add login for api handler

.gitignore

@@ -1 +1,2 @@
 *.log
+*.db

accessHandler.go

@@ -0,0 +1,127 @@
+package AccessHandler
+
+import (
+	"gitea.tecamino.com/paadi/dbHandler"
+	"gitea.tecamino.com/paadi/tecamino-logger/logging"
+)
+
+// AccessHandler
+//
+// Description:
+//
+//	AccessHandler manages access-related functionality, including
+//	database operations for users and roles, as well as logging.
+//	It encapsulates a database handler and a logger so that
+//	authentication and authorization operations can be performed
+//	consistently across the application.
+type AccessHandler struct {
+	dbHandler *dbHandler.DBHandler // Database handler used for managing users and roles
+	logger    *logging.Logger      // Centralized application logger
+}
+
+// NewAccessHandler
+//
+// Description:
+//
+//	Creates and initializes a new AccessHandler instance.
+//
+// Behavior:
+//  1. If a logger is not provided (nil), it creates a new logger instance
+//     that writes to "accessHandler.log".
+//  2. Initializes the AccessHandler struct.
+//  3. Sets up the internal DBAHandler with the same logger.
+//  4. Automatically creates required database tables and default data:
+//     - User table
+//     - Default user(s)
+//     - Role table
+//     - Default role(s)
+//
+// Parameters:
+//   - dbPath: The file path to the database.
+//   - logger: Optional pointer to a logging.Logger instance. If nil, a new one is created.
+//
+// Returns:
+//   - aH:  A pointer to the fully initialized AccessHandler.
+//   - err: Any error that occurs during initialization.
+//
+// Example:
+//
+//	handler, err := NewAccessHandler("data/app.db", appLogger)
+//	if err != nil {
+//	    log.Fatal(err)
+//	}
+func NewAccessHandler(path string, logger *logging.Logger) (aH *AccessHandler, err error) {
+	if logger == nil {
+		logger, err = logging.NewLogger("accessHandler.log", nil)
+		if err != nil {
+			return
+		}
+	}
+
+	logger.Debug("NewAccessHandler", "initialize new access handler")
+
+	// Initialize AccessHandler with logger
+	aH = &AccessHandler{
+		logger: logger,
+	}
+
+	logger.Debug("NewAccessHandler", "initialize db handler")
+	// Create a new DB handler instance
+	aH.dbHandler, err = dbHandler.NewDBHandler(path, "user", logger)
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add user table")
+	// Add the user table to the database
+	err = aH.AddUserTable()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add default user")
+	// Add default users to the system
+	err = aH.AddDefaultUser()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add role table")
+	// Add the role table to the database
+	err = aH.AddRoleTable()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add default role")
+	// Add default roles to the system
+	err = aH.AddDefaultRole()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+	}
+
+	return
+}
+
+// GetLogger
+//
+// Description:
+//
+//	Returns the logger associated with this AccessHandler instance.
+//	Useful when another component or handler needs to reuse the
+//	same logging instance for consistent log output.
+//
+// Returns:
+//   - *logging.Logger: The logger assigned to this AccessHandler.
+//
+// Example:
+//
+//	log := accessHandler.GetLogger()
+//	log.Info("Some event")
+func (aH *AccessHandler) GetLogger() *logging.Logger {
+	return aH.logger
+}

accessHandlerAPI.go

@@ -0,0 +1,158 @@
+package AccessHandler
+
+import (
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"gitea.tecamino.com/paadi/dbHandler"
+	"gitea.tecamino.com/paadi/tecamino-logger/logging"
+)
+
+// AccessHandler
+//
+// Description:
+//
+//	AccessHandler manages access-related functionality, including
+//	database operations for users and roles, as well as logging.
+//	It encapsulates a database handler and a logger so that
+//	authentication and authorization operations can be performed
+//	consistently across the application.
+type AccessHandlerAPI struct {
+	dbHandler *dbHandler.DBHandler // Database handler used for managing users and roles
+	logger    *logging.Logger      // Centralized application logger
+}
+
+// NewAccessHandlerAPI
+//
+// Description:
+//
+//	Creates and initializes a new AccessHandler instance.
+//
+// Behavior:
+//  1. If a logger is not provided (nil), it creates a new logger instance
+//     that writes to "accessHandler.log".
+//  2. Initializes the AccessHandler struct.
+//  3. Sets up the internal DBAHandler with the same logger.
+//  4. Automatically creates required database tables and default data:
+//     - User table
+//     - Default user(s)
+//     - Role table
+//     - Default role(s)
+//
+// Parameters:
+//   - dbPath: The file path to the database.
+//   - logger: Optional pointer to a logging.Logger instance. If nil, a new one is created.
+//
+// Returns:
+//   - aH:  A pointer to the fully initialized AccessHandler.
+//   - err: Any error that occurs during initialization.
+//
+// Example:
+//
+//	handler, err := NewAccessHandlerAPI("data/app.db", appLogger)
+//	if err != nil {
+//	    log.Fatal(err)
+//	}
+func NewAccessHandlerAPI(path string, logger *logging.Logger) (aH *AccessHandlerAPI, err error) {
+	if logger == nil {
+		logger, err = logging.NewLogger("accessHandler.log", nil)
+		if err != nil {
+			return
+		}
+	}
+
+	logger.Debug("NewAccessHandlerAPI", "initialize new access handler")
+
+	// Initialize AccessHandler with logger
+	aH = &AccessHandlerAPI{
+		logger: logger,
+	}
+
+	logger.Debug("NewAccessHandlerAPI", "initialize db handler")
+	// Create a new DB handler instance
+	aH.dbHandler, err = dbHandler.NewDBHandler(path, "user", logger)
+	if err != nil {
+		aH.logger.Error("NewAccessHandlerAPI", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandlerAPI", "add user table")
+	// Add the user table to the database
+	err = aH.dbHandler.AddNewTable(models.User{})
+	if err != nil {
+		aH.logger.Error("NewAccessHandlerAPI", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandlerAPI", "add default user")
+	// Add default users to the system
+	name := "admin"
+	role := "admin"
+	email := "zuercher@tecamino.ch"
+
+	// Check if a user with this email already exists
+	if err := aH.dbHandler.Exists(&models.User{}, "email", email, false); err == nil {
+		aH.logger.Debug("AddDefaultUser", "user email "+email+" exists already")
+		// Found a user → skip create
+	} else {
+		// Create default settings for the new user
+		settings := models.Settings{}
+		aH.logger.Debug("AddDefaultUser", "set default quasar settings")
+		settings.DefaultQuasarSettings()
+
+		// Insert default admin user into the database
+		aH.dbHandler.AddNewColum(&models.User{
+			Name:     name,
+			Role:     role,
+			Email:    email,
+			Password: "$2a$10$sZZOWBP8DSFLrLFQNoXw8OsEEr0tez1B8lPzKCHofaHg6PMNxx1pG",
+			Settings: settings,
+		})
+	}
+
+	logger.Debug("NewAccessHandlerAPI", "add role table")
+	// Add the role table to the database
+	err = aH.dbHandler.AddNewTable(models.Role{})
+	if err != nil {
+		aH.logger.Error("NewAccessHandlerAPI", err)
+		return
+	}
+
+	// Add default roles to the system
+	logger.Debug("NewAccessHandlerAPI", "add default role")
+
+	// Check if a role with this name already exists
+	if err := aH.dbHandler.Exists(&models.Role{}, "role", role, false); err == nil {
+		// Found a role → skip creation
+		aH.logger.Debug("AddDefaultRole", "role "+role+" exists already")
+	} else {
+		// Initialize default permissions for admin
+		permissions := models.Permissions{}
+		aH.logger.Debug("AddDefaultRole", "set default Permissions")
+		permissions.DefaultPermissions()
+
+		// Create the default admin role
+		aH.dbHandler.AddNewColum(&models.Role{
+			Role:        role,
+			Permissions: permissions,
+		})
+	}
+	return
+}
+
+// GetLogger
+//
+// Description:
+//
+//	Returns the logger associated with this AccessHandler instance.
+//	Useful when another component or handler needs to reuse the
+//	same logging instance for consistent log output.
+//
+// Returns:
+//   - *logging.Logger: The logger assigned to this AccessHandler.
+//
+// Example:
+//
+//	log := accessHandler.GetLogger()
+//	log.Info("Some event")
+func (aH *AccessHandlerAPI) GetLogger() *logging.Logger {
+	return aH.logger
+}

