lift dbhandler version

accessHandler.go

@@ -1,125 +1,10 @@
 package AccessHandler
 
-import "gitea.tecamino.com/paadi/tecamino-logger/logging"
+import (
+	"gitea.tecamino.com/paadi/access-handler/handlers"
+	"gitea.tecamino.com/paadi/tecamino-logger/logging"
+)
 
-//
-// AccessHandler
-//
-// Description:
-//   AccessHandler manages access-related functionality, including
-//   database operations for users and roles, as well as logging.
-//   It encapsulates a database handler and a logger so that
-//   authentication and authorization operations can be performed
-//   consistently across the application.
-//
-type AccessHandler struct {
-	dbHandler *DBHandler      // Database handler used for managing users and roles
-	logger    *logging.Logger // Centralized application logger
-}
-
-//
-// NewAccessHandler
-//
-// Description:
-//   Creates and initializes a new AccessHandler instance.
-//
-// Behavior:
-//   1. If a logger is not provided (nil), it creates a new logger instance
-//      that writes to "accessHandler.log".
-//   2. Initializes the AccessHandler struct.
-//   3. Sets up the internal DBHandler with the same logger.
-//   4. Automatically creates required database tables and default data:
-//        - User table
-//        - Default user(s)
-//        - Role table
-//        - Default role(s)
-//
-// Parameters:
-//   - dbPath: The file path or connection string for the database.
-//   - logger: Optional pointer to a logging.Logger instance. If nil, a new one is created.
-//
-// Returns:
-//   - aH:  A pointer to the fully initialized AccessHandler.
-//   - err: Any error that occurs during initialization.
-//
-// Example:
-//   handler, err := NewAccessHandler("data/app.db", appLogger)
-//   if err != nil {
-//       log.Fatal(err)
-//   }
-//
-func NewAccessHandler(dbPath string, logger *logging.Logger) (aH *AccessHandler, err error) {
-	if logger == nil {
-		logger, err = logging.NewLogger("accessHandler.log", nil)
-		if err != nil {
-			return
-		}
-	}
-
-	logger.Debug("NewAccessHandler", "initialize new access handler")
-
-	// Initialize AccessHandler with logger
-	aH = &AccessHandler{
-		logger: logger,
-	}
-
-	logger.Debug("NewAccessHandler", "initialize db handler")
-	// Create a new DB handler instance
-	aH.dbHandler, err = NewDBHandler(dbPath, logger)
-	if err != nil {
-		aH.logger.Error("NewAccessHandler", err)
-		return
-	}
-
-	logger.Debug("NewAccessHandler", "add user table")
-	// Add the user table to the database
-	err = aH.AddUserTable()
-	if err != nil {
-		aH.logger.Error("NewAccessHandler", err)
-		return
-	}
-
-	logger.Debug("NewAccessHandler", "add default user")
-	// Add default users to the system
-	err = aH.AddDefaultUser()
-	if err != nil {
-		aH.logger.Error("NewAccessHandler", err)
-		return
-	}
-
-	logger.Debug("NewAccessHandler", "add role table")
-	// Add the role table to the database
-	err = aH.AddRoleTable()
-	if err != nil {
-		aH.logger.Error("NewAccessHandler", err)
-		return
-	}
-
-	logger.Debug("NewAccessHandler", "add default role")
-	// Add default roles to the system
-	err = aH.AddDefaultRole()
-	if err != nil {
-		aH.logger.Error("NewAccessHandler", err)
-	}
-
-	return
-}
-
-//
-// GetLogger
-//
-// Description:
-//   Returns the logger associated with this AccessHandler instance.
-//   Useful when another component or handler needs to reuse the
-//   same logging instance for consistent log output.
-//
-// Returns:
-//   - *logging.Logger: The logger assigned to this AccessHandler.
-//
-// Example:
-//   log := accessHandler.GetLogger()
-//   log.Info("Some event")
-//
-func (aH *AccessHandler) GetLogger() *logging.Logger {
-	return aH.logger
+func NewAccessHandler(path string, logger *logging.Logger) (aH *handlers.AccessHandler, err error) {
+	return handlers.NewAccessHandler(path, logger)
 }

