feat: init project

server/acl.go

@@ -0,0 +1,95 @@
+package server
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/boojack/corgi/api"
+	"github.com/boojack/corgi/common"
+
+	"github.com/gorilla/sessions"
+	"github.com/labstack/echo-contrib/session"
+	"github.com/labstack/echo/v4"
+)
+
+var (
+	userIDContextKey = "user-id"
+)
+
+func getUserIDContextKey() string {
+	return userIDContextKey
+}
+
+func setUserSession(ctx echo.Context, user *api.User) error {
+	sess, _ := session.Get("session", ctx)
+	sess.Options = &sessions.Options{
+		Path:     "/",
+		MaxAge:   1000 * 3600 * 24 * 30,
+		HttpOnly: true,
+	}
+	sess.Values[userIDContextKey] = user.ID
+	err := sess.Save(ctx.Request(), ctx.Response())
+	if err != nil {
+		return fmt.Errorf("failed to set session, err: %w", err)
+	}
+	return nil
+}
+
+func removeUserSession(ctx echo.Context) error {
+	sess, _ := session.Get("session", ctx)
+	sess.Options = &sessions.Options{
+		Path:     "/",
+		MaxAge:   0,
+		HttpOnly: true,
+	}
+	sess.Values[userIDContextKey] = nil
+	err := sess.Save(ctx.Request(), ctx.Response())
+	if err != nil {
+		return fmt.Errorf("failed to set session, err: %w", err)
+	}
+	return nil
+}
+
+func aclMiddleware(s *Server, next echo.HandlerFunc) echo.HandlerFunc {
+	return func(c echo.Context) error {
+		ctx := c.Request().Context()
+		path := c.Path()
+		// Skip auth.
+		if common.HasPrefixes(path, "/api/auth") {
+			return next(c)
+		}
+
+		if common.HasPrefixes(path, "/api/ping", "/api/status", "/api/user/:id") && c.Request().Method == http.MethodGet {
+			return next(c)
+		}
+
+		{
+			sess, _ := session.Get("session", c)
+			userIDValue := sess.Values[userIDContextKey]
+			if userIDValue != nil {
+				userID, _ := strconv.Atoi(fmt.Sprintf("%v", userIDValue))
+				userFind := &api.UserFind{
+					ID: &userID,
+				}
+				user, err := s.Store.FindUser(ctx, userFind)
+				if err != nil && common.ErrorCode(err) != common.NotFound {
+					return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to find user by ID: %d", userID)).SetInternal(err)
+				}
+				if user != nil {
+					if user.RowStatus == api.Archived {
+						return echo.NewHTTPError(http.StatusForbidden, fmt.Sprintf("User has been archived with email %s", user.Email))
+					}
+					c.Set(getUserIDContextKey(), userID)
+				}
+			}
+		}
+
+		userID := c.Get(getUserIDContextKey())
+		if userID == nil {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
+		}
+
+		return next(c)
+	}
+}

