add server side password change information

README.md

@@ -20,7 +20,7 @@ A simple, lightweight web application for managing user profile photos in a Free
 1.  **Clone the Repository**
     ```bash
     git clone https://git.astraltech.xyz/gawells/Self-Service-Dashboard
-    cd account-manager
+    cd Self-Service-Dashboard
     ```
 
 2.  **Configure the Application**
@@ -39,7 +39,7 @@ A simple, lightweight web application for managing user profile photos in a Free
 
 5.  **Run the Server**
     ```bash
-    go run src/*.go
+    go run ./src/main/
     ```
     The application will be available at `http://<host>:<port>`.
 

src/ldap.go

@@ -1,119 +0,0 @@
-package main
-
-import (
-	"crypto/tls"
-	"errors"
-	"log"
-
-	"github.com/go-ldap/ldap/v3"
-)
-
-type LDAPServer struct {
-	URL                string
-	StartTLS           bool
-	IgnoreInsecureCert bool
-	Connection         *ldap.Conn
-}
-
-type LDAPSearch struct {
-	Succeeded  bool
-	LDAPSearch *ldap.SearchResult
-}
-
-func connectToLDAPServer(URL string, starttls bool, ignore_cert bool) (*LDAPServer, error) {
-	l, err := ldap.DialURL(URL)
-	if err != nil {
-		return nil, err
-	}
-
-	if starttls {
-		if err := l.StartTLS(&tls.Config{InsecureSkipVerify: ignore_cert}); err != nil {
-			log.Println("StartTLS failed:", err)
-		}
-	}
-
-	return &LDAPServer{
-		Connection:         l,
-		URL:                URL,
-		StartTLS:           starttls,
-		IgnoreInsecureCert: ignore_cert,
-	}, nil
-}
-
-func reconnectToLDAPServer(server *LDAPServer) {
-	if server == nil {
-		log.Println("Cannot reconnect: server is nil")
-		return
-	}
-
-	l, err := ldap.DialURL(server.URL)
-	if err != nil {
-		log.Print(err)
-		return
-	}
-
-	if server.StartTLS {
-		if err := l.StartTLS(&tls.Config{InsecureSkipVerify: server.IgnoreInsecureCert}); err != nil {
-			log.Println("StartTLS failed:", err)
-		}
-	}
-
-	server.Connection = l
-}
-
-func connectAsLDAPUser(server *LDAPServer, bindDN, password string) error {
-	if server == nil {
-		return errors.New("LDAP server is nil")
-	}
-
-	// Reconnect if needed
-	if server.Connection == nil || server.Connection.IsClosing() {
-		reconnectToLDAPServer(server)
-	}
-	return server.Connection.Bind(bindDN, password)
-}
-
-func searchLDAPServer(server *LDAPServer, baseDN string, searchFilter string, attributes []string) LDAPSearch {
-	if server == nil {
-		return LDAPSearch{false, nil}
-	}
-
-	if server.Connection == nil {
-		reconnectToLDAPServer(server)
-		if server.Connection == nil {
-			return LDAPSearch{false, nil}
-		}
-	}
-
-	searchRequest := ldap.NewSearchRequest(
-		baseDN,
-		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		searchFilter, attributes,
-		nil,
-	)
-
-	sr, err := server.Connection.Search(searchRequest)
-	if err != nil {
-		return LDAPSearch{false, nil}
-	}
-
-	return LDAPSearch{true, sr}
-}
-
-func modifyLDAPAttribute(server *LDAPServer, userDN string, attribute string, data []string) error {
-	modify := ldap.NewModifyRequest(userDN, nil)
-	modify.Replace(attribute, data)
-	err := server.Connection.Modify(modify)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func closeLDAPServer(server *LDAPServer) {
-	if server != nil && server.Connection != nil {
-		server.Connection.Close()
-	}
-}
-
-func ldapEscapeFilter(input string) string { return ldap.EscapeFilter(input) }

src/logging/logging.go

@@ -0,0 +1,120 @@
+package logging
+
+import (
+	"log"
+)
+
+type EventType int
+
+const (
+	ReadFile EventType = iota
+	AuthenticateUser
+)
+
+type LogLevel int
+
+const (
+	InfoLevel LogLevel = iota
+	EventLevel
+	DebugLevel
+	WarnLevel
+	ErrorLevel
+	FatalLevel
+)
+
+var (
+	currentLevel LogLevel = InfoLevel
+)
+
+func Info(message string) {
+	if currentLevel > InfoLevel {
+		return
+	}
+	log.Printf("Info: %s", message)
+}
+
+func Infof(message string, v ...any) {
+	if currentLevel > InfoLevel {
+		return
+	}
+	log.Printf("Info: "+message, v...)
+}
+
+func Debug(message string) {
+	if currentLevel > DebugLevel {
+		return
+	}
+	log.Printf("Debug: %s", message)
+}
+
+func Debugf(message string, v ...any) {
+	if currentLevel > DebugLevel {
+		return
+	}
+	log.Printf("Debug: "+message, v...)
+}
+
+func Warn(message string) {
+	if currentLevel > WarnLevel {
+		return
+	}
+	log.Printf("Warn: %s", message)
+}
+
+func Warnf(message string, v ...any) {
+	if currentLevel > WarnLevel {
+		return
+	}
+	log.Printf("Warn: "+message, v...)
+}
+
+func Error(message string) {
+	if currentLevel > ErrorLevel {
+		return
+	}
+	log.Printf("Error: %s", message)
+}
+
+func Errorf(message string, v ...any) {
+	if currentLevel > ErrorLevel {
+		return
+	}
+	log.Printf("Error: "+message, v...)
+}
+
+func Fatal(message string) {
+	if currentLevel > FatalLevel {
+		return
+	}
+	log.Fatal(message)
+}
+
+func Fatalf(message string, v ...any) {
+	if currentLevel > FatalLevel {
+		return
+	}
+	log.Fatalf(message, v...)
+}
+
+func Event(eventType EventType, eventData ...any) {
+	if currentLevel > EventLevel {
+		return
+	}
+
+	switch eventType {
+	case ReadFile:
+		{
+			log.Printf("Reading file %s", eventData[0])
+			break
+		}
+	case AuthenticateUser:
+		{
+			log.Printf("Authenticating user %s", eventData[0])
+			break
+		}
+	}
+}
+
+func SetLogLovel(level LogLevel) {
+	currentLevel = level
+}

