252 lines
7.4 KiB
Go
252 lines
7.4 KiB
Go
package platform
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
func (s *service) workspaces(w http.ResponseWriter, r *http.Request, project, account string) error {
|
|
switch r.Method {
|
|
case http.MethodGet:
|
|
rows, err := s.db.QueryContext(r.Context(), `
|
|
SELECT w.id::text,w.name,m.role,w.owner_id::text,w.slug FROM workspaces w
|
|
JOIN workspace_members m ON (m.project,m.workspace_id)=(w.project,w.id)
|
|
WHERE m.project=$1 AND m.account_id=$2 ORDER BY lower(w.name),w.id LIMIT 200
|
|
`, project, account)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer rows.Close()
|
|
items := []response{}
|
|
for rows.Next() {
|
|
var id, name, role, owner, slug string
|
|
if err := rows.Scan(&id, &name, &role, &owner, &slug); err != nil {
|
|
return err
|
|
}
|
|
items = append(items, response{"id": id, "name": name, "role": role, "owner_id": owner, "slug": slug})
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return err
|
|
}
|
|
reply(w, 200, response{"items": items})
|
|
case http.MethodPost:
|
|
var input struct {
|
|
Name string `json:"name"`
|
|
Slug *string `json:"slug,omitempty"`
|
|
}
|
|
if !decode(w, r, &input) {
|
|
return nil
|
|
}
|
|
input.Name = strings.TrimSpace(input.Name)
|
|
if input.Name == "" || len(input.Name) > 160 || !validSlug(input.Slug) {
|
|
reject(w, 400, "invalid_workspace")
|
|
return nil
|
|
}
|
|
tx, err := s.db.BeginTx(r.Context(), nil)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer tx.Rollback()
|
|
id, err := createWorkspace(r.Context(), tx, project, account, input.Name)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
var slug string
|
|
if input.Slug != nil {
|
|
_, err = tx.ExecContext(r.Context(), "UPDATE workspaces SET slug=$3 WHERE project=$1 AND id=$2", project, id, *input.Slug)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err = tx.QueryRowContext(r.Context(), "SELECT slug FROM workspaces WHERE project=$1 AND id=$2", project, id).Scan(&slug); err != nil {
|
|
return err
|
|
}
|
|
if err = tx.Commit(); err != nil {
|
|
return err
|
|
}
|
|
reply(w, 201, response{"id": id, "name": input.Name, "role": "admin", "owner_id": account, "slug": slug})
|
|
default:
|
|
reject(w, 405, "method_not_allowed")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func createWorkspace(ctx context.Context, tx *sql.Tx, project, account, name string) (string, error) {
|
|
var id string
|
|
err := tx.QueryRowContext(ctx, `
|
|
INSERT INTO workspaces(project,name,owner_id) VALUES($1,$2,$3) RETURNING id::text
|
|
`, project, name, account).Scan(&id)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
_, err = tx.ExecContext(ctx, `
|
|
INSERT INTO workspace_members(project,workspace_id,account_id,role) VALUES($1,$2,$3,'admin')
|
|
`, project, id, account)
|
|
return id, err
|
|
}
|
|
|
|
func lockWorkspace(ctx context.Context, tx *sql.Tx, project, workspace, account string) (string, string, error) {
|
|
var owner, role string
|
|
err := tx.QueryRowContext(ctx, `
|
|
SELECT owner_id::text FROM workspaces WHERE project=$1 AND id=$2 FOR UPDATE
|
|
`, project, workspace).Scan(&owner)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
// Read membership after the workspace lock, so concurrent revocation is visible.