dbHandler.go

@@ -1,300 +0,0 @@
-package AccessHandler
-
-import (
-	"errors"
-	"fmt"
-	"reflect"
-	"strings"
-
-	"gitea.tecamino.com/paadi/tecamino-logger/logging"
-	"github.com/glebarez/sqlite"
-	"gorm.io/gorm"
-)
-
-// DBHandler
-//
-// Description:
-//
-//	Wraps the GORM database connection and provides helper methods for
-//	common CRUD operations, as well as integrated logging for traceability.
-//
-// Fields:
-//   - db:     Active GORM database connection.
-//   - logger: Pointer to a custom logger instance for structured logging.
-type DBHandler struct {
-	db     *gorm.DB
-	logger *logging.Logger
-}
-
-// NewDBHandler
-//
-// Description:
-//
-//	Creates a new database handler using the specified SQLite database file.
-//
-// Behavior:
-//  1. Opens a GORM connection to the database file at `dbPath`.
-//  2. Wraps it in a `DBHandler` struct with logging support.
-//
-// Parameters:
-//   - dbPath: Path to the SQLite database file.
-//   - logger: Logging instance to record DB operations.
-//
-// Returns:
-//   - dH:  A pointer to the initialized `DBHandler`.
-//   - err: Any error encountered during database connection.
-func NewDBHandler(dbPath string, logger *logging.Logger) (dH *DBHandler, err error) {
-	dH = &DBHandler{logger: logger}
-	logger.Debug("NewDBHandler", "open database "+dbPath)
-	dH.db, err = gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
-	return
-}
-
-// addNewTable
-//
-// Description:
-//
-//	Uses GORM’s `AutoMigrate` to create or update the database schema
-//	for the provided model type.
-//
-// Parameters:
-//   - model: Struct type representing the database table schema.
-//
-// Returns:
-//   - error: Any migration error encountered.
-func (dH *DBHandler) addNewTable(model any) error {
-	return dH.db.AutoMigrate(&model)
-}
-
-// addNewColum
-//
-// Description:
-//
-//	Inserts a new record into the database table corresponding to `model`.
-//
-// Parameters:
-//   - model: Struct instance containing values to be inserted.
-//
-// Returns:
-//   - error: Any error encountered during record creation.
-func (dH *DBHandler) addNewColum(model any) error {
-	return dH.db.Create(model).Error
-}
-
-// getById
-//
-// Description:
-//
-//	Retrieves a record (or all records) from a table by numeric ID.
-//
-// Behavior:
-//   - If `id == 0`, returns all records in the table.
-//   - Otherwise, fetches the record matching the given ID.
-//
-// Parameters:
-//   - model: Pointer to a slice or struct to store the result.
-//   - id:    Numeric ID to query by.
-//
-// Returns:
-//   - error: Any query error or “not found” message.
-func (dH *DBHandler) getById(model any, id uint) error {
-	dH.logger.Debug("getById", "find id "+fmt.Sprint(id))
-
-	if id == 0 {
-		return dH.db.Find(model).Error
-	}
-
-	err := dH.db.First(model, id).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return fmt.Errorf("no record found for id: %v", id)
-	} else if err != nil {
-		return fmt.Errorf("query failed: %w", err)
-	}
-	return nil
-}
-
-// getByKey
-//
-// Description:
-//
-//	Retrieves one or more records matching a key/value pair.
-//
-// Behavior:
-//   - If `LikeSearch` is true, performs a SQL LIKE query.
-//   - Otherwise, performs an exact match query.
-//
-// Parameters:
-//   - model:      Pointer to a slice or struct to store results.
-//   - key:        Column name (e.g., "email").
-//   - value:      Value to match or partially match.
-//   - LikeSearch: If true, replaces '*' with '%' for wildcard matching.
-//
-// Returns:
-//   - error: Any database query error.
-func (dH *DBHandler) getByKey(model any, key string, value any, LikeSearch bool) error {
-	if LikeSearch {
-		value = strings.ReplaceAll(fmt.Sprint(value), "*", "%")
-		dH.logger.Debug("getByKey", "find like key "+key+" value "+fmt.Sprint(value))
-		return dH.db.Where(key+" LIKE ?", value).Find(model).Error
-	}
-
-	dH.logger.Debug("getByKey", "find equal key "+key+" value "+fmt.Sprint(value))
-	return dH.db.Find(model, key+" = ?", value).Error
-}
-
-// updateValuesById
-//
-// Description:
-//
-//	Updates record fields based on their unique ID.
-//
-// Behavior:
-//  1. Confirms that `model` is a pointer to a struct.
-//  2. Fetches the record by ID.
-//  3. Updates all non-zero fields using `gorm.Model.Updates`.
-//
-// Parameters:
-//   - model: Pointer to struct containing new values.
-//   - id:    Numeric ID of the record to update.
-//
-// Returns:
-//   - error: If the model is invalid or query/update fails.
-func (dH *DBHandler) updateValuesById(model any, id uint) error {
-	dH.logger.Debug("updateValuesById", "model"+fmt.Sprint(model))
-	modelType := reflect.TypeOf(model)
-	if modelType.Kind() != reflect.Ptr {
-		return errors.New("model must be a pointer to struct")
-	}
-
-	lookUpModel := reflect.New(modelType.Elem()).Interface()
-	if err := dH.getById(lookUpModel, id); err != nil {
-		return err
-	}
-	return dH.db.Model(lookUpModel).Updates(model).Error
-}
-
-// updateValuesByKey
-//
-// Description:
-//
-//	Updates records based on a key/value match.
-//
-// Behavior:
-//  1. Confirms model type.
-//  2. Fetches the matching record(s) using `getByKey`.
-//  3. Updates all non-zero fields.
-//
-// Parameters:
-//   - model: Pointer to struct containing updated values.
-//   - key:   Column name to filter by.
-//   - value: Value to match.
-//
-// Returns:
-//   - error: Any query or update error.
-func (dH *DBHandler) updateValuesByKey(model any, key string, value any) error {
-	dH.logger.Debug("updateValuesByKey", "model"+fmt.Sprint(model))
-	modelType := reflect.TypeOf(model)
-	if modelType.Kind() != reflect.Ptr {
-		return errors.New("model must be a pointer to struct")
-	}
-
-	lookUpModel := reflect.New(modelType.Elem()).Interface()
-	if err := dH.getByKey(lookUpModel, key, value, false); err != nil {
-		return err
-	}
-	return dH.db.Model(lookUpModel).Updates(model).Error
-}
-
-// deleteById
-//
-// Description:
-//
-//	Deletes records by their ID(s).
-//
-// Behavior:
-//   - If the first ID == 0, all records in the table are deleted.
-//   - Otherwise, deletes the provided IDs.
-//
-// Parameters:
-//   - model: Model struct type representing the table.
-//   - id:    Variadic list of IDs to delete.
-//
-// Returns:
-//   - error: Any deletion error.
-func (dH *DBHandler) deleteById(model any, id ...uint) error {
-	if id[0] == 0 {
-		dH.logger.Debug("deleteById", "delete all")
-		return dH.db.Where("1 = 1").Delete(model).Error
-	}
-
-	dH.logger.Debug("deleteById", "delete ids"+fmt.Sprint(id))
-	if err := dH.exists(model, "id", id, false); err != nil {
-		return err
-	}
-	return dH.db.Delete(model, id).Error
-}
-
-// deleteByKey
-//
-// Description:
-//
-//	Deletes records that match a key/value pair.
-//
-// Behavior:
-//   - Supports LIKE queries if `LikeSearch` is true.
-//
-// Parameters:
-//   - model:      Model struct type representing the table.
-//   - key:        Column name to filter by.
-//   - value:      Value to match.
-//   - LikeSearch: Whether to use wildcard search.
-//
-// Returns:
-//   - error: Any deletion error.
-func (dH *DBHandler) deleteByKey(model any, key string, value any, LikeSearch bool) error {
-	if LikeSearch {
-		value = strings.ReplaceAll(fmt.Sprint(value), "*", "%")
-		dH.logger.Debug("deleteByKey", "delete like key "+key+" value "+fmt.Sprint(value))
-		return dH.db.Where(key+" LIKE ?", value).Delete(model).Error
-	}
-
-	dH.logger.Debug("deleteByKey", "delete equal key "+key+" value "+fmt.Sprint(value))
-	return dH.db.Where(key+" = ?", value).Delete(model).Error
-}
-
-// exists
-//
-// Description:
-//
-//	Checks whether a record exists matching the specified key/value filter.
-//
-// Behavior:
-//   - Performs a `First` query on the database.
-//   - If `LikeSearch` is true, performs a LIKE query.
-//   - Returns an error if the record does not exist or query fails.
-//
-// Parameters:
-//   - model:      Model struct type to search.
-//   - key:        Column name to filter by.
-//   - value:      Value to match.
-//   - LikeSearch: Whether to use wildcard search.
-//
-// Returns:
-//   - error: “no record found” or DB error.
-func (dH *DBHandler) exists(model any, key string, value any, LikeSearch bool) (err error) {
-	if LikeSearch {
-		value = strings.ReplaceAll(fmt.Sprint(value), "*", "%")
-		key = key + " LIKE ?"
-	} else {
-		key = key + " = ?"
-	}
-
-	dH.logger.Debug("exists", "check if exists key "+key+" value "+fmt.Sprint(value))
-	err = dH.db.Where(key, value).First(model).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return fmt.Errorf("no record found for %s %v", key[:len(key)-1], value)
-	} else if err != nil {
-		return fmt.Errorf("query failed: %w", err)
-	}
-	return
-}

db_test.go

@@ -3,8 +3,10 @@ package AccessHandler
 import (
 	"bytes"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"gitea.tecamino.com/paadi/access-handler/models"
@@ -13,116 +15,128 @@ import (
 	"github.com/go-playground/assert/v2"
 )
 
-func TestAccesshandlerLogin(t *testing.T) {
+func TestDatabase(t *testing.T) {
+	// set enviroment variables
+	os.Setenv("ACCESS_SECRET", "12345678910111213141516171819202")
+	os.Setenv("REFRESH_SECRET", "9998979695949392919089888786858")
+	os.Setenv("DOMAIN", "localhost")
+
+	dbName := "user.db"
+	if _, err := os.Stat(dbName); err == nil {
+		t.Log("remove user.db to start test with empty database")
+		if err := os.Remove(dbName); err != nil {
+			t.Fatal(err)
+		}
+	}
+
 	t.Log("start access handler test")
 
 	t.Log("initialize accessHandler")
-	accessHandler, err := NewAccessHandler("test.db", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	t.Log("add another user")
-	err = accessHandler.AddNewUser("guest", "guest@gmail.com", "passwordd1", "admin")
-	if err != nil {
-		t.Log(err)
-	}
-
-	t.Log("get user id 1")
-	result, err := accessHandler.GetUserByKey("user_name", "admin", false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result)
-
-	t.Log("get all users")
-	result, err = accessHandler.GetUserById(0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result)
-
-	t.Log("get user by key")
-	result, err = accessHandler.GetUserByKey("password", "passwordd", false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result)
-
-	t.Log("get user by key and like")
-	result, err = accessHandler.GetUserByKey("user_name", "a*", true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result)
-
-	// var user_name string = "admin1"
-	// if len(result) > 0 {
-	// 	if result[0].Name == user_name {
-	// 		user_name = "admin"
-	// 	}
-
-	// 	t.Log("update user to ", user_name)
-
-	// 	accessHandler.UpdateUserByKey(models.User{
-	// 		Name: user_name,
-	// 	}, "user_name", result[0].Name)
-	// }
-	t.Log("read user again")
-	result, err = accessHandler.GetUserByKey("user_name", "a*", true)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result)
-
-	// t.Log("delete user id 1")
-	// err = accessHandler.DeleteUserByKey("user_name", user_name, false)
-	// if err != nil {
-	// 	t.Fatal(err)
-	// }
-	t.Log("read user again")
-	result, err = accessHandler.GetUserById(0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result)
-
-	t.Log("read admin permissions")
-	result1, err := accessHandler.GetRoleByKey("role", "admin", false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Log(result1)
-}
-
-func TestLoginHandler(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-
-	// Setup your AccessHandler and router
-	aH, err := NewAccessHandler("test.db", nil)
+	accessHandler, err := NewAccessHandler(".", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	r := gin.Default()
 