src/main/config.go

@@ -3,6 +3,8 @@ package main
 import (
 	"encoding/json"
 	"os"
+
+	"astraltech.xyz/accountmanager/src/logging"
 )
 
 type LDAPConfig struct {
@@ -30,12 +32,20 @@ type ServerConfig struct {
 }
 
 func loadServerConfig(path string) (*ServerConfig, error) {
+	logging.Debugf("Loading server config file: %s", path)
 	file, err := os.ReadFile(path)
 	if err != nil {
+		logging.Errorf("Failed to load server config")
+		logging.Error(err.Error())
 		return nil, err
 	}
 
 	var cfg ServerConfig
+	logging.Debugf("Unmarshaling JSON data")
 	err = json.Unmarshal(file, &cfg)
-	return &cfg, err
+	if err != nil {
+		logging.Error("Failed to read JSON data")
+		logging.Error(err.Error())
+	}
+	return &cfg, nil
 }

src/main/email.go

@@ -1,9 +1,11 @@
 package main
 
 import (
-	"log"
 	"net/smtp"
 	"strconv"
+	"strings"
+
+	"astraltech.xyz/accountmanager/src/logging"
 )
 
 type EmailAccount struct {
@@ -20,6 +22,7 @@ type EmailAccountData struct {
 }
 
 func createEmailAccount(accountData EmailAccountData, smtpHost string, smtpPort int) EmailAccount {
+	logging.Debugf("Creating Email Account: \n\tUsername: %s\n\tEmail: %s\n\tSMTP Host: %s:%d", accountData.username, accountData.email, smtpHost, smtpPort)
 	account := EmailAccount{
 		email:    accountData.email,
 		smtpHost: smtpHost,
@@ -30,13 +33,9 @@ func createEmailAccount(accountData EmailAccountData, smtpHost string, smtpPort
 }
 
 func sendEmail(account EmailAccount, toEmail []string, subject string, message string) {
-	ToEmailList := ""
+	logging.Debugf("Sending an email from %s to %s", account.email, strings.Join(toEmail, ""))
-	for i := 0; i < len(toEmail); i++ {
+
-		ToEmailList += toEmail[i]
+	ToEmailList := strings.Join(toEmail, "")
-		if i+1 < len(toEmail) {
-			ToEmailList += ", "
-		}
-	}
 
 	messageData := []byte(
 		"From: " + account.email + "\r\n" +
@@ -47,6 +46,7 @@ func sendEmail(account EmailAccount, toEmail []string, subject string, message s
 	)
 	err := smtp.SendMail(account.smtpHost+":"+account.smtpPort, account.auth, account.email, toEmail, messageData)
 	if err != nil {
-		log.Print(err)
+		logging.Error("Failed to send email")
+		logging.Error(err.Error())
 	}
 }

src/main/helpers.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"net/http"
+	"os"
+
+	"astraltech.xyz/accountmanager/src/logging"
+)
+
+// Reads a file, if fails just returns an error
+func ReadFile(path string) ([]byte, error) {
+	logging.Event(logging.ReadFile, "static/blank_profile.jpg")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		logging.Infof("Could not read file at %s", path)
+		logging.Infof("Error code: %e", err)
+		return nil, err
+	}
+	logging.Infof("Successfully read file at %s", path)
+	return data, err
+}
+
+func ReadRequiredFile(path string) []byte {
+	logging.Event(logging.ReadFile, "static/blank_profile.jpg")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		logging.Fatalf("Could not read file at %s", path)
+		return nil
+	}
+	logging.Infof("Successfully read file at %s", path)
+	return data
+}
+
+func Mkdir(path string, perm os.FileMode) error {
+	logging.Infof("Making directory %s", path)
+	err := os.Mkdir(path, perm)
+	if err != nil {
+		logging.Errorf("Failed to make %s directory", path)
+		logging.Error(err.Error())
+		return err
+	}
+	return nil
+}
+
+func CreateFile(path string) (*os.File, error) {
+	logging.Infof("Creating %s", path)
+	file, err := os.Create(path)
+	if err != nil {
+		logging.Errorf("Faile to create %s", path)
+		logging.Error(err.Error())
+	}
+	return file, nil
+}
+
+func HandleFunc(path string, handler func(http.ResponseWriter, *http.Request)) {
+	logging.Infof("Handling %s", path)
+	http.HandleFunc(path, handler)
+}

