ntfy/auth/auth_sqlite.go

511 lines
15 KiB
Go
Raw Normal View History

2022-01-23 06:02:16 +01:00
package auth
2022-01-23 05:01:20 +01:00
import (
"database/sql"
2022-12-08 03:26:18 +01:00
"encoding/json"
"errors"
"fmt"
2022-01-26 03:57:28 +01:00
_ "github.com/mattn/go-sqlite3" // SQLite driver
2022-01-23 05:01:20 +01:00
"golang.org/x/crypto/bcrypt"
2022-12-03 21:20:59 +01:00
"heckel.io/ntfy/util"
2022-01-31 17:44:58 +01:00
"strings"
2022-01-23 05:01:20 +01:00
)
2022-01-26 03:57:28 +01:00
const (
2022-12-03 21:20:59 +01:00
tokenLength = 32
2022-02-08 04:09:31 +01:00
bcryptCost = 10
intentionalSlowDownHash = "$2a$10$YFCQvqQDwIIwnJM1xkAYOeih0dg17UVGanaTStnrSzC8NCWxcLDwy" // Cost should match bcryptCost
2022-01-26 03:57:28 +01:00
)
2022-01-23 05:01:20 +01:00
2022-12-15 05:11:22 +01:00
// Manager-related queries
2022-01-23 05:01:20 +01:00
const (
createAuthTablesQueries = `
BEGIN;
2022-12-02 21:37:48 +01:00
CREATE TABLE IF NOT EXISTS plan (
id INT NOT NULL,
2022-12-18 20:35:05 +01:00
code TEXT NOT NULL,
2022-12-19 15:59:32 +01:00
messages_limit INT NOT NULL,
2022-12-17 21:17:52 +01:00
emails_limit INT NOT NULL,
2022-12-19 15:59:32 +01:00
attachment_file_size_limit INT NOT NULL,
attachment_total_size_limit INT NOT NULL,
2022-12-02 21:37:48 +01:00
PRIMARY KEY (id)
);
2022-01-23 05:01:20 +01:00
CREATE TABLE IF NOT EXISTS user (
2022-12-02 21:37:48 +01:00
id INTEGER PRIMARY KEY AUTOINCREMENT,
plan_id INT,
user TEXT NOT NULL,
2022-01-23 05:01:20 +01:00
pass TEXT NOT NULL,
2022-12-02 21:37:48 +01:00
role TEXT NOT NULL,
2022-12-08 03:26:18 +01:00
settings JSON,
2022-12-02 21:37:48 +01:00
FOREIGN KEY (plan_id) REFERENCES plan (id)
2022-01-23 05:01:20 +01:00
);
2022-12-02 21:37:48 +01:00
CREATE UNIQUE INDEX idx_user ON user (user);
CREATE TABLE IF NOT EXISTS user_access (
user_id INT NOT NULL,
2022-01-23 05:01:20 +01:00
topic TEXT NOT NULL,
read INT NOT NULL,
write INT NOT NULL,
2022-12-02 21:37:48 +01:00
PRIMARY KEY (user_id, topic),
FOREIGN KEY (user_id) REFERENCES user (id)
2022-12-08 03:26:18 +01:00
);
2022-12-02 21:37:48 +01:00
CREATE TABLE IF NOT EXISTS user_token (
user_id INT NOT NULL,
2022-12-05 02:33:17 +01:00
token TEXT NOT NULL,
2022-12-02 21:37:48 +01:00
expires INT NOT NULL,
2022-12-05 02:33:17 +01:00
PRIMARY KEY (user_id, token)
2022-12-02 21:37:48 +01:00
);
CREATE TABLE IF NOT EXISTS schemaVersion (
2022-01-23 05:01:20 +01:00
id INT PRIMARY KEY,
version INT NOT NULL
);
2022-12-02 21:37:48 +01:00
INSERT INTO user (id, user, pass, role) VALUES (1, '*', '', 'anonymous') ON CONFLICT (id) DO NOTHING;
2022-01-23 05:01:20 +01:00
COMMIT;
`
2022-12-03 21:20:59 +01:00
selectUserByNameQuery = `
2022-12-19 15:59:32 +01:00
SELECT u.user, u.pass, u.role, u.settings, p.code, p.messages_limit, p.emails_limit, p.attachment_file_size_limit, p.attachment_total_size_limit
2022-12-17 21:17:52 +01:00
FROM user u
LEFT JOIN plan p on p.id = u.plan_id
WHERE user = ?
