feat: add auth, hosts, & keychains ownership

server/app/keychains/repository.go

@@ -4,18 +4,27 @@ import (
 	"gorm.io/gorm"
 	"rul.sh/vaulterm/db"
 	"rul.sh/vaulterm/models"
+	"rul.sh/vaulterm/utils"
 )
 
-type Keychains struct{ db *gorm.DB }
+type Keychains struct {
+	db   *gorm.DB
+	User *utils.UserContext
+}
 
-func NewRepository() *Keychains {
-	return &Keychains{db: db.Get()}
+func NewRepository(r *Keychains) *Keychains {
+	if r == nil {
+		r = &Keychains{}
+	}
+	r.db = db.Get()
+	return r
 }
 
 func (r *Keychains) GetAll() ([]*models.Keychain, error) {
 	var rows []*models.Keychain
-	ret := r.db.Order("created_at DESC").Find(&rows)
+	query := r.ACL(r.db.Order("created_at DESC"))
 
+	ret := query.Find(&rows)
 	return rows, ret.Error
 }
 
@@ -25,7 +34,9 @@ func (r *Keychains) Create(item *models.Keychain) error {
 
 func (r *Keychains) Get(id string) (*models.Keychain, error) {
 	var keychain models.Keychain
-	if err := r.db.Where("id = ?", id).First(&keychain).Error; err != nil {
+	query := r.ACL(r.db.Where("id = ?", id))
+
+	if err := query.First(&keychain).Error; err != nil {
 		return nil, err
 	}
 
@@ -34,7 +45,8 @@ func (r *Keychains) Get(id string) (*models.Keychain, error) {
 
 func (r *Keychains) Exists(id string) (bool, error) {
 	var count int64
-	ret := r.db.Model(&models.Keychain{}).Where("id = ?", id).Count(&count)
+	query := r.ACL(r.db.Model(&models.Keychain{}).Where("id = ?", id))
+	ret := query.Count(&count)
 	return count > 0, ret.Error
 }
 
@@ -58,5 +70,14 @@ func (r *Keychains) GetDecrypted(id string) (*KeychainDecrypted, error) {
 }
 
 func (r *Keychains) Update(id string, item *models.Keychain) error {
-	return r.db.Where("id = ?", id).Updates(item).Error
+	query := r.ACL(r.db.Where("id = ?", id))
+	return query.Updates(item).Error
+}
+
+func (r *Keychains) ACL(query *gorm.DB) *gorm.DB {
+	if r.User.IsAdmin {
+		return query
+	}
+
+	return query.Where("keychains.owner_id = ?", r.User.ID)
 }

server/app/keychains/router.go

@@ -9,7 +9,7 @@ import (
 	"rul.sh/vaulterm/utils"
 )
 
-func Router(app *fiber.App) {
+func Router(app fiber.Router) {
 	router := app.Group("/keychains")
 
 	router.Get("/", getAll)
@@ -25,7 +25,9 @@ type GetAllResult struct {
 func getAll(c *fiber.Ctx) error {
 	withData := c.Query("withData")
 
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Keychains{User: user})
+
 	rows, err := repo.GetAll()
 	if err != nil {
 		return utils.ResponseError(c, err, 500)
@@ -62,11 +64,13 @@ func create(c *fiber.Ctx) error {
 		return utils.ResponseError(c, err, 500)
 	}
 
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Keychains{User: user})
 
 	item := &models.Keychain{
-		Type:  body.Type,
-		Label: body.Label,
+		OwnerID: user.ID,
+		Type:    body.Type,
+		Label:   body.Label,
 	}
 
 	if err := item.EncryptData(body.Data); err != nil {
@@ -86,7 +90,9 @@ func update(c *fiber.Ctx) error {
 		return utils.ResponseError(c, err, 500)
 	}
 
-	repo := NewRepository()
+	user := utils.GetUser(c)
+	repo := NewRepository(&Keychains{User: user})
+
 	id := c.Params("id")
 
 	exist, _ := repo.Exists(id)