Complete GORM to sqlc migration

- Remove GORM dependency, use sqlc for type-safe SQL queries
- Update all handlers to use sqlc patterns (context, value types)
- Fix N+1 query problem in domain listing with JOIN query
- Enable SQL query logging in debug mode (USE_EMBEDDED=false)
- Add comprehensive comments for non-Go developers
This commit is contained in:
Christoph Haas 2026-03-29 13:56:14 +02:00
parent dad96978e0
commit c4e3a31b69
9 changed files with 94 additions and 97 deletions

View file

@ -3,6 +3,7 @@
package main package main
import ( import (
"context" // context for cancellation and timeouts
"crypto/rand" // cryptographically secure random number generator "crypto/rand" // cryptographically secure random number generator
"flag" // standard library for parsing command-line flags "flag" // standard library for parsing command-line flags
"fmt" // formatted I/O, used here for printing output "fmt" // formatted I/O, used here for printing output
@ -90,25 +91,22 @@ func main() {
log.Fatalf("Failed to hash password: %v", err) log.Fatalf("Failed to hash password: %v", err)
} }
ctx := context.Background()
// Get or create a default domain for the admin user. // Get or create a default domain for the admin user.
domains, err := database.GetAllDomains() domains, err := database.GetAllDomains(ctx)
if err != nil || len(domains) == 0 { if err != nil || len(domains) == 0 {
// Create a default domain if none exist. // Create a default domain if none exist.
domain, err := database.CreateDomain("localhost") err := database.CreateDomain(ctx, "localhost")
if err != nil { if err != nil {
log.Fatalf("Failed to create default domain: %v", err) log.Fatalf("Failed to create default domain: %v", err)
} }
if err := database.UpsertAdminUser("admin", hash, domain.ID); err != nil { domains, err = database.GetAllDomains(ctx)
log.Fatalf("Failed to reset admin password: %v", err) if err != nil || len(domains) == 0 {
log.Fatalf("Failed to get domain: %v", err)
} }
fmt.Printf("Admin password reset successfully.\n")
fmt.Printf("Username: admin\n")
fmt.Printf("Password: %s\n", password)
fmt.Printf("Default domain created: localhost\n")
return
} }
// Use the first domain found. if err := database.UpsertAdminUser(ctx, "admin", hash, domains[0].ID); err != nil {
if err := database.UpsertAdminUser("admin", hash, domains[0].ID); err != nil {
log.Fatalf("Failed to reset admin password: %v", err) log.Fatalf("Failed to reset admin password: %v", err)
} }
fmt.Printf("Admin password reset successfully.\n") fmt.Printf("Admin password reset successfully.\n")

View file

@ -4,11 +4,10 @@ go 1.25.0
require ( require (
github.com/gin-gonic/gin v1.10.0 github.com/gin-gonic/gin v1.10.0
github.com/go-sql-driver/mysql v1.9.3
github.com/golang-jwt/jwt/v5 v5.3.1 github.com/golang-jwt/jwt/v5 v5.3.1
github.com/joho/godotenv v1.5.1 github.com/joho/godotenv v1.5.1
golang.org/x/crypto v0.49.0 golang.org/x/crypto v0.49.0
gorm.io/driver/mysql v1.6.0
gorm.io/gorm v1.31.1
) )
require ( require (
@ -22,10 +21,7 @@ require (
github.com/go-playground/locales v0.14.1 // indirect github.com/go-playground/locales v0.14.1 // indirect
github.com/go-playground/universal-translator v0.18.1 // indirect github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-playground/validator/v10 v10.20.0 // indirect github.com/go-playground/validator/v10 v10.20.0 // indirect
github.com/go-sql-driver/mysql v1.9.3 // indirect
github.com/goccy/go-json v0.10.2 // indirect github.com/goccy/go-json v0.10.2 // indirect
github.com/jinzhu/inflection v1.0.0 // indirect
github.com/jinzhu/now v1.1.5 // indirect
github.com/json-iterator/go v1.1.12 // indirect github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/cpuid/v2 v2.2.7 // indirect github.com/klauspost/cpuid/v2 v2.2.7 // indirect
github.com/leodido/go-urn v1.4.0 // indirect github.com/leodido/go-urn v1.4.0 // indirect

View file

@ -34,10 +34,6 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU= github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@ -97,9 +93,5 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gorm.io/driver/mysql v1.6.0 h1:eNbLmNTpPpTOVZi8MMxCi2aaIm0ZpInbORNXDwyLGvg=
gorm.io/driver/mysql v1.6.0/go.mod h1:D/oCC2GWK3M/dqoLxnOlaNKmXz8WNTfcS9y5ovaSqKo=
gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50= nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4= rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=