-	SetMiddlewareLogger(r, aH.GetLogger())
+	accessHandler.SetMiddlewareLogger(r)
+
+	r.POST("/users/add", accessHandler.AddUser)
+	r.GET("/users", accessHandler.GetUser)
+	r.GET("/roles", accessHandler.GetRole)
+	r.POST("/roles/add", accessHandler.AddRole)
+
+	type request struct {
+		Log         string
+		Name        string
+		Method      string
+		Path        string
+		Payload     any
+		Cookie      *http.Cookie
+		ignoreError bool
+	}
+	var requests []request
+
+	requests = append(requests,
+		request{Log: "add another user", Name: "add user", Method: "POST", Path: "/users/add", Payload: models.User{
+
+			Name:     "guest",
+			Password: "passwordd1",
+			Role:     &models.Role{Role: "guest"},
+			Email:    "guest@gmail.com",
+		}, ignoreError: true},
+		request{Log: "Get all users", Name: "get all users", Method: "GET", Path: "/users"},
+		request{Log: "Get user id 1", Name: "get user id 1", Method: "GET", Path: "/users?id=1"},
+		request{Log: "Add new role", Name: "add new role", Method: "POST", Path: "/roles/add", Payload: models.Role{
+			Role: "testRole",
+		}, ignoreError: true},
+		request{Log: "Get all roles", Name: "get all roles", Method: "GET", Path: "/roles"},
+		request{Log: "Get all role id 1", Name: "get role id 1", Method: "GET", Path: "/roles?id=1"},
+		request{Log: "Get user id 2", Name: "get user id 2", Method: "GET", Path: "/users?id=2"},
+	)
+
+	for _, request := range requests {
+		if request.Log != "" {
+			t.Log(request.Log)
+		}
+		var bodyReader io.Reader
+		if request.Payload != nil {
+			jsonBytes, _ := json.Marshal(request.Payload)
+			bodyReader = bytes.NewBuffer(jsonBytes)
+		}
+		req, _ := http.NewRequest(request.Method, request.Path, bodyReader)
+		if request.Cookie != nil {
+			req.AddCookie(request.Cookie) // attach refresh_token cookie
+		}
+		w := httptest.NewRecorder()
+
+		r.ServeHTTP(w, req)
+
+		t.Log(request.Name+" response:", w.Body.String())
+		if !request.ignoreError {
+			assert.Equal(t, http.StatusOK, w.Code)
+		}
+	}
+
+}
+
+func TestLoginAndAuthorization(t *testing.T) {
+	os.Setenv("ACCESS_SECRET", "12345678910111213141516171819202")
+	os.Setenv("REFRESH_SECRET", "9998979695949392919089888786858")
+	os.Setenv("DOMAIN", "localhost")
+
+	gin.SetMode(gin.TestMode)
+
+	// Setup your AccessHandler and router
+	aH, err := NewAccessHandler(".", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := gin.Default()
+
+	aH.SetMiddlewareLogger(r)
 
 	r.POST("/login", aH.Login)
 	r.POST("/login/refresh", aH.Refresh)
+	r.POST("/roles/update", aH.UpdateRole)
 	r.GET("/login/me", aH.Me)
 	r.GET("/logout", aH.Logout)
-	middleware := r.Group("", AuthMiddleware())
+	middleware := r.Group("", aH.AuthMiddleware())
 
 	auth := middleware.Group("/members", aH.AuthorizeRole(""))
 	auth.GET("", func(ctx *gin.Context) {
 		ctx.JSON(http.StatusOK, "ok")
 	})
+	auth2 := middleware.Group("", aH.AuthorizeRole("/login/change", "password"))
+
+	auth2.POST("/login/change/password", aH.ChangePassword)
 
 	// ---- Step 1: Perform login ----
 	user := models.User{
 		Name:        "guest",
 		Password:    "passwordd1",
+		NewPassword: "Newpasswordd1",
 	}
 	jsonBody, _ := json.Marshal(user)
 
@@ -154,19 +168,40 @@ func TestLoginHandler(t *testing.T) {
 		Name        string
 		Method      string
 		Path        string
+		Payload     any
 		Cookie      *http.Cookie
+		ignoreError bool
 	}
 	var requests []request
 
+	user.Id = 2
+
+	correctUser := user
+	correctUser.Password = user.NewPassword
+
 	requests = append(requests,
 		request{Name: "Refresh", Method: "POST", Path: "/login/refresh", Cookie: refreshCookie},
 		request{Name: "Me", Method: "GET", Path: "/login/me", Cookie: accessCookie},
+		request{Name: "add new role", Method: "POST", Path: "/roles/update", Payload: models.Role{
+			Role: "guest", Permissions: models.Permissions{{Name: "members", Permission: 31}},
+		}, ignoreError: true},
 		request{Name: "Authorization", Method: "GET", Path: "/members", Cookie: accessCookie},
+		request{Name: "Change Password", Method: "POST", Path: "/login/change/password", Cookie: accessCookie, Payload: user},
 		request{Name: "Logout", Method: "GET", Path: "/logout", Cookie: refreshCookie},
+		request{Name: "New wrong login", Method: "POST", Path: "/login", Payload: user, ignoreError: true},
+		request{Name: "New login", Method: "POST", Path: "/login", Payload: correctUser},
 	)
 
 	for _, request := range requests {
-		req, _ := http.NewRequest(request.Method, request.Path, nil)
+		var body io.Reader
+		if request.Payload != nil {
+			jsonBytes, err := json.Marshal(request.Payload)
+			if err != nil {
+				t.Fatal(err)
+			}
+			body = bytes.NewBuffer(jsonBytes)
+		}
+		req, _ := http.NewRequest(request.Method, request.Path, body)
 		if request.Cookie != nil {
 			req.AddCookie(request.Cookie) // attach refresh_token cookie
 		}
@@ -175,6 +210,8 @@ func TestLoginHandler(t *testing.T) {
 		r.ServeHTTP(w, req)
 
 		t.Log(request.Name+" response:", w.Body.String())
+		if !request.ignoreError {
 			assert.Equal(t, http.StatusOK, w.Code)
 		}
 	}
+}

go.mod

@@ -3,13 +3,12 @@ module gitea.tecamino.com/paadi/access-handler
 go 1.24.5
 
 require (
+	gitea.tecamino.com/paadi/dbHandler v1.1.6
 	gitea.tecamino.com/paadi/tecamino-logger v0.2.1
 	github.com/gin-gonic/gin v1.11.0
-	github.com/glebarez/sqlite v1.11.0
 	github.com/go-playground/assert/v2 v2.2.0
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	golang.org/x/crypto v0.43.0
-	gorm.io/gorm v1.31.0
 )
 
 require (
@@ -20,6 +19,7 @@ require (
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/glebarez/go-sqlite v1.21.2 // indirect
+	github.com/glebarez/sqlite v1.11.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.27.0 // indirect
@@ -52,6 +52,7 @@ require (
 	golang.org/x/tools v0.37.0 // indirect
 	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gorm.io/gorm v1.31.0 // indirect
 	modernc.org/libc v1.22.5 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
 	modernc.org/memory v1.5.0 // indirect

