Merge pull request #14 from isoppp/feature/role-handling

role handling and me api

Author: isoppp

db/migrations/000001_init_schema.down.sql

@@ -3,3 +3,4 @@ DROP TABLE IF EXISTS user_role;
 DROP TABLE IF EXISTS roles;
 DROP TABLE IF EXISTS sessions;
 DROP TABLE IF EXISTS users;
+DROP TYPE IF EXISTS user_role_type;

db/migrations/000001_init_schema.up.sql

@@ -15,12 +15,13 @@ CREATE TABLE "sessions"
     "created_at" timestamptz      NOT NULL DEFAULT (now())
 );
 
+DROP TYPE IF EXISTS user_role_type;
+CREATE TYPE user_role_type AS ENUM('Admin', 'User', 'TEST_DUMMY1', 'TEST_DUMMY2');
+
 CREATE TABLE "roles"
 (
     "id"         SERIAL PRIMARY KEY,
-    "name"       varchar UNIQUE NOT NULL,
-    "created_at" timestamptz    NOT NULL DEFAULT (now()),
-    "updated_at" timestamptz    NOT NULL DEFAULT (now())
+    "name"       user_role_type UNIQUE NOT NULL
 );
 
 CREATE TABLE "user_role"

db/seed.sql

@@ -1,21 +1,21 @@
-INSERT INTO roles (id, name)
-VALUES (1, 'Admin'), (2, 'User')
+INSERT INTO roles (name)
+VALUES ('Admin'), ('User')
 ON CONFLICT DO NOTHING;
 
-INSERT INTO users (id, email, hashed_password)
-VALUES (1, '[email protected]', 'asdf1234'), (2, '[email protected]', 'asdf1234'), (3, '[email protected]', 'asdf1234')
+INSERT INTO users (email, hashed_password)
+VALUES ('[email protected]', 'asdf1234'), ('[email protected]', 'asdf1234'), ('[email protected]', 'asdf1234')
 ON CONFLICT DO NOTHING;
 
 INSERT INTO user_role (user_id, role_id)
 VALUES (1, 1), (2, 2), (3, 2)
 ON CONFLICT DO NOTHING;
 
-INSERT INTO posts (id, user_id, content)
+INSERT INTO posts (user_id, content)
 VALUES
-    (1, 2, 'Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo. Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus. Phasellus viverra nulla ut metus varius laoreet. Quisque rutrum. Aenean imperdiet. Etiam ultricies nisi vel augue. Curabitur ullamcorper ultricies nisi. Nam eget dui. Etiam rhoncus. Maecenas tempus, tellus eget condimentum rhoncus, sem quam semper libero, sit amet adipiscing sem neque sed ipsum. Nam quam nunc, blandit vel, luctus pulvinar, hendrerit id, lorem. Maecenas nec odio et ante tincidunt tempus. Donec vitae sapien ut libero venenatis faucibus. Nullam quis ante. Etiam sit amet orci eget eros faucibus tincidunt. Duis leo. Sed fringilla mauris sit amet nibh. Donec sodales sagittis magna. Sed consequat, leo eget bibendum sodales, augue velit cursus nunc,'),
-    (2, 2, 'post 2'),
-    (3, 2, 'post 3'),
-    (4, 3, 'post 4'),
-    (5, 3, 'post 5')
+    (2, 'Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Aenean commodo ligula eget dolor. Aenean massa. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Donec quam felis, ultricies nec, pellentesque eu, pretium quis, sem. Nulla consequat massa quis enim. Donec pede justo, fringilla vel, aliquet nec, vulputate eget, arcu. In enim justo, rhoncus ut, imperdiet a, venenatis vitae, justo. Nullam dictum felis eu pede mollis pretium. Integer tincidunt. Cras dapibus. Vivamus elementum semper nisi. Aenean vulputate eleifend tellus. Aenean leo ligula, porttitor eu, consequat vitae, eleifend ac, enim. Aliquam lorem ante, dapibus in, viverra quis, feugiat a, tellus. Phasellus viverra nulla ut metus varius laoreet. Quisque rutrum. Aenean imperdiet. Etiam ultricies nisi vel augue. Curabitur ullamcorper ultricies nisi. Nam eget dui. Etiam rhoncus. Maecenas tempus, tellus eget condimentum rhoncus, sem quam semper libero, sit amet adipiscing sem neque sed ipsum. Nam quam nunc, blandit vel, luctus pulvinar, hendrerit id, lorem. Maecenas nec odio et ante tincidunt tempus. Donec vitae sapien ut libero venenatis faucibus. Nullam quis ante. Etiam sit amet orci eget eros faucibus tincidunt. Duis leo. Sed fringilla mauris sit amet nibh. Donec sodales sagittis magna. Sed consequat, leo eget bibendum sodales, augue velit cursus nunc,'),
+    (2, 'post 2'),
+    (2, 'post 3'),
+    (3, 'post 4'),
+    (3, 'post 5')
 ON CONFLICT DO NOTHING;
 

internal/boilmodels/boil_types.go

@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"sandbox-go-api-sqlboiler-rest-auth/internal/boilmodels"
 	"sandbox-go-api-sqlboiler-rest-auth/internal/middleware"
-	"time"
 
