Bookhoard/bookhoard
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 12 Wiki Activity

feat: Implement role-based registration restrictions and reorganize Bruno collection

Browse Source 
- Add role-based restrictions to POST /api/auth/register endpoint
- Only admins can create admin accounts if any admin already exists
- First user automatically gets admin role regardless of request
- Regular users can only create user accounts, not admin accounts
- Unauthenticated users can only create first admin, not subsequent admins
- Reorganize Bruno collection into logical subfolders (auth/, admin/, profile/)
- Update documentation to reflect new registration restrictions and security rules

BREAKING CHANGES:
- /api/auth/register now enforces role-based creation restrictions
- Bruno collection reorganized with subfolder structure
This commit is contained in:
john-okeefe
2026-01-27 14:15:06 -05:00
parent 71584c1b55
commit 481adaa71e
15 changed files with 197 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bruno/user/Register Admin User.bru
-68
View File
@@ -1,68 +0,0 @@
meta {
name: Register Admin User
type: http
seq: 4
}
post {
url: {{base_url}}/api/auth/register
body: json
auth: inherit
}
body:json {
{
"email": "admin@example.com",
"username": "admin",
"password": "admin123",
"first_name": "Admin",
"last_name": "User",
"role": "admin"
}
}
script:post-response {
function onResponse(res) {
let data = res.getBody();
return bru.setEnvVar("token", data.token, { persist: true });
}
onResponse(res);
}
settings {
encodeUrl: true
timeout: 0
}
docs {
## Register Admin User
Creates a new admin user account.
**Method:** POST
**Endpoint:** /api/auth/register
**Request Body:**
- `email` (string): Email address
- `username` (string): Username
- `password` (string): Password
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): Must be "admin"
**Response:**
- `token` (string): JWT token with admin role
- `user` (object): User details
- `id` (string): User ID
- `email` (string): Email
- `username` (string): Username
- `theme` (string): User theme preference
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): User role ("admin")
**Status Codes:**
- 201: Created
- 409: User exists
}
bruno/user/Register User.bru
-67
View File
@@ -1,67 +0,0 @@
meta {
name: Register User
type: http
seq: 3
}
post {
url: {{base_url}}/api/auth/register
body: json
auth: inherit
}
body:json {
{
"email": "test@example.com",
"username": "testuser",
"password": "password123",
"first_name": "Test",
"last_name": "User"
}
}
script:post-response {
function onResponse(res) {
let data = res.getBody();
return bru.setEnvVar("token", data.token, { persist: true });
}
onResponse(res);
}
settings {
encodeUrl: true
timeout: 0
}
docs {
## Register User
Creates a new user account.
**Method:** POST
**Endpoint:** /api/auth/register
**Request Body:**
- `email` (string): Email address
- `username` (string): Username
- `password` (string): Password
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): User role ("user" or "admin")
**Response:**
- `token` (string): JWT token
- `user` (object): User details
- `id` (string): User ID
- `email` (string): Email
- `username` (string): Username
- `theme` (string): User theme preference
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): User role ("user" or "admin")
**Status Codes:**
- 201: Created
- 409: User exists
}
bruno/user/Delete Account.bru → bruno/user/admin/Delete Account.bru
View File
bruno/user/Delete User Account (Admin).bru → bruno/user/admin/Delete User Account (Admin).bru
View File
bruno/user/List Users.bru → bruno/user/admin/List Users.bru
View File
bruno/user/admin/Register Admin User.bru
+81
View File
@@ -0,0 +1,81 @@
meta {
name: Register Admin User
type: http
seq: 4
}
post {
url: {{base_url}}/api/auth/register
body: json
auth: inherit
}
body:json {
{
"email": "admin@example.com",
"username": "admin",
"password": "admin123",
"first_name": "Admin",
"last_name": "User",
"role": "admin"
}
}
script:post-response {
function onResponse(res) {
let data = res.getBody();
return bru.setEnvVar("token", data.token, { persist: true });
}
onResponse(res);
}
settings {
encodeUrl: true
timeout: 0
}
docs {
## Register Admin User
Creates a new admin user account with role-based restrictions.
**Method:** POST
**Endpoint:** /api/auth/register
**Request Body:**
- `email` (string): Email address
- `username` (string): Username
- `password` (string): Password
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): Must be "admin"
**Response:**
- `token` (string): JWT token with admin role
- `user` (object): User details
- `id` (string): User ID
- `email` (string): Email
- `username` (string): Username
- `theme` (string): User theme preference
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): User role ("admin")
**Status Codes:**
- 201: Created
- 400: Invalid input data
- 403: Forbidden - admin creation restrictions apply
- 409: User exists
**Role Restrictions:**
- **First User**: Anyone can create first admin (auto-assigned)
- **Existing Admins Present**: Only authenticated admins can create new admin accounts
