------
|
|
|
|
impl User {
|
|
/// List all users.
|
|
pub async fn list_all(db: &Database) -> cot::db::Result<Vec<Self>> {
|
|
Self::objects().all(db).await
|
|
}
|
|
|
|
/// Get a user by primary key.
|
|
pub async fn get_by_id(db: &Database, user_id: i64) -> cot::db::Result<Option<Self>> {
|
|
Self::get_by_primary_key(db, Auto::Fixed(user_id)).await
|
|
}
|
|
|
|
/// Create a new user and insert it into the database.
|
|
pub async fn create(
|
|
db: &Database,
|
|
username: &str,
|
|
email: Option<&str>,
|
|
display_name: Option<&str>,
|
|
password: &str,
|
|
role: &str,
|
|
) -> cot::db::Result<Self> {
|
|
let hash = PasswordHash::from_password(&Password::new(password));
|
|
let mut user = Self {
|
|
id: Auto::auto(),
|
|
username: LimitedString::new(username).unwrap(),
|
|
password: Some(hash.into_string()),
|
|
email: email.map(str::to_owned),
|
|
display_name: display_name.map(str::to_owned),
|
|
avatar_url: None,
|
|
telegram_id: None,
|
|
telegram_link_code: None,
|
|
telegram_link_code_created_at: None,
|
|
role: LimitedString::new(role).unwrap(),
|
|
is_active: true,
|
|
};
|
|
user.insert(db).await?;
|
|
Ok(user)
|
|
}
|
|
|
|
/// Create a user without a password (for OIDC-only accounts).
|
|
pub async fn create_oidc(
|
|
db: &Database,
|
|
username: &str,
|
|
email: Option<&str>,
|
|
display_name: Option<&str>,
|
|
role: &str,
|
|
) -> cot::db::Result<Self> {
|
|
let mut user = Self {
|
|
id: Auto::auto(),
|
|
username: LimitedString::new(username).unwrap(),
|
|
password: None,
|
|
email: email.map(str::to_owned),
|
|
display_name: display_name.map(str::to_owned),
|
|
avatar_url: None,
|
|
telegram_id: None,
|
|
telegram_link_code: None,
|
|
telegram_link_code_created_at: None,
|
|
role: LimitedString::new(role).unwrap(),
|
|
is_active: true,
|
|
};
|
|
user.insert(db).await?;
|
|
Ok(user)
|
|
}
|
|
|
|
/// Update an existing user. If `new_password` is `Some`, the password hash
|
|
/// is replaced; otherwise the existing hash is kept.
|
|
pub async fn update_fields(
|
|
&mut self,
|
|
db: &Database,
|
|
username: &str,
|
|
email: Option<&str>,
|
|
display_name: Option<&str>,
|
|
new_password: Option<&str>,
|
|
role: &str,
|
|
) -> cot::db::Result<()> {
|
|
self.username = LimitedString::new(username).unwrap();
|
|
self.email = email.map(str::to_owned);
|
|
self.display_name = display_name.map(str::to_owned);
|
|
if let Some(pw) = new_password {
|
|
self.password = Some(PasswordHash::from_password(&Password::new(pw)).into_string());
|
|
}
|
|
self.role = LimitedString::new(role).unwrap();
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Look up a user by username.
|
|
pub async fn get_by_username(db: &Database, username: &str) -> cot::db::Result<Option<Self>> {
|
|
let Ok(username) = LimitedString::<255>::new(username) else {
|
|
return Ok(None);
|
|
};
|
|
cot::db::query!(User, $username == username).get(db).await
|
|
}
|
|
|
|
/// Find a user by email address.
|
|
pub async fn get_by_email(db: &Database, email: &str) -> cot::db::Result<Option<Self>> {
|
|
let email = email.to_owned();
|
|
cot::db::query!(User, $email == Some(email)).get(db).await
|
|
}
|
|
|
|
/// Find a user linked to a non-empty Telegram ID.
|
|
pub async fn get_by_telegram_id(
|
|
db: &Database,
|
|
telegram_id: &str,
|
|
) -> cot::db::Result<Option<Self>> {
|
|
let telegram_id = telegram_id.trim();
|
|
if telegram_id.is_empty() {
|
|
return Ok(None);
|
|
}
|
|
let telegram_id = telegram_id.to_owned();
|
|
cot::db::query!(User, $telegram_id == Some(telegram_id))
|
|
.get(db)
|
|
.await
|
|
}
|
|
|
|
/// Find a user waiting for this Telegram link code.