server/auth.go

@@ -0,0 +1,102 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/boojack/corgi/api"
+	"github.com/boojack/corgi/common"
+
+	"github.com/labstack/echo/v4"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func (s *Server) registerAuthRoutes(g *echo.Group) {
+	g.POST("/auth/signin", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		signin := &api.Signin{}
+		if err := json.NewDecoder(c.Request().Body).Decode(signin); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signin request").SetInternal(err)
+		}
+
+		userFind := &api.UserFind{
+			Email: &signin.Email,
+		}
+		user, err := s.Store.FindUser(ctx, userFind)
+		if err != nil && common.ErrorCode(err) != common.NotFound {
+			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to find user by email %s", signin.Email)).SetInternal(err)
+		}
+		if user == nil {
+			return echo.NewHTTPError(http.StatusUnauthorized, fmt.Sprintf("User not found with email %s", signin.Email))
+		} else if user.RowStatus == api.Archived {
+			return echo.NewHTTPError(http.StatusForbidden, fmt.Sprintf("User has been archived with email %s", signin.Email))
+		}
+
+		// Compare the stored hashed password, with the hashed version of the password that was received.
+		if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(signin.Password)); err != nil {
+			// If the two passwords don't match, return a 401 status.
+			return echo.NewHTTPError(http.StatusUnauthorized, "Incorrect password").SetInternal(err)
+		}
+
+		if err = setUserSession(c, user); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to set signin session").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.POST("/auth/signup", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		signup := &api.Signup{}
+		if err := json.NewDecoder(c.Request().Body).Decode(signup); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted signup request").SetInternal(err)
+		}
+
+		userCreate := &api.UserCreate{
+			Email:    signup.Email,
+			Name:     signup.Name,
+			Password: signup.Password,
+		}
+		if err := userCreate.Validate(); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Invalid user create format.").SetInternal(err)
+		}
+
+		passwordHash, err := bcrypt.GenerateFromPassword([]byte(signup.Password), bcrypt.DefaultCost)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
+		}
+
+		userCreate.PasswordHash = string(passwordHash)
+
+		user, err := s.Store.CreateUser(ctx, userCreate)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create user").SetInternal(err)
+		}
+
+		err = setUserSession(c, user)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to set signup session").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode created user response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.POST("/auth/logout", func(c echo.Context) error {
+		err := removeUserSession(c)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to set logout session").SetInternal(err)
+		}
+
+		c.Response().WriteHeader(http.StatusOK)
+		return nil
+	})
+}

server/common.go

@@ -0,0 +1,11 @@
+package server
+
+func composeResponse(data interface{}) interface{} {
+	type R struct {
+		Data interface{} `json:"data"`
+	}
+
+	return R{
+		Data: data,
+	}
+}

server/dist/index.html

@@ -0,0 +1,13 @@
+<!-- THIS FILE IS A PLACEHOLDER AND SHOULD NOT BE CHANGED -->
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Corgi</title>
+  </head>
+  <body>
+    <p>No frontend embeded.</p>
+  </body>
+</html>

server/embed_frontend.go

@@ -0,0 +1,43 @@
+package server
+
+import (
+	"embed"
+	"io/fs"
+	"net/http"
+
+	"github.com/labstack/echo/v4"
+	"github.com/labstack/echo/v4/middleware"
+)
+
+//go:embed dist
+var embeddedFiles embed.FS
+
+func getFileSystem(path string) http.FileSystem {
+	fs, err := fs.Sub(embeddedFiles, path)
+	if err != nil {
+		panic(err)
+	}
+
+	return http.FS(fs)
+}
+
+func embedFrontend(e *echo.Echo) {
+	// Use echo static middleware to serve the built dist folder
+	// refer: https://github.com/labstack/echo/blob/master/middleware/static.go
+	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
+		HTML5:      true,
+		Filesystem: getFileSystem("dist"),
+	}))
+
+	g := e.Group("assets")
+	g.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			c.Response().Header().Set(echo.HeaderCacheControl, "max-age=31536000, immutable")
+			return next(c)
+		}
+	})
+	g.Use(middleware.StaticWithConfig(middleware.StaticConfig{
+		HTML5:      true,
+		Filesystem: getFileSystem("dist/assets"),
+	}))
+}