go.sum

@@ -1,3 +1,5 @@
+gitea.tecamino.com/paadi/dbHandler v1.1.6 h1:Mz7ioUmozXx22oV3P7GHsvQn/2QKOjkNyzdptvqbaN8=
+gitea.tecamino.com/paadi/dbHandler v1.1.6/go.mod h1:y/xn/POJg1DO++67uKvnO23lJQgh+XFQq7HZCS9Getw=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1 h1:sQTBKYPdzn9mmWX2JXZBtGBvNQH7cuXIwsl4TD0aMgE=
 gitea.tecamino.com/paadi/tecamino-logger v0.2.1/go.mod h1:FkzRTldUBBOd/iy2upycArDftSZ5trbsX5Ira5OzJgM=
 github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=

handlers/access.go

@@ -0,0 +1,126 @@
+package handlers
+
+import (
+	"gitea.tecamino.com/paadi/dbHandler"
+	"gitea.tecamino.com/paadi/tecamino-logger/logging"
+)
+
+// AccessHandler
+//
+// Description:
+//
+//	AccessHandler manages access-related functionality, including
+//	database operations for users and roles, as well as logging.
+//	It encapsulates a database handler and a logger so that
+//	authentication and authorization operations can be performed
+//	consistently across the application.
+type AccessHandler struct {
+	dbHandler *dbHandler.DBHandler // Database handler used for managing users and roles
+	logger    *logging.Logger      // Centralized application logger
+}
+
+// NewAccessHandler
+//
+// Description:
+//
+//	Creates and initializes a new AccessHandler instance.
+//
+// Behavior:
+//  1. If a logger is not provided (nil), it creates a new logger instance
+//     that writes to "accessHandler.log".
+//  2. Initializes the AccessHandler struct.
+//  3. Sets up the internal DBAHandler with the same logger.
+//  4. Automatically creates required database tables and default data:
+//     - User table
+//     - Default user(s)
+//     - Role table
+//     - Default role(s)
+//
+// Parameters:
+//   - dbPath: The file path to the database.
+//   - logger: Optional pointer to a logging.Logger instance. If nil, a new one is created.
+//
+// Returns:
+//   - aH:  A pointer to the fully initialized AccessHandler.
+//   - err: Any error that occurs during initialization.
+//
+// Example:
+//
+//	handler, err := NewAccessHandler("data/app.db", appLogger)
+//	if err != nil {
+//	    log.Fatal(err)
+//	}
+func NewAccessHandler(path string, logger *logging.Logger) (aH *AccessHandler, err error) {
+	if logger == nil {
+		logger, err = logging.NewLogger("accessHandler.log", nil)
+		if err != nil {
+			return
+		}
+	}
+
+	logger.Debug("NewAccessHandler", "initialize new access handler")
+
+	// Initialize AccessHandler with logger
+	aH = &AccessHandler{
+		logger: logger,
+	}
+
+	logger.Debug("NewAccessHandler", "initialize db handler")
+	// Create a new DB handler instance
+	aH.dbHandler, err = dbHandler.NewDBHandler("user", path, logger)
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add role table")
+	// Add the role table to the database
+	err = aH.AddRoleTable()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add default role")
+	// Add default roles to the system
+	err = aH.AddDefaultRole()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+	}
+
+	logger.Debug("NewAccessHandler", "add user table")
+	// Add the user table to the database
+	err = aH.AddUserTable()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+
+	logger.Debug("NewAccessHandler", "add default user")
+	// Add default users to the system
+	err = aH.AddDefaultUser()
+	if err != nil {
+		aH.logger.Error("NewAccessHandler", err)
+		return
+	}
+	return
+}
+
+// GetLogger
+//
+// Description:
+//
+//	Returns the logger associated with this AccessHandler instance.
+//	Useful when another component or handler needs to reuse the
+//	same logging instance for consistent log output.
+//
+// Returns:
+//   - *logging.Logger: The logger assigned to this AccessHandler.
+//
+// Example:
+//
+//	log := accessHandler.GetLogger()
+//	log.Info("Some event")
+func (aH *AccessHandler) GetLogger() *logging.Logger {
+	return aH.logger
+}

handlers/login.go

@@ -1,13 +1,13 @@
-package AccessHandler
+package handlers
 
 import (
 	"fmt"
-	"log"
 	"net/http"
+	"os"
 	"time"
 
+	"gitea.tecamino.com/paadi/access-handler/internal/utils"
 	"gitea.tecamino.com/paadi/access-handler/models"
-	"gitea.tecamino.com/paadi/access-handler/utils"
 
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
@@ -17,12 +17,12 @@ import (
 // 🔐 AUTHENTICATION CONSTANTS
 // -----------------------------
 
-// JWT secrets (replace "*" with strong random values in production!)
-var ACCESS_SECRET = []byte("ShFRprALcXjlosJ2hFCnGYGG3Ce2uRx6")
-var REFRESH_SECRET = []byte("pQIjuX6g6Tzf0FEfdScxttT3hlL9NFaa")
+// JWT secrets
+var ACCESS_SECRET = []byte(os.Getenv("ACCESS_SECRET"))
+var REFRESH_SECRET = []byte(os.Getenv("REFRESH_SECRET"))
 
 // DOMAIN defines where cookies are valid. Change this in production.
-var DOMAIN = "localhost"
+var DOMAIN = os.Getenv("DOMAIN")
 
 // ACCESS_TOKEN_TIME defines how long access tokens are valid.
 var ACCESS_TOKEN_TIME = 15 * time.Minute
@@ -53,27 +53,18 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 	}
 
 	// Fetch user record from DB
-	dbRecord, err := aH.GetUserByKey("user_name", user.Name, false)
-	if err != nil {
-		aH.logger.Error("Login", err)
-		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
-		return
-	}
-
-	if len(dbRecord) > 1 {
-		log.Println("multiple users found")
-		aH.logger.Error("Login", "more than one record found")
-		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
+	dbUser, hasError := aH.getUserFromDB(c, user.Name)
+	if hasError {
 		return
 	}
 
 	// Check password
-	if !utils.CheckPassword(user.Password, dbRecord[0].Password) {
+	if !utils.CheckPassword(user.Password, dbUser.Password) {
 		aH.logger.Error("Login", "invalid password")
 		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
 		return
 	}
-	user = dbRecord[0]
+	user = dbUser
 
 	// -----------------------------
 	// 🔑 TOKEN CREATION
@@ -87,7 +78,7 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
 		"id":       user.Id,
 		"username": user.Name,
-		"role":     user.Role,
+		"role":     user.Role.Role,
 		"type":     "access",
 		"exp":      accessTokenExp.Unix(),
 	})
@@ -96,7 +87,7 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
 		"id":       user.Id,
 		"username": user.Name,
-		"role":     user.Role,
+		"role":     user.Role.Role,
 		"type":     "refresh",
 		"exp":      refreshTokenExp.Unix(),
 	})
@@ -134,7 +125,7 @@ func (aH *AccessHandler) Login(c *gin.Context) {
 		"message":  "login successful",
 		"id":       user.Id,
 		"user":     user.Name,
-		"role":     user.Role,
+		"role":     user.Role.Role,
 		"settings": user.Settings,
 	})
 }
@@ -174,7 +165,11 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 
 	username := claims["username"].(string)
 	id := int(claims["id"].(float64))
-	role := claims["role"].(string)
+
+	user, hasError := aH.getUserFromDB(c, username)
+	if hasError {
+		return
+	}
 
 	// Create new access token
 	aH.logger.Debug("Refresh", "create new access token")
@@ -182,7 +177,7 @@ func (aH *AccessHandler) Refresh(c *gin.Context) {
 	newAccess := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
 		"id":       id,
 		"username": username,
-		"role":     role,
+		"role":     user.Role.Role,
 		"exp":      accessExp.Unix(),
 	})
 	accessString, _ := newAccess.SignedString(ACCESS_SECRET)
@@ -241,3 +236,34 @@ func (aH *AccessHandler) Logout(c *gin.Context) {
 
