diff --git a/source/calendarwebapp/authenticator.d b/source/calendarwebapp/authenticator.d index cf97d60..8f44335 100644 --- a/source/calendarwebapp/authenticator.d +++ b/source/calendarwebapp/authenticator.d @@ -64,8 +64,9 @@ public: } } -enum Role +enum Privilege { + None, User, Admin } @@ -77,7 +78,7 @@ struct AuthInfo @name("_id") BsonObjectID id; string username; string passwordHash; - Role role; + Privilege privilege; mixin(generateAuthMethods); @@ -89,12 +90,12 @@ private: import std.traits : EnumMembers; string ret; - foreach (member; EnumMembers!Role) + foreach (member; EnumMembers!Privilege) { ret ~= q{ bool is%s() const pure @safe nothrow { - return role == Role.%s; + return privilege == Privilege.%s; } }.format(member.to!string, member.to!string); } diff --git a/source/calendarwebapp/calendarwebapp.d b/source/calendarwebapp/calendarwebapp.d index 7bcc1ff..38efaae 100644 --- a/source/calendarwebapp/calendarwebapp.d +++ b/source/calendarwebapp/calendarwebapp.d @@ -2,7 +2,7 @@ module calendarwebapp.calendarwebapp; import botan.rng.rng : RandomNumberGenerator; -import calendarwebapp.authenticator : Authenticator, AuthInfo, Privilege = Role; +import calendarwebapp.authenticator; import calendarwebapp.event; import core.time : days; @@ -25,24 +25,24 @@ import vibe.web.web : errorDisplay, noRoute, redirect, render, SessionVar, { @noRoute AuthInfo authenticate(scope HTTPServerRequest req, scope HTTPServerResponse) @safe { - if (!req.session || !req.session.isKeySet("authInfo")) - { + if (authInfo.value.isNone) redirect("/login"); - return AuthInfo.init; - } - return req.session.get!AuthInfo("authInfo"); + + return authInfo.value; } public: - @anyAuth void index() + @auth(Role.user | Role.admin) void index() { auto events = eventStore.getAllEvents(); - render!("showevents.dt", events); + auto authInfo = this.authInfo.value; + render!("showevents.dt", events, authInfo); } @noAuth void getLogin(string _error = null) { - render!("login.dt", _error); + auto authInfo = this.authInfo.value; + render!("login.dt", _error, authInfo); } @noAuth @errorDisplay!getLogin void postLogin(string username, string password) @safe @@ -53,18 +53,20 @@ public: redirect("/"); } - @anyAuth void getLogout() @safe + @auth(Role.user | Role.admin) void getLogout() @safe { terminateSession(); redirect("/"); } - @anyAuth void getCreateevent(ValidationErrorData _error = ValidationErrorData.init) + @auth(Role.user | Role.admin) void getCreateevent( + ValidationErrorData _error = ValidationErrorData.init) { - render!("createevent.dt", _error); + auto authInfo = this.authInfo.value; + render!("createevent.dt", _error, authInfo); } - @anyAuth @errorDisplay!getCreateevent void postCreateevent(Date begin, + @auth(Role.user | Role.admin) @errorDisplay!getCreateevent void postCreateevent(Date begin, Nullable!Date end, string description, string name, EventType type, bool shout) @safe { import std.array : replace, split; @@ -80,7 +82,7 @@ public: redirect("/"); } - @anyAuth void postRemoveevent(BsonObjectID id) @safe + @auth(Role.user | Role.admin) void postRemoveevent(BsonObjectID id) @safe { eventStore.removeEvent(id); redirect("/"); @@ -89,7 +91,8 @@ public: @auth(Role.admin) void getUsers() { auto users = authenticator.getAllUsers; - render!("showusers.dt", users); + auto authInfo = this.authInfo.value; + render!("showusers.dt", users, authInfo); } @auth(Role.admin) void postRemoveuser(BsonObjectID id) @safe @@ -100,7 +103,8 @@ public: @auth(Role.admin) void getCreateuser(ValidationErrorData _error = ValidationErrorData.init) { - render!