api.go

@@ -0,0 +1,305 @@
+package AccessHandler
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"gitea.tecamino.com/paadi/access-handler/utils"
+	"github.com/gin-gonic/gin"
+)
+
+func (aH *AccessHandlerAPI) AddUser(c *gin.Context) {
+	var user models.User
+	err := c.BindJSON(&user)
+	if err != nil {
+		aH.logger.Error("AddUser", err)
+		c.JSON(http.StatusInternalServerError, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if !user.IsValid() {
+		aH.logger.Error("AddUser", "user empty")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
+		return
+	}
+
+	// Check if a user with this email already exists
+	if err := aH.dbHandler.Exists(&models.User{}, "email", user.Email, false); err == nil {
+		// Found a user → skip create
+		aH.logger.Error("AddUser", "user with email "+user.Email+" already exists")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse(fmt.Sprintf("user with email %s already exists", user.Email)))
+		return
+	}
+
+	hash, err := utils.HashPassword(user.Password)
+	if err != nil {
+		aH.logger.Error("AddUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	if !utils.IsValidEmail(user.Email) {
+		aH.logger.Error("AddUser", "not valid email address")
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(errors.New("not valid email address")))
+		return
+	}
+
+	// Hash the provided password before saving
+	hash, err = utils.HashPassword(user.Password)
+	if err != nil {
+		aH.logger.Error("AddUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	aH.logger.Debug("AddUser", "add new user "+user.Name+" with role "+user.Role)
+
+	// Insert the new user record
+	aH.dbHandler.AddNewColum(&models.User{
+		Name:     user.Name,
+		Role:     user.Role,
+		Email:    user.Email,
+		Password: hash,
+	})
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("user '%s' successfully added", user.Name),
+	})
+}
+
+func (aH *AccessHandlerAPI) GetUser(c *gin.Context) {
+	var i int
+	var err error
+
+	id := c.Query("id")
+	if id != "" {
+		i, err = strconv.Atoi(id)
+		if err != nil {
+			aH.logger.Error("GetUser", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	}
+
+	var users []models.User
+	err = aH.dbHandler.GetById(&users, uint(i))
+	if err != nil {
+		aH.logger.Error("GetUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, users)
+}
+
+func (aH *AccessHandlerAPI) UpdateUser(c *gin.Context) {
+	var user models.User
+	if err := c.BindJSON(&user); err != nil {
+		aH.logger.Error("UpdateUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	err := aH.dbHandler.UpdateValuesById(&user, user.Id)
+	if err != nil {
+		aH.logger.Error("UpdateUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, models.NewJsonMessageResponse("successfully updated user '"+user.Email+"'"))
+
+}
+
+func (aH *AccessHandlerAPI) DeleteUser(c *gin.Context) {
+	queryId := c.Query("id")
+
+	if queryId == "" || queryId == "null" || queryId == "undefined" {
+		aH.logger.Error("DeleteUser", "id query missing or wrong value: "+queryId)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "id query missing or wrong value: " + queryId,
+		})
+		return
+	}
+
+	var request struct {
+		Ids []int `json:"ids"`
+	}
+
+	err := c.BindJSON(&request)
+	if err != nil {
+		aH.logger.Error("DeleteUser", "id query missing or wrong value: "+queryId)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	if len(request.Ids) == 0 {
+		aH.logger.Error("DeleteUser", "no ids given to be deleted")
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "no ids given to be deleted",
+		})
+		return
+	}
+
+	var ownId string
+	removeIds := make([]uint, len(request.Ids))
+	for i, id := range request.Ids {
+		if queryId == fmt.Sprint(id) {
+			ownId = queryId
+			continue
+		}
+		removeIds[i] = uint(id)
+	}
+
+	if ownId != "" {
+		aH.logger.Error("DeleteUser", "can not delete logged in member id: "+queryId)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "can not delete logged in member id: " + queryId,
+			"id":      queryId,
+		})
+		return
+	}
+
+	err = aH.dbHandler.DeleteById(&models.User{}, removeIds...)
+	if err != nil {
+		aH.logger.Error("DeleteUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "member(s) deleted",
+	})
+}
+
+func (aH *AccessHandlerAPI) AddRole(c *gin.Context) {
+	var role models.Role
+	err := c.BindJSON(&role)
+	if err != nil {
+		aH.logger.Error("AddRole", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if !role.IsValid() {
+		aH.logger.Error("AddRole", "user empty")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
+		return
+	}
+
+	// Check if a role with this name already exists
+	if err := aH.dbHandler.Exists(&models.Role{}, "role", role, false); err == nil {
+		aH.logger.Error("AddRole", fmt.Sprintf("role with name %s already exists", role.Role))
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse(fmt.Sprintf("role with name %s already exists", role.Role)))
+	}
+
+	// Insert new role with provided permissions
+	aH.dbHandler.AddNewColum(&models.Role{
+		Role:        role.Role,
+		Permissions: role.Permissions,
+	})
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("role '%s' successfully added", role.Role),
+	})
+}
+
+func (aH *AccessHandlerAPI) GetRole(c *gin.Context) {
+	var i int
+	var err error
+
+	id := c.Query("id")
+	if id != "" {
+		i, err = strconv.Atoi(id)
+		if err != nil {
+			aH.logger.Error("GetRole", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	}
+
+	var role []models.Role
+	err = aH.dbHandler.GetById(&role, uint(i))
+	if err != nil {
+		aH.logger.Error("GetRole", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, role)
+}
+
+func (aH *AccessHandlerAPI) UpdateRole(c *gin.Context) {
+	var role models.Role
+	if err := c.BindJSON(&role); err != nil {
+		aH.logger.Error("UpdateRole", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	err := aH.dbHandler.UpdateValuesById(&role, role.Id)
+	if err != nil {
+		aH.logger.Error("UpdateRole", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, models.NewJsonMessageResponse("successfully updated role '"+role.Role+"'"))
+}
+
+func (aH *AccessHandlerAPI) DeleteRole(c *gin.Context) {
+	queryId := c.Query("id")
+
+	if queryId == "" || queryId == "null" || queryId == "undefined" {
+		aH.logger.Error("DeleteRole", "id query missing or wrong value: "+queryId)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "id query missing or wrong value: " + queryId,
+		})
+		return
+	}
+
+	var request struct {
+		Ids []int `json:"ids"`
+	}
+
+	err := c.BindJSON(&request)
+	if err != nil {
+		aH.logger.Error("DeleteRole", "id query missing or wrong value: "+queryId)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	if len(request.Ids) == 0 {
+		aH.logger.Error("DeleteRole", "no ids given to be deleted")
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "no ids given to be deleted",
+		})
+		return
+	}
+
+	var ownId string
+	removeIds := make([]uint, len(request.Ids))
+	for i, id := range request.Ids {
+		if queryId == fmt.Sprint(id) {
+			ownId = queryId
+			continue
+		}
+		removeIds[i] = uint(id)
+	}
+
+	if ownId != "" {
+		aH.logger.Error("DeleteRole", "can not delete logged in member role id: "+queryId)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "can not delete logged in member id: " + queryId,
+			"id":      queryId,
+		})
+		return
+	}
+
+	err = aH.dbHandler.DeleteById(&models.Role{}, removeIds...)
+	if err != nil {
+		aH.logger.Error("DeleteRole", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "role(s) deleted",
+	})
+}

