@@ -32,6 +32,10 @@ func main() {
 		log.Fatal(errors.Wrap(err, "migrating database"))
 	}
 
+	if err := db.CreateAdminUser(database, "admin"); err != nil {

@@ -33,2 +33,4 @@
 	}
 
+	if err := db.CreateAdminUser(database, "admin"); err != nil {
+	  log.Fatalln(err)

@@ -276,0 +294,4 @@
+		return
+	}
+}
+func (rl *rushlink) createUserHandler(w http.ResponseWriter, r *http.Request) {

@@ -278,0 +309,4 @@
+
+	new_username := r.FormValue("username")
+	new_password := r.FormValue("password")
+	new_admin, _ := strconv.ParseBool(r.FormValue("admin"))

@@ -278,0 +334,4 @@
+
+	// Authenticate the user
+	user, err := db.Authenticate(rl.db, username, password)
+	if err != nil || (shouldBeAdmin && !user.Admin && (canAlsoBe == nil || *canAlsoBe != user.User)) {

@@ -39,2 +39,4 @@
 	PubID uuid.UUID `gorm:"uniqueIndex"`
 
+	// User ID that created this file
+	CreatedBy   uint `gorm:"index"`

@@ -0,0 +66,4 @@
+	return &user, nil
+}
+
+const (

@@ -0,0 +81,4 @@
+	}
+
+	// Hash the password using argon2id
+	hash := argon2.IDKey([]byte(password), salt, 2, 64*1024, 1, pwdHashSize)

@@ -0,0 +84,4 @@
+	hash := argon2.IDKey([]byte(password), salt, 2, 64*1024, 1, pwdHashSize)
+
+	// Encode the salt and hash as a string in PHC format
+	encodedSalt := base64.URLEncoding.EncodeToString(salt)

@@ -0,0 +86,4 @@
+	// Encode the salt and hash as a string in PHC format
+	encodedSalt := base64.URLEncoding.EncodeToString(salt)
+	encodedHash := base64.URLEncoding.EncodeToString(hash)
+	return fmt.Sprintf("$%s$%s$%s$%s", pwdAlgo, pwdParams, encodedSalt, encodedHash), nil

@@ -0,0 +91,4 @@
+
+func comparePassword(hashedPassword string, password string) (bool, error) {
+	// Extract the salt and hash from the hashed password string
+	fields := strings.Split(hashedPassword, "$")[1:]

@@ -0,0 +93,4 @@
+	// Extract the salt and hash from the hashed password string
+	fields := strings.Split(hashedPassword, "$")[1:]
+	if len(fields) != 4 || fields[0] != pwdAlgo || fields[1] != pwdParams {
+		return false, errors.New("invalid password format in db")

@@ -0,0 +98,4 @@
+	encodedSalt, encodedHash := fields[2], fields[3]
+
+	// Decode the salt and hash from base64
+	salt, err := base64.URLEncoding.DecodeString(encodedSalt)

@@ -0,0 +102,4 @@
+	if err != nil {
+		return false, err
+	}
+	hash, err := base64.URLEncoding.DecodeString(encodedHash)

@@ -0,0 +112,4 @@
+
+	// Compare the computed hash with the stored hash
+	// todo constant time?
+	return bytes.Equal(hash, computedHash), nil

@@ -0,0 +141,4 @@
+	// Update the user fields
+	existingUser.User = updatedUser.User
+	existingUser.Password = updatedUser.Password
+	existingUser.Admin = updatedUser.Admin