fix user defined exiration

go.mod

@@ -3,7 +3,7 @@ module gitea.tecamino.com/paadi/access-handler
 go 1.24.5
 
 require (
-	gitea.tecamino.com/paadi/dbHandler v1.0.4
+	gitea.tecamino.com/paadi/dbHandler v1.0.8
 	gitea.tecamino.com/paadi/tecamino-logger v0.2.1
 	github.com/gin-gonic/gin v1.11.0
 	github.com/go-playground/assert/v2 v2.2.0

go.sum

@@ -1,5 +1,5 @@
-gitea.tecamino.com/paadi/dbHandler v1.0.4 h1:ctnaec0GDdtw3gRQdUISVDYLJ9x+vt50VW41OemfhD4=
-gitea.tecamino.com/paadi/dbHandler v1.0.4/go.mod h1:y/xn/POJg1DO++67uKvnO23lJQgh+XFQq7HZCS9Getw=
+gitea.tecamino.com/paadi/dbHandler v1.0.8 h1:ZWSBM/KFtLwTv2cBqwK1mOxWAxAfL0BcWEC3kJ9JALU=
+gitea.tecamino.com/paadi/dbHandler v1.0.8/go.mod h1:y/xn/POJg1DO++67uKvnO23lJQgh+XFQq7HZCS9Getw=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1 h1:sQTBKYPdzn9mmWX2JXZBtGBvNQH7cuXIwsl4TD0aMgE=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1/go.mod h1:FkzRTldUBBOd/iy2upycArDftSZ5trbsX5Ira5OzJgM=
 github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=

handlers/login.go

@@ -60,12 +60,24 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 		return
 	}
 
+	if len(dbRecord) == 0 {
+		aH.logger.Error("Login", "no user "+user.Name+" found")
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+
 	if len(dbRecord) > 1 {
 		aH.logger.Error("Login", "more than one record found")
 		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
 		return
 	}
 
+	if !dbRecord[0].ExpirationIsValid() {
+		aH.logger.Error("Login", fmt.Sprintf("user %s is expired", user.Name))
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("user "+user.Name+" is expired"))
+		return
+	}
+
 	// Check password
 	if !utils.CheckPassword(user.Password, dbRecord[0].Password) {
 		aH.logger.Error("Login", "invalid password")
@@ -89,6 +101,7 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 		"role":           user.Role,
 		"type":           "access",
 		"exp":            accessTokenExp.Unix(),
+		"userExpiration": user.Expiration,
 	})
 
 	// Create refresh token
@@ -98,6 +111,7 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 		"role":           user.Role,
 		"type":           "refresh",
 		"exp":            refreshTokenExp.Unix(),
+		"userExpiration": user.GetExpiration(),
 	})
 
 	// Sign tokens
@@ -175,6 +189,13 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 	id := int(claims["id"].(float64))
 	role := claims["role"].(string)
 
+	if !expirationDateValid(claims["userExpiration"].(string)) {
+		aH.Logout(c)
+		aH.logger.Error("Refresh", fmt.Sprintf("user %s is expired", username))
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("user "+username+" is expired"))
+		return
+	}
+
 	// Create new access token
 	aH.logger.Debug("Refresh", "create new access token")
 	accessExp := time.Now().Add(ACCESS_TOKEN_TIME)
@@ -240,3 +261,16 @@ func (aH *AccessHandler) Logout(c *gin.Context) {
 
 	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
 }
+
+func expirationDateValid(expiration string) bool {
+	if expiration == "" {
+		return true // No expiration = always valid
+	}
+
+	t, err := time.Parse(time.RFC3339, expiration)
+	if err != nil {
+		return false // Invalid date format
+	}
+
+	return time.Now().Before(t)
+}

handlers/role.go

@@ -17,7 +17,7 @@ func (aH *AccessHandler) AddDefaultRole() (err error) {
 	role := "admin"
 
 	// Check if a role with this name already exists
-	if err := aH.dbHandler.Exists(&models.Role{}, "role", role, false); err == nil {
+	if aH.dbHandler.Exists(&models.Role{}, "role", role, false) {
 		// Found a role → skip creation
 		aH.logger.Debug("AddDefaultRole", "role "+role+" exists already")
 		return nil
@@ -52,7 +52,7 @@ func (aH *AccessHandler) AddRole(c *gin.Context) {
 	}
 
 	// Check if a role with this name already exists
-	if err := aH.dbHandler.Exists(&models.Role{}, "role", role.Role, false); err == nil {
+	if aH.dbHandler.Exists(&models.Role{}, "role", role.Role, false) {
 		aH.logger.Error("AddRole", fmt.Sprintf("role with name %s already exists", role.Role))
 		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse(fmt.Sprintf("role with name %s already exists", role.Role)))
 	}

handlers/user.go

@@ -21,7 +21,7 @@ func (aH *AccessHandler) AddDefaultUser() (err error) {
 	email := "zuercher@tecamino.ch"
 
 	// Check if a user with this email already exists
-	if err := aH.dbHandler.Exists(&models.User{}, "email", email, false); err == nil {
+	if aH.dbHandler.Exists(&models.User{}, "email", email, false) {
 		aH.logger.Debug("AddDefaultUser", "user email "+email+" exists already")
 		// Found a user → skip create
 		return nil
@@ -59,7 +59,7 @@ func (aH *AccessHandler) AddUser(c *gin.Context) {
 	}
 
 	// Check if a user with this email already exists
-	if err := aH.dbHandler.Exists(&models.User{}, "email", user.Email, false); err == nil {
+	if aH.dbHandler.Exists(&models.User{}, "email", user.Email, false) {
 		// Found a user → skip create
 		aH.logger.Error("AddUser", "user with email "+user.Email+" already exists")
 		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse(fmt.Sprintf("user with email %s already exists", user.Email)))

models/user.go

@@ -1,14 +1,31 @@
 package models
 
+import "time"
+
 type User struct {
 	Id         uint       `gorm:"primaryKey" json:"id"`
 	Name       string     `gorm:"column:user_name" json:"user"`
 	Email      string     `gorm:"column:email" json:"email"`
 	Role       string     `gorm:"column:role" json:"role,omitempty"`
 	Password   string     `gorm:"column:password" json:"password"`
-	Settings Settings `gorm:"type:json" json:"settings,omitempty"`
+	Expiration *time.Time `gorm:"column:expiration" json:"expiration,omitempty"`
+	Settings   Settings   `gorm:"type:json" json:"settings"`
 }
 
 func (u *User) IsValid() bool {
 	return u.Name != ""
 }
+
+func (u *User) ExpirationIsValid() bool {
+	if u.Expiration == nil {
+		return true
+	}
+	return time.Now().Before(*u.Expiration)
+}
+
+func (u *User) GetExpiration() string {
+	if u.Expiration == nil {
+		return ""
+	}
+	return u.Expiration.Format(time.RFC3339)
+}