View file

@ -1,7 +1,6 @@
package handlers package handlers
import ( import (
"context"
"net/http" "net/http"
"strconv" "strconv"
"strings" "strings"

View file

@ -49,8 +49,6 @@ func (h *AuthHandler) Login(c *gin.Context) {
return return
} }
ip := h.getClientIP(c)
user, err := h.db.GetImcUserByUsername(c.Request.Context(), req.Username) user, err := h.db.GetImcUserByUsername(c.Request.Context(), req.Username)
if err != nil || !auth.CheckPassword(req.Password, user.PasswordHash) { if err != nil || !auth.CheckPassword(req.Password, user.PasswordHash) {
Error(c, http.StatusUnauthorized, "invalid credentials") Error(c, http.StatusUnauthorized, "invalid credentials")

View file

@ -1,9 +1,6 @@
package handlers package handlers
import ( import (
"context"
"database/sql"
"errors"
"net/http" "net/http"
"regexp" "regexp"
"strconv" "strconv"
@ -33,15 +30,10 @@ func (h *DomainHandler) List(c *gin.Context) {
} }
isAdmin := authCtx.IsAdmin() isAdmin := authCtx.IsAdmin()
domains, err := h.db.GetUserAccessibleDomains(c.Request.Context(), authCtx.UserID, isAdmin) ctx := c.Request.Context()
if err != nil {
Error(c, http.StatusInternalServerError, "database error")
return
}
// If admin, use optimized single-query method.
if isAdmin { if isAdmin {
domainStats, err := h.db.GetAllDomainsWithCounts(c.Request.Context()) domainStats, err := h.db.GetAllDomainsWithCounts(ctx)
if err != nil { if err != nil {
Error(c, http.StatusInternalServerError, "database error") Error(c, http.StatusInternalServerError, "database error")
return return
@ -50,11 +42,16 @@ func (h *DomainHandler) List(c *gin.Context) {
return return
} }
// For non-admins, build stats from their accessible domains. domains, err := h.db.GetUserAccessibleDomains(ctx, uint32(authCtx.UserID), isAdmin)
if err != nil {
Error(c, http.StatusInternalServerError, "database error")
return
}
domainStats := make([]db.DomainStats, len(domains)) domainStats := make([]db.DomainStats, len(domains))
for i, d := range domains { for i, d := range domains {
userCount, _ := h.db.CountUsersByDomain(c.Request.Context(), d.ID) userCount, _ := h.db.CountUsersByDomain(ctx, d.ID)
aliasCount, _ := h.db.CountAliasesByDomain(c.Request.Context(), d.ID) aliasCount, _ := h.db.CountAliasesByDomain(ctx, d.ID)
domainStats[i] = db.DomainStats{ domainStats[i] = db.DomainStats{
ID: d.ID, ID: d.ID,
Name: d.Name, Name: d.Name,
@ -73,7 +70,8 @@ func (h *DomainHandler) Get(c *gin.Context) {
return return
} }
domain, err := h.db.GetDomainByName(c.Request.Context(), domainName) ctx := c.Request.Context()
domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
@ -85,7 +83,7 @@ func (h *DomainHandler) Get(c *gin.Context) {
return return
} }
canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin())
if !canAccess { if !canAccess {
Error(c, http.StatusForbidden, "access denied") Error(c, http.StatusForbidden, "access denied")
return return
@ -113,19 +111,20 @@ func (h *DomainHandler) Create(c *gin.Context) {
return return
} }
existing, err := h.db.GetDomainByName(name) ctx := c.Request.Context()
if err == nil && existing != nil { _, err := h.db.GetDomainByName(ctx, name)
if err == nil {
Error(c, http.StatusConflict, "domain already exists") Error(c, http.StatusConflict, "domain already exists")
return return
} }
domain, err := h.db.CreateDomain(name) err = h.db.CreateDomain(ctx, name)
if err != nil { if err != nil {
Error(c, http.StatusInternalServerError, "failed to create domain") Error(c, http.StatusInternalServerError, "failed to create domain")
return return
} }
Created(c, domain) Created(c, map[string]string{"message": "domain created"})
} }
func validateDomainName(name string) error { func validateDomainName(name string) error {
@ -181,13 +180,15 @@ func (h *DomainHandler) Delete(c *gin.Context) {
return return
} }
domain, err := h.db.GetDomainByName(domainName) ctx := c.Request.Context()
domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
} }
if err := h.db.DeleteDomain(domain.ID); err != nil { err = h.db.DeleteDomain(ctx, domain.ID)
if err != nil {
Error(c, http.StatusInternalServerError, "failed to delete domain") Error(c, http.StatusInternalServerError, "failed to delete domain")
return return
} }
@ -196,20 +197,15 @@ func (h *DomainHandler) Delete(c *gin.Context) {
} }
type DomainPermissions struct { type DomainPermissions struct {
DomainID uint `json:"domainId"` DomainID uint32 `json:"domainId"`
DomainName string `json:"domainName"` DomainName string `json:"domainName"`
UserID uint `json:"userId"` UserID uint32 `json:"userId"`
CanManage bool `json:"canManage"` CanManage bool `json:"canManage"`
} }
func (h *DomainHandler) GetPermissions(c *gin.Context) { func (h *DomainHandler) GetPermissions(c *gin.Context) {
authCtx := GetAuthContext(c) authCtx := GetAuthContext(c)
if authCtx == nil { if authCtx == nil || !authCtx.IsAdmin() {
Error(c, http.StatusUnauthorized, "authentication required")
return
}
if !authCtx.IsAdmin() {
Error(c, http.StatusForbidden, "admin access required") Error(c, http.StatusForbidden, "admin access required")
return return
} }
@ -220,13 +216,14 @@ func (h *DomainHandler) GetPermissions(c *gin.Context) {
return return
} }
domain, err := h.db.GetDomainByName(domainName) ctx := c.Request.Context()
domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
} }
users, err := h.db.GetUsersForDomain(domain.ID) users, err := h.db.GetUsersForDomain(ctx, domain.ID)
if err != nil { if err != nil {
Error(c, http.StatusInternalServerError, "database error") Error(c, http.StatusInternalServerError, "database error")
return return
@ -258,21 +255,23 @@ func (h *DomainHandler) AddPermission(c *gin.Context) {
return return
} }
domain, err := h.db.GetDomainByName(domainName) ctx := c.Request.Context()
domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
} }
var req struct { var req struct {
UserID uint `json:"userId" binding:"required"` UserID uint32 `json:"userId" binding:"required"`
} }
if err := c.ShouldBindJSON(&req); err != nil { if err := c.ShouldBindJSON(&req); err != nil {
Error(c, http.StatusBadRequest, "invalid request") Error(c, http.StatusBadRequest, "invalid request")
return return
} }
if err := h.db.AddUserToDomain(req.UserID, domain.ID); err != nil { err = h.db.AddUserToDomain(ctx, req.UserID, domain.ID)
if err != nil {
Error(c, http.StatusInternalServerError, "failed to add user to domain") Error(c, http.StatusInternalServerError, "failed to add user to domain")
return return
} }
@ -293,7 +292,8 @@ func (h *DomainHandler) RemovePermission(c *gin.Context) {
return return
} }
domain, err := h.db.GetDomainByName(domainName) ctx := c.Request.Context()
domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
@ -306,7 +306,8 @@ func (h *DomainHandler) RemovePermission(c *gin.Context) {
return return
} }
if err := h.db.RemoveUserFromDomain(uint(userID), domain.ID); err != nil { err = h.db.RemoveUserFromDomain(ctx, uint32(userID), domain.ID)
if err != nil {
Error(c, http.StatusInternalServerError, "failed to remove user from domain") Error(c, http.StatusInternalServerError, "failed to remove user from domain")
return return
} }

View file

@ -21,19 +21,21 @@ type Stats struct {
} }
func (h *StatsHandler) Get(c *gin.Context) { func (h *StatsHandler) Get(c *gin.Context) {
domains, err := h.db.GetAllDomains() ctx := c.Request.Context()
domains, err := h.db.GetAllDomains(ctx)
if err != nil { if err != nil {
domains = []db.DomainStats{} domains = nil
} }
users, err := h.db.GetAllMailUsers() users, err := h.db.GetAllMailUsers(ctx)
if err != nil { if err != nil {
users = []db.VirtualUser{} users = nil
} }
aliases, err := h.db.GetAllAliases() aliases, err := h.db.GetAllAliases(ctx)
if err != nil { if err != nil {
aliases = []db.AliasWithDomain{} aliases = nil
} }
stats := Stats{ stats := Stats{