server/profile/profile.go

@@ -0,0 +1,74 @@
+package profile
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/boojack/corgi/server/version"
+)
+
+// Profile is the configuration to start main server.
+type Profile struct {
+	// Mode can be "prod" or "dev"
+	Mode string `json:"mode"`
+	// Port is the binding port for server
+	Port int `json:"port"`
+	// Data is the data directory
+	Data string `json:"data"`
+	// DSN points to where Corgi stores its own data
+	DSN string `json:"dsn"`
+	// Version is the current version of server
+	Version string `json:"version"`
+}
+
+func checkDSN(dataDir string) (string, error) {
+	// Convert to absolute path if relative path is supplied.
+	if !filepath.IsAbs(dataDir) {
+		absDir, err := filepath.Abs(filepath.Dir(os.Args[0]) + "/" + dataDir)
+		if err != nil {
+			return "", err
+		}
+		dataDir = absDir
+	}
+
+	// Trim trailing / in case user supplies
+	dataDir = strings.TrimRight(dataDir, "/")
+
+	if _, err := os.Stat(dataDir); err != nil {
+		return "", fmt.Errorf("unable to access data folder %s, err %w", dataDir, err)
+	}
+
+	return dataDir, nil
+}
+
+// GetDevProfile will return a profile for dev or prod.
+func GetProfile() (*Profile, error) {
+	profile := Profile{}
+	flag.StringVar(&profile.Mode, "mode", "dev", "mode of server")
+	flag.IntVar(&profile.Port, "port", 8081, "port of server")
+	flag.StringVar(&profile.Data, "data", "", "data directory")
+	flag.Parse()
+
+	if profile.Mode != "dev" && profile.Mode != "prod" {
+		profile.Mode = "dev"
+	}
+
+	if profile.Mode == "prod" && profile.Data == "" {
+		profile.Data = "/var/opt/corgi"
+	}
+
+	dataDir, err := checkDSN(profile.Data)
+	if err != nil {
+		fmt.Printf("Failed to check dsn: %s, err: %+v\n", dataDir, err)
+		return nil, err
+	}
+
+	profile.Data = dataDir
+	profile.DSN = fmt.Sprintf("%s/corgi_%s.db", dataDir, profile.Mode)
+	profile.Version = version.GetCurrentVersion(profile.Mode)
+
+	return &profile, nil
+}

server/server.go

@@ -0,0 +1,74 @@
+package server
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/boojack/corgi/server/profile"
+	"github.com/boojack/corgi/store"
+
+	"github.com/gorilla/securecookie"
+	"github.com/gorilla/sessions"
+	"github.com/labstack/echo-contrib/session"
+	"github.com/labstack/echo/v4"
+	"github.com/labstack/echo/v4/middleware"
+)
+
+type Server struct {
+	e *echo.Echo
+
+	Profile *profile.Profile
+
+	Store *store.Store
+}
+
+func NewServer(profile *profile.Profile) *Server {
+	e := echo.New()
+	e.Debug = true
+	e.HideBanner = true
+	e.HidePort = true
+
+	e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
+		Format: `{"time":"${time_rfc3339}",` +
+			`"method":"${method}","uri":"${uri}",` +
+			`"status":${status},"error":"${error}"}` + "\n",
+	}))
+
+	e.Use(middleware.CORS())
+
+	e.Use(middleware.TimeoutWithConfig(middleware.TimeoutConfig{
+		Skipper:      middleware.DefaultSkipper,
+		ErrorMessage: "Request timeout",
+		Timeout:      30 * time.Second,
+	}))
+
+	embedFrontend(e)
+
+	// In dev mode, set the const secret key to make signin session persistence.
+	secret := []byte("iamcorgi")
+	if profile.Mode == "prod" {
+		secret = securecookie.GenerateRandomKey(16)
+	}
+	e.Use(session.Middleware(sessions.NewCookieStore(secret)))
+
+	s := &Server{
+		e:       e,
+		Profile: profile,
+	}
+
+	apiGroup := e.Group("/api")
+	apiGroup.Use(func(next echo.HandlerFunc) echo.HandlerFunc {
+		return aclMiddleware(s, next)
+	})
+	s.registerSystemRoutes(apiGroup)
+	s.registerAuthRoutes(apiGroup)
+	s.registerUserRoutes(apiGroup)
+	s.registerWorkspaceRoutes(apiGroup)
+	s.registerShortcutRoutes(apiGroup)
+
+	return s
+}
+
+func (server *Server) Run() error {
+	return server.e.Start(fmt.Sprintf(":%d", server.Profile.Port))
+}