 	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
 }
+
+func (aH *AccessHandler) getUserFromDB(c *gin.Context, userName string) (user models.User, hasError bool) {
+	hasError = true
+	// Fetch user record from DB
+	var dbRecord []models.User
+	err := aH.dbHandler.GetByKey(&dbRecord, "Role", "user_name", userName, false)
+	if err != nil {
+		aH.logger.Error("Login", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if len(dbRecord) == 0 {
+		aH.logger.Error("Login", "no user "+userName+" found")
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+
+	if len(dbRecord) > 1 {
+		aH.logger.Error("Login", "more than one record found")
+		c.JSON(http.StatusInternalServerError, models.NewJsonMessageResponse("internal error"))
+		return
+	}
+
+	if !dbRecord[0].ExpirationIsValid() {
+		aH.logger.Error("Login", fmt.Sprintf("user %s is expired", userName))
+		c.JSON(http.StatusUnauthorized, models.NewJsonMessageResponse("user "+userName+" is expired"))
+		return
+	}
+	return dbRecord[0], false
+}

handlers/middleware.go

@@ -1,11 +1,12 @@
-package AccessHandler
+package handlers
 
 import (
-	"fmt"
 	"log"
 	"net/http"
+	"slices"
 	"strings"
 
+	"gitea.tecamino.com/paadi/access-handler/models"
 	"gitea.tecamino.com/paadi/tecamino-logger/logging"
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
@@ -28,10 +29,10 @@ import (
 // Usage:
 //
 //	SetMiddlewareLogger(router, logger)
-func SetMiddlewareLogger(r *gin.Engine, logger *logging.Logger) {
+func (aH *AccessHandler) SetMiddlewareLogger(r *gin.Engine) {
 	// Add middleware that injects logger into context
 	r.Use(func(c *gin.Context) {
-		c.Set("logger", logger)
+		c.Set("logger", aH.logger)
 		c.Next()
 	})
 }
@@ -56,7 +57,7 @@ func SetMiddlewareLogger(r *gin.Engine, logger *logging.Logger) {
 // Usage:
 //
 //	r.Use(AuthMiddleware())
-func AuthMiddleware() gin.HandlerFunc {
+func (aH *AccessHandler) AuthMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		// Retrieve logger from Gin context
 		middlewareLogger, ok := c.Get("logger")
@@ -116,7 +117,7 @@ func AuthMiddleware() gin.HandlerFunc {
 // Usage:
 //
 //	router.GET("/secure/:id", aH.AuthorizeRole("/api/v1"))
-func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
+func (aH *AccessHandler) AuthorizeRole(suffix string, exeptions ...string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		aH.logger.Debug("AuthorizeRole", "permission path of url path")
 		permissionPath := strings.TrimPrefix(c.Request.URL.Path, suffix+"/")
@@ -130,7 +131,8 @@ func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
 		}
 
 		// Fetch roles and associated permissions from the database or store
-		roles, err := aH.GetRoleByKey("role", role, false)
+		var roles []models.Role
+		err := aH.dbHandler.GetByKey(&roles, "", "role", role, false)
 		if err != nil {
 			aH.logger.Error("AuthorizeRole", err)
 			c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"message": http.StatusInternalServerError})
@@ -139,8 +141,7 @@ func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
 
 		// Validate that a role was found
 		if len(roles) == 0 {
-			log.Println("not logged in")
-			aH.logger.Error("AuthorizeRole", "no logged in")
+			aH.logger.Error("AuthorizeRole", "not logged in")
 			c.JSON(http.StatusUnauthorized, http.StatusUnauthorized)
 			return
 		} else if len(roles) > 1 {
@@ -149,9 +150,14 @@ func (aH *AccessHandler) AuthorizeRole(suffix string) gin.HandlerFunc {
 			return
 		}
 
+		// check exeptions
+		if slices.Contains(exeptions, permissionPath) {
+			c.Next()
+			return
+		}
+
 		// Check permissions
 		for _, permission := range roles[0].Permissions {
-			fmt.Println(100, permissionPath, permission.Name)
 			if permission.Name == permissionPath {
 				c.Next()
 				return

handlers/role.go

@@ -0,0 +1,183 @@
+package handlers
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"github.com/gin-gonic/gin"
+)
+
+func (aH *AccessHandler) AddRoleTable() error {
+	return aH.dbHandler.AddNewTable(models.Role{})
+}
+
+func (aH *AccessHandler) AddDefaultRole() (err error) {
+	role := "admin"
+
+	// Check if a role with this name already exists
+	if aH.dbHandler.Exists(&models.Role{}, "", "role", role, false) {
+		// Found a role → skip creation
+		aH.logger.Debug("AddDefaultRole", "role "+role+" exists already")
+		return nil
+	}
+
+	// Initialize default permissions for admin
+	permissions := models.Permissions{}
+	aH.logger.Debug("AddDefaultRole", "set default Permissions")
+	permissions.DefaultPermissions()
+
+	// Create the default admin role
+	aH.dbHandler.AddNewColum(&models.Role{
+		Role:        role,
+		Permissions: permissions,
+	})
+	return
+}
+
+func (aH *AccessHandler) AddRole(c *gin.Context) {
+	var role models.Role
+	err := c.BindJSON(&role)
+	if err != nil {
+		aH.logger.Error("AddRole", err)
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if !role.IsValid() {
+		aH.logger.Error("AddRole", "user empty")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
+		return
+	}
+
+	// Check if a role with this name already exists
+	if aH.dbHandler.Exists(&models.Role{}, "", "role", role.Role, false) {
+		aH.logger.Error("AddRole", fmt.Sprintf("role with name %s already exists", role.Role))
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse(fmt.Sprintf("role with name %s already exists", role.Role)))
+		return
+	}
+
+	// Insert new role with provided permissions
+	aH.dbHandler.AddNewColum(&models.Role{
+		Role:        role.Role,
+		Permissions: role.Permissions,
+	})
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("role '%s' successfully added", role.Role),
+	})
+}
+
+func (aH *AccessHandler) GetRole(c *gin.Context) {
+	var i int
+	var err error
+	var roles []models.Role
+
+	role := c.Query("role")
+	id := c.Query("id")
+
+	if role != "" {
+		err = aH.dbHandler.GetByKey(&roles, "", "role", role, false)
+	} else if id != "" {
+		i, err = strconv.Atoi(id)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{
+				"message": err.Error(),
+			})
+			return
+		}
+		err = aH.dbHandler.GetById(&roles, "", uint(i))
+	} else {
+		err = aH.dbHandler.GetById(&roles, "", 0)
+
+	}
+
+	if err != nil {
+		aH.logger.Error("GetRole", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, roles)
+}
+
+func (aH *AccessHandler) UpdateRole(c *gin.Context) {
+	var role models.Role
+	if err := c.BindJSON(&role); err != nil {
+		aH.logger.Error("UpdateRole", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	if role.Id != 0 {
+		err := aH.dbHandler.UpdateValuesById(&role, "", role.Id)
+		if err != nil {
+			aH.logger.Error("UpdateRole", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	} else {
+		err := aH.dbHandler.UpdateValuesByKey(&role, "", "role", role.Role)
+		if err != nil {
+			aH.logger.Error("UpdateRole", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	}
+
+	c.JSON(http.StatusOK, models.NewJsonMessageResponse("successfully updated role '"+role.Role+"'"))
+}
+
+func (aH *AccessHandler) DeleteRole(c *gin.Context) {
+	queryRole := c.Query("role")
+	if queryRole == "" || queryRole == "null" || queryRole == "undefined" {
+		aH.logger.Error("DeleteRole", "id query missing or wrong value: "+queryRole)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	var request struct {
+		Roles []string `json:"roles"`
+	}
+
+	err := c.BindJSON(&request)
+	if err != nil {
+		aH.logger.Error("DeleteRole", err)
+		c.JSON(http.StatusBadRequest, nil)
+		return
+	}
+
+	if len(request.Roles) == 0 {
+		aH.logger.Error("DeleteRole", "no ids given to be deleted")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("no roles given to be deleted"))
+		return
+	}
+
+	var ownRole string
+
+	for _, role := range request.Roles {
+		if queryRole == role {
+			ownRole = role
+			continue
+		}
+		err = aH.dbHandler.DeleteByKey(&models.Role{}, "", "role", role, false)
+		if err != nil {
+			aH.logger.Error("DeleteRole", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	}
+
+	if ownRole != "" {
+		aH.logger.Error("DeleteRole", "can not delete logged in role id: "+ownRole)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "can not delete logged in role id: " + ownRole,
+			"role":    ownRole,
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "role(s) deleted",
+	})
+}

