7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
84 lines
1.9 KiB
Go
84 lines
1.9 KiB
Go
package handlers
|
|
|
|
import (
|
|
"net/http"
|
|
"strconv"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
|
|
"github.com/treytartt/casera-api/internal/apperrors"
|
|
"github.com/treytartt/casera-api/internal/middleware"
|
|
"github.com/treytartt/casera-api/internal/services"
|
|
)
|
|
|
|
// UserHandler handles user-related HTTP requests
|
|
type UserHandler struct {
|
|
userService *services.UserService
|
|
}
|
|
|
|
// NewUserHandler creates a new user handler
|
|
func NewUserHandler(userService *services.UserService) *UserHandler {
|
|
return &UserHandler{
|
|
userService: userService,
|
|
}
|
|
}
|
|
|
|
// ListUsers handles GET /api/users/
|
|
func (h *UserHandler) ListUsers(c echo.Context) error {
|
|
user, err := middleware.MustGetAuthUser(c)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Only allow listing users that share residences with the current user
|
|
users, err := h.userService.ListUsersInSharedResidences(user.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return c.JSON(http.StatusOK, map[string]interface{}{
|
|
"count": len(users),
|
|
"results": users,
|
|
})
|
|
}
|
|
|
|
// GetUser handles GET /api/users/:id/
|
|
func (h *UserHandler) GetUser(c echo.Context) error {
|
|
user, err := middleware.MustGetAuthUser(c)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
userID, err := strconv.ParseUint(c.Param("id"), 10, 32)
|
|
if err != nil {
|
|
return apperrors.BadRequest("error.invalid_user_id")
|
|
}
|
|
|
|
// Can only view users that share a residence
|
|
targetUser, err := h.userService.GetUserIfSharedResidence(uint(userID), user.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return c.JSON(http.StatusOK, targetUser)
|
|
}
|
|
|
|
// ListProfiles handles GET /api/users/profiles/
|
|
func (h *UserHandler) ListProfiles(c echo.Context) error {
|
|
user, err := middleware.MustGetAuthUser(c)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// List profiles of users in shared residences
|
|
profiles, err := h.userService.ListProfilesInSharedResidences(user.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return c.JSON(http.StatusOK, map[string]interface{}{
|
|
"count": len(profiles),
|
|
"results": profiles,
|
|
})
|
|
}
|