server/shortcut.go

@@ -0,0 +1,128 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/boojack/corgi/api"
+	"github.com/boojack/corgi/common"
+
+	"github.com/labstack/echo/v4"
+)
+
+func (s *Server) registerShortcutRoutes(g *echo.Group) {
+	g.POST("/shortcut", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
+		}
+		shortcutCreate := &api.ShortcutCreate{
+			CreatorID: userID,
+		}
+		if err := json.NewDecoder(c.Request().Body).Decode(shortcutCreate); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted post shortcut request").SetInternal(err)
+		}
+
+		shortcut, err := s.Store.CreateShortcut(ctx, shortcutCreate)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create shortcut").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(shortcut)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode shortcut response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.PATCH("/shortcut/:shortcutId", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		shortcutID, err := strconv.Atoi(c.Param("shortcutId"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("shortcutId"))).SetInternal(err)
+		}
+
+		shortcutPatch := &api.ShortcutPatch{
+			ID: shortcutID,
+		}
+		if err := json.NewDecoder(c.Request().Body).Decode(shortcutPatch); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted patch shortcut request").SetInternal(err)
+		}
+
+		shortcut, err := s.Store.PatchShortcut(ctx, shortcutPatch)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to patch shortcut").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(shortcut)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode shortcut response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.GET("/shortcut", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		shortcutFind := &api.ShortcutFind{}
+
+		if workspaceID, err := strconv.Atoi(c.QueryParam("workspaceId")); err == nil {
+			shortcutFind.WorkspaceID = &workspaceID
+		}
+
+		list, err := s.Store.FindShortcutList(ctx, shortcutFind)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch shortcut list").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(list)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode shortcut list response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.GET("/shortcut/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		shortcutID, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
+		}
+
+		shortcutFind := &api.ShortcutFind{
+			ID: &shortcutID,
+		}
+		shortcut, err := s.Store.FindShortcut(ctx, shortcutFind)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, fmt.Sprintf("Failed to fetch shortcut by ID %d", *shortcutFind.ID)).SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(shortcut)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode shortcut response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.DELETE("/shortcut/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		shortcutID, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
+		}
+
+		shortcutDelete := &api.ShortcutDelete{
+			ID: shortcutID,
+		}
+		if err := s.Store.DeleteShortcut(ctx, shortcutDelete); err != nil {
+			if common.ErrorCode(err) == common.NotFound {
+				return echo.NewHTTPError(http.StatusNotFound, fmt.Sprintf("Shortcut ID not found: %d", shortcutID))
+			}
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to delete shortcut").SetInternal(err)
+		}
+
+		return c.JSON(http.StatusOK, true)
+	})
+}

server/system.go

@@ -0,0 +1,34 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/boojack/corgi/api"
+
+	"github.com/labstack/echo/v4"
+)
+
+func (s *Server) registerSystemRoutes(g *echo.Group) {
+	g.GET("/ping", func(c echo.Context) error {
+		data := s.Profile
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(data)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to compose system profile").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.GET("/status", func(c echo.Context) error {
+		systemStatus := api.SystemStatus{
+			Profile: s.Profile,
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(systemStatus)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode system status response").SetInternal(err)
+		}
+		return nil
+	})
+}

