replace static secrets with enviroment variables

accessHandler.go

@@ -1,10 +1,15 @@
 package AccessHandler
 
 import (
+	"os"
+
 	"gitea.tecamino.com/paadi/access-handler/handlers"
 	"gitea.tecamino.com/paadi/tecamino-logger/logging"
 )
 
 func NewAccessHandler(path string, logger *logging.Logger) (aH *handlers.AccessHandler, err error) {
+	logger.Debug("NewAccessHandler", "get enviroment variables")
+	handlers.ACCESS_SECRET = []byte(os.Getenv("ACCESS_SECRET"))
+	handlers.REFRESH_SECRET = []byte(os.Getenv("REFRESH_SECRET"))
 	return handlers.NewAccessHandler(path, logger)
 }

db_test.go

@@ -16,6 +16,10 @@ import (
 )
 
 func TestDatabase(t *testing.T) {
+	// set enviroment variables
+	os.Setenv("ACCESS_SECRET", "12345678910111213141516171819202")
+	os.Setenv("REFRESH_SECRET", "9998979695949392919089888786858")
+
 	dbName := "user.db"
 	if _, err := os.Stat(dbName); err == nil {
 		t.Log("remove user.db to start test with empty database")
@@ -154,6 +158,9 @@ func TestDatabase(t *testing.T) {
 }
 
 func TestLoginAndAuthorization(t *testing.T) {
+	os.Setenv("ACCESS_SECRET", "12345678910111213141516171819202")
+	os.Setenv("REFRESH_SECRET", "9998979695949392919089888786858")
+
 	gin.SetMode(gin.TestMode)
 
 	// Setup your AccessHandler and router

handlers/login.go

@@ -16,9 +16,9 @@ import (
 // 🔐 AUTHENTICATION CONSTANTS
 // -----------------------------
 
-// JWT secrets (replace "*" with strong random values in production!)
-var ACCESS_SECRET = []byte("ShFRprALcXjlosJ2hFCnGYGG3Ce2uRx6")
-var REFRESH_SECRET = []byte("pQIjuX6g6Tzf0FEfdScxttT3hlL9NFaa")
+// JWT secrets
+var ACCESS_SECRET []byte
+var REFRESH_SECRET []byte
 
 // DOMAIN defines where cookies are valid. Change this in production.
 var DOMAIN = "localhost"
@@ -164,9 +164,8 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 
 	username := claims["username"].(string)
 	id := int(claims["id"].(float64))
-	role := claims["role"].(string)
 
-	_, hasError := aH.getUserFromDB(c, username)
+	user, hasError := aH.getUserFromDB(c, username)
 	if hasError {
 		return
 	}
@@ -177,7 +176,7 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 	newAccess := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
 		"id":       id,
 		"username": username,
-		"role":     role,
+		"role":     user.Role,
 		"exp":      accessExp.Unix(),
 	})
 	accessString, _ := newAccess.SignedString(ACCESS_SECRET)

models/permission.go

@@ -12,7 +12,7 @@ func (r *Permissions) DefaultPermissions() {
 	*r = append(*r,
 		Permission{Name: "settings", Permission: 7},
 		Permission{Name: "userSettings", Permission: 7},
-		Permission{Name: "members", Permission: 7},
+		Permission{Name: "members", Permission: 15},
 		Permission{Name: "events", Permission: 7},
 		Permission{Name: "responsible", Permission: 7},
 	)

models/settings.go

@@ -12,6 +12,7 @@ type Settings struct {
 	SecondaryColor     string `json:"secondaryColor,omitempty"`
 	SecondaryColorText string `json:"secondaryColorText,omitempty"`
 	Icon               string `json:"icon,omitempty"`
+	AppName            string `json:"appName,omitempty"`
 	DatabaseName       string `json:"databaseName,omitempty"`
 	DatabaseToken      string `json:"databaseToken,omitempty"`
 }