2022-12-03 21:20:59 +01:00
`
selectUserByTokenQuery = `
2022-12-19 15:59:32 +01:00
SELECT u.user, u.pass, u.role, u.settings, p.code, p.messages_limit, p.emails_limit, p.attachment_file_size_limit, p.attachment_total_size_limit
2022-12-17 21:17:52 +01:00
FROM user u
JOIN user_token t on u.id = t.user_id
LEFT JOIN plan p on p.id = u.plan_id
WHERE t.token = ?
2022-12-03 21:20:59 +01:00
`
2022-01-23 05:01:20 +01:00
selectTopicPermsQuery = `
SELECT read, write
2022-12-02 21:37:48 +01:00
FROM user_access
JOIN user ON user.user = '*' OR user.user = ?
WHERE ? LIKE user_access.topic
ORDER BY user.user DESC
2022-01-23 05:01:20 +01:00
`
)
2022-01-23 06:54:18 +01:00
// Manager-related queries
const (
2022-12-16 04:07:04 +01:00
insertUserQuery = `INSERT INTO user (user, pass, role) VALUES (?, ?, ?)`
selectUsernamesQuery = `SELECT user FROM user ORDER BY role, user`
updateUserPassQuery = `UPDATE user SET pass = ? WHERE user = ?`
updateUserRoleQuery = `UPDATE user SET role = ? WHERE user = ?`
updateUserSettingsQuery = `UPDATE user SET settings = ? WHERE user = ?`
deleteUserQuery = `DELETE FROM user WHERE user = ?`
2022-01-24 06:54:28 +01:00
2022-12-02 21:37:48 +01:00
upsertUserAccessQuery = `INSERT INTO user_access (user_id, topic, read, write) VALUES ((SELECT id FROM user WHERE user = ?), ?, ?, ?)`
selectUserAccessQuery = `SELECT topic, read, write FROM user_access WHERE user_id = (SELECT id FROM user WHERE user = ?)`
deleteAllAccessQuery = `DELETE FROM user_access`
deleteUserAccessQuery = `DELETE FROM user_access WHERE user_id = (SELECT id FROM user WHERE user = ?)`
deleteTopicAccessQuery = `DELETE FROM user_access WHERE user_id = (SELECT id FROM user WHERE user = ?) AND topic = ?`
2022-12-03 21:20:59 +01:00
2022-12-16 04:07:04 +01:00
insertTokenQuery = `INSERT INTO user_token (user_id, token, expires) VALUES ((SELECT id FROM user WHERE user = ?), ?, ?)`
deleteTokenQuery = `DELETE FROM user_token WHERE user_id = (SELECT id FROM user WHERE user = ?) AND token = ?`
deleteUserTokenQuery = `DELETE FROM user_token WHERE user_id = (SELECT id FROM user WHERE user = ?)`
2022-01-23 06:54:18 +01:00
)
// Schema management queries
const (
currentSchemaVersion = 1
insertSchemaVersion = `INSERT INTO schemaVersion VALUES (1, ?)`
selectSchemaVersionQuery = `SELECT version FROM schemaVersion WHERE id = 1`
)
2022-12-19 22:22:13 +01:00
// SQLiteAuthManager is an implementation of Manager. It stores users and access control list
2022-01-26 04:30:53 +01:00
// in a SQLite database.
