SirBlob/TypstDrive
1
0
Fork 0
Code Actions Packages Activity

Update Version: 1.4.0

Browse Source
This commit is contained in:
SirBlob
2026-05-14 18:40:27 -04:00
parent 6178e9e55b
commit 7afd726188
21 changed files with 1051 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/Cargo.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "server"
version = "1.3.0"
version = "1.4.0"
edition = "2021"
[dependencies]
server/src/admin.rs
+140
View File
@@ -0,0 +1,140 @@
use axum::{
extract::{Path, State},
http::StatusCode,
Json,
};
use axum_extra::extract::cookie::SignedCookieJar;
use uuid::Uuid;
use argon2::{
password_hash::{rand_core::OsRng, PasswordHasher, SaltString},
Argon2,
};
use crate::{
models::{AdminCreateUserRequest, AdminUserView, UpdateUserRequest},
AppState,
};
async fn require_admin(state: &AppState, jar: &SignedCookieJar) -> Result<String, (StatusCode, String)> {
let user_id = jar.get("session_user_id").map(|c| c.value().to_string())
.ok_or((StatusCode::UNAUTHORIZED, "Not logged in".to_string()))?;
let is_admin: Option<(i64,)> = sqlx::query_as("SELECT is_admin FROM users WHERE id = ?")
.bind(&user_id)
.fetch_optional(&state.db)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
match is_admin {
Some((v,)) if v != 0 => Ok(user_id),
_ => Err((StatusCode::FORBIDDEN, "Admin access required".to_string())),
}
}
pub async fn create_user(
State(state): State<AppState>,
jar: SignedCookieJar,
Json(payload): Json<AdminCreateUserRequest>,
) -> Result<(StatusCode, Json<AdminUserView>), (StatusCode, String)> {
require_admin(&state, &jar).await?;
if payload.username.is_empty() || payload.email.is_empty() || payload.password.is_empty() {
return Err((StatusCode::BAD_REQUEST, "Username, email, and password are required".to_string()));
}
let salt = SaltString::generate(&mut OsRng);
let password_hash = Argon2::default()
.hash_password(payload.password.as_bytes(), &salt)
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
.to_string();
let user_id = Uuid::new_v4().to_string();
let is_admin = payload.is_admin.unwrap_or(false);
let result = sqlx::query_as::<_, AdminUserView>(
"INSERT INTO users (id, username, email, password_hash, is_admin) VALUES (?, ?, ?, ?, ?) RETURNING id, username, email, is_admin, created_at"
)
.bind(&user_id)
.bind(&payload.username)
.bind(&payload.email)
.bind(&password_hash)
.bind(if is_admin { 1i64 } else { 0i64 })
.fetch_one(&state.db)
.await;
match result {
Ok(user) => Ok((StatusCode::CREATED, Json(user))),
Err(sqlx::Error::Database(err)) if err.is_unique_violation() => {
Err((StatusCode::CONFLICT, "Username or email already exists".to_string()))
}
Err(e) => Err((StatusCode::INTERNAL_SERVER_ERROR, e.to_string())),
}
}
pub async fn list_users(
State(state): State<AppState>,
jar: SignedCookieJar,
) -> Result<Json<Vec<AdminUserView>>, (StatusCode, String)> {
require_admin(&state, &jar).await?;
let users = sqlx::query_as::<_, AdminUserView>(
"SELECT id, username, email, is_admin, created_at FROM users ORDER BY created_at ASC"
)
.fetch_all(&state.db)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
Ok(Json(users))
}
pub async fn update_user(
State(state): State<AppState>,
jar: SignedCookieJar,
Path(user_id): Path<String>,
Json(payload): Json<UpdateUserRequest>,
) -> Result<Json<AdminUserView>, (StatusCode, String)> {
let requester_id = require_admin(&state, &jar).await?;
if let Some(is_admin) = payload.is_admin {
if !is_admin && requester_id == user_id {
return Err((StatusCode::BAD_REQUEST, "Cannot remove your own admin privileges".to_string()));
}
sqlx::query("UPDATE users SET is_admin = ? WHERE id = ?")