- **Unauthenticated Users**: Cannot create admin accounts if any admin exists
- **Security**: Requires admin authentication for subsequent admin creation
**Usage Notes:**
- Use this request only when specifically creating admin accounts
- For regular user creation, use "Register User" request
- Admin token will have elevated privileges for administrative operations
}
bruno/user/Login User.bru → bruno/user/auth/Login User.bru
+1 -1
View File
@@ -1,7 +1,7 @@
meta {
name: Login User
type: http
seq: 2
seq: 1
}
post {
bruno/user/auth/Register User.bru
+80
View File
@@ -0,0 +1,80 @@
meta {
name: Register User
type: http
seq: 2
}
post {
url: {{base_url}}/api/auth/register
body: json
auth: inherit
}
body:json {
{
"email": "test@example.com",
"username": "testuser",
"password": "password123",
"first_name": "Test",
"last_name": "User"
}
}
script:post-response {
function onResponse(res) {
let data = res.getBody();
return bru.setEnvVar("token", data.token, { persist: true });
}
onResponse(res);
}
settings {
encodeUrl: true
timeout: 0
}
docs {
## Register User
Creates a new user account with role-based restrictions.
**Method:** POST
**Endpoint:** /api/auth/register
**Request Body:**
- `email` (string): Email address
- `username` (string): Username
- `password` (string): Password
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): User role ("user" or "admin")
**Response:**
- `token` (string): JWT token
- `user` (object): User details
- `id` (string): User ID
- `email` (string): Email
- `username` (string): Username
- `theme` (string): User theme preference
- `first_name` (string, optional): First name
- `last_name` (string, optional): Last name
- `role` (string): User role ("user" or "admin")
**Status Codes:**
- 201: Created
- 400: Invalid input data
- 403: Forbidden - role-based restrictions apply
- 409: User exists
**Role Restrictions:**
- **First User**: Automatically gets admin role regardless of request
- **Existing Admins Present**: Only authenticated admins can create new admin accounts
- **No Admins Yet**: Anyone can create first admin (auto-assigned)
- **Regular User Creation**: Anyone can create regular user accounts
- **Unauthenticated Users**: Can only create first admin, not subsequent admins
**Examples:**
- First admin creation: `{"email": "admin@example.com", "username": "admin", "password": "password123", "role": "admin"}`
- Regular user creation: `{"email": "user@example.com", "username": "user", "password": "password123", "role": "user"}`
}
bruno/user/Get Profile.bru → bruno/user/profile/Get Profile.bru
View File
bruno/user/Update Email.bru → bruno/user/profile/Update Email.bru
View File
bruno/user/Update Password.bru → bruno/user/profile/Update Password.bru
View File
bruno/user/Update Profile.bru → bruno/user/profile/Update Profile.bru
View File
bruno/user/Update Theme.bru → bruno/user/profile/Update Theme.bru
View File
bruno/user/Update Username.bru → bruno/user/profile/Update Username.bru
View File
internal/handlers/auth.go
+35 -2
View File
@@ -136,15 +136,25 @@ func (h *AuthHandler) Register(c echo.Context) error {
return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to hash password"})
}
// Set role - first user is always admin, otherwise validate requested role
// Check if any admin users already exist
adminExists := false
for _, u := range users {
if u.Role == "admin" {
adminExists = true
break
}
}
// Set role - first user is always admin, otherwise validate requested role based on existing admins
var userRole string
if len(users) == 0 {
userRole = "admin" // First user is always admin
} else {
userRole = req.Role
if userRole == "" {
userRole = "user"
userRole = "user" // Default to regular user if not specified
}
// Validate role for subsequent users
if userRole != "user" && userRole != "admin" {
if c.Request().Header.Get("HX-Request") == "true" {
@@ -152,6 +162,29 @@ func (h *AuthHandler) Register(c echo.Context) error {
}
return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid role. must be 'user' or 'admin'"})
}
// Role-based restrictions: only admins can create admin users if any admin already exists
if userRole == "admin" && adminExists {
// Check if current user is admin (requires authentication)
userID := c.Get("user_id")
if userID == nil {
// Not authenticated - cannot create admin user if admins exist
if c.Request().Header.Get("HX-Request") == "true" {
return c.HTML(http.StatusForbidden, `<div class="text-red-500">Only existing administrators can create admin accounts</div>`)
}
return c.JSON(http.StatusForbidden, map[string]string{"error": "only existing administrators can create admin accounts"})
}
// User is authenticated - check their role
userRoleAuth := c.Get("user_role").(string)
if userRoleAuth != "admin" {
// Authenticated but not admin - cannot create admin accounts
if c.Request().Header.Get("HX-Request") == "true" {
return c.HTML(http.StatusForbidden, `<div class="text-red-500">Only administrators can create admin accounts</div>`)
}
return c.JSON(http.StatusForbidden, map[string]string{"error": "only administrators can create admin accounts"})
}
}
}
// Create user