From ac7aa8c6e95023def1eba7615d8a42ad52271500 Mon Sep 17 00:00:00 2001
From: Vidhu Kant Sharma <vidhukant@vidhukant.xyz>
Date: Sun, 29 Jan 2023 20:11:09 +0530
Subject: checking password before editing/deleting user

---
 util/authorize.go      | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++
 util/jwt_middleware.go | 51 -------------------------------------
 2 files changed, 68 insertions(+), 51 deletions(-)
 create mode 100644 util/authorize.go
 delete mode 100644 util/jwt_middleware.go

(limited to 'util')

diff --git a/util/authorize.go b/util/authorize.go
new file mode 100644
index 0000000..ca6660e
--- /dev/null
+++ b/util/authorize.go
@@ -0,0 +1,68 @@
+/* OpenBills-server - Server for libre billing software OpenBills-web
+ * Copyright (C) 2022  Vidhu Kant Sharma <vidhukant@vidhukant.xyz>
+
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package util
+
+import (
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v4"
+	"net/http"
+	"time"
+)
+
+var accessSecret []byte
+
+func init() {
+	conf := GetConfig().Crypto
+	accessSecret = []byte(conf.AccessTokenSecret)
+}
+
+func Authorize() gin.HandlerFunc {
+	return func(ctx *gin.Context) {
+		tokenHeader := ctx.Request.Header["Authorization"]
+		if tokenHeader != nil {
+			token, err := jwt.ParseWithClaims(tokenHeader[0], &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
+				return []byte(accessSecret), nil
+			})
+			if err != nil {
+				ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "access token expired"})
+			} else {
+				ctx.Set("userId", token.Claims.(*jwt.StandardClaims).Issuer)
+				ctx.Next()
+			}
+		} else {
+			// invalid Authorization header
+			ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "not logged in"})
+		}
+
+	}
+}
+
+// generate new access token
+func newAccessToken(userId string) (string, error) {
+	claims := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.StandardClaims{
+		Issuer:    userId,
+		ExpiresAt: time.Now().Add(time.Second * 15).Unix(),
+	})
+
+	token, err := claims.SignedString(accessSecret)
+	if err != nil {
+		return "", err
+	}
+
+	return token, nil
+}
diff --git a/util/jwt_middleware.go b/util/jwt_middleware.go
deleted file mode 100644
index ce8c20a..0000000
--- a/util/jwt_middleware.go
+++ /dev/null
@@ -1,51 +0,0 @@
-/* OpenBills-server - Server for libre billing software OpenBills-web
- * Copyright (C) 2022  Vidhu Kant Sharma <vidhukant@vidhukant.xyz>
-
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
-
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
-
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package util
-
-import (
-	"github.com/golang-jwt/jwt/v4"
-	"github.com/gin-gonic/gin"
-	"net/http"
-)
-
-var accessSecret []byte
-func init() {
-	conf := GetConfig().Crypto
-	accessSecret = []byte(conf.AccessTokenSecret)
-}
-
-func Authorize() gin.HandlerFunc {
-	return func(ctx *gin.Context) {
-		tokenHeader := ctx.Request.Header["Authorization"]
-		if tokenHeader != nil {
-			token, err := jwt.ParseWithClaims(tokenHeader[0], &jwt.StandardClaims{}, func(token *jwt.Token) (interface{}, error) {
-				return []byte(accessSecret), nil
-			})
-			if err != nil {
-				ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "access token expired"})
-			} else {
-			    ctx.Set("userId", token.Claims.(*jwt.StandardClaims).Issuer)
-			    ctx.Next()
-			}
-		} else {
-		    // invalid Authorization header
-	        ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"message": "not logged in"})
-		}
-
-	}
-}
-- 
cgit v1.2.3