 	"github.com/volatiletech/sqlboiler/v4/boil"
 
@@ -15,10 +14,9 @@ import (
 )
 
 type PublicUser struct {
-	ID        int       `boil:"id" json:"id"`
-	Email     string    `boil:"email" json:"email"`
-	CreatedAt time.Time `boil:"created_at" json:"created_at"`
-	UpdatedAt time.Time `boil:"updated_at" json:"updated_at"`
+	ID    int                  `json:"id"`
+	Email string               `json:"email"`
+	Roles boilmodels.RoleSlice `json:"roles,omitempty"`
 }
 
 type UsersData struct {
@@ -34,6 +32,22 @@ type CreateUserRequest struct {
 	Password string `json:"password"`
 }
 
+func Me(c echo.Context) error {
+	cc := c.(*middleware.CustomContext)
+	cu := cc.CurrentUser
+	cc.ZapLogger.Info("cu:", cu)
+	if cu == nil {
+		return echo.NewHTTPError(http.StatusForbidden, http.StatusText(http.StatusForbidden))
+	}
+	return c.JSON(http.StatusOK, JsonSuccessResponse(UserData{
+		User: &PublicUser{
+			ID:    cu.ID,
+			Email: cu.Email,
+			Roles: cu.R.Roles,
+		},
+	}))
+}
+
 func GetUsers(c echo.Context) error {
 	cc := c.(*middleware.CustomContext)
 	ctx := cc.Request().Context()
@@ -43,6 +57,7 @@ func GetUsers(c echo.Context) error {
 		c.Error(err)
 		return err
 	}
+
 	return c.JSON(http.StatusOK, JsonSuccessResponse(UsersData{
 		Users: &users,
 	}))
@@ -86,19 +101,32 @@ func CreateUser(c echo.Context) error {
 	if err := c.Bind(req); err != nil {
 		return echo.NewHTTPError(http.StatusBadRequest, err.Error())
 	}
+
+	r, err := boilmodels.Roles(qm.Where("name = ?", boilmodels.UserRoleTypeUser)).One(ctx, cc.DB)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	}
+	cc.ZapLogger.Info(r.Name)
+
 	u := boilmodels.User{
 		Email:          req.Email,
 		HashedPassword: req.Password,
 	}
-	err := u.Insert(ctx, cc.DB, boil.Infer())
+
+	err = u.Insert(ctx, cc.DB, boil.Infer())
 	if err != nil {
 		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
 	}
+
+	err = u.SetRoles(ctx, cc.DB, false, r)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	}
+
 	pu := PublicUser{
-		ID:        u.ID,
-		Email:     u.Email,
-		CreatedAt: u.CreatedAt,
-		UpdatedAt: u.UpdatedAt,
+		ID:    u.ID,
+		Email: u.Email,
+		Roles: u.R.Roles,
 	}
 
 	return c.JSON(http.StatusOK, JsonSuccessResponse(UserData{

internal/boilmodels/roles.go

@@ -8,6 +8,8 @@ import (
 	"sandbox-go-api-sqlboiler-rest-auth/internal/cookie"
 	"time"
 
+	"github.com/volatiletech/sqlboiler/v4/queries/qm"
+
 	"github.com/gorilla/securecookie"
 
 	"go.uber.org/zap"
@@ -44,9 +46,9 @@ func SessionRestorer(db *sql.DB, logger *zap.SugaredLogger, sc *securecookie.Sec
 			sess, err := boilmodels.FindSession(c.Request().Context(), db, dv)
 			if err != nil {
 				// maybe wrong cookie id?
-				return echo.NewHTTPError(500, "cannot get cookie, but got session id", dv, err)
+				return echo.NewHTTPError(500, "cannot get user by session id in cookie", dv, err)
 			}
-			user, err := sess.User().One(c.Request().Context(), db)
+			user, err := sess.User(qm.Load(boilmodels.UserRels.Roles)).One(c.Request().Context(), db)
 			if err != nil {
 				return echo.NewHTTPError(500, "cannod find user from session relation", dv, err)
 			}

internal/boilmodels/roles_test.go

@@ -21,6 +21,7 @@ func bindRoutes(e *echo.Echo, cfg *config.Config, l *zap.Logger, db *sql.DB, sc
 	e.DELETE("/api/v1/sessions", handlers.DeleteSession)
 
 	// users
+	e.GET("/api/v1/me", handlers.Me)
 	e.GET("/api/v1/users", handlers.GetUsers)
 	e.POST("/api/v1/users", handlers.CreateUser)
 	e.GET("/api/v1/users/:id", handlers.GetUser)