jordi fita mas
50fbfce9ee
It is inside the “user menu” only because this is where Numerus has the same option, although it makes less sense in this case, because Numerus is geared toward individual freelancers while Camper is for companies. But, since it is easy to change afterward, this will do for now. However, it should be only shown to admin users, because regular employees have no UPDATE privilege on the company relation. Thus, the need for a new template function to check if the user is admin. Part of #17.
51 lines
925 B
Go
51 lines
925 B
Go
/*
|
|
* SPDX-FileCopyrightText: 2023 jordi fita mas <jfita@peritasoft.com>
|
|
* SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package auth
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
|
|
"golang.org/x/text/language"
|
|
|
|
"dev.tandem.ws/tandem/camper/pkg/locale"
|
|
)
|
|
|
|
const (
|
|
CSRFTokenField = "csrf_token"
|
|
CSRFTokenHeader = "X-CSRFToken"
|
|
)
|
|
|
|
type User struct {
|
|
ID int
|
|
Email string
|
|
LoggedIn bool
|
|
Role string
|
|
Language language.Tag
|
|
CSRFToken string
|
|
Locale *locale.Locale
|
|
}
|
|
|
|
func (user *User) VerifyCSRFToken(r *http.Request) error {
|
|
token := r.Header.Get(CSRFTokenHeader)
|
|
if token == "" {
|
|
token = r.FormValue(CSRFTokenField)
|
|
}
|
|
if user.CSRFToken == token {
|
|
return nil
|
|
}
|
|
return errors.New(user.Locale.Gettext("Cross-site request forgery detected."))
|
|
}
|
|
|
|
func (user *User) IsEmployee() bool {
|
|
role := user.Role[0]
|
|
return role == 'e' || role == 'a'
|
|
}
|
|
|
|
func (user *User) IsAdmin() bool {
|
|
return user.Role[0] == 'a'
|
|
}
|