db_test.go

@@ -7,7 +7,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"gitea.tecamino.com/paadi/AccessHandler/models"
+	"gitea.tecamino.com/paadi/access-handler/models"
 
 	"github.com/gin-gonic/gin"
 	"github.com/go-playground/assert/v2"
@@ -17,7 +17,7 @@ func TestAccesshandlerLogin(t *testing.T) {
 	t.Log("start access handler test")
 
 	t.Log("initialize accessHandler")
-	accessHandler, err := NewAccessHandler("test.db", nil)
+	accessHandler, err := NewAccessHandler(".", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -99,7 +99,7 @@ func TestLoginHandler(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 
 	// Setup your AccessHandler and router
-	aH, err := NewAccessHandler("test.db", nil)
+	aH, err := NewAccessHandler(".", nil)
 	if err != nil {
 		t.Fatal(err)
 	}

go.mod

@@ -1,15 +1,14 @@
-module gitea.tecamino.com/paadi/AccessHandler
+module gitea.tecamino.com/paadi/access-handler
 
 go 1.24.5
 
 require (
+	gitea.tecamino.com/paadi/dbHandler v1.0.2
 	gitea.tecamino.com/paadi/tecamino-logger v0.2.1
 	github.com/gin-gonic/gin v1.11.0
-	github.com/glebarez/sqlite v1.11.0
 	github.com/go-playground/assert/v2 v2.2.0
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	golang.org/x/crypto v0.43.0
-	gorm.io/gorm v1.31.0
 )
 
 require (
@@ -20,6 +19,7 @@ require (
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/glebarez/go-sqlite v1.21.2 // indirect
+	github.com/glebarez/sqlite v1.11.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.27.0 // indirect
@@ -52,6 +52,7 @@ require (
 	golang.org/x/tools v0.37.0 // indirect
 	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gorm.io/gorm v1.31.0 // indirect
 	modernc.org/libc v1.22.5 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
 	modernc.org/memory v1.5.0 // indirect

go.sum

@@ -1,3 +1,5 @@
+gitea.tecamino.com/paadi/dbHandler v1.0.2 h1:5d3sWIFY6JQLX0PGSTsxcvZFCSNTgtx4lHTX5lwF2H8=
+gitea.tecamino.com/paadi/dbHandler v1.0.2/go.mod h1:y/xn/POJg1DO++67uKvnO23lJQgh+XFQq7HZCS9Getw=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1 h1:sQTBKYPdzn9mmWX2JXZBtGBvNQH7cuXIwsl4TD0aMgE=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1/go.mod h1:FkzRTldUBBOd/iy2upycArDftSZ5trbsX5Ira5OzJgM=
 github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=