2022-12-15 05:11:22 +01:00
type SQLiteAuthManager struct {
2022-01-23 05:01:20 +01:00
db *sql.DB
defaultRead bool
defaultWrite bool
}
2022-12-15 05:11:22 +01:00
var _ Manager = (*SQLiteAuthManager)(nil)
2022-01-23 05:01:20 +01:00
2022-12-15 05:11:22 +01:00
// NewSQLiteAuthManager creates a new SQLiteAuthManager instance
func NewSQLiteAuthManager(filename string, defaultRead, defaultWrite bool) (*SQLiteAuthManager, error) {
2022-01-23 05:01:20 +01:00
db, err := sql.Open("sqlite3", filename)
if err != nil {
return nil, err
}
if err := setupAuthDB(db); err != nil {
2022-01-23 05:01:20 +01:00
return nil, err
}
2022-12-15 05:11:22 +01:00
return &SQLiteAuthManager{
2022-01-23 05:01:20 +01:00
db: db,
defaultRead: defaultRead,
defaultWrite: defaultWrite,
}, nil
}
2022-12-08 02:44:20 +01:00
// Authenticate checks username and password and returns a user if correct. The method
2022-01-26 04:30:53 +01:00
// returns in constant-ish time, regardless of whether the user exists or the password is
// correct or incorrect.
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) Authenticate(username, password string) (*User, error) {
2022-01-24 06:54:28 +01:00
if username == Everyone {
2022-01-26 03:57:28 +01:00
return nil, ErrUnauthenticated
2022-01-24 06:54:28 +01:00
}
2022-01-26 03:57:28 +01:00
user, err := a.User(username)
2022-01-23 05:01:20 +01:00
if err != nil {
bcrypt.CompareHashAndPassword([]byte(intentionalSlowDownHash),
2022-01-26 03:57:28 +01:00
[]byte("intentional slow-down to avoid timing attacks"))
return nil, ErrUnauthenticated
2022-01-23 05:01:20 +01:00
}
2022-01-26 03:57:28 +01:00
if err := bcrypt.CompareHashAndPassword([]byte(user.Hash), []byte(password)); err != nil {
return nil, ErrUnauthenticated
2022-01-23 05:01:20 +01:00
}
2022-01-26 03:57:28 +01:00
return user, nil
2022-01-23 05:01:20 +01:00
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) AuthenticateToken(token string) (*User, error) {
2022-12-03 21:20:59 +01:00
user, err := a.userByToken(token)
if err != nil {
return nil, ErrUnauthenticated
}
2022-12-08 02:44:20 +01:00
user.Token = token
2022-12-03 21:20:59 +01:00
return user, nil
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) CreateToken(user *User) (string, error) {
2022-12-03 21:20:59 +01:00
token := util.RandomString(tokenLength)
expires := 1 // FIXME
if _, err := a.db.Exec(insertTokenQuery, user.Name, token, expires); err != nil {
return "", err
}
return token, nil
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) RemoveToken(user *User) error {
2022-12-08 02:44:20 +01:00
if user.Token == "" {
return ErrUnauthorized
}
if _, err := a.db.Exec(deleteTokenQuery, user.Name, user.Token); err != nil {
return err
}
return nil
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) ChangeSettings(user *User) error {
2022-12-08 03:26:18 +01:00
settings, err := json.Marshal(user.Prefs)
if err != nil {
return err
}
if _, err := a.db.Exec(updateUserSettingsQuery, string(settings), user.Name); err != nil {
return err
}
return nil
}
2022-01-26 04:30:53 +01:00
// Authorize returns nil if the given user has access to the given topic using the desired
// permission. The user param may be nil to signal an anonymous user.
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) Authorize(user *User, topic string, perm Permission) error {
2022-01-24 05:02:39 +01:00
if user != nil && user.Role == RoleAdmin {
2022-01-23 05:01:20 +01:00
return nil // Admin can do everything
}
2022-01-24 06:54:28 +01:00
username := Everyone
2022-01-24 05:02:39 +01:00
if user != nil {
username = user.Name
}
2022-01-26 04:30:53 +01:00
// Select the read/write permissions for this user/topic combo. The query may return two
// rows (one for everyone, and one for the user), but prioritizes the user. The value for
// user.Name may be empty (= everyone).