src/main/ldap.go

@@ -0,0 +1,181 @@
+package main
+
+import (
+	"crypto/tls"
+	"fmt"
+	"strings"
+
+	"astraltech.xyz/accountmanager/src/logging"
+	"github.com/go-ldap/ldap/v3"
+)
+
+type LDAPServer struct {
+	URL                string
+	StartTLS           bool
+	IgnoreInsecureCert bool
+	Connection         *ldap.Conn
+}
+
+type LDAPSearch struct {
+	Succeeded  bool
+	LDAPSearch *ldap.SearchResult
+}
+
+func connectToLDAPServer(URL string, starttls bool, ignore_cert bool) *LDAPServer {
+	logging.Debugf("Connecting to LDAP server %s", URL)
+	l, err := ldap.DialURL(URL)
+	if err != nil {
+		logging.Fatal("Failed to connect to LDAP server")
+		logging.Fatal(err.Error())
+	}
+	logging.Infof("Connected to LDAP server")
+
+	if starttls {
+		logging.Debugf("Enabling StartTLS")
+		if err := l.StartTLS(&tls.Config{InsecureSkipVerify: ignore_cert}); err != nil {
+			logging.Errorf("StartTLS failed %s", err.Error())
+		}
+		logging.Infof("StartTLS enabled")
+	}
+
+	return &LDAPServer{
+		Connection:         l,
+		URL:                URL,
+		StartTLS:           starttls,
+		IgnoreInsecureCert: ignore_cert,
+	}
+}
+
+func reconnectToLDAPServer(server *LDAPServer) error {
+	logging.Debugf("Reconnecting to %s LDAP server", server.URL)
+	if server == nil {
+		logging.Errorf("Cannot reconnect: server is nil")
+		return fmt.Errorf("Server is nil")
+	}
+
+	l, err := ldap.DialURL(server.URL)
+	if err != nil {
+		logging.Errorf("Failed to connect to LDAP server (has server gone down)")
+		return err
+	}
+
+	if server.StartTLS {
+		logging.Debugf("StartTLS enabling")
+		if err := l.StartTLS(&tls.Config{InsecureSkipVerify: server.IgnoreInsecureCert}); err != nil {
+			logging.Error("StartTLS failed")
+			return err
+		}
+		logging.Debugf("Successfully Started TLS")
+	}
+
+	server.Connection = l
+	return nil
+}
+
+func connectAsLDAPUser(server *LDAPServer, bindDN, password string) error {
+	logging.Debugf("Connecting to %s LDAP server with %s BindDN", server.URL, bindDN)
+	if server == nil {
+		logging.Errorf("Failed to connect as user, LDAP server is NULL")
+		return fmt.Errorf("LDAP server is null")
+	}
+
+	if server.Connection == nil || server.Connection.IsClosing() {
+		err := reconnectToLDAPServer(server)
+		return err
+	}
+	err := server.Connection.Bind(bindDN, password)
+	if err != nil {
+		logging.Errorf("Failed to bind to LDAP as user %s", err.Error())
+		return err
+	}
+	return nil
+}
+
+func searchLDAPServer(server *LDAPServer, baseDN string, searchFilter string, attributes []string) LDAPSearch {
+	logging.Debugf("Searching %s LDAP server\n\tBase DN: %s\n\tSearch Filter %s\n\tAttributes: %s", server.URL, baseDN, searchFilter, strings.Join(attributes, ","))
+	if server == nil {
+		logging.Errorf("Server is nil, failed to search LDAP server")
+		return LDAPSearch{false, nil}
+	}
+
+	if server.Connection == nil {
+		reconnectToLDAPServer(server)
+		if server.Connection == nil {
+			return LDAPSearch{false, nil}
+		}
+	}
+
+	searchRequest := ldap.NewSearchRequest(
+		baseDN,
+		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+		searchFilter, attributes,
+		nil,
+	)
+
+	sr, err := server.Connection.Search(searchRequest)
+	if err != nil {
+		logging.Errorf("Failed to search LDAP server %s\n", err.Error())
+		return LDAPSearch{false, nil}
+	}
+
+	return LDAPSearch{true, sr}
+}
+
+func modifyLDAPAttribute(server *LDAPServer, userDN string, attribute string, data []string) error {
+	logging.Infof("Modifing LDAP attribute %s", attribute)
+	modify := ldap.NewModifyRequest(userDN, nil)
+	modify.Replace(attribute, data)
+	err := server.Connection.Modify(modify)
+	if err != nil {
+		logging.Errorf("Failed to modify %s", err.Error())
+		return err
+	}
+	return nil
+}
+
+func changeLDAPPassword(server *LDAPServer, userDN, oldPassword, newPassword string) error {
+	logging.Infof("Changing LDAP password for %s", userDN)
+
+	if server == nil || server.Connection == nil {
+		return fmt.Errorf("LDAP connection not initialized")
+	}
+
+	// Ensure connection is alive
+	if server.Connection.IsClosing() {
+		if err := reconnectToLDAPServer(server); err != nil {
+			return err
+		}
+	}
+
+	// Bind as the user (required for FreeIPA self-password change)
+	err := server.Connection.Bind(userDN, oldPassword)
+	if err != nil {
+		logging.Errorf("Failed to bind as user: %s", err.Error())
+		return err
+	}
+
+	// Perform password modify extended operation
+	_, err = server.Connection.PasswordModify(&ldap.PasswordModifyRequest{
+		UserIdentity: userDN,
+		OldPassword:  oldPassword,
+		NewPassword:  newPassword,
+	})
+	if err != nil {
+		logging.Errorf("Password modify failed: %s", err.Error())
+		return err
+	}
+	logging.Infof("Password successfully changed for %s", userDN)
+	return nil
+}
+
+func closeLDAPServer(server *LDAPServer) {
+	if server != nil && server.Connection != nil {
+		logging.Debug("Closing connection to LDAP server")
+		err := server.Connection.Close()
+		if err != nil {
+			logging.Errorf("Failed to close LDAP server %s", err.Error())
+		}
+	}
+}
+
+func ldapEscapeFilter(input string) string { return ldap.EscapeFilter(input) }