login.go

@@ -0,0 +1,243 @@
+package AccessHandler
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"gitea.tecamino.com/paadi/access-handler/utils"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// -----------------------------
+// 🔐 AUTHENTICATION CONSTANTS
+// -----------------------------
+
+// JWT secrets (replace "*" with strong random values in production!)
+var ACCESS_SECRET = []byte("ShFRprALcXjlosJ2hFCnGYGG3Ce2uRx6")
+var REFRESH_SECRET = []byte("pQIjuX6g6Tzf0FEfdScxttT3hlL9NFaa")
+
+// DOMAIN defines where cookies are valid. Change this in production.
+var DOMAIN = "localhost"
+
+// ACCESS_TOKEN_TIME defines how long access tokens are valid.
+var ACCESS_TOKEN_TIME = 15 * time.Minute
+
+// REFRESH_TOKEN_TIME defines how long refresh tokens are valid.
+var REFRESH_TOKEN_TIME = 72 * time.Hour
+
+// -----------------------------
+// 🧠 HANDLERS
+// -----------------------------
+
+// Login authenticates a user and returns JWT tokens (access + refresh).
+func (aH *AccessHandler) Login(c *gin.Context) {
+	var user models.User
+
+	aH.logger.Debug("Login", "bind JSON request")
+	if err := c.BindJSON(&user); err != nil {
+		aH.logger.Error("Login", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	// Validate input
+	if !user.IsValid() {
+		aH.logger.Error("Login", "user empty")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
+		return
+	}
+
+	// Fetch user record from DB
+	dbRecord, err := aH.GetUserByKey("user_name", user.Name, false)
+	if err != nil {
+		aH.logger.Error("Login", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if len(dbRecord) > 1 {
+		log.Println("multiple users found")
+		aH.logger.Error("Login", "more than one record found")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
+		return
+	}
+
+	// Check password
+	if !utils.CheckPassword(user.Password, dbRecord[0].Password) {
+		aH.logger.Error("Login", "invalid password")
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+	user = dbRecord[0]
+
+	// -----------------------------
+	// 🔑 TOKEN CREATION
+	// -----------------------------
+	aH.logger.Debug("Login", "create tokens")
+
+	accessTokenExp := time.Now().Add(ACCESS_TOKEN_TIME)
+	refreshTokenExp := time.Now().Add(REFRESH_TOKEN_TIME)
+
+	// Create access token
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"id":       user.Id,
+		"username": user.Name,
+		"role":     user.Role,
+		"type":     "access",
+		"exp":      accessTokenExp.Unix(),
+	})
+
+	// Create refresh token
+	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"id":       user.Id,
+		"username": user.Name,
+		"role":     user.Role,
+		"type":     "refresh",
+		"exp":      refreshTokenExp.Unix(),
+	})
+
+	// Sign tokens
+	accessString, err := accessToken.SignedString(ACCESS_SECRET)
+	if err != nil {
+		aH.logger.Error("Login", "failed to sign access token")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("could not create access token"))
+		return
+	}
+
+	refreshString, err := refreshToken.SignedString(REFRESH_SECRET)
+	if err != nil {
+		aH.logger.Error("Login", "failed to sign refresh token")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("could not create refresh token"))
+		return
+	}
+
+	// -----------------------------
+	// 🍪 SET COOKIES
+	// -----------------------------
+	aH.logger.Debug("Login", "set cookies")
+
+	secure := gin.Mode() == gin.ReleaseMode
+
+	c.SetCookie("access_token", accessString, int(time.Until(accessTokenExp).Seconds()),
+		"/", "", secure, true)
+	c.SetCookie("refresh_token", refreshString, int(time.Until(refreshTokenExp).Seconds()),
+		"/", "", secure, true)
+
+	aH.logger.Info("Login", "user "+user.Name+" logged in successfully")
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":  "login successful",
+		"id":       user.Id,
+		"user":     user.Name,
+		"role":     user.Role,
+		"settings": user.Settings,
+	})
+}
+
+// Refresh generates a new access token from a valid refresh token.
+func (aH *AccessHandler) Refresh(c *gin.Context) {
+	aH.logger.Debug("Refresh", "get refresh cookie")
+
+	refreshCookie, err := c.Cookie("refresh_token")
+	if err != nil {
+		aH.logger.Error("Refresh", "no refresh token")
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "no refresh token"})
+		return
+	}
+
+	// Validate token
+	aH.logger.Debug("Refresh", "parse token")
+	token, err := jwt.Parse(refreshCookie, func(token *jwt.Token) (any, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return REFRESH_SECRET, nil
+	})
+	if err != nil || !token.Valid {
+		aH.logger.Error("Refresh", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "invalid refresh token"})
+		return
+	}
+
+	// Extract claims
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok || claims["type"] != "refresh" {
+		aH.logger.Error("Refresh", "invalid token type")
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "invalid token type"})
+		return
+	}
+
+	username := claims["username"].(string)
+	id := int(claims["id"].(float64))
+	role := claims["role"].(string)
+
+	// Create new access token
+	aH.logger.Debug("Refresh", "create new access token")
+	accessExp := time.Now().Add(ACCESS_TOKEN_TIME)
+	newAccess := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"id":       id,
+		"username": username,
+		"role":     role,
+		"exp":      accessExp.Unix(),
+	})
+	accessString, _ := newAccess.SignedString(ACCESS_SECRET)
+
+	// Set new access cookie
+	aH.logger.Debug("Refresh", "set new access cookie")
+	c.SetCookie("access_token", accessString, int(time.Until(accessExp).Seconds()),
+		"/", DOMAIN, gin.Mode() == gin.ReleaseMode, true)
+
+	c.JSON(http.StatusOK, gin.H{"message": "token refreshed"})
+}
+
+// Me returns information about the currently authenticated user.
+func (aH *AccessHandler) Me(c *gin.Context) {
+	aH.logger.Debug("Me", "get access cookie")
+
+	cookie, err := c.Cookie("access_token")
+	if err != nil {
+		aH.logger.Error("Me", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "not logged in"})
+		return
+	}
+
+	// Parse and validate access token
+	aH.logger.Debug("Me", "parse token")
+	token, err := jwt.Parse(cookie, func(t *jwt.Token) (any, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
+		}
+		return ACCESS_SECRET, nil
+	})
+	if err != nil || !token.Valid {
+		aH.logger.Error("Me", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "invalid token"})
+		return
+	}
+
+	claims := token.Claims.(jwt.MapClaims)
+	c.JSON(http.StatusOK, gin.H{
+		"id":   claims["id"],
+		"user": claims["username"],
+		"role": claims["role"],
+	})
+}
+
+// Logout clears authentication cookies and ends the session.
+func (aH *AccessHandler) Logout(c *gin.Context) {
+	aH.logger.Info("Logout", "logout user")
+
+	secure := gin.Mode() == gin.ReleaseMode
+	aH.logger.Debug("Logout", fmt.Sprintf("domain=%s secure=%t", DOMAIN, secure))
+
+	// Clear cookies
+	c.SetCookie("access_token", "", -1, "/", DOMAIN, secure, true)
+	c.SetCookie("refresh_token", "", -1, "/", DOMAIN, secure, true)
+
+	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
+}

