work on determining which secrets accessible to user

controllers/store_secrets.go

@@ -226,6 +226,26 @@ func UpdateSecret(c *gin.Context) {
 	s.DeviceName = input.DeviceName
 	s.DeviceCategory = input.DeviceCategory
 
+	secretList, err := models.SecretsGetAllowedForGroup(&s, user_id)
+
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("error determining secret : '%s'", err)})
+		return
+	}
+
+	if len(secretList) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no secret matching search parameters"})
+		return
+	} else if len(secretList) == 1 {
+		// Update secret
+		log.Printf("mock updating secret\n")
+		c.JSON(http.StatusOK, gin.H{"message": "secret updated successfully"})
+	} else {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "multiple secrets matched search parameters, be more specific"})
+		return
+	}
+
+	/*
 		// TODO:
 		// Get a list of matching secrets - SecretsSearchAllSafes
 		//secretList, err := models.SecretsSearchAllSafes(&s)
@@ -244,19 +264,6 @@ func UpdateSecret(c *gin.Context) {
 		if allowedUpdate != 0 {
 			s.SafeId = allowedUpdate
 		}
-
-	// Query which safes the current user is allowed to access
-
-	/*
-		safeId := SecretCheckSafeAllowed(int(user_id), input)
-		if safeId == 0 {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "error determining safe"})
-			return
-		}
-
-		s.SafeId = safeId
-	*/
-
 		// TODO - replace this with a call to SecretsGetMultipleSafes
 
 		// Confirm that the secret already exists
@@ -304,6 +311,7 @@ func UpdateSecret(c *gin.Context) {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+	*/
 
 }
 

models/permissions.go

@@ -2,6 +2,8 @@ package models
 
 type Permission struct {
 	PermissionId int    `db:"PermissionId"`
+	Description  string `db:"Description"`
+	ReadOnly     bool   `db:"ReadOnly"`
 	RoleId       int    `db:"RoleId"`
 	SafeId       int    `db:"SafeId"`
 	GroupId      int    `db:"GroupId"`

models/secret.go

@@ -17,7 +17,6 @@ import (
 // We use the json:"-" field tag to prevent showing these details to the user
 type Secret struct {
 	SecretId       int    `db:"SecretId" json:"-"`
-	//RoleId         int    `db:"RoleId" json:"-"`
 	SafeId         int    `db:"SafeId"`
 	DeviceName     string `db:"DeviceName"`
 	DeviceCategory string `db:"DeviceCategory"`
@@ -46,6 +45,81 @@ func (s *Secret) SaveSecret() (*Secret, error) {
 	return s, nil
 }
 
+func SecretsGetAllowedForUser(s *Secret, userId string) ([]UserSecret, error) {
+	// Query based on group
+	// SELECT users.UserId, users.GroupId, permissions.ReadOnly, permissions.SafeId, safes.SafeName, secrets.* FROM users INNER JOIN groups ON users.GroupId = groups.GroupId INNER JOIN permissions ON groups.GroupId = permissions.GroupId INNER JOIN safes on permissions.SafeId = safes.SafeId INNER JOIN secrets on secrets.SafeId = safes.SafeId WHERE users.UserId = 2
+	var secretResults []UserSecret
+
+	return secretResults, nil
+}
+
+func SecretsGetAllowedForGroup(s *Secret, userId int) ([]UserSecret, error) {
+	// Query based on group
+	// SELECT users.UserId, users.GroupId, permissions.ReadOnly, permissions.SafeId, safes.SafeName, secrets.* FROM users INNER JOIN groups ON users.GroupId = groups.GroupId INNER JOIN permissions ON groups.GroupId = permissions.GroupId INNER JOIN safes on permissions.SafeId = safes.SafeId INNER JOIN secrets on secrets.SafeId = safes.SafeId WHERE users.UserId = 2
+	var err error
+	var secretResults []UserSecret
+
+	args := []interface{}{}
+	query := "users.UserId, users.GroupId, permissions.ReadOnly, permissions.SafeId, safes.SafeName, secrets.* FROM users INNER JOIN groups ON users.GroupId = groups.GroupId INNER JOIN permissions ON groups.GroupId = permissions.GroupId INNER JOIN safes on permissions.SafeId = safes.SafeId INNER JOIN secrets on secrets.SafeId = safes.SafeId WHERE users.UserId = ? "
+	args = append(args, userId)
+
+	// Make sure at least one parameter was specified
+	if s.DeviceName == "" && s.DeviceCategory == "" && s.UserName == "" {
+		err = errors.New("no search parameters specified")
+		log.Println(err)
+		return secretResults, err
+	}
+
+	// Add any other arguments to the query if they were specified
+	if s.DeviceName != "" {
+		query += " AND DeviceName LIKE ? "
+		args = append(args, s.DeviceName)
+	}
+
+	if s.DeviceCategory != "" {
+		query += " AND DeviceCategory LIKE ? "
+		args = append(args, s.DeviceCategory)
+	}
+
+	if s.UserName != "" {
+		query += " AND UserName LIKE ? "
+		args = append(args, s.UserName)
+	}
+
+	// Execute the query
+	log.Printf("SecretsGetAllowedForGroup query string : '%s'\n%+v\n", query, args)
+	rows, err := db.Queryx(query, args...)
+
+	if err != nil {
+		log.Printf("SecretsGetAllowedForGroup error executing sql record : '%s'\n", err)
+		return secretResults, err
+	} else {
+		// parse all the results into a slice
+		for rows.Next() {
+			var r UserSecret
+			err = rows.StructScan(&r)
+			if err != nil {
+				log.Printf("SecretsGetAllowedForGroup error parsing sql record : '%s'\n", err)
+				return secretResults, err
+			}
+
+			// Decrypt the secret
+			_, err = r.DecryptSecret()
+			if err != nil {
+				//log.Printf("GetSecret unable to decrypt stored secret '%v' : '%s'\n", r.Secret, err)
+				log.Printf("SecretsGetAllowedForGroup unable to decrypt stored secret : '%s'\n", err)
+				return secretResults, err
+			} else {
+				secretResults = append(secretResults, r)
+			}
+
+		}
+		log.Printf("SecretsGetAllowedForGroup retrieved '%d' results\n", len(secretResults))
+	}
+
+	return secretResults, nil
+}
+
 func SecretsSearchAllSafes(s *Secret) ([]Secret, error) {
 	var err error
 	var secretResults []Secret

models/setup.go

@@ -374,6 +374,8 @@ func CreateTables() {
 			FOREIGN KEY (GroupId) REFERENCES groups(GroupId)
 		);
 		INSERT INTO permissions SELECT PermissionId, SafeId, UserId, GroupId, '' AS Description, 0 as ReadOnly FROM _permissions_old;
+		UPDATE permissions SET ReadOnly = 0 WHERE ReadOnly is null;
+		UPDATE permissions SET Description = '' WHERE Description is null;
 		COMMIT;
 		PRAGMA foreign_keys=on;
 		DROP TABLE _permissions_old;

models/user.go

@@ -35,6 +35,7 @@ type UserGroup struct {
 	Admin     bool   `db:"Admin"`
 }
 
+// Combine Users and Safes to determine which safes a user has access to
 type UserSafe struct {
 	User
 	SafeId   int    `db:"SafeId"`
@@ -42,6 +43,13 @@ type UserSafe struct {
 	GroupId  int    `db:"GroupId"`
 }
 
+// Used for querying all secrets the user has access to
+type UserSecret struct {
+	User
+	Group
+	Secret
+}
+
 func (u *User) SaveUser() (*User, error) {
 
 	var err error