src/main/main.go

@@ -11,6 +11,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"astraltech.xyz/accountmanager/src/logging"
 )
 
 var (
@@ -33,20 +35,20 @@ var (
 )
 
 func createUserPhoto(username string, photoData []byte) error {
-	os.Mkdir("./avatars", os.ModePerm)
+	Mkdir("./avatars", os.ModePerm)
 
 	path := fmt.Sprintf("./avatars/%s.jpeg", username)
 	cleaned := filepath.Clean(path)
-	dst, err := os.Create(cleaned)
+	dst, err := CreateFile(cleaned)
 
 	if err != nil {
-		fmt.Printf("Not saving file\n")
 		return fmt.Errorf("Could not save file")
 	}
 	photoCreatedMutex.Lock()
 	photoCreatedTimestamp[username] = time.Now()
 	photoCreatedMutex.Unlock()
 	defer dst.Close()
+	logging.Info("Writing to avarar file")
 	_, err = dst.Write(photoData)
 	if err != nil {
 		return err
@@ -55,6 +57,7 @@ func createUserPhoto(username string, photoData []byte) error {
 }
 
 func authenticateUser(username, password string) (UserData, error) {
+	logging.Event(logging.AuthenticateUser, username)
 	ldapServerMutex.Lock()
 	defer ldapServerMutex.Unlock()
 	if ldapServer.Connection == nil {
@@ -96,9 +99,12 @@ type LoginPageData struct {
 }
 
 func loginHandler(w http.ResponseWriter, r *http.Request) {
+	logging.Info("Handing login page")
+
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	tmpl := template.Must(template.ParseFiles("src/pages/login_page.html"))
 	if r.Method == http.MethodGet {
+		logging.Info("Rending login page")
 		tmpl.Execute(w, LoginPageData{IsHiddenClassList: "hidden"})
 		return
 	}
@@ -109,10 +115,9 @@ func loginHandler(w http.ResponseWriter, r *http.Request) {
 		if strings.Contains(username, "/") {
 			tmpl.Execute(w, LoginPageData{IsHiddenClassList: ""})
 		}
-
 		password := r.FormValue("password")
 
-		log.Printf("New Login request for %s\n", username)
+		logging.Infof("New Login request for %s\n", username)
 		userData, err := authenticateUser(username, password)
 		if err != nil {
 			log.Print(err)
@@ -170,7 +175,7 @@ func avatarHandler(w http.ResponseWriter, r *http.Request) {
 
 	filePath := fmt.Sprintf("./avatars/%s.jpeg", username)
 	cleaned := filepath.Clean(filePath)
-	value, err := os.ReadFile(cleaned)
+	value, err := ReadFile(cleaned)
 
 	if err == nil {
 		photoCreatedMutex.Lock()
@@ -187,7 +192,6 @@ func avatarHandler(w http.ResponseWriter, r *http.Request) {
 	connected := connectAsLDAPUser(ldapServer, serverConfig.LDAPConfig.BindDN, serverConfig.LDAPConfig.BindPassword)
 	if connected != nil {
 		w.Write(blankPhotoData)
-		fmt.Println("Returned blank avatar because couldnt connect as user")
 		return
 	}
 
@@ -199,13 +203,11 @@ func avatarHandler(w http.ResponseWriter, r *http.Request) {
 	)
 	if !userSearch.Succeeded || len(userSearch.LDAPSearch.Entries) == 0 {
 		w.Write(blankPhotoData)
-		fmt.Println("Returned blank avatar because we couldnt find the user")
 		return
 	}
 	entry := userSearch.LDAPSearch.Entries[0]
 	bytes := entry.GetRawAttributeValue("jpegphoto")
 	if len(bytes) == 0 {
-		fmt.Println("Returned blank avatar because we just don't have an avatar")
 		w.Write(blankPhotoData)
 		return
 	} else {
@@ -226,14 +228,13 @@ func logoutHandler(w http.ResponseWriter, r *http.Request) {
 	if exist {
 		if r.FormValue("csrf_token") != sessionData.CSRFToken {
 			http.Error(w, "Unable to log user out", http.StatusForbidden)
-			log.Printf("%s attempted to logout with invalid csrf token", sessionData.data.Username)
+			logging.Debugf("%s attempted to logout with invalid csrf token", sessionData.data.Username)
 			return
 		}
 	}
+	logging.Infof("handling logout event for %s", sessionData.data.Username)
 
-	sessionMutex.Lock()
+	deleteSession(token)
-	delete(sessions, token)
-	sessionMutex.Unlock()
 	http.Redirect(w, r, "/login", http.StatusSeeOther)
 }
 