2022-01-24 05:02:39 +01:00
rows, err := a.db.Query(selectTopicPermsQuery, username, topic)
2022-01-23 05:01:20 +01:00
if err != nil {
return err
}
defer rows.Close()
if !rows.Next() {
return a.resolvePerms(a.defaultRead, a.defaultWrite, perm)
}
var read, write bool
if err := rows.Scan(&read, &write); err != nil {
return err
} else if err := rows.Err(); err != nil {
return err
}
return a.resolvePerms(read, write, perm)
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) resolvePerms(read, write bool, perm Permission) error {
2022-01-23 06:02:16 +01:00
if perm == PermissionRead && read {
2022-01-23 05:01:20 +01:00
return nil
2022-01-23 06:02:16 +01:00
} else if perm == PermissionWrite && write {
2022-01-23 05:01:20 +01:00
return nil
}
2022-01-23 06:02:16 +01:00
return ErrUnauthorized
2022-01-23 05:01:20 +01:00
}
2022-01-23 06:54:18 +01:00
2022-01-26 04:30:53 +01:00
// AddUser adds a user with the given username, password and role. The password should be hashed
// before it is stored in a persistence layer.
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) AddUser(username, password string, role Role) error {
2022-01-31 17:44:58 +01:00
if !AllowedUsername(username) || !AllowedRole(role) {
2022-01-26 03:57:28 +01:00
return ErrInvalidArgument
}
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
2022-01-23 06:54:18 +01:00
if err != nil {
return err
}
2022-01-24 05:02:39 +01:00
if _, err = a.db.Exec(insertUserQuery, username, hash, role); err != nil {
2022-01-23 06:54:18 +01:00
return err
}
return nil
}
2022-01-26 04:30:53 +01:00
// RemoveUser deletes the user with the given username. The function returns nil on success, even
// if the user did not exist in the first place.
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) RemoveUser(username string) error {
2022-01-31 17:44:58 +01:00
if !AllowedUsername(username) {
2022-01-26 03:57:28 +01:00
return ErrInvalidArgument
}
2022-12-16 04:07:04 +01:00
if _, err := a.db.Exec(deleteUserAccessQuery, username); err != nil {
2022-01-23 06:54:18 +01:00
return err
}
2022-12-16 04:07:04 +01:00
if _, err := a.db.Exec(deleteUserTokenQuery, username); err != nil {
return err
}
if _, err := a.db.Exec(deleteUserQuery, username); err != nil {
2022-01-23 06:54:18 +01:00
return err
}
return nil
}
2022-01-26 04:30:53 +01:00
// Users returns a list of users. It always also returns the Everyone user ("*").
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) Users() ([]*User, error) {
2022-01-24 05:02:39 +01:00
rows, err := a.db.Query(selectUsernamesQuery)
if err != nil {
return nil, err
}
defer rows.Close()
usernames := make([]string, 0)
for rows.Next() {
var username string
if err := rows.Scan(&username); err != nil {
return nil, err
} else if err := rows.Err(); err != nil {
return nil, err
}
usernames = append(usernames, username)
}
rows.Close()
users := make([]*User, 0)
for _, username := range usernames {
user, err := a.User(username)
if err != nil {
return nil, err
}
users = append(users, user)
}
2022-01-24 06:54:28 +01:00
everyone, err := a.everyoneUser()
if err != nil {
return nil, err
}
users = append(users, everyone)
2022-01-24 05:02:39 +01:00
return users, nil
}
2022-01-26 04:30:53 +01:00
// User returns the user with the given username if it exists, or ErrNotFound otherwise.
// You may also pass Everyone to retrieve the anonymous user and its Grant list.