.bind(if is_admin { 1i64 } else { 0i64 })
.bind(&user_id)
.execute(&state.db)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
}
let user = sqlx::query_as::<_, AdminUserView>(
"SELECT id, username, email, is_admin, created_at FROM users WHERE id = ?"
)
.bind(&user_id)
.fetch_optional(&state.db)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
.ok_or((StatusCode::NOT_FOUND, "User not found".to_string()))?;
Ok(Json(user))
}
pub async fn delete_user(
State(state): State<AppState>,
jar: SignedCookieJar,
Path(user_id): Path<String>,
) -> Result<StatusCode, (StatusCode, String)> {
let requester_id = require_admin(&state, &jar).await?;
if requester_id == user_id {
return Err((StatusCode::BAD_REQUEST, "Cannot delete your own account via admin panel".to_string()));
}
sqlx::query("DELETE FROM users WHERE id = ?")
.bind(&user_id)
.execute(&state.db)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
Ok(StatusCode::NO_CONTENT)
}
server/src/auth.rs
+11 -5
View File
@@ -11,6 +11,8 @@ use crate::{
AppState,
};
const USER_FIELDS: &str = "id, username, email, password_hash, is_admin";
use argon2::{
password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
Argon2,
@@ -20,6 +22,10 @@ pub async fn register(
State(state): State<AppState>,
Json(payload): Json<RegisterRequest>,
) -> Result<Json<User>, (StatusCode, String)> {
if !state.registration_enabled {
return Err((StatusCode::FORBIDDEN, "Registration is disabled on this instance".to_string()));
}
if payload.username.is_empty() || payload.password.is_empty() || payload.email.is_empty() {
return Err((StatusCode::BAD_REQUEST, "Username, email, and password cannot be empty".to_string()));
}
@@ -34,7 +40,7 @@ pub async fn register(
let user_id = Uuid::new_v4().to_string();
let result = sqlx::query_as::<_, User>(
"INSERT INTO users (id, username, email, password_hash) VALUES (?, ?, ?, ?) RETURNING id, username, email, password_hash"
"INSERT INTO users (id, username, email, password_hash) VALUES (?, ?, ?, ?) RETURNING id, username, email, password_hash, is_admin"
)
.bind(&user_id)
.bind(&payload.username)
@@ -57,7 +63,7 @@ pub async fn login(
jar: SignedCookieJar,
Json(payload): Json<LoginRequest>,
) -> Result<(SignedCookieJar, Json<User>), (StatusCode, String)> {
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash FROM users WHERE email = ?")
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash, is_admin FROM users WHERE email = ?")
.bind(&payload.email)
.fetch_optional(&state.db)
.await
@@ -106,7 +112,7 @@ pub async fn update_profile(
match result {
Ok(_) => {
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash FROM users WHERE id = ?")
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash, is_admin FROM users WHERE id = ?")
.bind(&user_id)
.fetch_optional(&state.db)
.await
@@ -135,7 +141,7 @@ pub async fn me(
None => return Err((StatusCode::UNAUTHORIZED, "Not logged in".to_string())),
};
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash FROM users WHERE id = ?")
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash, is_admin FROM users WHERE id = ?")
.bind(&user_id)
.fetch_optional(&state.db)
.await
@@ -159,7 +165,7 @@ pub async fn change_password(
return Err((StatusCode::BAD_REQUEST, "Passwords cannot be empty".to_string()));
}
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash FROM users WHERE id = ?")
let user = sqlx::query_as::<_, User>("SELECT id, username, email, password_hash, is_admin FROM users WHERE id = ?")