@@ -279,17 +280,19 @@ func uploadPhotoHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func faviconHandler(w http.ResponseWriter, r *http.Request) {
+	logging.Info("Requesting Favicon")
 	http.ServeFile(w, r, serverConfig.StyleConfig.FaviconPath)
 }
 
 func logoHandler(w http.ResponseWriter, r *http.Request) {
+	logging.Info("Requesting Logo")
 	http.ServeFile(w, r, serverConfig.StyleConfig.LogoPath)
 }
 
 func cleanupSessions() {
-	sessionMutex.Lock()
+	logging.Debug("Cleaning up stale session\n")
-	defer sessionMutex.Unlock()
 
+	sessionMutex.Lock()
 	sessions_to_delete := []string{}
 	for session_token, session_data := range sessions {
 		timeUntilRemoval := time.Minute * 5
@@ -300,17 +303,76 @@ func cleanupSessions() {
 			sessions_to_delete = append(sessions_to_delete, session_token)
 		}
 	}
+	sessionMutex.Unlock()
 	for _, session_id := range sessions_to_delete {
-		delete(sessions, session_id)
+		deleteSession(session_id)
 	}
 }
 
-func main() {
+func changePasswordHandler(w http.ResponseWriter, r *http.Request) {
-	var err error = nil
+	w.Header().Set("Content-Type", "application/json")
 
-	blankPhotoData, err = os.ReadFile("static/blank_profile.jpg")
+	exist, sessionData := validateSession(r)
+	if !exist {
+		w.WriteHeader(http.StatusUnauthorized)
+		w.Write([]byte(`{"success": false, "error": "Not authenticated"}`))
+		return
+	}
+
+	err := r.ParseMultipartForm(10 << 20)
 	if err != nil {
-		log.Fatal("Could not load blank profile image")
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte(`{"success": false, "error": "Bad request"}`))
+		return
+	}
+
+	if r.FormValue("csrf_token") != sessionData.CSRFToken {
+		w.WriteHeader(http.StatusForbidden)
+		w.Write([]byte(`{"success": false, "error": "CSRF Forbidden"}`))
+		return
+	}
+
+	oldPassword := r.FormValue("old_password")
+	newPassword := r.FormValue("new_password")
+	newPasswordRepeat := r.FormValue("new_password_repeat")
+
+	if newPassword != newPasswordRepeat {
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte(`{"success": false, "error": "Passwords do not match"}`))
+		return
+	}
+
+	userDN := fmt.Sprintf(
+		"uid=%s,cn=users,cn=accounts,%s",
+		sessionData.data.Username,
+		serverConfig.LDAPConfig.BaseDN,
+	)
+
+	err = changeLDAPPassword(ldapServer, userDN, oldPassword, newPassword)
+	if err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+
+		if strings.Contains(err.Error(), "Invalid Credentials") {
+			w.Write([]byte(`{"success": false, "error": "Current password incorrect"}`))
+		} else if strings.Contains(err.Error(), "Too soon to change password") {
+			w.Write([]byte(`{"success": false, "error": "Too soon to change password"}`))
+		} else {
+			w.Write([]byte(`{"success": false, "error": "Internal error"}`))
+		}
+		return
+	}
+
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(`{"success": true}`))
+}
+
+func main() {
+	logging.Info("Starting the server")
+
+	var err error = nil
+	blankPhotoData, err = ReadFile("static/blank_profile.jpg")
+	if err != nil {
+		logging.Fatal("Could not load blank profile image")
 	}
 	serverConfig, err = loadServerConfig("./data/config.json")
 	if err != nil {
@@ -318,31 +380,28 @@ func main() {
 	}
 
 	ldapServerMutex.Lock()
-	server, err := connectToLDAPServer(serverConfig.LDAPConfig.LDAPURL, serverConfig.LDAPConfig.Security == "tls", serverConfig.LDAPConfig.IgnoreInvalidCert)
+	server := connectToLDAPServer(serverConfig.LDAPConfig.LDAPURL, serverConfig.LDAPConfig.Security == "tls", serverConfig.LDAPConfig.IgnoreInvalidCert)
 	ldapServer = server
 	ldapServerMutex.Unlock()
-	if err != nil {
-		log.Fatal(err)
-		return
-	}
 	defer closeLDAPServer(ldapServer)
 
 	createWorker(time.Minute*5, cleanupSessions)
-	http.HandleFunc("/favicon.ico", faviconHandler)
+	HandleFunc("/favicon.ico", faviconHandler)
-	http.HandleFunc("/logo", logoHandler)
+	HandleFunc("/logo", logoHandler)
 
 	http.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
-	http.HandleFunc("/login", loginHandler)
+	HandleFunc("/login", loginHandler)
-	http.HandleFunc("/profile", profileHandler)
+	HandleFunc("/profile", profileHandler)
-	http.HandleFunc("/logout", logoutHandler)
+	HandleFunc("/logout", logoutHandler)
 
-	http.HandleFunc("/avatar", avatarHandler)
+	HandleFunc("/avatar", avatarHandler)
-	http.HandleFunc("/change-photo", uploadPhotoHandler)
+	HandleFunc("/change-photo", uploadPhotoHandler)
+	HandleFunc("/change-password", changePasswordHandler)
 