loginApi.go

@@ -0,0 +1,227 @@
+package AccessHandler
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"gitea.tecamino.com/paadi/access-handler/utils"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// -----------------------------
+// 🧠 HANDLERS
+// -----------------------------
+
+// Login authenticates a user and returns JWT tokens (access + refresh).
+func (aH *AccessHandlerAPI) Login(c *gin.Context) {
+	var user models.User
+
+	aH.logger.Debug("Login", "bind JSON request")
+	if err := c.BindJSON(&user); err != nil {
+		aH.logger.Error("Login", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	// Validate input
+	if !user.IsValid() {
+		aH.logger.Error("Login", "user empty")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
+		return
+	}
+
+	// Fetch user record from DB
+	var dbRecord []models.User
+	err := aH.dbHandler.GetByKey(&dbRecord, "user_name", user.Name, false)
+	if err != nil {
+		aH.logger.Error("Login", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if len(dbRecord) > 1 {
+		log.Println("multiple users found")
+		aH.logger.Error("Login", "more than one record found")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
+		return
+	}
+
+	// Check password
+	if !utils.CheckPassword(user.Password, dbRecord[0].Password) {
+		aH.logger.Error("Login", "invalid password")
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+	user = dbRecord[0]
+
+	// -----------------------------
+	// 🔑 TOKEN CREATION
+	// -----------------------------
+	aH.logger.Debug("Login", "create tokens")
+
+	accessTokenExp := time.Now().Add(ACCESS_TOKEN_TIME)
+	refreshTokenExp := time.Now().Add(REFRESH_TOKEN_TIME)
+
+	// Create access token
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"id":       user.Id,
+		"username": user.Name,
+		"role":     user.Role,
+		"type":     "access",
+		"exp":      accessTokenExp.Unix(),
+	})
+
+	// Create refresh token
+	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"id":       user.Id,
+		"username": user.Name,
+		"role":     user.Role,
+		"type":     "refresh",
+		"exp":      refreshTokenExp.Unix(),
+	})
+
+	// Sign tokens
+	accessString, err := accessToken.SignedString(ACCESS_SECRET)
+	if err != nil {
+		aH.logger.Error("Login", "failed to sign access token")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("could not create access token"))
+		return
+	}
+
+	refreshString, err := refreshToken.SignedString(REFRESH_SECRET)
+	if err != nil {
+		aH.logger.Error("Login", "failed to sign refresh token")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("could not create refresh token"))
+		return
+	}
+
+	// -----------------------------
+	// 🍪 SET COOKIES
+	// -----------------------------
+	aH.logger.Debug("Login", "set cookies")
+
+	secure := gin.Mode() == gin.ReleaseMode
+
+	c.SetCookie("access_token", accessString, int(time.Until(accessTokenExp).Seconds()),
+		"/", "", secure, true)
+	c.SetCookie("refresh_token", refreshString, int(time.Until(refreshTokenExp).Seconds()),
+		"/", "", secure, true)
+
+	aH.logger.Info("Login", "user "+user.Name+" logged in successfully")
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":  "login successful",
+		"id":       user.Id,
+		"user":     user.Name,
+		"role":     user.Role,
+		"settings": user.Settings,
+	})
+}
+
+// Refresh generates a new access token from a valid refresh token.
+func (aH *AccessHandlerAPI) Refresh(c *gin.Context) {
+	aH.logger.Debug("Refresh", "get refresh cookie")
+
+	refreshCookie, err := c.Cookie("refresh_token")
+	if err != nil {
+		aH.logger.Error("Refresh", "no refresh token")
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "no refresh token"})
+		return
+	}
+
+	// Validate token
+	aH.logger.Debug("Refresh", "parse token")
+	token, err := jwt.Parse(refreshCookie, func(token *jwt.Token) (any, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return REFRESH_SECRET, nil
+	})
+	if err != nil || !token.Valid {
+		aH.logger.Error("Refresh", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "invalid refresh token"})
+		return
+	}
+
+	// Extract claims
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok || claims["type"] != "refresh" {
+		aH.logger.Error("Refresh", "invalid token type")
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "invalid token type"})
+		return
+	}
+
+	username := claims["username"].(string)
+	id := int(claims["id"].(float64))
+	role := claims["role"].(string)
+
+	// Create new access token
+	aH.logger.Debug("Refresh", "create new access token")
+	accessExp := time.Now().Add(ACCESS_TOKEN_TIME)
+	newAccess := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"id":       id,
+		"username": username,
+		"role":     role,
+		"exp":      accessExp.Unix(),
+	})
+	accessString, _ := newAccess.SignedString(ACCESS_SECRET)
+
+	// Set new access cookie
+	aH.logger.Debug("Refresh", "set new access cookie")
+	c.SetCookie("access_token", accessString, int(time.Until(accessExp).Seconds()),
+		"/", DOMAIN, gin.Mode() == gin.ReleaseMode, true)
+
+	c.JSON(http.StatusOK, gin.H{"message": "token refreshed"})
+}
+
+// Me returns information about the currently authenticated user.
+func (aH *AccessHandlerAPI) Me(c *gin.Context) {
+	aH.logger.Debug("Me", "get access cookie")
+
+	cookie, err := c.Cookie("access_token")
+	if err != nil {
+		aH.logger.Error("Me", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "not logged in"})
+		return
+	}
+
+	// Parse and validate access token
+	aH.logger.Debug("Me", "parse token")
+	token, err := jwt.Parse(cookie, func(t *jwt.Token) (any, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
+		}
+		return ACCESS_SECRET, nil
+	})
+	if err != nil || !token.Valid {
+		aH.logger.Error("Me", err)
+		c.JSON(http.StatusUnauthorized, gin.H{"message": "invalid token"})
+		return
+	}
+
+	claims := token.Claims.(jwt.MapClaims)
+	c.JSON(http.StatusOK, gin.H{
+		"id":   claims["id"],
+		"user": claims["username"],
+		"role": claims["role"],
+	})
+}
+
+// Logout clears authentication cookies and ends the session.
+func (aH *AccessHandlerAPI) Logout(c *gin.Context) {
+	aH.logger.Info("Logout", "logout user")
+
+	secure := gin.Mode() == gin.ReleaseMode
+	aH.logger.Debug("Logout", fmt.Sprintf("domain=%s secure=%t", DOMAIN, secure))
+
+	// Clear cookies
+	c.SetCookie("access_token", "", -1, "/", DOMAIN, secure, true)
+	c.SetCookie("refresh_token", "", -1, "/", DOMAIN, secure, true)
+
+	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
+}

