Owen
218687a1ee
A small IT asset inventory system built around a nested folder tree, matching the project brief: Go + html/template + Bootstrap 5 + vanilla JS, SQLite storage (WAL, FKs, migrations), embedded templates/static assets, single compiled binary. - AJAX-driven inventory tree: lazy-loaded folder expansion with per-user persisted expand state, drag-and-drop move for folders/assets, safe delete-with-relocate-or-cascade confirmation, search with breadcrumbs. - Assets: CRUD, duplicate, move, auto-generated IT-000001-style IDs, CSV import (with optional folder auto-create) and export. - Admin-defined item types with custom fields (text/long_text/number/date/ boolean/dropdown/url/ip_address). - Configurable statuses, session-based auth (bcrypt, secure cookies), admin/user roles, user management. - CLI: serve, version, database migrate, database backup; /healthz; graceful shutdown; Dockerfile/docker-compose/systemd unit; Go test suite.
66 lines
1.8 KiB
Go
66 lines
1.8 KiB
Go
package web
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"inventree/internal/auth"
|
|
"inventree/internal/models"
|
|
)
|
|
|
|
// loadSession attaches the current user (if any) to the request context
|
|
// based on the session cookie. It never blocks the request.
|
|
func (a *App) loadSession(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
cookie, err := r.Cookie(auth.CookieName)
|
|
if err != nil || cookie.Value == "" {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
u, err := a.Auth.UserForToken(r.Context(), cookie.Value)
|
|
if err != nil {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
r = r.WithContext(auth.WithUser(r.Context(), u))
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// requireLogin redirects unauthenticated page requests to /login, and
|
|
// returns 401 for AJAX/API requests instead.
|
|
func (a *App) requireLogin(next http.HandlerFunc) http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
if _, ok := auth.UserFromContext(r.Context()); !ok {
|
|
if isAjax(r) {
|
|
writeErr(w, http.StatusUnauthorized, "not authenticated")
|
|
return
|
|
}
|
|
http.Redirect(w, r, "/login?next="+r.URL.Path, http.StatusSeeOther)
|
|
return
|
|
}
|
|
next(w, r)
|
|
}
|
|
}
|
|
|
|
// requireAdmin additionally requires the current user to hold the admin
|
|
// role.
|
|
func (a *App) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
|
|
return a.requireLogin(func(w http.ResponseWriter, r *http.Request) {
|
|
u, _ := auth.UserFromContext(r.Context())
|
|
if !u.IsAdmin() {
|
|
writeErr(w, http.StatusForbidden, "admin access required")
|
|
return
|
|
}
|
|
next(w, r)
|
|
})
|
|
}
|
|
|
|
func isAjax(r *http.Request) bool {
|
|
return r.Header.Get("X-Requested-With") == "XMLHttpRequest" || r.Header.Get("HX-Request") != ""
|
|
}
|
|
|
|
func currentUser(r *http.Request) *models.User {
|
|
u, _ := auth.UserFromContext(r.Context())
|
|
return u
|
|
}
|