-	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+	HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/profile", http.StatusFound) // 302 redirect
 	})
 
 	serverAddress := fmt.Sprintf(":%d", serverConfig.WebserverConfig.Port)
-	log.Fatal(http.ListenAndServe(serverAddress, nil))
+	logging.Fatal(http.ListenAndServe(serverAddress, nil).Error())
 }

src/main/session.go

@@ -4,10 +4,11 @@ import (
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
-	"log"
 	"net/http"
 	"sync"
 	"time"
+
+	"astraltech.xyz/accountmanager/src/logging"
 )
 
 type SessionData struct {
@@ -33,14 +34,15 @@ func GenerateSessionToken(length int) (string, error) {
 }
 
 func createSession(userData *UserData) *http.Cookie {
+	logging.Debugf("Creating a new session for %s", userData.Username)
 	token, err := GenerateSessionToken(32) // Use crypto/rand for this
 	if err != nil {
-		log.Print(err)
+		logging.Error(err.Error())
 		return nil
 	}
 	CSRFToken, err := GenerateSessionToken(32)
 	if err != nil {
-		log.Print(err)
+		logging.Error(err.Error())
 		return nil
 	}
 
@@ -72,8 +74,10 @@ func createSession(userData *UserData) *http.Cookie {
 }
 
 func validateSession(r *http.Request) (bool, *SessionData) {
+	logging.Debugf("Validating session")
 	cookie, err := r.Cookie("session_token")
 	if err != nil {
+		logging.Error(err.Error())
 		return false, &SessionData{}
 	}
 	token := cookie.Value
@@ -87,5 +91,16 @@ func validateSession(r *http.Request) (bool, *SessionData) {
 	if !exists || !sessionData.loggedIn {
 		return false, &SessionData{}
 	}
+	logging.Infof("Validated session for %s", sessionData.data.Username)
 	return true, &sessionData
 }
+
+func deleteSession(session_id string) {
+	sessionMutex.Lock()
+
+	tokenEncoded := sha256.Sum256([]byte(session_id))
+	tokenEncodedString := string(tokenEncoded[:])
+
+	delete(sessions, tokenEncodedString)
+	sessionMutex.Unlock()
+}

src/main/worker.go

@@ -2,9 +2,12 @@ package main
 
 import (
 	"time"
+
+	"astraltech.xyz/accountmanager/src/logging"
 )
 
 func createWorker(interval time.Duration, task func()) {
+	logging.Debugf("Creating worker that runs on a %s interval", interval.String())
 	go func() {
 		ticker := time.NewTicker(interval)
 		defer ticker.Stop()

src/pages/login_page.html

@@ -6,37 +6,31 @@
     rel="stylesheet"
 />
 <link rel="stylesheet" href="static/style.css" />
+<link rel="stylesheet" href="static/error/error.css" />
+<link rel="stylesheet" href="static/card.css" />
 <link rel="stylesheet" href="static/login_page.css" />
 
 <img id="logo_image" alt="logo" src="/logo" />
-<form id="login_card" method="POST">
+<form id="login_card" class="card" method="POST">
     <div id="welcome_text">
         Welcome to Astral Tech, Please Sign in to your account below
     </div>
 
-    <div id="incorrect_password_text" class="{{.IsHiddenClassList}}">
+    <div class="error {{.IsHiddenClassList}}">
         ⚠️ Invalid username or password.
-        <button id="incorrect_password_close_button">X</button>
+        <button class="close_error_button">X</button>
     </div>
 
     <div>
-        <label class="login_text">Username</label><br />
+        <label class="input_label">Username</label><br />
         <input type="text" name="username" placeholder="" required />
     </div>
 
     <div>
-        <label class="login_text">Password</label><br />
+        <label class="input_label">Password</label><br />
         <input type="password" name="password" placeholder="" required />
     </div>
     <button type="submit">Login</button>
 </form>
 
-<script>
+<script src="/static/error/error.js" type="text/javascript"></script>
-    document
-        .getElementById("incorrect_password_close_button")
-        .addEventListener("click", function () {
-            document
-                .getElementById("incorrect_password_text")
-                .classList.add("hidden");
-        });
-</script>

src/pages/profile_page.html

@@ -7,8 +7,59 @@
 />
 <link rel="stylesheet" href="static/style.css" />
 <link rel="stylesheet" href="static/card.css" />
+<link rel="stylesheet" href="static/error/error.css" />
 <link rel="stylesheet" href="static/profile_page.css" />
 
+<div id="popup_background" class="blocked hidden"></div>
+
+<div id="change_password_dialogue" class="hidden card static_center">
+    Change Password
+
+    <button id="close_password_dialogue">X</button>
+
+    <div id="password_error" class="error hidden">
+        <div id="password_text"></div>
+        <button id="password_error_close_button" class="close_error_button">
+            X
+        </button>
+    </div>
+
+    <div>
+        <label class="input_label">Current password</label><br />
+        <input
+            type="password"
+            id="current_password"
+            name="current_password"
+            placeholder=""
+            required
+        />
+    </div>
+
+    <div>
+        <label class="input_label">New password</label><br />
+        <input
+            type="password"
+            id="new_password"
+            name="new_password"
+            placeholder=""
+            required
+        />
+    </div>
+
+    <div>
+        <label class="input_label">New password (repeat)</label><br />
+        <input
+            type="password"
+            id="new_password_repeat"
+            name="new_password_repeat"
+            placeholder=""
+            required
+        />
+    </div>
+
+    <button id="final_change_password_button">Change Password</button>
+</div>
+
 <img id="logo_image" alt="logo" src="/logo" />
 <div id="main_content">
     <div class="cards">
@@ -51,28 +102,18 @@
                 <div class="data-value">{{.Email}}</div>
             </div>
 