|
|
pub async fn get_by_telegram_link_code(
|
|
db: &Database,
|
|
code: &str,
|
|
) -> cot::db::Result<Option<Self>> {
|
|
let code = code.trim();
|
|
if code.is_empty() {
|
|
return Ok(None);
|
|
}
|
|
let code = code.to_owned();
|
|
cot::db::query!(User, $telegram_link_code == Some(code))
|
|
.get(db)
|
|
.await
|
|
}
|
|
|
|
/// Count all users in the database.
|
|
pub async fn count_all(db: &Database) -> cot::db::Result<u64> {
|
|
Self::objects().count(db).await
|
|
}
|
|
|
|
/// Return a reference to the password hash, if set.
|
|
pub fn password_ref(&self) -> Option<PasswordHash> {
|
|
self.password
|
|
.as_ref()
|
|
.and_then(|hash| PasswordHash::new(hash.clone()).ok())
|
|
}
|
|
|
|
/// Parse the stored role code into a `Role`, defaulting to `Client`.
|
|
pub fn role(&self) -> crate::auth::Role {
|
|
crate::auth::Role::from_code(&self.role).unwrap_or(crate::auth::Role::Client)
|
|
}
|
|
|
|
/// Update the user's role and persist the change.
|
|
pub async fn update_role(&mut self, db: &Database, role: &str) -> cot::db::Result<()> {
|
|
self.role = LimitedString::new(role).unwrap();
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Store a Telegram link state. `Some("")` means the user declined linking.
|
|
pub async fn set_telegram_id(
|
|
&mut self,
|
|
db: &Database,
|
|
telegram_id: Option<&str>,
|
|
) -> cot::db::Result<()> {
|
|
self.telegram_id = telegram_id.map(str::to_owned);
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Store or clear a pending Telegram link code.
|
|
pub async fn set_telegram_link_code(
|
|
&mut self,
|
|
db: &Database,
|
|
code: Option<&str>,
|
|
created_at: Option<i64>,
|
|
) -> cot::db::Result<()> {
|
|
self.telegram_link_code = code.map(str::to_owned);
|
|
self.telegram_link_code_created_at = code.and(created_at);
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Complete Telegram linking and clear any pending code.
|
|
pub async fn complete_telegram_link(
|
|
&mut self,
|
|
db: &Database,
|
|
telegram_id: &str,
|
|
) -> cot::db::Result<()> {
|
|
self.telegram_id = Some(telegram_id.to_owned());
|
|
self.telegram_link_code = None;
|
|
self.telegram_link_code_created_at = None;
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Remove Telegram credentials and pending link data.
|
|
pub async fn clear_telegram_link(&mut self, db: &Database) -> cot::db::Result<()> {
|
|
self.telegram_id = None;
|
|
self.telegram_link_code = None;
|
|
self.telegram_link_code_created_at = None;
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Store an explicit opt-out and clear pending link data.
|
|
pub async fn decline_telegram_link(&mut self, db: &Database) -> cot::db::Result<()> {
|
|
self.telegram_id = Some(String::new());
|
|
self.telegram_link_code = None;
|
|
self.telegram_link_code_created_at = None;
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Delete this user by primary key.