View file

@ -32,7 +32,7 @@ type UpdateUserRequest struct {
} }
type UserWithQuota struct { type UserWithQuota struct {
ID uint `json:"id"` ID uint32 `json:"id"`
Email string `json:"email"` Email string `json:"email"`
Quota int64 `json:"quota"` Quota int64 `json:"quota"`
UsedQuota *int64 `json:"usedQuota"` UsedQuota *int64 `json:"usedQuota"`
@ -51,19 +51,20 @@ func (h *UserHandler) List(c *gin.Context) {
return return
} }
canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) ctx := c.Request.Context()
canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin())
if !canAccess { if !canAccess {
Error(c, http.StatusForbidden, "access denied") Error(c, http.StatusForbidden, "access denied")
return return
} }
domain, err := h.db.GetDomainByName(domainName) domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
} }
users, err := h.db.GetUsersByDomain(domain.ID) users, err := h.db.GetUsersByDomain(ctx, domain.ID)
if err != nil { if err != nil {
Error(c, http.StatusInternalServerError, "database error") Error(c, http.StatusInternalServerError, "database error")
return return
@ -71,16 +72,17 @@ func (h *UserHandler) List(c *gin.Context) {
result := make([]UserWithQuota, len(users)) result := make([]UserWithQuota, len(users))
for i, user := range users { for i, user := range users {
quota := user.Quota.Int64
result[i] = UserWithQuota{ result[i] = UserWithQuota{
ID: user.ID, ID: user.ID,
Email: user.Email, Email: user.Email,
Quota: user.Quota, Quota: quota,
} }
quota, err := mail.GetQuota(user.Email) mailQuota, err := mail.GetQuota(user.Email)
if err == nil && quota != nil { if err == nil && mailQuota != nil {
result[i].Quota = quota.Limit result[i].Quota = mailQuota.Limit
result[i].UsedQuota = &quota.Used result[i].UsedQuota = &mailQuota.Used
} }
} }
@ -102,7 +104,8 @@ func (h *UserHandler) Get(c *gin.Context) {
return return
} }
canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) ctx := c.Request.Context()
canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin())
if !canAccess { if !canAccess {
Error(c, http.StatusForbidden, "access denied") Error(c, http.StatusForbidden, "access denied")
return return
@ -114,7 +117,7 @@ func (h *UserHandler) Get(c *gin.Context) {
return return
} }
user, err := h.db.GetUserByID(uint(id)) user, err := h.db.GetUserByID(ctx, uint32(id))
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "user not found") Error(c, http.StatusNotFound, "user not found")
return return
@ -136,13 +139,14 @@ func (h *UserHandler) Create(c *gin.Context) {
return return
} }
canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) ctx := c.Request.Context()
canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin())
if !canAccess { if !canAccess {
Error(c, http.StatusForbidden, "access denied") Error(c, http.StatusForbidden, "access denied")
return return
} }
domain, err := h.db.GetDomainByName(domainName) domain, err := h.db.GetDomainByName(ctx, domainName)
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "domain not found") Error(c, http.StatusNotFound, "domain not found")
return return
@ -154,28 +158,27 @@ func (h *UserHandler) Create(c *gin.Context) {
return return
} }
// Validate email local part (before @)
if err := validateEmailLocalPart(req.Email); err != nil { if err := validateEmailLocalPart(req.Email); err != nil {
Error(c, http.StatusBadRequest, err.Error()) Error(c, http.StatusBadRequest, err.Error())
return return
} }
existing, _ := h.db.GetUserByEmail(req.Email) _, err = h.db.GetUserByEmail(ctx, req.Email)
if existing != nil { if err == nil {
Error(c, http.StatusConflict, "user already exists") Error(c, http.StatusConflict, "user already exists")
return return
} }
passwordHash := "{BLF-CRYPT}" + req.Password passwordHash := "{BLF-CRYPT}" + req.Password
user, err := h.db.CreateUserInDomain(req.Email, passwordHash, req.Quota, domain.ID) err = h.db.CreateUser(ctx, domain.ID, req.Email, passwordHash, req.Quota)
if err != nil { if err != nil {
log.Printf("CreateUserInDomain error: email=%s, domain=%s, err=%v", req.Email, domainName, err) log.Printf("CreateUser error: email=%s, domain=%s, err=%v", req.Email, domainName, err)
Error(c, http.StatusInternalServerError, "failed to create user") Error(c, http.StatusInternalServerError, "failed to create user")