-            <form
+            <button class="bottom_button" id="change_password_button">
-                action="/logout"
+                <input
-                method="POST"
+                    id="csrf_token_storage"
-                style="
+                    type="hidden"
-                    color: var(--primary-accent);
+                    name="csrf_token"
-                    text-decoration: none;
+                    value="{{.CSRFToken}}"
-                    font-weight: bold;
+                />
-                    margin-top: 20px;
+                Change Password
-                    display: inline-block;
+            </button>
-                "
+
-            >
+            <form action="/logout" method="POST" style="display: inline-block">
-                <button
+                <button class="bottom_button" id="signout_button">
-                    style="
-                        background: none;
-                        border-style: none;
-                        color: var(--primary-accent);
-                        text-decoration: none;
-                        font-weight: bold;
-                        font-size: 20px;
-                    "
-                    id="signout_button"
-                >
                     <input
                         id="csrf_token_storage"
                         type="hidden"
@@ -95,10 +136,102 @@
     });
 </script>
 
+<script type="text/javascript">
+    const popup_botton = document.getElementById("change_password_button");
+
+    popup_botton.addEventListener("click", () => {
+        document.getElementById("popup_background").classList.remove("hidden");
+        document
+            .getElementById("change_password_dialogue")
+            .classList.remove("hidden");
+    });
+</script>
+
+<script type="text/javascript">
+    const changePasswordButton = document.getElementById(
+        "final_change_password_button",
+    );
+
+    function displayError(errorText) {
+        document.getElementById("password_error").classList.remove("hidden");
+        document.getElementById("password_text").innerText =
+            "⚠️ " + errorText + ".";
+        return;
+    }
+
+    changePasswordButton.addEventListener("click", () => {
+        if (document.getElementById("current_password").value === "") {
+            displayError("Please enter current password");
+            return;
+        }
+
+        if (document.getElementById("new_password").value === "") {
+            displayError("No value for new password");
+            return;
+        }
+
+        if (document.getElementById("new_password_repeat").value === "") {
+            displayError("Please repeat new password");
+            return;
+        }
+
+        if (
+            document.getElementById("new_password").value !==
+            document.getElementById("new_password_repeat").value
+        ) {
+            displayError("New password and new password repeat do not match");
+            return;
+        }
+
+        const formData = new FormData();
+        formData.append(
+            "csrf_token",
+            document.getElementById("csrf_token_storage").value,
+        );
+        formData.append(
+            "old_password",
+            document.getElementById("current_password").value,
+        );
+        formData.append(
+            "new_password",
+            document.getElementById("new_password").value,
+        );
+        formData.append(
+            "new_password_repeat",
+            document.getElementById("new_password_repeat").value,
+        );
+
+        fetch("/change-password", {
+            method: "POST",
+            body: formData,
+        })
+            .then(async (res) => {
+                const data = await res.json();
+                if (!res.ok) {
+                    throw new Error(data.error || "Request failed");
+                }
+                return data;
+            })
+            .then((data) => {
+                document
+                    .getElementById("change_password_dialogue")
+                    .classList.add("hidden");
+                document
+                    .getElementById("popup_background")
+                    .classList.add("hidden");
+            })
+            .catch((err) => {
+                displayError(err.message);
+            });
+    });
+</script>
+
 <script type="text/javascript">
     var currentPreviewURL = null;
 
     fileInput.addEventListener("change", async () => {
+        document.getElementById("popup_background").classList.remove("hidden");
+
         const file = fileInput.files[0];
         if (!file) return;
         if (file.type !== "image/jpeg") {
@@ -118,7 +251,9 @@
             credentials: "include",
         });
         const text = await res.text();
-        // show the picture (so we don't need to re render the whole page)
+
+        document.getElementById("popup_background").classList.add("hidden");
+
         const img = document.querySelector(".profile-pic");
 
         if (currentPreviewURL != null) {
@@ -129,3 +264,16 @@
         currentPreviewURL = img.src;
     });
 </script>
+
+<script type="text/javascript">
+    document
+        .getElementById("close_password_dialogue")
+        .addEventListener("click", () => {
+            document
+                .getElementById("change_password_dialogue")
+                .classList.add("hidden");
+            document.getElementById("popup_background").classList.add("hidden");
+        });
+</script>
+
+<script src="/static/error/error.js" type="text/javascript"></script>

static/card.css

@@ -3,11 +3,22 @@
         255,
         255,
         255,
-        0.8
+        1
     ); /* Semi-transparent white for light theme */
     border: 1px solid var(--border-subtle);
     border-radius: 12px;
-    padding: 24px;
+    padding: 2.5rem;
     box-shadow: 0 4px 15px rgba(0, 0, 0, 0.03);
     transition: transform 0.2s ease;
+
+    display: flex;
+    flex-direction: column;
+    gap: 15px;
+}
+
+.static_center {
+    position: fixed;
+    left: 50%;
+    top: 50%;
+    transform: translateX(-50%) translateY(-50%);
 }

static/error/error.css

@@ -0,0 +1,30 @@
+.error {
+    background-color: var(--error-red) !important;
+    border-radius: 10px;
+    padding: 20px;
+    border-style: solid;
+    border-color: var(--error-border-red);
+    border-width: 1px;
+    box-sizing: border-box;
+    font-size: 12px;
+    position: relative;
+    color: white;
+    box-shadow: 0 2px 6px rgba(0, 0, 0, 0.1);
+}
+
+.close_error_button {
+    position: absolute !important;
+    background-color: rgba(0, 0, 0, 0) !important;
+    padding: 0px !important;
+    top: 20px;
+    right: 20px;
+    color: black !important;
+    font-weight: normal !important;
+    border: none;
+    width: fit-content !important;
+}
+
+.close_error_button:hover {
+    cursor: default;
+    font-weight: bold !important;
+}

