0.3.22 - PINs

server/internal/api/viewers.go

@@ -9,6 +9,8 @@ import (
 	"sync"
 	"time"
 
+	"golang.org/x/crypto/bcrypt"
+
 	"github.com/ponzischeme89/memby/server/internal/store"
 )
 
@@ -275,6 +277,52 @@ type viewerRequest struct {
 	Name      string `json:"name"`
 	ShortName string `json:"shortName"`
 	Colour    string `json:"colour"`
+	PIN       string `json:"pin,omitempty"`
+	ClearPIN  bool   `json:"clearPin,omitempty"`
+}
+
+type viewerPINRequest struct {
+	PIN string `json:"pin"`
+}
+
+func (s *Server) handleViewerPIN(w http.ResponseWriter, r *http.Request, sess store.Session) {
+	var req viewerPINRequest
+	if json.NewDecoder(http.MaxBytesReader(w, r.Body, 2<<10)).Decode(&req) != nil {
+		writeError(w, http.StatusBadRequest, "malformed request body")
+		return
+	}
+	viewerID := strings.TrimSpace(r.PathValue("viewerID"))
+	hash, err := pinHash(req.PIN)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "could not save PIN")
+		return
+	}
+	if err := s.store.SetViewerPIN(r.Context(), sess.EmbyUserID, viewerID, hash); err != nil {
+		if errors.Is(err, store.ErrViewerNotFound) {
+			writeError(w, http.StatusNotFound, "no such viewer")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "could not save PIN")
+		return
+	}
+	if err := s.store.SetViewerPINValue(r.Context(), sess.EmbyUserID, viewerID, req.PIN); err != nil {
+		writeError(w, http.StatusInternalServerError, "could not save PIN")
+		return
+	}
+	s.forgetViewers(sess.EmbyUserID)
+	writeJSON(w, http.StatusOK, map[string]bool{"saved": true})
+}
+
+func pinHash(pin string) ([]byte, error) {
+	if len(pin) < 4 || len(pin) > 12 {
+		return nil, errors.New("PIN must be 4 to 12 characters")
+	}
+	for _, r := range pin {
+		if r < '0' || r > '9' {
+			return nil, errors.New("PIN must contain only numbers")
+		}
+	}
+	return bcrypt.GenerateFromPassword([]byte(pin), bcrypt.DefaultCost)
 }
 
 func (s *Server) handleViewers(w http.ResponseWriter, r *http.Request, sess store.Session) {