return return
} }
Created(c, user) Created(c, map[string]string{"message": "user created"})
} }
func (h *UserHandler) Update(c *gin.Context) { func (h *UserHandler) Update(c *gin.Context) {
@ -193,7 +196,8 @@ func (h *UserHandler) Update(c *gin.Context) {
return return
} }
canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) ctx := c.Request.Context()
canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin())
if !canAccess { if !canAccess {
Error(c, http.StatusForbidden, "access denied") Error(c, http.StatusForbidden, "access denied")
return return
@ -205,7 +209,7 @@ func (h *UserHandler) Update(c *gin.Context) {
return return
} }
user, err := h.db.GetUserByID(uint(id)) user, err := h.db.GetUserByID(ctx, uint32(id))
if err != nil { if err != nil {
Error(c, http.StatusNotFound, "user not found") Error(c, http.StatusNotFound, "user not found")
return return
@ -219,14 +223,14 @@ func (h *UserHandler) Update(c *gin.Context) {
if req.Password != "" { if req.Password != "" {
passwordHash := "{BLF-CRYPT}" + req.Password passwordHash := "{BLF-CRYPT}" + req.Password
if err := h.db.UpdateUserPassword(user.ID, passwordHash); err != nil { if err := h.db.UpdateUserPassword(ctx, user.ID, passwordHash); err != nil {
Error(c, http.StatusInternalServerError, "failed to update password") Error(c, http.StatusInternalServerError, "failed to update password")
return return
} }
} }
if req.Quota >= 0 { if req.Quota >= 0 {
if err := h.db.UpdateUserQuota(user.ID, req.Quota); err != nil { if err := h.db.UpdateUserQuota(ctx, user.ID, req.Quota); err != nil {
Error(c, http.StatusInternalServerError, "failed to update quota") Error(c, http.StatusInternalServerError, "failed to update quota")
return return
} }
@ -250,7 +254,8 @@ func (h *UserHandler) Delete(c *gin.Context) {
return return
} }
canAccess, _ := h.db.CanAccessDomain(authCtx.UserID, domainName, authCtx.IsAdmin()) ctx := c.Request.Context()
canAccess, _ := h.db.CanAccessDomain(ctx, uint32(authCtx.UserID), domainName, authCtx.IsAdmin())
if !canAccess { if !canAccess {
Error(c, http.StatusForbidden, "access denied") Error(c, http.StatusForbidden, "access denied")
return return
@ -262,7 +267,8 @@ func (h *UserHandler) Delete(c *gin.Context) {
return return
} }
if err := h.db.DeleteUser(uint(id)); err != nil { err = h.db.DeleteUser(ctx, uint32(id))
if err != nil {
Error(c, http.StatusInternalServerError, "failed to delete user") Error(c, http.StatusInternalServerError, "failed to delete user")
return return
} }
@ -283,17 +289,14 @@ func validateEmailLocalPart(email string) error {
return &ValidationError{Message: "username must be between 1 and 64 characters"} return &ValidationError{Message: "username must be between 1 and 64 characters"}
} }
// RFC 5321: local-part cannot start or end with a dot
if strings.HasPrefix(localPart, ".") || strings.HasSuffix(localPart, ".") { if strings.HasPrefix(localPart, ".") || strings.HasSuffix(localPart, ".") {
return &ValidationError{Message: "username cannot start or end with a dot"} return &ValidationError{Message: "username cannot start or end with a dot"}
} }
// RFC 5321: local-part cannot contain consecutive dots
if strings.Contains(localPart, "..") { if strings.Contains(localPart, "..") {
return &ValidationError{Message: "username cannot contain consecutive dots"} return &ValidationError{Message: "username cannot contain consecutive dots"}
} }
// Check valid characters (RFC 5321: letters, digits, and special chars !#$%&'*+/=?^_`{|}~-)
if !emailLocalPartRegex.MatchString(localPart) { if !emailLocalPartRegex.MatchString(localPart) {
return &ValidationError{Message: "username contains invalid characters"} return &ValidationError{Message: "username contains invalid characters"}
} }

View file

@ -43,3 +43,11 @@ func (d *DB) GetAllDomainsWithCounts(ctx context.Context) ([]DomainStats, error)
} }
return stats, nil return stats, nil
} }
func (d *DB) CountUsersByDomain(ctx context.Context, domainID uint32) (int64, error) {
return d.Queries.CountUsersByDomain(ctx, domainID)
}
func (d *DB) CountAliasesByDomain(ctx context.Context, domainID uint32) (int64, error) {
return d.Queries.CountAliasesByDomain(ctx, domainID)
}