feat: add auth, hosts, & keychains ownership

server/app/hosts/repository.go

@@ -4,25 +4,36 @@ import (
 	"gorm.io/gorm"
 	"rul.sh/vaulterm/db"
 	"rul.sh/vaulterm/models"
+	"rul.sh/vaulterm/utils"
 )
 
-type Hosts struct{ db *gorm.DB }
+type Hosts struct {
+	db   *gorm.DB
+	User *utils.UserContext
+}
 
-func NewRepository() *Hosts {
-	return &Hosts{db: db.Get()}
+func NewRepository(r *Hosts) *Hosts {
+	if r == nil {
+		r = &Hosts{}
+	}
+	r.db = db.Get()
+	return r
 }
 
 func (r *Hosts) GetAll() ([]*models.Host, error) {
+	query := r.ACL(r.db.Order("id DESC"))
+
 	var rows []*models.Host
-	ret := r.db.Order("id DESC").Find(&rows)
+	ret := query.Find(&rows)
 
 	return rows, ret.Error
 }
 
 func (r *Hosts) Get(id string) (*models.HostDecrypted, error) {
-	var host models.Host
-	ret := r.db.Joins("Key").Joins("AltKey").Where("hosts.id = ?", id).First(&host)
+	query := r.ACL(r.db)
 
+	var host models.Host
+	ret := query.Joins("Key").Joins("AltKey").Where("hosts.id = ?", id).First(&host)
 	if ret.Error != nil {
 		return nil, ret.Error
 	}
@@ -37,12 +48,13 @@ func (r *Hosts) Get(id string) (*models.HostDecrypted, error) {
 
 func (r *Hosts) Exists(id string) (bool, error) {
 	var count int64
-	ret := r.db.Model(&models.Host{}).Where("id = ?", id).Count(&count)
+	ret := r.ACL(r.db.Model(&models.Host{}).Where("id = ?", id)).Count(&count)
 	return count > 0, ret.Error
 }
 
 func (r *Hosts) Delete(id string) error {
-	return r.db.Delete(&models.Host{Model: models.Model{ID: id}}).Error
+	query := r.ACL(r.db)
+	return query.Delete(&models.Host{Model: models.Model{ID: id}}).Error
 }
 
 func (r *Hosts) Create(item *models.Host) error {
@@ -50,5 +62,15 @@ func (r *Hosts) Create(item *models.Host) error {
 }
 
 func (r *Hosts) Update(id string, item *models.Host) error {
-	return r.db.Where("id = ?", id).Updates(item).Error
+	query := r.ACL(r.db.Where("id = ?", id))
+
+	return query.Updates(item).Error
+}
+
+func (r *Hosts) ACL(query *gorm.DB) *gorm.DB {
+	if r.User.IsAdmin {
+		return query
+	}
+
+	return query.Where("hosts.owner_id = ?", r.User.ID)
 }

server/app/hosts/router.go

@@ -9,7 +9,7 @@ import (
 	"rul.sh/vaulterm/utils"
 )
 
-func Router(app *fiber.App) {
+func Router(app fiber.Router) {
 	router := app.Group("/hosts")
 
 	router.Get("/", getAll)
@@ -19,7 +19,9 @@ func Router(app *fiber.App) {
 }
 
 func getAll(c *fiber.Ctx) error {
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Hosts{User: user})
+
 	rows, err := repo.GetAll()
 	if err != nil {
 		return utils.ResponseError(c, err, 500)
@@ -36,8 +38,11 @@ func create(c *fiber.Ctx) error {
 		return utils.ResponseError(c, err, 500)
 	}
 
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Hosts{User: user})
+
 	item := &models.Host{
+		OwnerID:  user.ID,
 		Type:     body.Type,
 		Label:    body.Label,
 		Host:     body.Host,
@@ -48,7 +53,7 @@ func create(c *fiber.Ctx) error {
 		AltKeyID: body.AltKeyID,
 	}
 
-	osName, err := tryConnect(item)
+	osName, err := tryConnect(c, item)
 	if err != nil {
 		return utils.ResponseError(c, fmt.Errorf("cannot connect to the host: %s", err), 500)
 	}
@@ -67,7 +72,8 @@ func update(c *fiber.Ctx) error {
 		return utils.ResponseError(c, err, 500)
 	}
 
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Hosts{User: user})
 
 	id := c.Params("id")
 	exist, _ := repo.Exists(id)
@@ -87,7 +93,7 @@ func update(c *fiber.Ctx) error {
 		AltKeyID: body.AltKeyID,
 	}
 
-	osName, err := tryConnect(item)
+	osName, err := tryConnect(c, item)
 	if err != nil {
 		return utils.ResponseError(c, fmt.Errorf("cannot connect to the host: %s", err), 500)
 	}
@@ -101,7 +107,8 @@ func update(c *fiber.Ctx) error {
 }
 
 func delete(c *fiber.Ctx) error {
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Hosts{User: user})
 
 	id := c.Params("id")
 	exist, _ := repo.Exists(id)

server/app/hosts/utils.go

@@ -3,13 +3,16 @@ package hosts
 import (
 	"fmt"
 
+	"github.com/gofiber/fiber/v2"
 	"rul.sh/vaulterm/app/keychains"
 	"rul.sh/vaulterm/lib"
 	"rul.sh/vaulterm/models"
+	"rul.sh/vaulterm/utils"
 )
 
-func tryConnect(host *models.Host) (string, error) {
-	keyRepo := keychains.NewRepository()
+func tryConnect(c *fiber.Ctx, host *models.Host) (string, error) {
+	user := utils.GetUser(c)
+	keyRepo := keychains.NewRepository(&keychains.Keychains{User: user})
 
 	var key map[string]interface{}
 	var altKey map[string]interface{}