From c4e3a31b69900057bd6bb2345e22ff3729c4583b Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 29 Mar 2026 13:56:14 +0200 Subject: [PATCH] Complete GORM to sqlc migration - Remove GORM dependency, use sqlc for type-safe SQL queries - Update all handlers to use sqlc patterns (context, value types) - Fix N+1 query problem in domain listing with JOIN query - Enable SQL query logging in debug mode (USE_EMBEDDED=false) - Add comprehensive comments for non-Go developers --- backend/cmd/server/main.go | 20 +++---- backend/go.mod | 6 +- backend/go.sum | 8 --- backend/internal/api/handlers/aliases.go | 1 - backend/internal/api/handlers/auth.go | 2 - backend/internal/api/handlers/domains.go | 73 ++++++++++++------------ backend/internal/api/handlers/stats.go | 14 +++-- backend/internal/api/handlers/users.go | 59 ++++++++++--------- backend/internal/db/virtual_domains.go | 8 +++ 9 files changed, 94 insertions(+), 97 deletions(-) diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go index 43ae5f9..e5323fa 100644 --- a/backend/cmd/server/main.go +++ b/backend/cmd/server/main.go @@ -3,6 +3,7 @@ package main import ( + "context" // context for cancellation and timeouts "crypto/rand" // cryptographically secure random number generator "flag" // standard library for parsing command-line flags "fmt" // formatted I/O, used here for printing output @@ -90,25 +91,22 @@ func main() { log.Fatalf("Failed to hash password: %v", err) } + ctx := context.Background() + // Get or create a default domain for the admin user. - domains, err := database.GetAllDomains() + domains, err := database.GetAllDomains(ctx) if err != nil || len(domains) == 0 { // Create a default domain if none exist. - domain, err := database.CreateDomain("localhost") + err := database.CreateDomain(ctx, "localhost") if err != nil { log.Fatalf("Failed to create default domain: %v", err) } - if err := database.UpsertAdminUser("admin", hash, domain.ID); err != nil { - log.Fatalf("Failed to reset admin password: %v", err) + domains, err = database.GetAllDomains(ctx) + if err != nil || len(domains) == 0 { + log.Fatalf("Failed to get domain: %v", err) } - fmt.Printf("Admin password reset successfully.\n") - fmt.Printf("Username: admin\n") - fmt.Printf("Password: %s\n", password) - fmt.Printf("Default domain created: localhost\n") - return } - // Use the first domain found. - if err := database.UpsertAdminUser("admin", hash, domains[0].ID); err != nil { + if err := database.UpsertAdminUser(ctx, "admin", hash, domains[0].ID); err != nil { log.Fatalf("Failed to reset admin password: %v", err) } fmt.Printf("Admin password reset successfully.\n") diff --git a/backend/go.mod b/backend/go.mod index ba524d9..26ca250 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -4,11 +4,10 @@ go 1.25.0 require ( github.com/gin-gonic/gin v1.10.0 + github.com/go-sql-driver/mysql v1.9.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/joho/godotenv v1.5.1 golang.org/x/crypto v0.49.0 - gorm.io/driver/mysql v1.6.0 - gorm.io/gorm v1.31.1 ) require ( @@ -22,10 +21,7 @@ require ( github.com/go-playground/locales v0.14.1 // indirect github.com/go-playground/universal-translator v0.18.1 // indirect github.com/go-playground/validator/v10 v10.20.0 // indirect - github.com/go-sql-driver/mysql v1.9.3 // indirect github.com/goccy/go-json v0.10.2 // indirect - github.com/jinzhu/inflection v1.0.0 // indirect - github.com/jinzhu/now v1.1.5 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/klauspost/cpuid/v2 v2.2.7 // indirect github.com/leodido/go-urn v1.4.0 // indirect diff --git a/backend/go.sum b/backend/go.sum index ed4dee7..6664ccb 100644 --- a/backend/go.sum +++ b/backend/go.sum @@ -34,10 +34,6 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= -github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E= -github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc= -github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ= -github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8= github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= @@ -97,9 +93,5 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gorm.io/driver/mysql v1.6.0 h1:eNbLmNTpPpTOVZi8MMxCi2aaIm0ZpInbORNXDwyLGvg= -gorm.io/driver/mysql v1.6.0/go.mod h1:D/oCC2GWK3M/dqoLxnOlaNKmXz8WNTfcS9y5ovaSqKo= -gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg= -gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs= nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50= rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4= diff --git a/backend/internal/api/handlers/aliases.go