handlers/user.go

@@ -0,0 +1,265 @@
+package handlers
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"gitea.tecamino.com/paadi/access-handler/internal/utils"
+	"gitea.tecamino.com/paadi/access-handler/models"
+	"github.com/gin-gonic/gin"
+)
+
+func (aH *AccessHandler) AddUserTable() error {
+	return aH.dbHandler.AddNewTable(models.User{})
+}
+
+func (aH *AccessHandler) AddDefaultUser() (err error) {
+	// Create default settings for the new user
+	settings := models.Settings{}
+	aH.logger.Debug("AddDefaultUser", "set default quasar settings")
+	settings.DefaultQuasarSettings()
+
+	user := &models.User{
+		Name:     "admin",
+		Email:    "zuercher@tecamino.ch",
+		Password: "$2a$10$sZZOWBP8DSFLrLFQNoXw8OsEEr0tez1B8lPzKCHofaHg6PMNxx1pG",
+		Settings: settings,
+	}
+
+	// Check if a user with this email already exists
+	if aH.dbHandler.Exists(&models.User{}, "", "email", user.Email, false) {
+		aH.logger.Debug("AddDefaultUser", "user email "+user.Email+" exists already")
+		// Found a user → skip create
+		return nil
+	}
+
+	// Insert default admin user into the database
+
+	if err := aH.dbHandler.AddNewColum(user); err != nil {
+		return err
+	}
+
+	role := &models.Role{}
+	if err := aH.dbHandler.GetByKey(role, "", "role", "admin", false); err != nil {
+		return err
+	}
+	return aH.dbHandler.AddRelation(user, role, "Role")
+}
+
+func (aH *AccessHandler) AddUser(c *gin.Context) {
+	var user models.User
+	err := c.BindJSON(&user)
+	if err != nil {
+		aH.logger.Error("AddUser", err)
+		c.JSON(http.StatusInternalServerError, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	if !user.IsValid() {
+		aH.logger.Error("AddUser", "user empty")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("user empty"))
+		return
+	}
+
+	// Check if a user with this email already exists
+	if aH.dbHandler.Exists(&models.User{}, "", "email", user.Email, false) {
+		// Found a user → skip create
+		aH.logger.Error("AddUser", "user with email "+user.Email+" already exists")
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse(fmt.Sprintf("user with email %s already exists", user.Email)))
+		return
+	}
+
+	if !utils.IsValidEmail(user.Email) {
+		aH.logger.Error("AddUser", "not valid email address")
+		c.JSON(http.StatusBadRequest, models.NewJsonErrorResponse(errors.New("not valid email address")))
+		return
+	}
+
+	// Hash the provided password before saving
+	user.Password, err = utils.HashPassword(user.Password)
+	if err != nil {
+		aH.logger.Error("AddUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	aH.logger.Debug("AddUser", "add default quasar user setting ")
+	user.Settings.DefaultQuasarSettings()
+
+	aH.logger.Debug("AddUser", "add new user "+user.Name+" with role "+user.Role.Role)
+
+	if user.Role.Id != 0 {
+		if err := aH.dbHandler.GetById(&user.Role, "", user.Role.Id); err != nil {
+			aH.logger.Error("AddUser", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	} else {
+		if err := aH.dbHandler.GetByKey(&user.Role, "", "role", user.Role.Role, false); err != nil {
+			aH.logger.Error("AddUser", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	}
+	user.RoleID = &user.Role.Id
+
+	// Insert the new user record
+	if err := aH.dbHandler.AddNewColum(&user); err != nil {
+		aH.logger.Error("AddUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("user '%s' successfully added", user.Name),
+	})
+}
+
+func (aH *AccessHandler) ChangePassword(c *gin.Context) {
+	var user models.User
+	err := c.BindJSON(&user)
+	if err != nil {
+		aH.logger.Error("ChangePassword", err)
+		c.JSON(http.StatusInternalServerError, models.NewJsonErrorResponse(err))
+		return
+	}
+
+	// get user to check ChangePassword
+	var dbRecord models.User
+	err = aH.dbHandler.GetById(&dbRecord, "Role", user.Id)
+	if err != nil {
+		aH.logger.Error("ChangePassword", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	// Check if old password is correct
+	if !utils.CheckPassword(user.Password, dbRecord.Password) {
+		// Found a user → skip create
+		aH.logger.Error("ChangePassword", "wrong password entered for user: "+user.Name)
+		c.JSON(http.StatusBadRequest, models.NewJsonMessageResponse("invalid credentials"))
+		return
+	}
+
+	// Hash the provided password before saving
+	user.Password, err = utils.HashPassword(user.NewPassword)
+	if err != nil {
+		aH.logger.Error("ChangePassword", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	aH.logger.Debug("ChangePassword", "change user "+user.Name+" password")
+
+	// Update user
+	aH.dbHandler.UpdateValuesById(&user, "Role", user.Id)
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("password of user '%s' changed", user.Name),
+	})
+}
+
+func (aH *AccessHandler) GetUser(c *gin.Context) {
+	var i int
+	var err error
+
+	id := c.Query("id")
+	if id == "undefined" || id == "null" || id == "" {
+		i = 0
+	} else {
+		i, err = strconv.Atoi(id)
+		if err != nil {
+			aH.logger.Error("GetUser", err)
+			c.JSON(http.StatusInternalServerError, nil)
+			return
+		}
+	}
+
+	var users []models.User
+	err = aH.dbHandler.GetById(&users, "Role", uint(i))
+	if err != nil {
+		aH.logger.Error("GetUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, users)
+}
+
+func (aH *AccessHandler) UpdateUser(c *gin.Context) {
+	var user models.User
+	if err := c.BindJSON(&user); err != nil {
+		aH.logger.Error("UpdateUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	err := aH.dbHandler.UpdateValuesById(&user, "Role", user.Id)
+	if err != nil {
+		aH.logger.Error("UpdateUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+	c.JSON(http.StatusOK, models.NewJsonMessageResponse("successfully updated user '"+user.Email+"'"))
+}
+
+func (aH *AccessHandler) DeleteUser(c *gin.Context) {
+	queryId := c.Query("id")
+
+	if queryId == "" || queryId == "null" || queryId == "undefined" {
+		aH.logger.Error("DeleteUser", "id query missing or wrong value: "+queryId)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "id query missing or wrong value: " + queryId,
+		})
+		return
+	}
+
+	var request struct {
+		Ids []int `json:"ids"`
+	}
+
+	err := c.BindJSON(&request)
+	if err != nil {
+		aH.logger.Error("DeleteUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	if len(request.Ids) == 0 {
+		aH.logger.Error("DeleteUser", "no ids given to be deleted")
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "no ids given to be deleted",
+		})
+		return
+	}
+
+	var ownId string
+	removeIds := make([]uint, len(request.Ids))
+	for i, id := range request.Ids {
+		if queryId == fmt.Sprint(id) {
+			ownId = queryId
+			continue
+		}
+		removeIds[i] = uint(id)
+	}
+
+	if ownId != "" {
+		aH.logger.Error("DeleteUser", "can not delete logged in member id: "+queryId)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"message": "can not delete logged in member id: " + queryId,
+			"id":      queryId,
+		})
+		return
+	}
+
+	err = aH.dbHandler.DeleteById(&models.User{}, "", removeIds...)
+	if err != nil {
+		aH.logger.Error("DeleteUser", err)
+		c.JSON(http.StatusInternalServerError, nil)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "member(s) deleted",
+	})
+}

