From 2418216388eef71e53dff60d36345fbf1c4db684 Mon Sep 17 00:00:00 2001
From: Florian Fischer <florian.fischer@muhq.space>
Date: Mon, 3 Jul 2023 17:50:35 +0200
Subject: add admin-password and button to become admin from the client

---
 config.go       |  6 ++++--
 main.go         | 35 +++++++++++++++++++++++++----------
 web/client.html | 12 ++++++++++++
 3 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/config.go b/config.go
index d12ad64..2483079 100644
--- a/config.go
+++ b/config.go
@@ -6,6 +6,7 @@ import (
 	"path"
 
 	"github.com/google/uuid"
+	"golang.org/x/exp/slices"
 	"gopkg.in/yaml.v3"
 	"muhq.space/go/wrms/llog"
 )
@@ -17,7 +18,8 @@ type Config struct {
 	UploadDir     string         `yaml:"upload-dir"`
 	LogLevel      string         `yaml:"loglevel"`
 	MpvFlags      string         `yaml:"mpv_flags"`
-	Admin         uuid.UUID      `yaml:"admin"`
+	AdminPW       string         `yaml:"admin-password"`
+	Admins        []uuid.UUID    `yaml:"admins"`
 	Spotify       *SpotifyConfig `yaml:"spotify"`
 	HasUpload     bool
 }
@@ -28,7 +30,7 @@ func defaultConfig() Config {
 }
 
 func (c Config) IsAdmin(id uuid.UUID) bool {
-	return c.Admin == id
+	return slices.Contains(c.Admins, id)
 }
 
 func findConfig() string {
diff --git a/main.go b/main.go
index 53abc2f..fd390bf 100644
--- a/main.go
+++ b/main.go
@@ -186,6 +186,30 @@ func nextHandler(w http.ResponseWriter, r *http.Request) {
 	genericControlHandler(w, r, "next")
 }
 
+func adminHandler(w http.ResponseWriter, r *http.Request) {
+	connId, err := getConnId(w, r)
+	if err != nil {
+		return
+	}
+
+	_pw, err := io.ReadAll(r.Body)
+	if err != nil {
+		llog.Warning("Failed to read admin password from request body")
+		http.Error(w, "Failed to read asdmin password from request body", http.StatusInternalServerError)
+		return
+	}
+
+	pw := string(_pw)
+
+	if pw == wrms.Config.AdminPW {
+		wrms.Config.Admins = append(wrms.Config.Admins, connId)
+	} else {
+		llog.Warning("Wrong admin password: %s", pw)
+		http.Error(w, "Wrong admin password", http.StatusUnauthorized)
+		return
+	}
+}
+
 func eventsEndpoint(w http.ResponseWriter, r *http.Request) {
 	connId, err := getConnId(w, r)
 	if err != nil {
@@ -227,6 +251,7 @@ func setupRoutes() {
 	http.HandleFunc("/delete", deleteHandler)
 	http.HandleFunc("/next", nextHandler)
 	http.HandleFunc("/playpause", playPauseHandler)
+	http.HandleFunc("/admin", adminHandler)
 	http.HandleFunc("/events", eventsEndpoint)
 }
 
@@ -239,22 +264,12 @@ func main() {
 	flag.StringVar(&config.LocalMusicDir,
 		"serve-music-dir", config.LocalMusicDir, "local music directory to serve")
 	flag.StringVar(&config.UploadDir, "upload-dir", config.UploadDir, "directory to upload songs to")
-	genAdmin := flag.Bool("generate-admin", false, "generate an admin uuid")
 	flag.Parse()
 
 	if *backends != "" {
 		config.Backends = strings.Split(*backends, " ")
 	}
 
-	if *genAdmin {
-		var err error
-		config.Admin, err = uuid.NewRandom()
-		if err != nil {
-			llog.Fatal("Failed to create random UUID: %v", err)
-		}
-		llog.Info("Admin uuid: %v", config.Admin)
-	}
-
 	llog.SetLogLevelFromString(config.LogLevel)
 	config.HasUpload = slices.Contains(config.Backends, "upload")
 
diff --git a/web/client.html b/web/client.html
index c193a42..63c9c4d 100644
--- a/web/client.html
+++ b/web/client.html
@@ -345,6 +345,14 @@
         document.getElementById("nextbutton").addEventListener("click", function() {
           new HttpClient().get("/next", console.log);
         });
+        {{else}}
+        document.getElementById("becomeAdmin").addEventListener("click", function() {
+          let pw = prompt("Enter admin password", "");
+          new HttpClient().post("/admin", pw, () => {
+            location.reload();
+            return false;
+          });
+        });
         {{end}}
       }
     </script>
@@ -384,6 +392,10 @@
     </div>
     {{end}}
 
+    {{if not .IsAdmin}}
+    <div style='float: right;'><button id="becomeAdmin">Become Admin</button></div>
+    {{end}}
+
     <h2>Playlist</h2>
     <ul id='playlist'></ul>
   </body>
-- 
cgit v1.2.3