static/error/error.js

@@ -0,0 +1,7 @@
+var error_close_buttons = document.getElementsByClassName("close_error_button");
+
+for (const close_button of error_close_buttons) {
+  close_button.addEventListener("click", function () {
+    this.parentElement.classList.add("hidden");
+  });
+}

static/login_page.css

@@ -6,51 +6,17 @@
 }
 
 #login_card {
-    /* The Magic Three */
-    display: flex;
-    flex-direction: column; /* Stack vertically */
-    gap: 15px; /* Space between inputs */
-
     position: fixed;
     top: 50%;
     left: 50%;
     transform: translateX(-50%) translateY(-50%);
-
-    background-color: var(--bg-card);
-    border: 1px solid var(--border-subtle);
-    padding: 2.5rem;
-    border-radius: 8px;
     width: 350px;
-
-    /* Soft shadow for depth in light mode */
-    box-shadow:
-        0 4px 12px rgba(0, 0, 0, 0.05),
-        0 1px 3px rgba(0, 0, 0, 0.1);
 }
 
 #login_card input {
-    padding: 12px;
-    background-color: var(--bg-input);
-    border: 1px solid var(--border-subtle);
-    color: var(--text-main);
-    border-radius: 6px;
     width: 324px;
 }
 
-#login_card input::placeholder {
-    color: var(--text-muted);
-}
-
-#login_card button {
-    padding: 12px;
-    background-color: var(--primary-accent); /* Our Teal/Blue */
-    color: white;
-    border: none;
-    border-radius: 6px;
-    cursor: pointer;
-    font-weight: bold;
-}
-
 #login_card div {
     width: 100%;
 }
@@ -69,48 +35,8 @@
     flex: 2;
 }
 
-#login_card button:hover {
-    background-color: var(--primary-hover);
-}
-
-.login_text {
-    color: var(--text-muted);
-    margin: 0;
-    padding: 0;
-    font-size: 15px;
-}
-
 #welcome_text {
     font-weight: 700;
     font-size: 1.25rem;
     margin-bottom: 8px;
 }
-
-#incorrect_password_text {
-    background-color: var(--error-red) !important;
-    border-radius: 10px;
-    padding: 20px;
-    border-style: solid;
-    border-color: var(--error-border-red);
-    border-width: 1px;
-    box-sizing: border-box;
-    font-size: 12px;
-    position: relative;
-    color: white;
-    box-shadow: 0 2px 6px rgba(0, 0, 0, 0.1);
-}
-
-#incorrect_password_close_button {
-    position: absolute !important;
-    background-color: rgba(0, 0, 0, 0) !important;
-    padding: 0px !important;
-    top: 20px;
-    right: 20px;
-    color: black !important;
-    font-weight: normal !important;
-}
-
-#incorrect_password_close_button:hover {
-    cursor: default;
-    font-weight: bold !important;
-}

static/profile_page.css

@@ -33,6 +33,8 @@
     max-width: 500px;
     text-align: center;
 
+    gap: 0px !important;
+
     position: fixed;
     left: 50%;
     top: 50%;
@@ -83,6 +85,8 @@
     border-radius: 50%;
     border: none;
     padding: 6px;
+
+    width: fit-content !important;
 }
 
 #edit_picture_button:hover {
@@ -90,8 +94,8 @@
 }
 
 #edit_picture_image {
-    width: 20px;
+    width: 20px !important;
-    height: 20px;
+    height: 20px !important;
 }
 
 #picture_holder {
@@ -100,6 +104,31 @@
     line-height: 0;
 }
 
-#signout_button:hover {
+.bottom_button:hover {
     text-decoration: underline !important;
+    background: none !important;
+}
+
+.bottom_button {
+    background: none;
+    border-style: none;
+    color: var(--primary-accent);
+    text-decoration: none;
+    font-weight: bold;
+    font-size: 20px;
+}
+
+#change_password_dialogue {
+    z-index: 10000;
+    position: fixed;
+}
+
+#change_password_dialogue input {
+    width: 350px;
+}
+
+#close_password_dialogue {
+    width: fit-content;
+    position: absolute;
+    right: 2.5rem;
 }

static/style.css

@@ -24,6 +24,52 @@ body {
     background-color: var(--bg-main);
 }
 
-.hidden {
+button {
-    display: none;
+    padding: 12px;
+    background-color: var(--primary-accent); /* Our Teal/Blue */
+    color: white;
+    border: none;
+    border-radius: 6px;
+    cursor: pointer;
+    font-weight: bold;
+    width: 100%;
+}
+
+button:hover {
+    background-color: var(--primary-hover);
+}
+
+input {
+    padding: 12px;
+    background-color: var(--bg-input);
+    border: 1px solid var(--border-subtle);
+    color: var(--text-main);
+    border-radius: 6px;
+}
+
+input::placeholder {
+    color: var(--text-muted);
+}
+
+.input_label {
+    color: var(--text-muted);
+    margin: 0;
+    padding: 0;
+    font-size: 15px;
+}
+
+.hidden {
+    display: none !important;
+}
+
+.blocked {
+    position: fixed; /* or absolute */
+    top: 0;
+    left: 0;
+    width: 100%;
+    height: 100%;
+    z-index: 9999; /* higher = on top */
+
+    background-color: black;
+    opacity: 10%;
 }