server/user.go

@@ -0,0 +1,199 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/boojack/corgi/api"
+	"github.com/boojack/corgi/common"
+
+	"github.com/labstack/echo/v4"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func (s *Server) registerUserRoutes(g *echo.Group) {
+	g.GET("/user", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userList, err := s.Store.FindUserList(ctx, &api.UserFind{})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user list").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(userList)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user list response").SetInternal(err)
+		}
+		return nil
+	})
+
+	// GET /api/user/me is used to check if the user is logged in.
+	g.GET("/user/me", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
+		}
+
+		userFind := &api.UserFind{
+			ID: &userID,
+		}
+		user, err := s.Store.FindUser(ctx, userFind)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
+		}
+
+		userSettingList, err := s.Store.FindUserSettingList(ctx, &api.UserSettingFind{
+			UserID: userID,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find userSettingList").SetInternal(err)
+		}
+		user.UserSettingList = userSettingList
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.POST("/user/setting", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
+		}
+
+		userSettingUpsert := &api.UserSettingUpsert{}
+		if err := json.NewDecoder(c.Request().Body).Decode(userSettingUpsert); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted post user setting upsert request").SetInternal(err)
+		}
+		if err := userSettingUpsert.Validate(); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Invalid user setting format").SetInternal(err)
+		}
+
+		userSettingUpsert.UserID = userID
+		userSetting, err := s.Store.UpsertUserSetting(ctx, userSettingUpsert)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to upsert user setting").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(userSetting)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user setting response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.GET("/user/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		id, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted user id").SetInternal(err)
+		}
+
+		user, err := s.Store.FindUser(ctx, &api.UserFind{
+			ID: &id,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch user").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.PATCH("/user/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
+		}
+		currentUserID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
+		}
+		currentUser, err := s.Store.FindUser(ctx, &api.UserFind{
+			ID: &currentUserID,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
+		}
+		if currentUser == nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Current session user not found with ID: %d", currentUserID)).SetInternal(err)
+		} else if currentUserID != userID {
+			return echo.NewHTTPError(http.StatusForbidden, "Access forbidden for current session user").SetInternal(err)
+		}
+
+		userPatch := &api.UserPatch{
+			ID: userID,
+		}
+		if err := json.NewDecoder(c.Request().Body).Decode(userPatch); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted patch user request").SetInternal(err)
+		}
+
+		if userPatch.Email != nil && !common.ValidateEmail(*userPatch.Email) {
+			return echo.NewHTTPError(http.StatusBadRequest, "Invalid email format")
+		}
+
+		if userPatch.Password != nil && *userPatch.Password != "" {
+			passwordHash, err := bcrypt.GenerateFromPassword([]byte(*userPatch.Password), bcrypt.DefaultCost)
+			if err != nil {
+				return echo.NewHTTPError(http.StatusInternalServerError, "Failed to generate password hash").SetInternal(err)
+			}
+
+			passwordHashStr := string(passwordHash)
+			userPatch.PasswordHash = &passwordHashStr
+		}
+
+		user, err := s.Store.PatchUser(ctx, userPatch)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to patch user").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(user)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode user response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.DELETE("/user/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		currentUserID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
+		}
+		currentUser, err := s.Store.FindUser(ctx, &api.UserFind{
+			ID: &currentUserID,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find user").SetInternal(err)
+		}
+		if currentUser == nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("Current session user not found with ID: %d", currentUserID)).SetInternal(err)
+		}
+
+		userID, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
+		}
+
+		userDelete := &api.UserDelete{
+			ID: userID,
+		}
+		if err := s.Store.DeleteUser(ctx, userDelete); err != nil {
+			if common.ErrorCode(err) == common.NotFound {
+				return echo.NewHTTPError(http.StatusNotFound, fmt.Sprintf("User ID not found: %d", userID))
+			}
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to delete user").SetInternal(err)
+		}
+
+		return c.JSON(http.StatusOK, true)
+	})
+}

server/version/version.go

@@ -0,0 +1,67 @@
+package version
+
+import (
+	"strconv"
+	"strings"
+)
+
+// Version is the service current released version.
+// Semantic versioning: https://semver.org/
+var Version = "0.0.1"
+
+// DevVersion is the service current development version.
+var DevVersion = "0.0.1"
+
+func GetCurrentVersion(mode string) string {
+	if mode == "dev" {
+		return DevVersion
+	}
+	return Version
+}
+
+func GetMinorVersion(version string) string {
+	versionList := strings.Split(version, ".")
+	if len(versionList) < 3 {
+		return ""
+	}
+	return versionList[0] + "." + versionList[1]
+}
+
+func GetSchemaVersion(version string) string {
+	minorVersion := GetMinorVersion(version)
+
+	return minorVersion + ".0"
+}
+
+// convSemanticVersionToInt converts version string to int.
+func convSemanticVersionToInt(version string) int {
+	versionList := strings.Split(version, ".")
+
+	if len(versionList) < 3 {
+		return 0
+	}
+	major, err := strconv.Atoi(versionList[0])
+	if err != nil {
+		return 0
+	}
+	minor, err := strconv.Atoi(versionList[1])
+	if err != nil {
+		return 0
+	}
+	patch, err := strconv.Atoi(versionList[2])
+	if err != nil {
+		return 0
+	}
+
+	return major*10000 + minor*100 + patch
+}
+
+// IsVersionGreaterThanOrEqualTo returns true if version is greater than or equal to target.
+func IsVersionGreaterOrEqualThan(version, target string) bool {
+	return convSemanticVersionToInt(version) >= convSemanticVersionToInt(target)
+}
+
+// IsVersionGreaterThan returns true if version is greater than target.
+func IsVersionGreaterThan(version, target string) bool {
+	return convSemanticVersionToInt(version) > convSemanticVersionToInt(target)
+}