|
|
pub async fn delete_by_id(db: &Database, user_id: i64) -> cot::db::Result<()> {
|
|
cot::db::query!(User, $id == Auto::Fixed(user_id))
|
|
.delete(db)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
// Accessor helpers for templates
|
|
pub fn id_val(&self) -> i64 {
|
|
self.id.unwrap()
|
|
}
|
|
|
|
pub fn username_str(&self) -> &str {
|
|
&self.username
|
|
}
|
|
|
|
pub fn email_str(&self) -> String {
|
|
self.email.clone().unwrap_or_default()
|
|
}
|
|
|
|
pub fn display_name_str(&self) -> String {
|
|
self.display_name.clone().unwrap_or_default()
|
|
}
|
|
|
|
pub fn telegram_id(&self) -> Option<&str> {
|
|
self.telegram_id.as_deref()
|
|
}
|
|
|
|
pub fn telegram_link_code(&self) -> Option<&str> {
|
|
self.telegram_link_code.as_deref()
|
|
}
|
|
|
|
pub fn telegram_link_code_created_at(&self) -> Option<i64> {
|
|
self.telegram_link_code_created_at
|
|
}
|
|
|
|
pub fn role_str(&self) -> &str {
|
|
&self.role
|
|
}
|
|
|
|
pub fn is_active(&self) -> bool {
|
|
self.is_active
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// OidcLink model
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[derive(Debug, Clone)]
|
|
#[cot::db::model]
|
|
pub struct OidcLink {
|
|
#[model(primary_key)]
|
|
id: Auto<i64>,
|
|
user_id: i64,
|
|
issuer: LimitedString<255>,
|
|
sub: LimitedString<255>,
|
|
email: Option<String>,
|
|
name: Option<String>,
|
|
avatar_url: Option<String>,
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// OidcLink helper methods
|
|
// ---------------------------------------------------------------------------
|
|
|
|
impl OidcLink {
|
|
/// Find an OIDC link by issuer + subject.
|
|
pub async fn find_by_issuer_sub(
|
|
db: &Database,
|
|
issuer: &str,
|
|
sub: &str,
|
|
) -> cot::db::Result<Option<Self>> {
|
|
let Ok(issuer) = LimitedString::<255>::new(issuer) else {
|
|
return Ok(None);
|
|
};
|
|
let Ok(sub) = LimitedString::<255>::new(sub) else {
|
|
return Ok(None);
|
|
};
|
|
cot::db::query!(OidcLink, $issuer == issuer && $sub == sub)
|
|
.get(db)
|
|
.await
|
|
}
|
|
|
|
/// Create a new OIDC link for a user.
|
|
pub async fn create_link(
|
|
db: &Database,
|
|
user_id: i64,
|
|
issuer: &str,
|
|
sub: &str,
|
|
email: Option<&str>,
|
|
name: Option<&str>,
|
|
) -> cot::db::Result<Self> {
|
|
let mut link = Self {
|
|
id: Auto::auto(),
|
|
user_id,
|
|
issuer: LimitedString::new(issuer).unwrap(),
|
|
sub: LimitedString::new(sub).unwrap(),
|
|
email: email.map(str::to_owned),
|
|
name: name.map(str::to_owned),
|
|
avatar_url: None,
|
|
};
|
|
link.insert(db).await?;
|
|
Ok(link)
|
|
}
|
|
|
|
/// Update cached claims (email, name) on an existing link.
|
|
pub async fn update_claims(
|
|
&mut self,
|
|
db: &Database,
|
|
email: Option<&str>,
|
|
name: Option<&str>,
|
|
) -> cot::db::Result<()> {
|
|
self.email = email.map(str::to_owned);
|
|
self.name = name.map(str::to_owned);
|
|
self.save(db).await
|
|
}
|
|
|
|
/// Delete this OIDC link by primary key.
|
|
pub async fn delete(self, db: &Database) -> cot::db::Result<()> {
|
|
let link_id = self.id;
|
|
cot::db::query!(OidcLink, $id == link_id).delete(db).await?;
|
|
Ok(())
|
|
}
|
|
|
|
/// Accessor for the linked user ID.