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) User(username string) (*User, error) {
2022-01-24 06:54:28 +01:00
if username == Everyone {
return a.everyoneUser()
}
2022-12-03 21:20:59 +01:00
rows, err := a.db.Query(selectUserByNameQuery, username)
2022-01-24 05:02:39 +01:00
if err != nil {
return nil, err
}
2022-12-03 21:20:59 +01:00
return a.readUser(rows)
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) userByToken(token string) (*User, error) {
2022-12-03 21:20:59 +01:00
rows, err := a.db.Query(selectUserByTokenQuery, token)
if err != nil {
return nil, err
}
return a.readUser(rows)
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) readUser(rows *sql.Rows) (*User, error) {
2022-01-26 03:57:28 +01:00
defer rows.Close()
2022-12-03 21:20:59 +01:00
var username, hash, role string
2022-12-18 20:35:05 +01:00
var prefs, planCode sql.NullString
2022-12-19 15:59:32 +01:00
var messagesLimit, emailsLimit, attachmentFileSizeLimit, attachmentTotalSizeLimit sql.NullInt64
2022-01-26 03:57:28 +01:00
if !rows.Next() {
2022-01-24 05:02:39 +01:00
return nil, ErrNotFound
}
2022-12-19 15:59:32 +01:00
if err := rows.Scan(&username, &hash, &role, &prefs, &planCode, &messagesLimit, &emailsLimit, &attachmentFileSizeLimit, &attachmentTotalSizeLimit); err != nil {
2022-01-24 05:02:39 +01:00
return nil, err
2022-01-26 03:57:28 +01:00
} else if err := rows.Err(); err != nil {
2022-01-24 05:02:39 +01:00
return nil, err
}
2022-01-24 06:54:28 +01:00
grants, err := a.readGrants(username)
if err != nil {
return nil, err
}
2022-12-08 03:26:18 +01:00
user := &User{
Name: username,
Hash: hash,
Role: Role(role),
Grants: grants,
}
if prefs.Valid {
user.Prefs = &UserPrefs{}
if err := json.Unmarshal([]byte(prefs.String), user.Prefs); err != nil {
return nil, err
}
}
2022-12-18 20:35:05 +01:00
if planCode.Valid {
user.Plan = &Plan{
2022-12-19 15:59:32 +01:00
Code: planCode.String,
Upgradable: true, // FIXME
2022-12-19 22:22:13 +01:00
MessagesLimit: messagesLimit.Int64,
2022-12-19 15:59:32 +01:00
EmailsLimit: emailsLimit.Int64,
AttachmentFileSizeLimit: attachmentFileSizeLimit.Int64,
AttachmentTotalSizeLimit: attachmentTotalSizeLimit.Int64,
2022-12-17 21:17:52 +01:00
}
}
2022-12-08 03:26:18 +01:00
return user, nil
2022-01-24 06:54:28 +01:00
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) everyoneUser() (*User, error) {
2022-01-24 06:54:28 +01:00
grants, err := a.readGrants(Everyone)
if err != nil {
return nil, err
}
return &User{
Name: Everyone,
2022-01-26 03:57:28 +01:00
Hash: "",
2022-01-24 06:54:28 +01:00
Role: RoleAnonymous,
Grants: grants,
}, nil
}
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) readGrants(username string) ([]Grant, error) {
2022-01-24 06:54:28 +01:00
rows, err := a.db.Query(selectUserAccessQuery, username)
2022-01-24 05:02:39 +01:00
if err != nil {
return nil, err
}
2022-01-24 06:54:28 +01:00
defer rows.Close()
2022-01-24 05:02:39 +01:00
grants := make([]Grant, 0)
2022-01-24 06:54:28 +01:00
for rows.Next() {
2022-01-24 05:02:39 +01:00
var topic string
var read, write bool
2022-01-24 06:54:28 +01:00
if err := rows.Scan(&topic, &read, &write); err != nil {
2022-01-24 05:02:39 +01:00
return nil, err
2022-01-24 06:54:28 +01:00
} else if err := rows.Err(); err != nil {
2022-01-24 05:02:39 +01:00
return nil, err
}
grants = append(grants, Grant{
2022-01-31 17:47:30 +01:00
TopicPattern: fromSQLWildcard(topic),
AllowRead: read,
AllowWrite: write,
2022-01-24 05:02:39 +01:00
})
}
2022-01-24 06:54:28 +01:00
return grants, nil
2022-01-24 05:02:39 +01:00
}
2022-01-26 04:30:53 +01:00
// ChangePassword changes a user's password
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) ChangePassword(username, password string) error {
2022-01-26 03:57:28 +01:00
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcryptCost)
2022-01-23 06:54:18 +01:00
if err != nil {
return err
}
2022-01-24 05:02:39 +01:00
if _, err := a.db.Exec(updateUserPassQuery, hash, username); err != nil {
2022-01-23 06:54:18 +01:00
return err
}
return nil
}
2022-01-23 21:30:30 +01:00
2022-01-26 04:30:53 +01:00
// ChangeRole changes a user's role. When a role is changed from RoleUser to RoleAdmin,
// all existing access control entries (Grant) are removed, since they are no longer needed.
