add new function to change passsword with test

db_test.go

@@ -16,6 +16,11 @@ import (
 )
 
 func TestDatabase(t *testing.T) {
+	// set enviroment variables
+	os.Setenv("ACCESS_SECRET", "12345678910111213141516171819202")
+	os.Setenv("REFRESH_SECRET", "9998979695949392919089888786858")
+	os.Setenv("DOMAIN", "localhost")
+
 	dbName := "user.db"
 	if _, err := os.Stat(dbName); err == nil {
 		t.Log("remove user.db to start test with empty database")
@@ -154,6 +159,10 @@ func TestDatabase(t *testing.T) {
 }
 
 func TestLoginAndAuthorization(t *testing.T) {
+	os.Setenv("ACCESS_SECRET", "12345678910111213141516171819202")
+	os.Setenv("REFRESH_SECRET", "9998979695949392919089888786858")
+	os.Setenv("DOMAIN", "localhost")
+
 	gin.SetMode(gin.TestMode)
 
 	// Setup your AccessHandler and router
@@ -176,11 +185,15 @@ func TestLoginAndAuthorization(t *testing.T) {
 	auth.GET("", func(ctx *gin.Context) {
 		ctx.JSON(http.StatusOK, "ok")
 	})
+	auth2 := middleware.Group("", aH.AuthorizeRole("/login/change", "password"))
+
+	auth2.POST("/login/change/password", aH.ChangePassword)
 
 	// ---- Step 1: Perform login ----
 	user := models.User{
-		Name:     "guest",
-		Password: "passwordd1",
+		Name:        "guest",
+		Password:    "passwordd1",
+		NewPassword: "Newpasswordd1",
 	}
 	jsonBody, _ := json.Marshal(user)
 
@@ -209,22 +222,40 @@ func TestLoginAndAuthorization(t *testing.T) {
 	}
 
 	type request struct {
-		Name   string
-		Method string
-		Path   string
-		Cookie *http.Cookie
+		Name        string
+		Method      string
+		Path        string
+		Payload     any
+		Cookie      *http.Cookie
+		ignoreError bool
 	}
 	var requests []request
 
+	user.Id = 2
+
+	correctUser := user
+	correctUser.Password = user.NewPassword
+
 	requests = append(requests,
 		request{Name: "Refresh", Method: "POST", Path: "/login/refresh", Cookie: refreshCookie},
 		request{Name: "Me", Method: "GET", Path: "/login/me", Cookie: accessCookie},
 		request{Name: "Authorization", Method: "GET", Path: "/members", Cookie: accessCookie},
+		request{Name: "Change Password", Method: "POST", Path: "/login/change/password", Cookie: accessCookie, Payload: user},
 		request{Name: "Logout", Method: "GET", Path: "/logout", Cookie: refreshCookie},
+		request{Name: "New wrong login", Method: "POST", Path: "/login", Payload: user, ignoreError: true},
+		request{Name: "New login", Method: "POST", Path: "/login", Payload: correctUser},
 	)
 
 	for _, request := range requests {
-		req, _ := http.NewRequest(request.Method, request.Path, nil)
+		var body io.Reader
+		if request.Payload != nil {
+			jsonBytes, err := json.Marshal(request.Payload)
+			if err != nil {
+				t.Fatal(err)
+			}
+			body = bytes.NewBuffer(jsonBytes)
+		}
+		req, _ := http.NewRequest(request.Method, request.Path, body)
 		if request.Cookie != nil {
 			req.AddCookie(request.Cookie) // attach refresh_token cookie
 		}
@@ -233,6 +264,8 @@ func TestLoginAndAuthorization(t *testing.T) {
 		r.ServeHTTP(w, req)
 
 		t.Log(request.Name+" response:", w.Body.String())
-		assert.Equal(t, http.StatusOK, w.Code)
+		if !request.ignoreError {
+			assert.Equal(t, http.StatusOK, w.Code)
+		}
 	}
 }

handlers/login.go

@@ -3,6 +3,7 @@ package handlers
 import (
 	"fmt"
 	"net/http"
+	"os"
 	"time"
 
 	"gitea.tecamino.com/paadi/access-handler/internal/utils"
@@ -16,12 +17,12 @@ import (
 // 🔐 AUTHENTICATION CONSTANTS
 // -----------------------------
 
-// JWT secrets (replace "*" with strong random values in production!)
-var ACCESS_SECRET = []byte("ShFRprALcXjlosJ2hFCnGYGG3Ce2uRx6")
-var REFRESH_SECRET = []byte("pQIjuX6g6Tzf0FEfdScxttT3hlL9NFaa")
+// JWT secrets
+var ACCESS_SECRET = []byte(os.Getenv("ACCESS_SECRET"))
+var REFRESH_SECRET = []byte(os.Getenv("REFRESH_SECRET"))
 
 // DOMAIN defines where cookies are valid. Change this in production.
-var DOMAIN = "localhost"
+var DOMAIN = os.Getenv("DOMAIN")
 