|
|
pub fn user_id(&self) -> i64 {
|
|
self.user_id
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Migrations
|
|
// ---------------------------------------------------------------------------
|
|
|
|
pub mod db_migrations {
|
|
use cot::db::migrations::{self, Field, Operation, SyncDynMigration};
|
|
use cot::db::{DatabaseField, Identifier, LimitedString};
|
|
|
|
// -- M0002: create amnezia_fellow__user --------------------------------
|
|
|
|
#[derive(Debug, Copy, Clone)]
|
|
pub struct M0002CreateUser;
|
|
|
|
impl migrations::Migration for M0002CreateUser {
|
|
const APP_NAME: &'static str = "amnezia_fellow";
|
|
const MIGRATION_NAME: &'static str = "m_0002_create_user";
|
|
const DEPENDENCIES: &'static [migrations::MigrationDependency] =
|
|
&[migrations::MigrationDependency::migration(
|
|
"amnezia_fellow",
|
|
"m_0001_create_config_entry",
|
|
)];
|
|
const OPERATIONS: &'static [Operation] = &[Operation::create_model()
|
|
.table_name(Identifier::new("amnezia_fellow__user"))
|
|
.fields(&[
|
|
Field::new(Identifier::new("id"), <i64 as DatabaseField>::TYPE)
|
|
.primary_key()
|
|
.auto(),
|
|
Field::new(
|
|
Identifier::new("username"),
|
|
<LimitedString<255> as DatabaseField>::TYPE,
|
|
)
|
|
.unique(),
|
|
Field::new(Identifier::new("password"), <String as DatabaseField>::TYPE)
|
|
.set_null(true),
|
|
Field::new(Identifier::new("email"), <String as DatabaseField>::TYPE)
|
|
.set_null(true),
|
|
Field::new(
|
|
Identifier::new("display_name"),
|
|
<String as DatabaseField>::TYPE,
|
|
)
|
|
.set_null(true),
|
|
Field::new(
|
|
Identifier::new("avatar_url"),
|
|
<String as DatabaseField>::TYPE,
|
|
)
|
|
.set_null(true),
|
|
Field::new(
|
|
Identifier::new("role"),
|
|
<LimitedString<32> as DatabaseField>::TYPE,
|
|
),
|
|
Field::new(Identifier::new("is_active"), <bool as DatabaseField>::TYPE),
|
|
])
|
|
.build()];
|
|
}
|
|
|
|
// -- M0003: create amnezia_fellow__oidc_link ---------------------------
|
|
|
|
#[derive(Debug, Copy, Clone)]
|
|
pub struct M0003CreateOidcLink;
|
|
|
|
impl migrations::Migration for M0003CreateOidcLink {
|
|
const APP_NAME: &'static str = "amnezia_fellow";
|
|
const MIGRATION_NAME: &'static str = "m_0003_create_oidc_link";
|
|
const DEPENDENCIES: &'static [migrations::MigrationDependency] =
|
|
&[migrations::MigrationDependency::migration(
|
|
"amnezia_fellow",
|
|
"m_0002_create_user",
|
|
)];
|
|
const OPERATIONS: &'static [Operation] = &[Operation::create_model()
|
|
.table_name(Identifier::new("amnezia_fellow__oidc_link"))
|
|
.fields(&[
|
|
Field::new(Identifier::new("id"), <i64 as DatabaseField>::TYPE)
|
|
.primary_key()
|
|
.auto(),
|
|
Field::new(Identifier::new("user_id"), <i64 as DatabaseField>::TYPE),
|
|
Field::new(
|
|
Identifier::new("issuer"),
|
|
<LimitedString<255> as DatabaseField>::TYPE,
|
|
),
|
|
Field::new(
|
|
Identifier::new("sub"),
|
|
<LimitedString<255> as DatabaseField>::TYPE,
|
|
),
|
|
Field::new(Identifier::new("email"), <String as DatabaseField>::TYPE)
|
|
.set_null(true),
|
|
Field::new(Identifier::new("name"), <String as DatabaseField>::TYPE).set_null(true),
|
|
Field::new(
|
|
Identifier::new("avatar_url"),
|
|
<String as DatabaseField>::TYPE,
|
|
)
|
|
.set_null(true),
|
|
])
|
|
.build()];
|
|
}
|
|
|
|
// -- M0004: indexes on amnezia_fellow__oidc_link -----------------------
|
|
|
|
#[cot::db::migrations::migration_op]
|
|
async fn create_oidc_link_indexes(
|
|
ctx: migrations::MigrationContext<'_>,
|
|
) -> cot::db::Result<()> {
|
|
ctx.db