("createuser.dt", _error); + auto authInfo = this.authInfo.value; + render!("createuser.dt", _error, authInfo); } @auth(Role.admin) @errorDisplay!getCreateuser void postCreateuser(string username, @@ -120,7 +124,8 @@ private: string field; } - SessionVar!(AuthInfo, "authInfo") authInfo; + SessionVar!(AuthInfo, "authInfo") authInfo = AuthInfo(BsonObjectID.init, + string.init, string.init, Privilege.None); @Autowire EventStore eventStore; @Autowire Authenticator authenticator; diff --git a/test/calendarwebapp/testauthenticator.d b/test/calendarwebapp/testauthenticator.d index c672b09..bf304ec 100644 --- a/test/calendarwebapp/testauthenticator.d +++ b/test/calendarwebapp/testauthenticator.d @@ -46,7 +46,7 @@ public: auto userBson = Bson(["_id" : Bson(BsonObjectID.fromString("5988ef4ae6c19089a1a53b79")), "username" : Bson("foo"), "passwordHash" - : Bson("$2a$10$9LBqOZV99ARiE4Nx.2b7GeYfqk2.0A32PWGu2cRGyW2hRJ0xeDfnO"), "role" : Bson(1)]); + : Bson("$2a$10$9LBqOZV99ARiE4Nx.2b7GeYfqk2.0A32PWGu2cRGyW2hRJ0xeDfnO"), "privilege" : Bson(1)]); collection.returnValue!"findOne"(Bson(null), userBson, userBson); @@ -60,7 +60,7 @@ public: @safe unittest { AuthInfo auth; - auth.role = Role.User; + auth.privilege = Privilege.User; auth.isUser.shouldBeTrue; } @@ -68,7 +68,7 @@ public: @safe unittest { AuthInfo auth; - auth.role = Role.Admin; + auth.privilege = Privilege.None; auth.isUser.shouldBeFalse; } @@ -76,7 +76,7 @@ public: @safe unittest { AuthInfo auth; - auth.role = Role.Admin; + auth.privilege = Privilege.Admin; auth.isAdmin.shouldBeTrue; } @@ -84,6 +84,22 @@ public: @safe unittest { AuthInfo auth; - auth.role = Role.User; + auth.privilege = Privilege.None; auth.isAdmin.shouldBeFalse; } + +@("AuthInfo.isNone success") +@safe unittest +{ + AuthInfo auth; + auth.privilege = Privilege.None; + auth.isNone.shouldBeTrue; +} + +@("AuthInfo.isNone failure") +@safe unittest +{ + AuthInfo auth; + auth.privilege = Privilege.User; + auth.isNone.shouldBeFalse; +} \ No newline at end of file diff --git a/views/createuser.dt b/views/createuser.dt index 79c9670..2d37edb 100644 --- a/views/createuser.dt +++ b/views/createuser.dt @@ -29,4 +29,4 @@ block content tfoot tr td(colspan="2") - input#submitButton(type="submit", value="Ereignis erstellen") \ No newline at end of file + input#submitButton(type="submit", value="Benutzer erstellen") \ No newline at end of file diff --git a/views/navigation.dt b/views/navigation.dt index bec6532..c67ab16 100644 --- a/views/navigation.dt +++ b/views/navigation.dt @@ -1,12 +1,14 @@ -nav - ul - li - a(href='/') Home - li - a(href='/createevent') Ereignis erstellen - li - a(href='/users') Benutzerliste - li - a(href='/createuser') Benutzer erstellen - li - a(href='/logout') Ausloggen \ No newline at end of file +- if(!authInfo.isNone()) + nav + ul + li + a(href='/') Home + li + a(href='/createevent') Ereignis erstellen + - if(authInfo.isAdmin()) + li + a(href='/users') Benutzerliste + li + a(href='/createuser') Benutzer erstellen + li + a(href='/logout') Ausloggen diff --git a/views/showusers.dt b/views/showusers.dt index 749dbae..080dc5c 100644 --- a/views/showusers.dt +++ b/views/showusers.dt @@ -10,8 +10,8 @@ block content td username td #{user.username} tr - td role - td #{user.role} + td privilege + td #{user.privilege} form(action="/removeuser", method="post") input#id(value="#{user.id}", name="id", type="hidden") input#submitButton(type="submit", value="Entfernen")