You can now log in.
")) +} + +func (s *Server) handleUserLogin(w http.ResponseWriter, r *http.Request) { + if r.Method != "POST" { + jsonErr(w, 405, "POST required") + return + } + var req struct { + Username string `json:"username"` + Password string `json:"password"` + } + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + jsonErr(w, 400, "invalid JSON") + return + } + if req.Username == "" || req.Password == "" { + jsonErr(w, 400, "username and password required") + return + } + var userID, hash string + var confirmed int + err := s.db.QueryRow("SELECT id, password_hash, confirmed FROM server_users WHERE username=? OR email=?", + req.Username, strings.ToLower(req.Username)).Scan(&userID, &hash, &confirmed) + if err != nil { + jsonErr(w, 401, "invalid credentials") + return + } + if confirmed == 0 { + jsonErr(w, 403, "email not confirmed") + return + } + if bcrypt.CompareHashAndPassword([]byte(hash), []byte(req.Password)) != nil { + jsonErr(w, 401, "invalid credentials") + return + } + tok := s.userTokens.Create(userID) + jsonOK(w, map[string]string{"token": tok, "user_id": userID}) +} + +func (s *Server) handleForgot(w http.ResponseWriter, r *http.Request) { + if r.Method != "POST" { + jsonErr(w, 405, "POST required") + return + } + var req struct { + Email string `json:"email"` + } + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + jsonErr(w, 400, "invalid JSON") + return + } + if req.Email == "" { + jsonErr(w, 400, "email required") + return + } + var userID string + err := s.db.QueryRow("SELECT id FROM server_users WHERE email=?", strings.ToLower(req.Email)).Scan(&userID) + if err != nil { + jsonOK(w, map[string]string{"status": "if email exists, reset link sent"}) + return + } + tok := make([]byte, 24) + rand.Read(tok) + tokenStr := hex.EncodeToString(tok) + exp := time.Now().Add(1 * time.Hour).UTC().Format(time.RFC3339) + now := time.Now().UTC().Format(time.RFC3339) + s.db.Exec("INSERT INTO server_email_tokens (token, user_id, purpose, expires_at, created_at) VALUES (?, ?, 'reset', ?, ?)", + tokenStr, userID, exp, now) + host := s.smtpGet("smtp_host") + if host != "" { + resetURL := fmt.Sprintf("%s/reset?token=%s", s.smtpGet("server_url"), tokenStr) + if resetURL == "" { + resetURL = fmt.Sprintf("/api/v1/auth/reset?token=%s", tokenStr) + } + body := fmt.Sprintf("Reset your Verstak Sync password:\n\n%s\n\nThis link expires in 1 hour.", resetURL) + s.smtpSend(req.Email, "Verstak Sync password reset", body) + } + jsonOK(w, map[string]string{"status": "if email exists, reset link sent"}) +} + +func (s *Server) handleReset(w http.ResponseWriter, r *http.Request) { + if r.Method != "POST" { + jsonErr(w, 405, "POST required") + return + } + var req struct { + Token string `json:"token"` + NewPassword string `json:"new_password"` + } + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + jsonErr(w, 400, "invalid JSON") + return + } + if req.Token == "" || req.NewPassword == "" { + jsonErr(w, 400, "token and new_password required") + return + } + if err := validatePassword(req.NewPassword); err != "" { + jsonErr(w, 400, err) + return + } + var userID, expiresAt string + err := s.db.QueryRow("SELECT user_id, expires_at FROM server_email_tokens WHERE token=? AND purpose='reset'", + req.Token).Scan(&userID, &expiresAt) + if err != nil { + jsonErr(w, 400, "invalid or expired token") + return + } + exp, err := time.Parse(time.RFC3339, expiresAt) + if err != nil || time.Now().After(exp) { + jsonErr(w, 400, "token expired") + return + } + hash, err := bcrypt.GenerateFromPassword([]byte(req.NewPassword), bcrypt.DefaultCost) + if err != nil { + jsonErr(w, 500, "internal error") + return + } + s.db.Exec("UPDATE server_users SET password_hash=? WHERE id=?", string(hash), userID) + s.db.Exec("DELETE FROM server_email_tokens WHERE token=?", req.Token) + jsonOK(w, map[string]string{"status": "password reset"}) +} + +func (s *Server) handleUserDevices(w http.ResponseWriter, r *http.Request) { + userID, ok := s.requireUser(w, r) + if !ok { + return + } + if r.Method != "GET" { + jsonErr(w, 405, "GET required") + return + } + rows, err := s.db.Query(` + SELECT d.id, d.name, d.last_seen, d.created_at + FROM server_devices d + JOIN server_user_devices ud ON ud.device_id = d.id + WHERE ud.user_id = ? + ORDER BY d.created_at`, userID) + if err != nil { + jsonErr(w, 500, err.Error()) + return + } + defer rows.Close() + type deviceDTO struct { + ID string `json:"id"` + Name string `json:"name"` + LastSeen string `json:"last_seen"` + CreatedAt string `json:"created_at"` + } + var devices []deviceDTO + for rows.Next() { + var d deviceDTO + var lastSeen sql.NullString + if err := rows.Scan(&d.ID, &d.Name, &lastSeen, &d.CreatedAt); err != nil { + continue + } + d.LastSeen = lastSeen.String + devices = append(devices, d) + } + if devices == nil { + devices = []deviceDTO{} + } + jsonOK(w, map[string]interface{}{"devices": devices}) +} + func (s *Server) handleSyncPush(w http.ResponseWriter, r *http.Request) { if !s.requireAPIKey(w, r) { return @@ -591,32 +1060,43 @@ func (s *Server) handleAdminDashboard(w http.ResponseWriter, r *http.Request) { s.db.QueryRow("SELECT COUNT(*) FROM server_devices").Scan(&deviceCount) s.db.QueryRow("SELECT COUNT(*) FROM server_ops").Scan(&opsCount) + // Load SMTP config for display. + smtpHost := s.smtpGet("smtp_host") + smtpPort := s.smtpGet("smtp_port") + smtpUser := s.smtpGet("smtp_user") + smtpFrom := s.smtpGet("smtp_from") + srvURL := s.smtpGet("server_url") + html := fmt.Sprintf(`