middleware.go

@@ -0,0 +1,165 @@
+package AccessHandler
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+
+	"gitea.tecamino.com/paadi/tecamino-logger/logging"
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// SetMiddlewareLogger
+//
+// Description:
+//
+//	Registers a Gin middleware that attaches a custom logger instance
+//	to every incoming request via the Gin context. This allows other
+//	middleware and handlers to access the logger using:
+//
+//	    logger := c.MustGet("logger").(*logging.Logger)
+//
+// Parameters:
+//   - r:      The Gin engine to which the middleware is applied.
+//   - logger: A pointer to the application's custom logger.
+//
+// Usage:
+//
+//	SetMiddlewareLogger(router, logger)
+func SetMiddlewareLogger(r *gin.Engine, logger *logging.Logger) {
+	// Add middleware that injects logger into context
+	r.Use(func(c *gin.Context) {
+		c.Set("logger", logger)
+		c.Next()
+	})
+}
+
+// AuthMiddleware
+//
+// Description:
+//
+//	A Gin middleware that performs authentication using a JWT token stored
+//	in a cookie named "access_token". It validates the token and extracts
+//	the user's role from the claims, storing it in the Gin context.
+//
+// Behavior:
+//   - Requires that SetMiddlewareLogger was used earlier to inject the logger.
+//   - If the JWT cookie is missing or invalid, it aborts the request with
+//     an appropriate HTTP error (401 or 500).
+//
+// Returns:
+//
+//	A Gin handler function that can be used as middleware.
+//
+// Usage:
+//
+//	r.Use(AuthMiddleware())
+func AuthMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// Retrieve logger from Gin context
+		middlewareLogger, ok := c.Get("logger")
+		if !ok {
+			log.Fatal("middleware logger not set — use SetMiddlewareLogger first")
+			c.AbortWithStatusJSON(http.StatusInternalServerError, http.StatusInternalServerError)
+			return
+		}
+		logger := middlewareLogger.(*logging.Logger)
+
+		// Read access token from cookie
+		cookie, err := c.Cookie("access_token")
+		if err != nil {
+			logger.Error("AuthMiddleware", err)
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "not logged in"})
+			return
+		}
+
+		// Parse and validate JWT token
+		token, err := jwt.Parse(cookie, func(t *jwt.Token) (any, error) {
+			return ACCESS_SECRET, nil
+		})
+		if err != nil || !token.Valid {
+			logger.Error("AuthMiddleware", err)
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "invalid token"})
+			return
+		}
+
+		// Extract custom claims (role)
+		if claims, ok := token.Claims.(jwt.MapClaims); ok {
+			role, _ := claims["role"].(string)
+			c.Set("role", role)
+		}
+		c.Next()
+	}
+}
+
+// (AccessHandler).AuthorizeRole
+//
+// Description:
+//
+//	A role-based authorization middleware. It checks whether the authenticated
+//	user (based on the "role" set in AuthMiddleware) has permission to access
+//	the given route. The check is performed by comparing the requested URL
+//	path against the user’s allowed permissions.
+//
+// Parameters:
+//   - suffix: A URL prefix to trim from the request path before matching
+//     permissions (e.g., "/api/v1").
+//
+// Behavior:
+//   - Fetches the user role from Gin context.
+//   - Uses aH.GetRoleByKey() to retrieve role records and permissions.
+//   - Grants access (calls c.Next()) if a matching permission is found.
+//   - Denies access (401 Unauthorized) if no permission matches.
+//
+// Usage:
+//
+//	router.GET("/secure/:id", aH.AuthorizeRole("/api/v1"))
+func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		aH.logger.Debug("AuthorizeRole", "permission path of url path")
+		permissionPath := strings.TrimPrefix(c.Request.URL.Path, suffix+"/")
+
+		aH.logger.Debug("AuthorizeRole", "get set role")
+		role, ok := c.Get("role")
+		if !ok {
+			aH.logger.Error("AuthorizeRole", "no role set")
+			c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"message": http.StatusInternalServerError})
+			return
+		}
+
+		// Fetch roles and associated permissions from the database or store
+		roles, err := aH.GetRoleByKey("role", role, false)
+		if err != nil {
+			aH.logger.Error("AuthorizeRole", err)
+			c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"message": http.StatusInternalServerError})
+			return
+		}
+
+		// Validate that a role was found
+		if len(roles) == 0 {
+			log.Println("not logged in")
+			aH.logger.Error("AuthorizeRole", "no logged in")
+			c.JSON(http.StatusUnauthorized, http.StatusUnauthorized)
+			return
+		} else if len(roles) > 1 {
+			aH.logger.Error("AuthorizeRole", "more than one record found")
+			c.JSON(http.StatusInternalServerError, http.StatusInternalServerError)
+			return
+		}
+
+		// Check permissions
+		for _, permission := range roles[0].Permissions {
+			fmt.Println(100, permissionPath, permission.Name)
+			if permission.Name == permissionPath {
+				c.Next()
+				return
+			}
+		}
+
+		// Access denied
+		aH.logger.Error("AuthorizeRole", "Forbidden")
+		c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "Forbidden"})
+	}
+}

models/role.go

@@ -5,3 +5,7 @@ type Role struct {
 	Role        string      `gorm:"column:role" json:"role"`
 	Permissions Permissions `gorm:"type:json" json:"permissions"`
 }
+
+func (r *Role) IsValid() bool {
+	return r.Role != ""
+}