server/workspace.go

@@ -0,0 +1,162 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/boojack/corgi/api"
+	"github.com/boojack/corgi/common"
+
+	"github.com/labstack/echo/v4"
+)
+
+func (s *Server) registerWorkspaceRoutes(g *echo.Group) {
+	g.POST("/workspace", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
+		}
+
+		workspaceCreate := &api.WorkspaceCreate{
+			CreatorID: userID,
+		}
+		if err := json.NewDecoder(c.Request().Body).Decode(workspaceCreate); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted post workspace request").SetInternal(err)
+		}
+		workspace, err := s.Store.CreateWorkspace(ctx, workspaceCreate)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to create workspace").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(workspace)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode workspace response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.GET("/workspace", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing auth session")
+		}
+
+		workspaceFind := &api.WorkspaceFind{
+			MemberID: &userID,
+		}
+		workspaceList, err := s.Store.FindWordspaceList(ctx, workspaceFind)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to fetch workspace list").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(workspaceList)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode workspace list response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.GET("/workspace/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		id, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted workspace id").SetInternal(err)
+		}
+
+		workspace, err := s.Store.FindWorkspace(ctx, &api.WorkspaceFind{
+			ID: &id,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find workspace").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(workspace)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode workspace response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.PATCH("/workspace/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
+		}
+		workspaceID, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
+		}
+		workspaceUser, err := s.Store.FindWordspaceUser(ctx, &api.WorkspaceUserFind{
+			WorkspaceID: &workspaceID,
+			UserID:      &userID,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find workspace user").SetInternal(err)
+		}
+		if workspaceUser == nil {
+			return echo.NewHTTPError(http.StatusUnauthorized, "not workspace user")
+		}
+		if workspaceUser.Role != api.RoleAdmin {
+			return echo.NewHTTPError(http.StatusUnauthorized, "not workspace admin")
+		}
+
+		patch := &api.WorkspacePatch{
+			ID: workspaceID,
+		}
+		if err := json.NewDecoder(c.Request().Body).Decode(patch); err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, "Malformatted patch workspace request").SetInternal(err)
+		}
+
+		workspace, err := s.Store.PatchWorkspace(ctx, patch)
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to patch workspace").SetInternal(err)
+		}
+
+		c.Response().Header().Set(echo.HeaderContentType, echo.MIMEApplicationJSONCharsetUTF8)
+		if err := json.NewEncoder(c.Response().Writer).Encode(composeResponse(workspace)); err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to encode workspace response").SetInternal(err)
+		}
+		return nil
+	})
+
+	g.DELETE("/workspace/:id", func(c echo.Context) error {
+		ctx := c.Request().Context()
+		userID, ok := c.Get(getUserIDContextKey()).(int)
+		if !ok {
+			return echo.NewHTTPError(http.StatusUnauthorized, "Missing user in session")
+		}
+		workspaceID, err := strconv.Atoi(c.Param("id"))
+		if err != nil {
+			return echo.NewHTTPError(http.StatusBadRequest, fmt.Sprintf("ID is not a number: %s", c.Param("id"))).SetInternal(err)
+		}
+		workspaceUser, err := s.Store.FindWordspaceUser(ctx, &api.WorkspaceUserFind{
+			WorkspaceID: &workspaceID,
+			UserID:      &userID,
+		})
+		if err != nil {
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to find workspace user").SetInternal(err)
+		}
+		if workspaceUser == nil {
+			return echo.NewHTTPError(http.StatusUnauthorized, "not workspace user")
+		}
+		if workspaceUser.Role != api.RoleAdmin {
+			return echo.NewHTTPError(http.StatusUnauthorized, "not workspace admin")
+		}
+
+		if err := s.Store.DeleteWorkspace(ctx, &api.WorkspaceDelete{
+			ID: workspaceID,
+		}); err != nil {
+			if common.ErrorCode(err) == common.NotFound {
+				return echo.NewHTTPError(http.StatusNotFound, fmt.Sprintf("User ID not found: %d", userID))
+			}
+			return echo.NewHTTPError(http.StatusInternalServerError, "Failed to delete user").SetInternal(err)
+		}
+
+		return c.JSON(http.StatusOK, true)
+	})
+}