bvandeusen
aa73c93f85
Four authenticated endpoints for the user's own account: - PUT /api/me/password — change own password. Caller must supply current_password (verified via bcrypt). Distinct from admin-driven reset (which doesn't require knowing the old). Audits ActionPasswordChangeSelf. - PUT /api/me/profile — set display_name + email. Both fields are nullable; empty string clears, omitted leaves unchanged. Email is lowercased before store + format-validated. Unique violation → 409 email_taken. - GET /api/me/api-token — returns current API token (for copy-paste into Subsonic clients). - POST /api/me/api-token — regenerates token. Old one stops working immediately. Audits ActionTokenRegenerate. All four use the existing RequireUser middleware on the authed sub-router; audit writes are best-effort (logged on failure). Tests cover happy paths, wrong-password 401, password-too-short 400, email-invalid 400, email-taken 409, clear-by-empty-string, omit-leaves-unchanged, token GET + regen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
62 lines
1.9 KiB
Go
62 lines
1.9 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/audit"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
|
|
)
|
|
|
|
type apiTokenResp struct {
|
|
APIToken string `json:"api_token"`
|
|
}
|
|
|
|
// handleGetMyAPIToken implements GET /api/me/api-token.
|
|
func (h *handlers) handleGetMyAPIToken(w http.ResponseWriter, r *http.Request) {
|
|
user, ok := auth.UserFromContext(r.Context())
|
|
if !ok {
|
|
writeErr(w, http.StatusUnauthorized, "auth_required", "")
|
|
return
|
|
}
|
|
q := dbq.New(h.pool)
|
|
current, err := q.GetUserByID(r.Context(), user.ID)
|
|
if err != nil {
|
|
h.logger.Error("get api token: lookup failed", "err", err)
|
|
writeErr(w, http.StatusInternalServerError, "server_error", "")
|
|
return
|
|
}
|
|
writeJSON(w, http.StatusOK, apiTokenResp{APIToken: current.ApiToken})
|
|
}
|
|
|
|
// handleRegenerateMyAPIToken implements POST /api/me/api-token.
|
|
func (h *handlers) handleRegenerateMyAPIToken(w http.ResponseWriter, r *http.Request) {
|
|
user, ok := auth.UserFromContext(r.Context())
|
|
if !ok {
|
|
writeErr(w, http.StatusUnauthorized, "auth_required", "")
|
|
return
|
|
}
|
|
newToken, err := auth.MintSessionToken()
|
|
if err != nil {
|
|
h.logger.Error("regenerate api token: mint failed", "err", err)
|
|
writeErr(w, http.StatusInternalServerError, "server_error", "")
|
|
return
|
|
}
|
|
q := dbq.New(h.pool)
|
|
updated, err := q.RegenerateApiToken(r.Context(), dbq.RegenerateApiTokenParams{
|
|
ID: user.ID,
|
|
ApiToken: newToken,
|
|
})
|
|
if err != nil {
|
|
h.logger.Error("regenerate api token: update failed", "err", err)
|
|
writeErr(w, http.StatusInternalServerError, "server_error", "")
|
|
return
|
|
}
|
|
|
|
if err := audit.Write(r.Context(), h.pool, user.ID, user.ID, audit.ActionTokenRegenerate, nil); err != nil {
|
|
h.logger.Warn("regenerate api token: audit failed", "err", err)
|
|
}
|
|
|
|
writeJSON(w, http.StatusOK, apiTokenResp{APIToken: updated.ApiToken})
|
|
}
|