role.go

@@ -0,0 +1,197 @@
+package AccessHandler
+
+import (
+	"fmt"
+
+	"gitea.tecamino.com/paadi/access-handler/models"
+)
+
+// AddRoleTable
+//
+// Description:
+//
+//	Creates a new database table for storing role definitions if it does not already exist.
+//
+// Behavior:
+//   - Uses the DBHandler to add a table based on the `models.Role` struct.
+//   - Returns an error if table creation fails.
+//
+// Returns:
+//   - error: Any database error encountered.
+func (aH *AccessHandler) AddRoleTable() error {
+	return aH.dbHandler.AddNewTable(models.Role{})
+}
+
+// AddDefaultRole
+//
+// Description:
+//
+//	Ensures that a default administrative role exists in the database.
+//	If a role named "admin" is already present, it logs and skips creation.
+//
+// Behavior:
+//  1. Checks for an existing "admin" role.
+//  2. If not found, initializes default permissions using
+//     `models.Permissions.DefaultPermissions()`.
+//  3. Creates a new role record with those permissions.
+//
+// Default Role:
+//   - Role: "admin"
+//   - Permissions: all default permissions defined in `models.Permissions`.
+//
+// Returns:
+//   - error: Any database or creation error encountered.
+func (aH *AccessHandler) AddDefaultRole() (err error) {
+	role := "admin"
+
+	// Check if a role with this name already exists
+	if err := aH.dbHandler.Exists(&models.Role{}, "role", role, false); err == nil {
+		// Found a role → skip creation
+		aH.logger.Debug("AddDefaultRole", "role "+role+" exists already")
+		return nil
+	}
+
+	// Initialize default permissions for admin
+	permissions := models.Permissions{}
+	aH.logger.Debug("AddDefaultRole", "set default Permissions")
+	permissions.DefaultPermissions()
+
+	// Create the default admin role
+	aH.dbHandler.AddNewColum(&models.Role{
+		Role:        role,
+		Permissions: permissions,
+	})
+	return
+}
+
+// AddNewRole
+//
+// Description:
+//
+//	Adds a new role with a specific set of permissions to the database.
+//
+// Behavior:
+//  1. Checks whether a role with the same name already exists.
+//  2. If it does not exist, creates a new role record.
+//
+// Parameters:
+//   - role:        The role name (e.g., "manager", "viewer").
+//   - permissions: A `models.Permissions` struct defining allowed actions.
+//
+// Returns:
+//   - error: If the role already exists or insertion fails.
+func (aH *AccessHandler) AddNewRole(role string, permissions models.Permissions) (err error) {
+	// Check if a role with this name already exists
+	if err := aH.dbHandler.Exists(&models.Role{}, "role", role, false); err == nil {
+		// Found a role → skip creation
+		return fmt.Errorf("role with name %s already exists", role)
+	}
+
+	// Insert new role with provided permissions
+	aH.dbHandler.AddNewColum(&models.Role{
+		Role:        role,
+		Permissions: permissions,
+	})
+	return
+}
+
+// GetRoleById
+//
+// Description:
+//
+//	Retrieves a role record from the database by its numeric ID.
+//
+// Parameters:
+//   - id: The unique ID of the role.
+//
+// Returns:
+//   - roles: A slice containing the matched role (usually length 1).
+//   - err:   Any database error encountered.
+func (aH *AccessHandler) GetRoleById(id uint) (roles []models.Role, err error) {
+	err = aH.dbHandler.GetById(&roles, id)
+	return
+}
+
+// GetRoleByKey
+//
+// Description:
+//
+//	Retrieves one or more roles based on a key/value query.
+//
+// Parameters:
+//   - key:        The column name to search by (e.g., "role").
+//   - value:      The value to match (e.g., "admin").
+//   - likeSearch: Whether to use SQL LIKE for partial matches.
+//
+// Returns:
+//   - roles: A list of matched roles.
+//   - err:   Any database error encountered.
+func (aH *AccessHandler) GetRoleByKey(key string, value any, likeSearch bool) (roles []models.Role, err error) {
+	err = aH.dbHandler.GetByKey(&roles, key, value, likeSearch)
+	return
+}
+
+// UpdateRoleById
+//
+// Description:
+//
+//	Updates a role record identified by its numeric ID.
+//
+// Parameters:
+//   - id:   The ID of the role to update.
+//   - role: A struct containing updated role data.
+//
+// Returns:
+//   - error: Any database error encountered.
+func (aH *AccessHandler) UpdateRoleById(id uint, role models.Role) error {
+	return aH.dbHandler.UpdateValuesById(&role, id)
+}
+
+// UpdateRoleByKey
+//
+// Description:
+//
+//	Updates a role record using a column key/value lookup.
+//
+// Parameters:
+//   - role:  The updated role data.
+//   - key:   The column name to search by.
+//   - value: The value to match against the key column.
+//
+// Returns:
+//   - error: Any database error encountered.
+func (aH *AccessHandler) UpdateRoleByKey(role models.Role, key string, value any) error {
+	return aH.dbHandler.UpdateValuesByKey(&role, key, value)
+}
+
+// DeleteRoleById
+//
+// Description:
+//
+//	Deletes a role record from the database by its numeric ID.
+//
+// Parameters:
+//   - id: The ID of the role to delete.
+//
+// Returns:
+//   - error: Any database error encountered during deletion.
+func (aH *AccessHandler) DeleteRoleById(id uint) (err error) {
+	return aH.dbHandler.DeleteById(&models.Role{}, id)
+}
+
+// DeleteRoleByKey
+//
+// Description:
+//
+//	Deletes one or more roles from the database matching a given key/value pair.
+//
+// Parameters:
+//   - key:        The column name used for filtering (e.g., "role").
+//   - value:      The matching value (e.g., "admin").
+//   - likeSearch: If true, performs a LIKE (partial) match.
+//
+// Returns:
+//   - error: Any database error encountered.
+func (aH *AccessHandler) DeleteRoleByKey(key string, value any, likeSearch bool) (err error) {
+	return aH.dbHandler.DeleteByKey(&models.Role{}, key, value, likeSearch)
+}