internal/utils/utils.go

@@ -0,0 +1,8 @@
+package utils
+
+import "regexp"
+
+func IsValidEmail(email string) bool {
+	re := regexp.MustCompile(`^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`)
+	return re.MatchString(email)
+}

models/permission.go

@@ -12,8 +12,10 @@ func (r *Permissions) DefaultPermissions() {
 	*r = append(*r,
 		Permission{Name: "settings", Permission: 7},
 		Permission{Name: "userSettings", Permission: 7},
-		Permission{Name: "members", Permission: 7},
+		Permission{Name: "members", Permission: 31},
 		Permission{Name: "events", Permission: 7},
+		Permission{Name: "responsible", Permission: 7},
+		Permission{Name: "group", Permission: 7},
 	)
 }
 

models/role.go

@@ -5,3 +5,7 @@ type Role struct {
 	Role        string      `gorm:"column:role" json:"role"`
 	Permissions Permissions `gorm:"type:json" json:"permissions"`
 }
+
+func (r *Role) IsValid() bool {
+	return r.Role != ""
+}

models/settings.go

@@ -12,6 +12,7 @@ type Settings struct {
 	SecondaryColor     string `json:"secondaryColor,omitempty"`
 	SecondaryColorText string `json:"secondaryColorText,omitempty"`
 	Icon               string `json:"icon,omitempty"`
+	AppName            string `json:"appName,omitempty"`
 	DatabaseName       string `json:"databaseName,omitempty"`
 	DatabaseToken      string `json:"databaseToken,omitempty"`
 }

models/user.go

@@ -1,14 +1,30 @@
 package models
 
+import (
+	"time"
+)
+
 type User struct {
 	Id          uint     `gorm:"primaryKey" json:"id"`
 	Name        string   `gorm:"column:user_name" json:"user"`
 	Email       string   `gorm:"column:email" json:"email"`
-	Role     string   `gorm:"column:role" json:"role"`
+	RoleID      *uint    `gorm:"column:roleId" json:"roleId,omitempty"`
+	Role        *Role    `gorm:"foreignKey:RoleID" json:"role,omitempty"`
 	Password    string   `gorm:"column:password" json:"password"`
+	NewPassword string   `gorm:"-" json:"newPassword,omitempty"`
+	Expiration  string   `gorm:"column:expiration" json:"expiration,omitempty"`
 	Settings    Settings `gorm:"type:json" json:"settings"`
 }
 
 func (u *User) IsValid() bool {
 	return u.Name != ""
 }
+
+func (u *User) ExpirationIsValid() bool {
+	if u.Expiration == "" || u.Expiration == "never" {
+		return true
+	}
+	loc := time.Now().Location()
+	parsedTime, _ := time.ParseInLocation("2006-01-02 15:04:05", u.Expiration, loc)
+	return parsedTime.After(time.Now())
+}

role.go

@@ -1,197 +0,0 @@
-package AccessHandler
-
-import (
-	"fmt"
-
-	"gitea.tecamino.com/paadi/access-handler/models"
-)
-
-// AddRoleTable
-//
-// Description:
-//
-//	Creates a new database table for storing role definitions if it does not already exist.
-//
-// Behavior:
-//   - Uses the DBHandler to add a table based on the `models.Role` struct.
-//   - Returns an error if table creation fails.
-//
-// Returns:
-//   - error: Any database error encountered.
-func (aH *AccessHandler) AddRoleTable() error {
-	return aH.dbHandler.addNewTable(models.Role{})
-}
-
-// AddDefaultRole
-//
-// Description:
-//
-//	Ensures that a default administrative role exists in the database.
-//	If a role named "admin" is already present, it logs and skips creation.
-//
-// Behavior:
-//  1. Checks for an existing "admin" role.
-//  2. If not found, initializes default permissions using
-//     `models.Permissions.DefaultPermissions()`.
-//  3. Creates a new role record with those permissions.
-//
-// Default Role:
-//   - Role: "admin"
-//   - Permissions: all default permissions defined in `models.Permissions`.
-//
-// Returns:
-//   - error: Any database or creation error encountered.
-func (aH *AccessHandler) AddDefaultRole() (err error) {
-	role := "admin"
-
-	// Check if a role with this name already exists
-	if err := aH.dbHandler.exists(&models.Role{}, "role", role, false); err == nil {
-		// Found a role → skip creation
-		aH.logger.Debug("AddDefaultRole", "role "+role+" exists already")
-		return nil
-	}
-
-	// Initialize default permissions for admin
-	permissions := models.Permissions{}
-	aH.logger.Debug("AddDefaultRole", "set default Permissions")
-	permissions.DefaultPermissions()
-
-	// Create the default admin role
-	aH.dbHandler.addNewColum(&models.Role{
-		Role:        role,
-		Permissions: permissions,
-	})
-	return
-}
-
-// AddNewRole
-//
-// Description:
-//
-//	Adds a new role with a specific set of permissions to the database.
-//
-// Behavior:
-//  1. Checks whether a role with the same name already exists.
-//  2. If it does not exist, creates a new role record.
-//
-// Parameters:
-//   - role:        The role name (e.g., "manager", "viewer").
-//   - permissions: A `models.Permissions` struct defining allowed actions.
-//
-// Returns:
-//   - error: If the role already exists or insertion fails.
-func (aH *AccessHandler) AddNewRole(role string, permissions models.Permissions) (err error) {
-	// Check if a role with this name already exists
-	if err := aH.dbHandler.exists(&models.Role{}, "role", role, false); err == nil {
-		// Found a role → skip creation
-		return fmt.Errorf("role with name %s already exists", role)
-	}
-
-	// Insert new role with provided permissions
-	aH.dbHandler.addNewColum(&models.Role{
-		Role:        role,
-		Permissions: permissions,
-	})
-	return
-}
-
-// GetRoleById
-//
-// Description:
-//
-//	Retrieves a role record from the database by its numeric ID.
-//
-// Parameters:
-//   - id: The unique ID of the role.
-//
-// Returns:
-//   - roles: A slice containing the matched role (usually length 1).
-//   - err:   Any database error encountered.
-func (aH *AccessHandler) GetRoleById(id uint) (roles []models.Role, err error) {
-	err = aH.dbHandler.getById(&roles, id)
-	return
-}
-
-// GetRoleByKey
-//
-// Description:
-//
-//	Retrieves one or more roles based on a key/value query.
-//
-// Parameters:
-//   - key:        The column name to search by (e.g., "role").
-//   - value:      The value to match (e.g., "admin").
-//   - likeSearch: Whether to use SQL LIKE for partial matches.
-//
-// Returns:
-//   - roles: A list of matched roles.
-//   - err:   Any database error encountered.
-func (aH *AccessHandler) GetRoleByKey(key string, value any, likeSearch bool) (roles []models.Role, err error) {
-	err = aH.dbHandler.getByKey(&roles, key, value, likeSearch)
-	return
-}
-
-// UpdateRoleById
-//
-// Description:
-//
-//	Updates a role record identified by its numeric ID.
-//
-// Parameters:
-//   - id:   The ID of the role to update.
-//   - role: A struct containing updated role data.
-//
-// Returns:
-//   - error: Any database error encountered.
-func (aH *AccessHandler) UpdateRoleById(id uint, role models.Role) error {
-	return aH.dbHandler.updateValuesById(&role, id)
-}
-
-// UpdateRoleByKey
-//
-// Description:
-//
-//	Updates a role record using a column key/value lookup.
-//
-// Parameters:
-//   - role:  The updated role data.
-//   - key:   The column name to search by.
-//   - value: The value to match against the key column.
-//
-// Returns:
-//   - error: Any database error encountered.
-func (aH *AccessHandler) UpdateRoleByKey(role models.Role, key string, value any) error {
-	return aH.dbHandler.updateValuesByKey(&role, key, value)
-}
-
-// DeleteRoleById
-//
-// Description:
-//
-//	Deletes a role record from the database by its numeric ID.
-//
-// Parameters:
-//   - id: The ID of the role to delete.
-//
-// Returns:
-//   - error: Any database error encountered during deletion.
-func (aH *AccessHandler) DeleteRoleById(id uint) (err error) {
-	return aH.dbHandler.deleteById(&models.Role{}, id)
-}
-
-// DeleteRoleByKey
-//
-// Description:
-//
-//	Deletes one or more roles from the database matching a given key/value pair.
-//
-// Parameters:
-//   - key:        The column name used for filtering (e.g., "role").
-//   - value:      The matching value (e.g., "admin").
-//   - likeSearch: If true, performs a LIKE (partial) match.
-//
-// Returns:
-//   - error: Any database error encountered.
-func (aH *AccessHandler) DeleteRoleByKey(key string, value any, likeSearch bool) (err error) {
-	return aH.dbHandler.deleteByKey(&models.Role{}, key, value, likeSearch)
-}

