86 lines
1.8 KiB
Markdown
86 lines
1.8 KiB
Markdown
# User Management - Xtream Player
|
|
|
|
## Overview
|
|
|
|
Users are stored in H2 database (`~/.xtream-player/users.db`).
|
|
If no users exist, application creates default user `admin` / `admin` on startup.
|
|
|
|
## Authentication for User API
|
|
|
|
User CRUD API is protected by a fixed bearer token:
|
|
|
|
- Header: `Authorization: Bearer MujBearer852654`
|
|
|
|
Without this header (or with wrong value), API returns `401 Unauthorized`.
|
|
|
|
## /user CRUD API
|
|
|
|
Base endpoint:
|
|
|
|
- `http://localhost:8080/user`
|
|
|
|
### List users
|
|
|
|
```bash
|
|
curl -H "Authorization: Bearer MujBearer852654" \
|
|
http://localhost:8080/user
|
|
```
|
|
|
|
### Get one user
|
|
|
|
```bash
|
|
curl -H "Authorization: Bearer MujBearer852654" \
|
|
"http://localhost:8080/user?username=admin"
|
|
```
|
|
|
|
### Create user
|
|
|
|
```bash
|
|
curl -X POST -H "Authorization: Bearer MujBearer852654" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"user","password":"pass123"}' \
|
|
http://localhost:8080/user
|
|
```
|
|
|
|
You can also send URL-encoded form data:
|
|
|
|
```bash
|
|
curl -X POST -H "Authorization: Bearer MujBearer852654" \
|
|
-d "username=user&password=pass123" \
|
|
http://localhost:8080/user
|
|
```
|
|
|
|
### Update password
|
|
|
|
```bash
|
|
curl -X PUT -H "Authorization: Bearer MujBearer852654" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"user","newPassword":"newPass123"}' \
|
|
http://localhost:8080/user
|
|
```
|
|
|
|
`password` is accepted as fallback key as well.
|
|
|
|
### Delete user
|
|
|
|
By query param:
|
|
|
|
```bash
|
|
curl -X DELETE -H "Authorization: Bearer MujBearer852654" \
|
|
"http://localhost:8080/user?username=user"
|
|
```
|
|
|
|
Or by JSON body:
|
|
|
|
```bash
|
|
curl -X DELETE -H "Authorization: Bearer MujBearer852654" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"username":"user"}' \
|
|
http://localhost:8080/user
|
|
```
|
|
|
|
## Response Notes
|
|
|
|
- Returned user objects include: `id`, `username`, `createdAt`, `updatedAt`
|
|
- Password hash is never returned by the API.
|