user.go

@@ -0,0 +1,218 @@
+package AccessHandler
+
+import (
+	"fmt"
+
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"gitea.tecamino.com/paadi/access-handler/utils"
+)
+
+// AddUserTable
+//
+// Description:
+//
+//	Creates a new database table for storing user records if it does not already exist.
+//
+// Behavior:
+//   - Uses the DBHandler to add a table based on the `models.User` struct.
+//   - Returns any error encountered during table creation.
+//
+// Returns:
+//   - error: Any database error that occurs while creating the table.
+func (aH *AccessHandler) AddUserTable() error {
+	return aH.dbHandler.AddNewTable(models.User{})
+}
+
+// AddDefaultUser
+//
+// Description:
+//
+//	Ensures a default administrative user exists in the database.
+//	If a user with the predefined email already exists, the function logs
+//	a debug message and exits without making changes.
+//
+// Behavior:
+//  1. Checks if the default user (admin) already exists by email.
+//  2. If not found, creates default Quasar UI settings and adds the user.
+//
+// Default User:
+//   - Name:  "admin"
+//   - Role:  "admin"
+//   - Email: "zuercher@tecamino.ch"
+//   - Password: (empty or hashed later)
+//
+// Returns:
+//   - error: Any database or creation error encountered.
+func (aH *AccessHandler) AddDefaultUser() (err error) {
+	name := "admin"
+	role := "admin"
+	email := "zuercher@tecamino.ch"
+
+	// Check if a user with this email already exists
+	if err := aH.dbHandler.Exists(&models.User{}, "email", email, false); err == nil {
+		aH.logger.Debug("AddDefaultUser", "user email "+email+" exists already")
+		// Found a user → skip create
+		return nil
+	}
+
+	// Create default settings for the new user
+	settings := models.Settings{}
+	aH.logger.Debug("AddDefaultUser", "set default quasar settings")
+	settings.DefaultQuasarSettings()
+
+	// Insert default admin user into the database
+	aH.dbHandler.AddNewColum(&models.User{
+		Name:     name,
+		Role:     role,
+		Email:    email,
+		Password: "$2a$10$sZZOWBP8DSFLrLFQNoXw8OsEEr0tez1B8lPzKCHofaHg6PMNxx1pG",
+		Settings: settings,
+	})
+	return
+}
+
+// AddNewUser
+//
+// Description:
+//
+//	Adds a new user record to the database with a hashed password.
+//
+// Behavior:
+//  1. Verifies that the email does not already exist.
+//  2. Hashes the password using utils.HashPassword().
+//  3. Inserts the new user record into the database.
+//
+// Parameters:
+//   - userName: The user's display name.
+//   - email:    The user's unique email address.
+//   - password: The user's raw password (will be hashed).
+//   - role:     The role assigned to the user.
+//
+// Returns:
+//   - error: If the user already exists or if hashing/insertion fails.
+func (aH *AccessHandler) AddNewUser(userName, email, password, role string) (err error) {
+	// Check if a user with this email already exists
+	if err := aH.dbHandler.Exists(&models.User{}, "email", email, false); err == nil {
+		// Found a user → skip create
+		aH.logger.Error("AddNewUser", "user with email "+email+" already exists")
+		return fmt.Errorf("user with email %s already exists", email)
+	}
+
+	// Hash the provided password before saving
+	hash, err := utils.HashPassword(password)
+	if err != nil {
+		return err
+	}
+
+	aH.logger.Debug("AddNewUser", "add new user "+userName+" with role "+role)
+
+	// Insert the new user record
+	aH.dbHandler.AddNewColum(&models.User{
+		Name:     userName,
+		Role:     role,
+		Email:    email,
+		Password: hash,
+	})
+	return
+}
+
+// GetUserById
+//
+// Description:
+//
+//	Retrieves user(s) from the database by their unique ID.
+//
+// Parameters:
+//   - id: The numeric user ID.
+//
+// Returns:
+//   - users: A slice containing the matched user (usually length 1).
+//   - err:   Any database error encountered.
+func (aH *AccessHandler) GetUserById(id uint) (users []models.User, err error) {
+	err = aH.dbHandler.GetById(&users, id)
+	return
+}
+
+// GetUserByKey
+//
+// Description:
+//
+//	Queries users based on a given column key and value.
+//
+// Parameters:
+//   - key:        The column name to search by (e.g., "email").
+//   - value:      The value to match.
+//   - likeSearch: If true, performs a LIKE (partial) search.
+//
+// Returns:
+//   - users: A list of users that match the search criteria.
+//   - err:   Any database error encountered.
+func (aH *AccessHandler) GetUserByKey(key string, value any, likeSearch bool) (users []models.User, err error) {
+	err = aH.dbHandler.GetByKey(&users, key, value, likeSearch)
+	return
+}
+
+// UpdateUserById
+//
+// Description:
+//
+//	Updates an existing user record identified by its numeric ID.
+//
+// Parameters:
+//   - id:   The user ID to update.
+//   - user: A struct containing updated field values.
+//
+// Returns:
+//   - error: Any error encountered during the update.
+func (aH *AccessHandler) UpdateUserById(id uint, user models.User) error {
+	return aH.dbHandler.UpdateValuesById(&user, id)
+}
+
+// UpdateUserByKey
+//
+// Description:
+//
+//	Updates a user record based on a specified column key and value.
+//
+// Parameters:
+//   - user:       The updated user data.
+//   - key:        The column name used for lookup.
+//   - value:      The value to match against the key column.
+//
+// Returns:
+//   - error: Any error encountered during the update.
+func (aH *AccessHandler) UpdateUserByKey(user models.User, key string, value any) error {
+	return aH.dbHandler.UpdateValuesByKey(&user, key, value)
+}
+
+// DeleteUserById
+//
+// Description:
+//
+//	Deletes a user from the database using their numeric ID.
+//
+// Parameters:
+//   - id: The ID of the user to delete.
+//
+// Returns:
+//   - error: Any database error encountered during deletion.
+func (aH *AccessHandler) DeleteUserById(id uint) (err error) {
+	return aH.dbHandler.DeleteById(&models.User{}, id)
+}
+
+// DeleteUserByKey
+//
+// Description:
+//
+//	Deletes users matching a specific key/value pair from the database.
+//
+// Parameters:
+//   - key:        The column name to search by.
+//   - value:      The value to match.
+//   - likeSearch: Whether to use a partial match (LIKE).
+//
+// Returns:
+//   - error: Any database error encountered during deletion.
+func (aH *AccessHandler) DeleteUserByKey(key string, value any, likeSearch bool) (err error) {
+	return aH.dbHandler.DeleteByKey(&models.User{}, key, value, likeSearch)
+}

utils/utils.go

@@ -0,0 +1,8 @@
+package utils
+
+import "regexp"
+
+func IsValidEmail(email string) bool {
+	re := regexp.MustCompile(`^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`)
+	return re.MatchString(email)
+}