user.go

@@ -1,218 +0,0 @@
-package AccessHandler
-
-import (
-	"fmt"
-
-	"gitea.tecamino.com/paadi/access-handler/models"
-	"gitea.tecamino.com/paadi/access-handler/utils"
-)
-
-// AddUserTable
-//
-// Description:
-//
-//	Creates a new database table for storing user records if it does not already exist.
-//
-// Behavior:
-//   - Uses the DBHandler to add a table based on the `models.User` struct.
-//   - Returns any error encountered during table creation.
-//
-// Returns:
-//   - error: Any database error that occurs while creating the table.
-func (aH *AccessHandler) AddUserTable() error {
-	return aH.dbHandler.addNewTable(models.User{})
-}
-
-// AddDefaultUser
-//
-// Description:
-//
-//	Ensures a default administrative user exists in the database.
-//	If a user with the predefined email already exists, the function logs
-//	a debug message and exits without making changes.
-//
-// Behavior:
-//  1. Checks if the default user (admin) already exists by email.
-//  2. If not found, creates default Quasar UI settings and adds the user.
-//
-// Default User:
-//   - Name:  "admin"
-//   - Role:  "admin"
-//   - Email: "zuercher@tecamino.ch"
-//   - Password: (empty or hashed later)
-//
-// Returns:
-//   - error: Any database or creation error encountered.
-func (aH *AccessHandler) AddDefaultUser() (err error) {
-	name := "admin"
-	role := "admin"
-	email := "zuercher@tecamino.ch"
-
-	// Check if a user with this email already exists
-	if err := aH.dbHandler.exists(&models.User{}, "email", email, false); err == nil {
-		aH.logger.Debug("AddDefaultUser", "user email "+email+" exists already")
-		// Found a user → skip create
-		return nil
-	}
-
-	// Create default settings for the new user
-	settings := models.Settings{}
-	aH.logger.Debug("AddDefaultUser", "set default quasar settings")
-	settings.DefaultQuasarSettings()
-
-	// Insert default admin user into the database
-	aH.dbHandler.addNewColum(&models.User{
-		Name:     name,
-		Role:     role,
-		Email:    email,
-		Password: "$2a$10$sZZOWBP8DSFLrLFQNoXw8OsEEr0tez1B8lPzKCHofaHg6PMNxx1pG",
-		Settings: settings,
-	})
-	return
-}
-
-// AddNewUser
-//
-// Description:
-//
-//	Adds a new user record to the database with a hashed password.
-//
-// Behavior:
-//  1. Verifies that the email does not already exist.
-//  2. Hashes the password using utils.HashPassword().
-//  3. Inserts the new user record into the database.
-//
-// Parameters:
-//   - userName: The user's display name.
-//   - email:    The user's unique email address.
-//   - password: The user's raw password (will be hashed).
-//   - role:     The role assigned to the user.
-//
-// Returns:
-//   - error: If the user already exists or if hashing/insertion fails.
-func (aH *AccessHandler) AddNewUser(userName, email, password, role string) (err error) {
-	// Check if a user with this email already exists
-	if err := aH.dbHandler.exists(&models.User{}, "email", email, false); err == nil {
-		// Found a user → skip create
-		aH.logger.Error("AddNewUser", "user with email "+email+" already exists")
-		return fmt.Errorf("user with email %s already exists", email)
-	}
-
-	// Hash the provided password before saving
-	hash, err := utils.HashPassword(password)
-	if err != nil {
-		return err
-	}
-
-	aH.logger.Debug("AddNewUser", "add new user "+userName+" with role "+role)
-
-	// Insert the new user record
-	aH.dbHandler.addNewColum(&models.User{
-		Name:     userName,
-		Role:     role,
-		Email:    email,
-		Password: hash,
-	})
-	return
-}
-
-// GetUserById
-//
-// Description:
-//
-//	Retrieves user(s) from the database by their unique ID.
-//
-// Parameters:
-//   - id: The numeric user ID.
-//
-// Returns:
-//   - users: A slice containing the matched user (usually length 1).
-//   - err:   Any database error encountered.
-func (aH *AccessHandler) GetUserById(id uint) (users []models.User, err error) {
-	err = aH.dbHandler.getById(&users, id)
-	return
-}
-
-// GetUserByKey
-//
-// Description:
-//
-//	Queries users based on a given column key and value.
-//
-// Parameters:
-//   - key:        The column name to search by (e.g., "email").
-//   - value:      The value to match.
-//   - likeSearch: If true, performs a LIKE (partial) search.
-//
-// Returns:
-//   - users: A list of users that match the search criteria.
-//   - err:   Any database error encountered.
-func (aH *AccessHandler) GetUserByKey(key string, value any, likeSearch bool) (users []models.User, err error) {
-	err = aH.dbHandler.getByKey(&users, key, value, likeSearch)
-	return
-}
-
-// UpdateUserById
-//
-// Description:
-//
-//	Updates an existing user record identified by its numeric ID.
-//
-// Parameters:
-//   - id:   The user ID to update.
-//   - user: A struct containing updated field values.
-//
-// Returns:
-//   - error: Any error encountered during the update.
-func (aH *AccessHandler) UpdateUserById(id uint, user models.User) error {
-	return aH.dbHandler.updateValuesById(&user, id)
-}
-
-// UpdateUserByKey
-//
-// Description:
-//
-//	Updates a user record based on a specified column key and value.
-//
-// Parameters:
-//   - user:       The updated user data.
-//   - key:        The column name used for lookup.
-//   - value:      The value to match against the key column.
-//
-// Returns:
-//   - error: Any error encountered during the update.
-func (aH *AccessHandler) UpdateUserByKey(user models.User, key string, value any) error {
-	return aH.dbHandler.updateValuesByKey(&user, key, value)
-}
-
-// DeleteUserById
-//
-// Description:
-//
-//	Deletes a user from the database using their numeric ID.
-//
-// Parameters:
-//   - id: The ID of the user to delete.
-//
-// Returns:
-//   - error: Any database error encountered during deletion.
-func (aH *AccessHandler) DeleteUserById(id uint) (err error) {
-	return aH.dbHandler.deleteById(&models.User{}, id)
-}
-
-// DeleteUserByKey
-//
-// Description:
-//
-//	Deletes users matching a specific key/value pair from the database.
-//
-// Parameters:
-//   - key:        The column name to search by.
-//   - value:      The value to match.
-//   - likeSearch: Whether to use a partial match (LIKE).
-//
-// Returns:
-//   - error: Any database error encountered during deletion.
-func (aH *AccessHandler) DeleteUserByKey(key string, value any, likeSearch bool) (err error) {
-	return aH.dbHandler.deleteByKey(&models.User{}, key, value, likeSearch)
-}