.bind(&user_id)
.fetch_optional(&state.db)
.await
server/src/db/postgres.rs
+12 -9
View File
@@ -6,7 +6,9 @@ pub async fn init_schema(pool: &AnyPool) {
id TEXT PRIMARY KEY,
username TEXT NOT NULL UNIQUE,
email TEXT UNIQUE,
password_hash TEXT NOT NULL
password_hash TEXT NOT NULL,
is_admin BOOLEAN NOT NULL DEFAULT FALSE,
created_at TEXT DEFAULT to_char(NOW(), 'YYYY-MM-DD HH24:MI:SS')
)",
"CREATE TABLE IF NOT EXISTS folders (
id TEXT PRIMARY KEY,
@@ -83,12 +85,13 @@ pub async fn init_schema(pool: &AnyPool) {
.expect("Failed to execute Postgres schema");
}
// Idempotent migration for existing databases with TIMESTAMP columns
sqlx::query("ALTER TABLE documents ADD COLUMN IF NOT EXISTS public_role TEXT")
.execute(pool)
.await
.unwrap_or_else(|e| {
eprintln!("Warning: public_role migration: {}", e);
Default::default()
});
// Idempotent migrations for existing databases
let migrations = [
"ALTER TABLE documents ADD COLUMN IF NOT EXISTS public_role TEXT",
"ALTER TABLE users ADD COLUMN IF NOT EXISTS is_admin BOOLEAN NOT NULL DEFAULT FALSE",
"ALTER TABLE users ADD COLUMN IF NOT EXISTS created_at TEXT DEFAULT to_char(NOW(), 'YYYY-MM-DD HH24:MI:SS')",
];
for stmt in &migrations {
sqlx::query(stmt).execute(pool).await.unwrap_or_else(|_| Default::default());
}
}
server/src/db/sqlite.rs
+12 -1
View File
@@ -11,7 +11,9 @@ pub async fn init_schema(pool: &AnyPool) {
id TEXT PRIMARY KEY,
username TEXT NOT NULL UNIQUE,
email TEXT UNIQUE,
password_hash TEXT NOT NULL
password_hash TEXT NOT NULL,
is_admin INTEGER NOT NULL DEFAULT 0,
created_at TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%S', 'now'))
)",
"CREATE TABLE IF NOT EXISTS folders (
id TEXT PRIMARY KEY,
@@ -87,4 +89,13 @@ pub async fn init_schema(pool: &AnyPool) {
.await
.expect("Failed to execute SQLite schema");
}
// Idempotent migrations for existing databases
let migrations = [
"ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0",
"ALTER TABLE users ADD COLUMN created_at TEXT DEFAULT (strftime('%Y-%m-%d %H:%M:%S', 'now'))",
];
for stmt in &migrations {
let _ = sqlx::query(stmt).execute(pool).await;
}
}
server/src/main.rs
+11
View File
@@ -12,6 +12,7 @@ use tower_http::services::{ServeDir, ServeFile};
use tower_http::trace::TraceLayer;
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
mod admin;
mod auth;
mod compiler;
mod db;
@@ -20,6 +21,7 @@ mod folders;
mod files;
mod handlers;
mod models;
mod setup;
mod world;
mod collab;
@@ -32,6 +34,7 @@ pub struct AppState {
pub bcast_map: Arc<Mutex<HashMap<String, Arc<BroadcastGroup>>>>,
pub db: AnyPool,
pub key: Key,
pub registration_enabled: bool,
}
impl axum::extract::FromRef<AppState> for Key {
@@ -71,14 +74,22 @@ async fn main() {
}
};
let registration_enabled = std::env::var("ALLOW_REGISTRATION")
.map(|v| v.to_lowercase() != "false")
.unwrap_or(true);
let state = AppState {
compiler: Arc::new(Mutex::new(TypstCompiler::new())),
bcast_map: Arc::new(Mutex::new(HashMap::new())),
db,
key,
registration_enabled,
};
let api_routes = Router::new()
.route("/setup", get(setup::setup_status).post(setup::run_setup))
.route("/admin/users", get(admin::list_users).post(admin::create_user))
.route("/admin/users/{id}", patch(admin::update_user).delete(admin::delete_user))
.route("/compile", post(compile_handler))
.route("/export/{format}", post(export_handler))
.route("/export/pandoc/{format}", post(handlers::pandoc_export_handler))
server/src/models.rs
+53
View File
@@ -1,6 +1,19 @@
use serde::{Deserialize, Serialize};
use sqlx::FromRow;
// sqlx::Any maps SQLite INTEGER to i64 (BIGINT), not bool.