 // ACCESS_TOKEN_TIME defines how long access tokens are valid.
 var ACCESS_TOKEN_TIME = 15 * time.Minute
@@ -49,34 +50,21 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 		aH.logger.Error("Login", "user empty")
 		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
 		return
-	} else if !user.ExpirationIsValid() {
-		aH.logger.Error("Login", fmt.Sprintf("user %s is expired", user.Name))
-		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("user "+user.Name+" is expired"))
-		return
 	}
 
 	// Fetch user record from DB
-	var dbRecord []models.User
-	err := aH.dbHandler.GetByKey(&dbRecord, "user_name", user.Name, false)
-	if err != nil {
-		aH.logger.Error("Login", err)
-		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
-		return
-	}
-
-	if len(dbRecord) > 1 {
-		aH.logger.Error("Login", "more than one record found")
-		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
+	dbUser, hasError := aH.getUserFromDB(c, user.Name)
+	if hasError {
 		return
 	}
 
 	// Check password
-	if !utils.CheckPassword(user.Password, dbRecord[0].Password) {
+	if !utils.CheckPassword(user.Password, dbUser.Password) {
 		aH.logger.Error("Login", "invalid password")
 		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
 		return
 	}
-	user = dbRecord[0]
+	user = dbUser
 
 	// -----------------------------
 	// 🔑 TOKEN CREATION
@@ -88,22 +76,20 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 
 	// Create access token
 	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
-		"id":             user.Id,
-		"username":       user.Name,
-		"role":           user.Role,
-		"type":           "access",
-		"exp":            accessTokenExp.Unix(),
-		"userExpiration": user.Expiration,
+		"id":       user.Id,
+		"username": user.Name,
+		"role":     user.Role,
+		"type":     "access",
+		"exp":      accessTokenExp.Unix(),
 	})
 
 	// Create refresh token
 	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
-		"id":             user.Id,
-		"username":       user.Name,
-		"role":           user.Role,
-		"type":           "refresh",
-		"exp":            refreshTokenExp.Unix(),
-		"userExpiration": user.GetExpiration(),
+		"id":       user.Id,
+		"username": user.Name,
+		"role":     user.Role,
+		"type":     "refresh",
+		"exp":      refreshTokenExp.Unix(),
 	})
 
 	// Sign tokens
@@ -179,11 +165,9 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 
 	username := claims["username"].(string)
 	id := int(claims["id"].(float64))
-	role := claims["role"].(string)
 
-	if !expirationDateValid(claims["userExpiration"].(string)) {
-		aH.logger.Error("Login", fmt.Sprintf("user %s is expired", username))
-		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("user "+username+" is expired"))
+	user, hasError := aH.getUserFromDB(c, username)
+	if hasError {
 		return
 	}
 
@@ -193,7 +177,7 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 	newAccess := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
 		"id":       id,
 		"username": username,
-		"role":     role,
+		"role":     user.Role,
 		"exp":      accessExp.Unix(),
 	})
 	accessString, _ := newAccess.SignedString(ACCESS_SECRET)
@@ -253,15 +237,33 @@ func (aH *AccessHandler) Logout(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
 }
 
-func expirationDateValid(expiration string) bool {
-	if expiration == "" {
-		return true // No expiration = always valid
-	}
-
-	t, err := time.Parse(time.RFC3339, expiration)
+func (aH *AccessHandler) getUserFromDB(c *gin.Context, userName string) (user models.User, hasError bool) {
+	hasError = true
+	// Fetch user record from DB
+	var dbRecord []models.User
+	err := aH.dbHandler.GetByKey(&dbRecord, "user_name", userName, false)
 	if err != nil {
-		return false // Invalid date format
+		aH.logger.Error("Login", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
 	}
 
-	return time.Now().Before(t)
+	if len(dbRecord) == 0 {
+		aH.logger.Error("Login", "no user "+userName+" found")
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+
+	if len(dbRecord) > 1 {
+		aH.logger.Error("Login", "more than one record found")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
+		return
+	}
+
+	if !dbRecord[0].ExpirationIsValid() {
+		aH.logger.Error("Login", fmt.Sprintf("user %s is expired", userName))
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("user "+userName+" is expired"))
+		return
+	}
+	return dbRecord[0], false
 }

handlers/middleware.go

@@ -3,6 +3,7 @@ package handlers
 import (
 	"log"
 	"net/http"
+	"slices"
 	"strings"
 
 	"gitea.tecamino.com/paadi/access-handler/models"
@@ -116,7 +117,7 @@ func (aH *AccessHandler) AuthMiddleware() gin.HandlerFunc {
 // Usage:
 //
 //	router.GET("/secure/:id", aH.AuthorizeRole("/api/v1"))
-func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
+func (aH *AccessHandler) AuthorizeRole(suffix string, exeptions ...string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		aH.logger.Debug("AuthorizeRole", "permission path of url path")
 		permissionPath := strings.TrimPrefix(c.Request.URL.Path, suffix+"/")
@@ -149,6 +150,12 @@ func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
 			return
 		}
 