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) ChangeRole(username string, role Role) error {
2022-01-31 17:44:58 +01:00
if !AllowedUsername(username) || !AllowedRole(role) {
2022-01-26 03:57:28 +01:00
return ErrInvalidArgument
}
2022-01-24 05:02:39 +01:00
if _, err := a.db.Exec(updateUserRoleQuery, string(role), username); err != nil {
2022-01-23 21:30:30 +01:00
return err
}
2022-01-24 05:02:39 +01:00
if role == RoleAdmin {
2022-01-24 06:54:28 +01:00
if _, err := a.db.Exec(deleteUserAccessQuery, username); err != nil {
2022-01-24 05:02:39 +01:00
return err
}
}
2022-01-23 21:30:30 +01:00
return nil
}
2022-01-26 04:30:53 +01:00
// AllowAccess adds or updates an entry in th access control list for a specific user. It controls
2022-01-31 17:44:58 +01:00
// read/write access to a topic. The parameter topicPattern may include wildcards (*).
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) AllowAccess(username string, topicPattern string, read bool, write bool) error {
2022-01-31 17:44:58 +01:00
if (!AllowedUsername(username) && username != Everyone) || !AllowedTopicPattern(topicPattern) {
return ErrInvalidArgument
}
if _, err := a.db.Exec(upsertUserAccessQuery, username, toSQLWildcard(topicPattern), read, write); err != nil {
2022-01-23 21:30:30 +01:00
return err
}
return nil
}
2022-01-26 04:30:53 +01:00
// ResetAccess removes an access control list entry for a specific username/topic, or (if topic is
2022-01-31 17:44:58 +01:00
// empty) for an entire user. The parameter topicPattern may include wildcards (*).
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) ResetAccess(username string, topicPattern string) error {
2022-02-01 18:23:11 +01:00
if !AllowedUsername(username) && username != Everyone && username != "" {
return ErrInvalidArgument
} else if !AllowedTopicPattern(topicPattern) && topicPattern != "" {
2022-01-31 17:44:58 +01:00
return ErrInvalidArgument
}
if username == "" && topicPattern == "" {
2022-01-24 06:54:28 +01:00
_, err := a.db.Exec(deleteAllAccessQuery, username)
return err
2022-01-31 17:44:58 +01:00
} else if topicPattern == "" {
2022-01-24 06:54:28 +01:00
_, err := a.db.Exec(deleteUserAccessQuery, username)
return err
2022-01-23 21:30:30 +01:00
}
2022-01-31 17:44:58 +01:00
_, err := a.db.Exec(deleteTopicAccessQuery, username, toSQLWildcard(topicPattern))
2022-01-24 06:54:28 +01:00
return err
2022-01-23 21:30:30 +01:00
}
2022-01-26 04:30:53 +01:00
// DefaultAccess returns the default read/write access if no access control entry matches
2022-12-15 05:11:22 +01:00
func (a *SQLiteAuthManager) DefaultAccess() (read bool, write bool) {
2022-01-26 04:30:53 +01:00
return a.defaultRead, a.defaultWrite
}
2022-01-31 17:44:58 +01:00
func toSQLWildcard(s string) string {
return strings.ReplaceAll(s, "*", "%")
}
func fromSQLWildcard(s string) string {
return strings.ReplaceAll(s, "%", "*")
}
func setupAuthDB(db *sql.DB) error {
// If 'schemaVersion' table does not exist, this must be a new database
rowsSV, err := db.Query(selectSchemaVersionQuery)
if err != nil {
return setupNewAuthDB(db)
}
defer rowsSV.Close()
// If 'schemaVersion' table exists, read version and potentially upgrade
schemaVersion := 0
if !rowsSV.Next() {
return errors.New("cannot determine schema version: database file may be corrupt")
}
if err := rowsSV.Scan(&schemaVersion); err != nil {
return err
}
rowsSV.Close()
// Do migrations
if schemaVersion == currentSchemaVersion {
return nil
}
return fmt.Errorf("unexpected schema version found: %d", schemaVersion)
}
func setupNewAuthDB(db *sql.DB) error {
if _, err := db.Exec(createAuthTablesQueries); err != nil {
return err
}
if _, err := db.Exec(insertSchemaVersion, currentSchemaVersion); err != nil {
return err
}
return nil
}