|
|
err = tx.QueryRowContext(ctx, `
|
|
SELECT role FROM workspace_members WHERE project=$1 AND workspace_id=$2 AND account_id=$3
|
|
`, project, workspace, account).Scan(&role)
|
|
return owner, role, err
|
|
}
|
|
|
|
func (s *service) workspace(w http.ResponseWriter, r *http.Request, project, account string) error {
|
|
workspace := r.PathValue("workspace")
|
|
tx, err := s.db.BeginTx(r.Context(), nil)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer tx.Rollback()
|
|
owner, role, err := lockWorkspace(r.Context(), tx, project, workspace, account)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
switch r.Method {
|
|
case http.MethodGet:
|
|
var name, slug string
|
|
if err := tx.QueryRowContext(r.Context(), "SELECT name,slug FROM workspaces WHERE project=$1 AND id=$2", project, workspace).Scan(&name, &slug); err != nil {
|
|
return err
|
|
}
|
|
reply(w, 200, response{"id": workspace, "name": name, "role": role, "owner_id": owner, "slug": slug})
|
|
return nil
|
|
case http.MethodPatch:
|
|
if role != "admin" {
|
|
reject(w, 403, "forbidden")
|
|
return nil
|
|
}
|
|
var input struct {
|
|
Name string `json:"name"`
|
|
Slug *string `json:"slug,omitempty"`
|
|
}
|
|
if !decode(w, r, &input) {
|
|
return nil
|
|
}
|
|
input.Name = strings.TrimSpace(input.Name)
|
|
if input.Name == "" || len(input.Name) > 160 || !validSlug(input.Slug) {
|
|
reject(w, 400, "invalid_workspace")
|
|
return nil
|
|
}
|
|
_, err = tx.ExecContext(r.Context(), "UPDATE workspaces SET name=$3,slug=COALESCE($4,slug),updated_at=now() WHERE project=$1 AND id=$2", project, workspace, input.Name, input.Slug)
|
|
case http.MethodDelete:
|
|
if owner != account {
|
|
reject(w, 403, "owner_required")
|
|
return nil
|
|
}
|
|
_, err = tx.ExecContext(r.Context(), "DELETE FROM workspaces WHERE project=$1 AND id=$2", project, workspace)
|
|
default:
|
|
reject(w, 405, "method_not_allowed")
|
|
return nil
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err = tx.Commit(); err != nil {
|
|
return err
|
|
}
|
|
reply(w, 204, nil)
|
|
return nil
|
|
}
|
|
|
|
func (s *service) members(w http.ResponseWriter, r *http.Request, project, account string) error {
|
|
if r.Method != http.MethodGet {
|
|
reject(w, 405, "method_not_allowed")
|
|
return nil
|
|
}
|
|
rows, err := s.db.QueryContext(r.Context(), `
|
|
SELECT m.account_id::text,m.role,a.username,a.display_name FROM workspace_members m
|
|
JOIN project_accounts a ON (a.project,a.id)=(m.project,m.account_id)
|
|
WHERE m.project=$1 AND m.workspace_id=$2 AND EXISTS(
|
|
SELECT 1 FROM workspace_members caller WHERE caller.project=$1 AND caller.workspace_id=$2 AND caller.account_id=$3)
|
|
ORDER BY m.joined_at,m.account_id LIMIT 200
|
|
`, project, r.PathValue("workspace"), account)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer rows.Close()
|
|
items := []response{}
|
|
for rows.Next() {
|
|
var id, role, name string
|
|
var username *string
|
|
if err := rows.Scan(&id, &role, &username, &name); err != nil {
|
|
return err
|
|
}
|
|
items = append(items, response{"account_id": id, "role": role, "username": username, "display_name": name})
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return err
|
|
}
|
|
if len(items) == 0 {
|
|
return sql.ErrNoRows
|
|
}
|
|
reply(w, 200, response{"items": items})
|
|
return nil
|
|
}
|
|
|
|
func (s *service) member(w http.ResponseWriter, r *http.Request, project, account string) error {
|
|
workspace, target := r.PathValue("workspace"), r.PathValue("account")
|
|
if r.Method != http.MethodPatch && r.Method != http.MethodDelete {
|
|
reject(w, 405, "method_not_allowed")
|
|
return nil
|
|
}
|
|
tx, err := s.db.BeginTx(r.Context(), nil)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer tx.Rollback()
|
|
owner, role, err := lockWorkspace(r.Context(), tx, project, workspace, account)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if owner == target {
|
|
reject(w, 409, "owner_membership_required")
|
|
return nil
|
|
}
|
|
if role != "admin" && (r.Method != http.MethodDelete || target != account) {
|
|
reject(w, 403, "forbidden")
|
|
return nil
|
|
}
|
|
var result sql.Result
|
|
if r.Method == http.MethodPatch {
|
|
var input struct {
|
|
Role string `json:"role"`
|
|
}
|
|
if !decode(w, r, &input) {
|
|
return nil
|
|
}
|
|
if input.Role != "admin" && input.Role != "editor" && input.Role != "viewer" {
|
|
reject(w, 400, "invalid_role")
|
|
return nil
|
|
}
|
|
result, err = tx.ExecContext(r.Context(), "UPDATE workspace_members SET role=$4 WHERE project=$1 AND workspace_id=$2 AND account_id=$3", project, workspace, target, input.Role)
|
|
} else {
|
|
result, err = tx.ExecContext(r.Context(), "DELETE FROM workspace_members WHERE project=$1 AND workspace_id=$2 AND account_id=$3", project, workspace, target)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, err := result.RowsAffected()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if n == 0 {
|
|
return sql.ErrNoRows
|
|
}
|
|
if err = tx.Commit(); err != nil {
|
|
return err
|
|
}
|
|
reply(w, 204, nil)
|
|
return nil
|
|
}
|