b/backend/internal/api/handlers/aliases.go index e0b2a50..93028ff 100644 --- a/backend/internal/api/handlers/aliases.go +++ b/backend/internal/api/handlers/aliases.go @@ -1,7 +1,6 @@ package handlers import ( - "context" "net/http" "strconv" "strings" diff --git a/backend/internal/api/handlers/auth.go b/backend/internal/api/handlers/auth.go index b4479d3..a91d7db 100644 --- a/backend/internal/api/handlers/auth.go +++ b/backend/internal/api/handlers/auth.go @@ -49,8 +49,6 @@ func (h *AuthHandler) Login(c *gin.Context) { return } - ip := h.getClientIP(c) - user, err := h.db.GetImcUserByUsername(c.Request.Context(), req.Username) if err != nil || !auth.CheckPassword(req.Password, user.PasswordHash) { Error(c, http.StatusUnauthorized, "invalid credentials") diff --git a/backend/internal/api/handlers/domains.go b/backend/internal/api/handlers/domains.go index c8cd0da..43323cc 100644 --- a/backend/internal/api/handlers/domains.go +++ b/backend/internal/api/handlers/domains.go @@ -1,9 +1,6 @@ package handlers import ( - "context" - "database/sql" - "errors" "net/http" "regexp" "strconv" @@ -33,15 +30,10 @@ func (h *DomainHandler) List(c *gin.Context) { } isAdmin := authCtx.IsAdmin() - domains, err := h.db.GetUserAccessibleDomains(c.Request.Context(), authCtx.UserID, isAdmin) - if err != nil { - Error(c, http.StatusInternalServerError, "database error") - return - } + ctx := c.Request.Context() - // If admin, use optimized single-query method. if isAdmin { - domainStats, err := h.db.GetAllDomainsWithCounts(c.Request.Context()) + domainStats, err := h.db.GetAllDomainsWithCounts(ctx) if err != nil { Error(c, http.StatusInternalServerError, "database error") return @@ -50,11 +42,16 @@ func (h *DomainHandler) List(c *gin.Context) { return } - // For non-admins, build stats from their accessible domains. + domains, err := h.db.GetUserAccessibleDomains(ctx, uint32(authCtx.UserID), isAdmin) + if err != nil { + Error(c, http.StatusInternalServerError, "database error") + return + } + domainStats := make([]db.DomainStats, len(domains)) for i, d := range domains { - userCount, _ := h.db.CountUsersByDomain(c.Request.Context(), d.ID) - aliasCount, _ := h.db.CountAliasesByDomain(c.Request.Context(), d.ID) + userCount, _ := h.db.CountUsersByDomain(ctx, d.ID) + aliasCount, _ := h.db.CountAliasesByDomain(ctx, d.ID) domainStats[i] = db.DomainStats{ ID: d.ID, Name: d.Name, @@ -73,7 +70,8 @@ func (h *DomainHandler) Get(c *gin.Context) { return } - domain, err := h.db.GetDomainByName(c.Request.Context(), domainName) + ctx := c.Request.Context() + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return @@ -85,7 +83,7 @@ func (h *DomainHandler) Get(c *gin.Context) { return } - canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) + canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin()) if !canAccess { Error(c, http.StatusForbidden, "access denied") return @@ -113,19 +111,20 @@ func (h *DomainHandler) Create(c *gin.Context) { return } - existing, err := h.db.GetDomainByName(name) - if err == nil && existing != nil { + ctx := c.Request.Context() + _, err := h.db.GetDomainByName(ctx, name) + if err == nil { Error(c, http.StatusConflict, "domain already exists") return } - domain, err := h.db.CreateDomain(name) + err = h.db.CreateDomain(ctx, name) if err != nil { Error(c, http.StatusInternalServerError, "failed to create domain") return } - Created(c, domain) + Created(c, map[string]string{"message": "domain created"}) } func validateDomainName(name string) error { @@ -181,13 +180,15 @@ func (h *DomainHandler) Delete(c *gin.Context) { return } - domain, err := h.db.GetDomainByName(domainName) + ctx := c.Request.Context() + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return } - if err := h.db.DeleteDomain(domain.ID); err != nil { + err = h.db.DeleteDomain(ctx, domain.ID) + if err != nil { Error(c, http.StatusInternalServerError, "failed to delete domain") return } @@ -196,20 +197,15 @@ func (h *DomainHandler) Delete(c *gin.Context) { } type DomainPermissions struct { - DomainID uint `json:"domainId"` + DomainID uint32 `json:"domainId"` DomainName string `json:"domainName"` - UserID uint `json:"userId"` + UserID uint32 `json:"userId"` CanManage bool `json:"canManage"` } func (h *DomainHandler) GetPermissions(c *gin.Context) { authCtx := GetAuthContext(c) - if authCtx == nil { - Error(c, http.StatusUnauthorized, "authentication required") - return - } - - if !authCtx.IsAdmin() { + if authCtx == nil || !authCtx.IsAdmin() { Error(c, http.StatusForbidden, "admin access required") return } @@ -220,13 +216,14 @@ func (h *DomainHandler) GetPermissions(c *gin.Context) { return } - domain, err := h.db.GetDomainByName(domainName) + ctx := c.Request.Context() + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return } - users, err := h.db.GetUsersForDomain(domain.ID) + users, err := h.db.GetUsersForDomain(ctx, domain.ID) if err != nil { Error(c, http.StatusInternalServerError, "database error") return @@ -258,21 +255,23 @@ func (h *DomainHandler) AddPermission(c *gin.Context) { return } - domain, err := h.db.GetDomainByName(domainName) + ctx := c.Request.Context() + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return } var req struct { - UserID uint `json:"userId" binding:"required"` + UserID uint32 `json:"userId" binding:"required"` } if err := c.ShouldBindJSON(&req); err != nil { Error(c, http.StatusBadRequest, "invalid request") return } - if err := h.db.AddUserToDomain(req.UserID, domain.ID); err != nil { + err = h.db.AddUserToDomain(ctx, req.UserID, domain.ID) + if err != nil { Error(c, http.StatusInternalServerError, "failed to add user to domain") return } @@ -293,7 +292,8 @@ func (h *DomainHandler) RemovePermission(c *gin.Context) { return } - domain, err := h.db.GetDomainByName(domainName) + ctx := c.Request.Context() + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return @@ -306,7 +306,8 @@ func (h *DomainHandler) RemovePermission(c *gin.Context) { return } - if err := h.db.RemoveUserFromDomain(uint(userID), domain.ID); err != nil { + err = h.db.RemoveUserFromDomain(ctx, uint32(userID), domain.ID) + if err != nil { Error(c, http.StatusInternalServerError, "failed to remove user from domain") return } diff --git a/backend/internal/api/handlers/stats.go b/backend/internal/api/handlers/stats.go index b798c16..f8a6aa8 100644 --- a/backend/internal/api/handlers/stats.go +++ b/backend/internal/api/handlers/stats.go @@ -21,19 +21,21 @@ type Stats struct { } func (h *StatsHandler) Get(c *gin.Context) { - domains, err := h.db.GetAllDomains() + ctx := c.Request.Context() + + domains, err := h.db.GetAllDomains(ctx) if err != nil { - domains = []db.DomainStats{} + domains = nil } - users, err := h.db.GetAllMailUsers() + users, err := h.db.GetAllMailUsers(ctx) if err != nil { - users = []db.VirtualUser{} + users = nil } - aliases, err := h.db.GetAllAliases() + aliases, err := h.db.GetAllAliases(ctx) if err != nil { - aliases = []db.AliasWithDomain{} + aliases = nil } stats := Stats{ diff --git a/backend/internal/api/handlers/users.go b/backend/internal/api/handlers/users.go index ae0988b..8dbc749 100644 --- a/backend/internal/api/handlers/users.go +++ b/backend/internal/api/handlers/users.go @@ -32,7 +32,7 @@ type UpdateUserRequest struct { } type UserWithQuota struct { - ID uint `json:"id"` + ID uint32 `json:"id"` Email string `json:"email"` Quota int64 `json:"quota"` UsedQuota *int64 `json:"usedQuota"` @@ -51,19 +51,20 @@ func (h *UserHandler) List(c *gin.Context) { return } - canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) + ctx := c.Request.Context() + canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin()) if !canAccess { Error(c, http.StatusForbidden, "access denied") return } - domain, err := h.db.GetDomainByName(domainName) + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return } - users, err := h.db.GetUsersByDomain(domain.ID) + users, err := h.db.GetUsersByDomain(ctx, domain.ID) if err != nil { Error(c, http.StatusInternalServerError, "database error") return @@ -71,16 +72,17 @@ func (h *UserHandler) List(c *gin.Context) { result := make([]UserWithQuota, len(users)) for i, user := range users { + quota := user.Quota.Int64 result[i] = UserWithQuota{ ID: user.ID, Email: user.Email, - Quota: user.Quota, + Quota: quota, } - quota, err := mail.GetQuota(user.Email) - if err == nil && quota != nil { - result[i].Quota = quota.Limit - result[i].UsedQuota = "a.Used + mailQuota, err := mail.GetQuota(user.Email) + if err == nil && mailQuota != nil { + result[i].Quota = mailQuota.Limit + result[i].UsedQuota = &mailQuota.Used } } @@ -102,7 +104,8 @@ func (h *UserHandler) Get(c *gin.Context) { return } - canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) + ctx := c.Request.Context() + canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin()) if !canAccess { Error(c, http.StatusForbidden, "access denied") return @@ -114,7 +117,7 @@ func (h *UserHandler) Get(c *gin.Context) { return } - user, err := h.db.GetUserByID(uint(id)) + user, err := h.db.GetUserByID(ctx, uint32(id)) if err != nil { Error(c, http.StatusNotFound, "user not found") return @@ -136,13 +139,14 @@ func (h *UserHandler) Create(c *gin.Context) { return } - canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) + ctx := c.Request.Context() + canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin()) if !canAccess { Error(c, http.StatusForbidden, "access denied") return } - domain, err := h.db.GetDomainByName(domainName) + domain, err := h.db.GetDomainByName(ctx, domainName) if err != nil { Error(c, http.StatusNotFound, "domain not found") return @@ -154,28 +158,27 @@ func (h *UserHandler) Create(c *gin.Context) { return } - // Validate email local part (before @) if err := validateEmailLocalPart(req.Email); err != nil { Error(c, http.StatusBadRequest, err.Error()) return } - existing, _ := h.db.GetUserByEmail(req.Email) - if existing != nil { + _, err = h.db.GetUserByEmail(ctx, req.Email) + if err == nil { Error(c, http.StatusConflict, "user already exists") return } passwordHash := "{BLF-CRYPT}" + req.Password - user, err := h.db.CreateUserInDomain(req.Email, passwordHash, req.Quota, domain.ID) + err = h.db.CreateUser(ctx, domain.ID, req.Email, passwordHash, req.Quota) if err != nil { - log.Printf("CreateUserInDomain error: email=%s, domain=%s, err=%v", req.Email, domainName, err) + log.Printf("CreateUser error: email=%s, domain=%s, err=%v", req.Email, domainName, err) Error(c, http.StatusInternalServerError, "failed to create user") return } - Created(c, user) + Created(c, map[string]string{"message": "user created"}) } func (h *UserHandler) Update(c *gin.Context) { @@ -193,7 +196,8 @@ func (h *UserHandler) Update(c *gin.Context) { return } - canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) + ctx := c.Request.Context() + canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin()) if !canAccess { Error(c, http.StatusForbidden, "access denied") return @@ -205,7 +209,7 @@ func (h *UserHandler) Update(c *gin.Context) { return } - user, err := h.db.GetUserByID(uint(id)) + user, err := h.db.GetUserByID(ctx, uint32(id)) if err != nil { Error(c, http.StatusNotFound, "user not found") return @@ -219,14 +223,14 @@ func (h *UserHandler) Update(c *gin.Context) { if req.Password != "" { passwordHash := "{BLF-CRYPT}" + req.Password - if err := h.db.UpdateUserPassword(user.ID, passwordHash); err != nil { + if err := h.db.UpdateUserPassword(ctx, user.ID, passwordHash); err != nil { Error(c, http.StatusInternalServerError, "failed to update password") return } } if req.Quota >= 0 { - if err := h.db.UpdateUserQuota(user.ID, req.Quota); err != nil { + if err := h.db.UpdateUserQuota(ctx, user.ID, req.Quota); err != nil { Error(c, http.StatusInternalServerError, "failed to update quota") return } @@ -250,7 +254,8 @@ func (h *UserHandler) Delete(c *gin.Context) { return } - canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) + ctx := c.Request.Context() + canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin()) if !canAccess { Error(c, http.StatusForbidden, "access denied") return @@ -262,7 +267,8 @@ func (h *UserHandler) Delete(c *gin.Context) { return } - if err := h.db.DeleteUser(uint(id)); err != nil { + err = h.db.DeleteUser(ctx, uint32(id)) + if err != nil { Error(c, http.StatusInternalServerError, "failed to delete user") return } @@ -283,17 +289,14 @@ func validateEmailLocalPart(email string) error { return &ValidationError{Message: "username must be between 1 and 64 characters"} } - // RFC 5321: local-part cannot start or end with a dot if strings.HasPrefix(localPart, ".") || strings.HasSuffix(localPart, ".") { return &ValidationError{Message: "username cannot start or end with a dot"} } - // RFC 5321: local-part cannot contain consecutive dots if strings.Contains(localPart, "..") { return &ValidationError{Message: "username cannot contain consecutive dots"} } - // Check valid characters (RFC 5321: letters, digits, and special chars !#$%&'*+/=?^_`{|}~-) if !emailLocalPartRegex.MatchString(localPart) { return &ValidationError{Message: "username contains invalid characters"} } diff --git a/backend/internal/db/virtual_domains.go b/backend/internal/db/virtual_domains.go index 2c9c406..79d38e2 100644 --- a/backend/internal/db/virtual_domains.go +++ b/backend/internal/db/virtual_domains.go @@ -43,3 +43,11 @@ func (d *DB) GetAllDomainsWithCounts(ctx context.Context) ([]DomainStats, error) } return stats, nil } + +func (d *DB) CountUsersByDomain(ctx context.Context, domainID uint32) (int64, error) { + return d.Queries.CountUsersByDomain(ctx, domainID) +} + +func (d *DB) CountAliasesByDomain(ctx context.Context, domainID uint32) (int64, error) { + return d.Queries.CountAliasesByDomain(ctx, domainID) +}