|
|
.raw(
|
|
"CREATE UNIQUE INDEX idx_amnezia_fellow_oidc_link_issuer_sub \
|
|
ON amnezia_fellow__oidc_link (issuer, sub)",
|
|
)
|
|
.await?;
|
|
ctx.db
|
|
.raw(
|
|
"CREATE INDEX idx_amnezia_fellow_oidc_link_user_id \
|
|
ON amnezia_fellow__oidc_link (user_id)",
|
|
)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
#[derive(Debug, Copy, Clone)]
|
|
pub struct M0004OidcLinkIndexes;
|
|
|
|
impl migrations::Migration for M0004OidcLinkIndexes {
|
|
const APP_NAME: &'static str = "amnezia_fellow";
|
|
const MIGRATION_NAME: &'static str = "m_0004_oidc_link_indexes";
|
|
const DEPENDENCIES: &'static [migrations::MigrationDependency] =
|
|
&[migrations::MigrationDependency::migration(
|
|
"amnezia_fellow",
|
|
"m_0003_create_oidc_link",
|
|
)];
|
|
const OPERATIONS: &'static [Operation] =
|
|
&[Operation::custom(create_oidc_link_indexes).build()];
|
|
}
|
|
|
|
// -- M0007: Telegram link state on amnezia_fellow__user ----------------
|
|
|
|
#[cot::db::migrations::migration_op]
|
|
async fn add_user_telegram_id(ctx: migrations::MigrationContext<'_>) -> cot::db::Result<()> {
|
|
ctx.db
|
|
.raw("ALTER TABLE amnezia_fellow__user ADD COLUMN telegram_id TEXT")
|
|
.await?;
|
|
ctx.db
|
|
.raw(
|
|
"CREATE UNIQUE INDEX idx_amnezia_fellow_user_telegram_id \
|
|
ON amnezia_fellow__user (telegram_id) \
|
|
WHERE telegram_id IS NOT NULL AND telegram_id != ''",
|
|
)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
#[derive(Debug, Copy, Clone)]
|
|
pub struct M0007UserTelegramId;
|
|
|
|
impl migrations::Migration for M0007UserTelegramId {
|
|
const APP_NAME: &'static str = "amnezia_fellow";
|
|
const MIGRATION_NAME: &'static str = "m_0007_user_telegram_id";
|
|
const DEPENDENCIES: &'static [migrations::MigrationDependency] =
|
|
&[migrations::MigrationDependency::migration(
|
|
"amnezia_fellow",
|
|
"m_0004_oidc_link_indexes",
|
|
)];
|
|
const OPERATIONS: &'static [Operation] = &[Operation::custom(add_user_telegram_id).build()];
|
|
}
|
|
|
|
// -- M0008: pending Telegram link code on amnezia_fellow__user ---------
|
|
|
|
#[cot::db::migrations::migration_op]
|
|
async fn add_user_telegram_link_code(
|
|
ctx: migrations::MigrationContext<'_>,
|
|
) -> cot::db::Result<()> {
|
|
ctx.db
|
|
.raw("ALTER TABLE amnezia_fellow__user ADD COLUMN telegram_link_code TEXT")
|
|
.await?;
|
|
ctx.db
|
|
.raw(
|
|
"ALTER TABLE amnezia_fellow__user \
|
|
ADD COLUMN telegram_link_code_created_at INTEGER",
|
|
)
|
|
.await?;
|
|
ctx.db
|
|
.raw(
|
|
"CREATE UNIQUE INDEX idx_amnezia_fellow_user_telegram_link_code \
|
|
ON amnezia_fellow__user (telegram_link_code) \
|
|
WHERE telegram_link_code IS NOT NULL AND telegram_link_code != ''",
|
|
)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
#[derive(Debug, Copy, Clone)]
|
|
pub struct M0008UserTelegramLinkCode;
|
|
|
|
impl migrations::Migration for M0008UserTelegramLinkCode {
|
|
const APP_NAME: &'static str = "amnezia_fellow";
|
|
const MIGRATION_NAME: &'static str = "m_0008_user_telegram_link_code";
|
|
const DEPENDENCIES: &'static [migrations::MigrationDependency] =
|
|
&[migrations::MigrationDependency::migration(
|
|
"amnezia_fellow",
|
|
"m_0007_user_telegram_id",
|
|
)];
|
|
const OPERATIONS: &'static [Operation] =
|
|
&[Operation::custom(add_user_telegram_link_code).build()];
|
|
}
|
|
|
|
pub const MIGRATIONS: &[&SyncDynMigration] = &[
|
|
&M0002CreateUser,
|
|
&M0003CreateOidcLink,
|
|
&M0004OidcLinkIndexes,
|
|
&M0007UserTelegramId,
|
|
&M0008UserTelegramLinkCode,
|
|
];
|
|
}
|