+		// check exeptions
+		if slices.Contains(exeptions, permissionPath) {
+			c.Next()
+			return
+		}
+
 		// Check permissions
 		for _, permission := range roles[0].Permissions {
 			if permission.Name == permissionPath {

handlers/user.go

@@ -99,6 +99,54 @@ func (aH *AccessHandler) AddUser(c *gin.Context) {
 	})
 }
 
+func (aH *AccessHandler) ChangePassword(c *gin.Context) {
+	var user models.User
+	err := c.BindJSON(&user)
+	if err != nil {
+		aH.logger.Error("ChangePassword", err)
+		c.JSON(http.StatusInternalServerError, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	// get user to check ChangePassword
+	var dbRecord models.User
+	err = aH.dbHandler.GetById(&dbRecord, user.Id)
+	if err != nil {
+		aH.logger.Error("ChangePassword", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	// Check if old password is correct
+	if !utils.CheckPassword(user.Password, dbRecord.Password) {
+		fmt.Println(123, dbRecord.Password, user.Password)
+		// Found a user → skip create
+		aH.logger.Error("ChangePassword", "wrong password entered for user: "+user.Name)
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+	fmt.Println(3)
+
+	// Hash the provided password before saving
+	user.Password, err = utils.HashPassword(user.NewPassword)
+	if err != nil {
+		aH.logger.Error("ChangePassword", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	fmt.Println(4)
+
+	aH.logger.Debug("ChangePassword", "change user "+user.Name+" password")
+
+	// Update user
+	aH.dbHandler.UpdateValuesById(&user, user.Id)
+	fmt.Println(5)
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("password of user '%s' changed", user.Name),
+	})
+}
+
 func (aH *AccessHandler) GetUser(c *gin.Context) {
 	var i int
 	var err error

models/permission.go

@@ -12,9 +12,10 @@ func (r *Permissions) DefaultPermissions() {
 	*r = append(*r,
 		Permission{Name: "settings", Permission: 7},
 		Permission{Name: "userSettings", Permission: 7},
-		Permission{Name: "members", Permission: 7},
+		Permission{Name: "members", Permission: 31},
 		Permission{Name: "events", Permission: 7},
 		Permission{Name: "responsible", Permission: 7},
+		Permission{Name: "group", Permission: 7},
 	)
 }
 

models/settings.go

@@ -12,6 +12,7 @@ type Settings struct {
 	SecondaryColor     string `json:"secondaryColor,omitempty"`
 	SecondaryColorText string `json:"secondaryColorText,omitempty"`
 	Icon               string `json:"icon,omitempty"`
+	AppName            string `json:"appName,omitempty"`
 	DatabaseName       string `json:"databaseName,omitempty"`
 	DatabaseToken      string `json:"databaseToken,omitempty"`
 }

models/user.go

@@ -1,15 +1,18 @@
 package models
 
-import "time"
+import (
+	"time"
+)
 
 type User struct {
-	Id         uint       `gorm:"primaryKey" json:"id"`
-	Name       string     `gorm:"column:user_name" json:"user"`
-	Email      string     `gorm:"column:email" json:"email"`
-	Role       string     `gorm:"column:role" json:"role,omitempty"`
-	Password   string     `gorm:"column:password" json:"password"`
-	Expiration *time.Time `gorm:"column:expiration" json:"expiration,omitempty"`
-	Settings   Settings   `gorm:"type:json" json:"settings"`
+	Id          uint     `gorm:"primaryKey" json:"id"`
+	Name        string   `gorm:"column:user_name" json:"user"`
+	Email       string   `gorm:"column:email" json:"email"`
+	Role        string   `gorm:"column:role" json:"role,omitempty"`
+	Password    string   `gorm:"column:password" json:"password"`
+	NewPassword string   `gorm:"-" json:"newPassword"`
+	Expiration  string   `gorm:"column:expiration" json:"expiration,omitempty"`
+	Settings    Settings `gorm:"type:json" json:"settings"`
 }
 
 func (u *User) IsValid() bool {
@@ -17,15 +20,10 @@ func (u *User) IsValid() bool {
 }
 
 func (u *User) ExpirationIsValid() bool {
-	if u.Expiration == nil {
+	if u.Expiration == "" || u.Expiration == "never" {
 		return true
 	}
-	return time.Now().Before(*u.Expiration)
-}
-
-func (u *User) GetExpiration() string {
-	if u.Expiration == nil {
-		return ""
-	}
-	return u.Expiration.Format(time.RFC3339)
+	loc := time.Now().Location()
+	parsedTime, _ := time.ParseInLocation("2006-01-02 15:04:05", u.Expiration, loc)
+	return parsedTime.After(time.Now())
 }