// These helpers let us store is_admin as i64 in DB-mapped structs
// while still serializing it as a JSON boolean for the frontend.
mod serde_i64_bool {
use serde::{Deserialize, Deserializer, Serializer};
pub fn serialize<S: Serializer>(v: &i64, s: S) -> Result<S::Ok, S::Error> {
s.serialize_bool(*v != 0)
}
pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<i64, D::Error> {
Ok(if bool::deserialize(d)? { 1 } else { 0 })
}
}
#[derive(Debug, Serialize, Deserialize, FromRow)]
pub struct User {
pub id: String,
@@ -8,6 +21,18 @@ pub struct User {
pub email: String,
#[serde(skip_serializing)]
pub password_hash: String,
#[serde(with = "serde_i64_bool")]
pub is_admin: i64,
}
#[derive(Debug, Serialize, Deserialize, FromRow)]
pub struct AdminUserView {
pub id: String,
pub username: String,
pub email: String,
#[serde(with = "serde_i64_bool")]
pub is_admin: i64,
pub created_at: String,
}
#[derive(Debug, Serialize, Deserialize, FromRow)]
@@ -161,3 +186,31 @@ pub struct InviteRequest {
pub email: String,
pub role: String,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct AdminCreateUserRequest {
pub username: String,
pub email: String,
pub password: String,
pub is_admin: Option<bool>,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct SetupRequest {
pub username: String,
pub email: String,
pub password: String,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct SetupStatus {
pub needs_setup: bool,
pub registration_enabled: bool,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct UpdateUserRequest {
pub is_admin: Option<bool>,
pub username: Option<String>,
pub email: Option<String>,
}
server/src/setup.rs
+73
View File
@@ -0,0 +1,73 @@
use axum::{extract::State, http::StatusCode, Json};
use axum_extra::extract::cookie::{Cookie, SameSite, SignedCookieJar};
use uuid::Uuid;
use argon2::{
password_hash::{rand_core::OsRng, PasswordHasher, SaltString},
Argon2,
};
use crate::{
models::{SetupRequest, SetupStatus, User},
AppState,
};
pub async fn setup_status(
State(state): State<AppState>,
) -> Json<SetupStatus> {
let count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users")
.fetch_one(&state.db)
.await
.unwrap_or((0,));
Json(SetupStatus {
needs_setup: count.0 == 0,
registration_enabled: state.registration_enabled,
})
}
pub async fn run_setup(
State(state): State<AppState>,
jar: SignedCookieJar,
Json(payload): Json<SetupRequest>,
) -> Result<(SignedCookieJar, Json<User>), (StatusCode, String)> {
let count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users")
.fetch_one(&state.db)
.await
.unwrap_or((0,));
if count.0 > 0 {
return Err((StatusCode::FORBIDDEN, "Setup has already been completed".to_string()));
}
if payload.username.is_empty() || payload.password.is_empty() || payload.email.is_empty() {
return Err((StatusCode::BAD_REQUEST, "Username, email, and password cannot be empty".to_string()));
}
let salt = SaltString::generate(&mut OsRng);
let password_hash = Argon2::default()
.hash_password(payload.password.as_bytes(), &salt)
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
.to_string();
let user_id = Uuid::new_v4().to_string();
let user = sqlx::query_as::<_, User>(
"INSERT INTO users (id, username, email, password_hash, is_admin) VALUES (?, ?, ?, ?, ?) RETURNING id, username, email, password_hash, is_admin"
)
.bind(&user_id)
.bind(&payload.username)
.bind(&payload.email)
.bind(&password_hash)
.bind(1i64)
.fetch_one(&state.db)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
let mut cookie = Cookie::new("session_user_id", user.id.clone());
cookie.set_http_only(true);
cookie.set_same_site(SameSite::Lax);
cookie.set_path("/");
Ok((jar.add(cookie), Json(user)))
}