From 69de76cb32cfd638672d4d5846d0659bf102316f Mon Sep 17 00:00:00 2001 From: Brian Picciano Date: Tue, 17 May 2022 15:54:20 -0600 Subject: [PATCH] Add asset file upload form, plus related necessary refactors --- srv/src/api/api.go | 12 ++++-- srv/src/api/apiutil/apiutil.go | 21 ++++++++++ srv/src/api/assets.go | 28 +++++++++++++ srv/src/api/csrf.go | 3 +- srv/src/api/middleware.go | 6 +-- srv/src/api/render.go | 68 +++++++++++++++++++------------ srv/src/api/tpl/admin-assets.html | 26 +++++++++++- srv/src/api/tpl/index.html | 12 +++--- srv/src/api/tpl/post.html | 32 +++++++-------- 9 files changed, 152 insertions(+), 56 deletions(-) diff --git a/srv/src/api/api.go b/srv/src/api/api.go index b0948ac..cf34157 100644 --- a/srv/src/api/api.go +++ b/srv/src/api/api.go @@ -11,6 +11,7 @@ import ( "net/url" "os" + "github.com/mediocregopher/blog.mediocregopher.com/srv/api/apiutil" "github.com/mediocregopher/blog.mediocregopher.com/srv/cfg" "github.com/mediocregopher/blog.mediocregopher.com/srv/chat" "github.com/mediocregopher/blog.mediocregopher.com/srv/mailinglist" @@ -158,9 +159,9 @@ func (a *api) handler() http.Handler { return a.requirePowMiddleware(h) } - postFormMiddleware := func(h http.Handler) http.Handler { + formMiddleware := func(h http.Handler) http.Handler { h = checkCSRFMiddleware(h) - h = postOnlyMiddleware(h) + h = disallowGetMiddleware(h) h = logReqMiddleware(h) h = addResponseHeaders(map[string]string{ "Cache-Control": "no-store, max-age=0", @@ -193,14 +194,17 @@ func (a *api) handler() http.Handler { a.requirePowMiddleware, ))) - mux.Handle("/api/", http.StripPrefix("/api", postFormMiddleware(apiMux))) + mux.Handle("/api/", http.StripPrefix("/api", formMiddleware(apiMux))) } { v2Mux := http.NewServeMux() v2Mux.Handle("/follow.html", a.renderDumbHandler("follow.html")) v2Mux.Handle("/posts/", a.renderPostHandler()) - v2Mux.Handle("/assets", a.renderPostAssetsIndexHandler()) + v2Mux.Handle("/assets", apiutil.MethodMux(map[string]http.Handler{ + "GET": a.renderPostAssetsIndexHandler(), + "POST": formMiddleware(a.uploadPostAssetHandler()), + })) v2Mux.Handle("/assets/", a.servePostAssetHandler()) v2Mux.Handle("/", a.renderIndexHandler()) diff --git a/srv/src/api/apiutil/apiutil.go b/srv/src/api/apiutil/apiutil.go index c9f8795..f7830ae 100644 --- a/srv/src/api/apiutil/apiutil.go +++ b/srv/src/api/apiutil/apiutil.go @@ -11,6 +11,7 @@ import ( "fmt" "net/http" "strconv" + "strings" "github.com/mediocregopher/mediocre-go-lib/v2/mlog" ) @@ -110,3 +111,23 @@ func RandStr(numBytes int) string { } return hex.EncodeToString(b) } + +// MethodMux will take the request method (GET, POST, etc...) and handle the +// request using the corresponding Handler in the given map. +// +// If no Handler is defined for a method then a 405 Method Not Allowed error is +// returned. +func MethodMux(handlers map[string]http.Handler) http.Handler { + + return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + + handler, ok := handlers[strings.ToUpper(r.Method)] + + if !ok { + http.Error(rw, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + handler.ServeHTTP(rw, r) + }) +} diff --git a/srv/src/api/assets.go b/srv/src/api/assets.go index e94d324..c0a6fd9 100644 --- a/srv/src/api/assets.go +++ b/srv/src/api/assets.go @@ -111,3 +111,31 @@ func (a *api) servePostAssetHandler() http.Handler { }) } + +func (a *api) uploadPostAssetHandler() http.Handler { + + renderIndex := a.renderPostAssetsIndexHandler() + + return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + + id := r.PostFormValue("id") + if id == "" { + apiutil.BadRequest(rw, r, errors.New("id is required")) + return + } + + file, _, err := r.FormFile("file") + if err != nil { + apiutil.BadRequest(rw, r, fmt.Errorf("reading multipart file: %w", err)) + return + } + defer file.Close() + + if err := a.params.PostAssetStore.Set(id, file); err != nil { + apiutil.InternalServerError(rw, r, fmt.Errorf("storing file: %w", err)) + return + } + + renderIndex.ServeHTTP(rw, r) + }) +} diff --git a/srv/src/api/csrf.go b/srv/src/api/csrf.go index 9717030..2a93ed7 100644 --- a/srv/src/api/csrf.go +++ b/srv/src/api/csrf.go @@ -10,6 +10,7 @@ import ( const ( csrfTokenCookieName = "csrf_token" csrfTokenHeaderName = "X-CSRF-Token" + csrfTokenFormName = "csrfToken" ) func setCSRFMiddleware(h http.Handler) http.Handler { @@ -45,7 +46,7 @@ func checkCSRFMiddleware(h http.Handler) http.Handler { givenCSRFTok := r.Header.Get(csrfTokenHeaderName) if givenCSRFTok == "" { - givenCSRFTok = r.FormValue("csrfToken") + givenCSRFTok = r.FormValue(csrfTokenFormName) } if csrfTok == "" || givenCSRFTok != csrfTok { diff --git a/srv/src/api/middleware.go b/srv/src/api/middleware.go index fcd29b3..974889b 100644 --- a/srv/src/api/middleware.go +++ b/srv/src/api/middleware.go @@ -80,11 +80,11 @@ func logReqMiddleware(h http.Handler) http.Handler { }) } -func postOnlyMiddleware(h http.Handler) http.Handler { +func disallowGetMiddleware(h http.Handler) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { - // we allow websockets to not be POSTs because, well, they can't be - if r.Method == "POST" || r.Header.Get("Upgrade") == "websocket" { + // we allow websockets to be GETs because, well, they must be + if r.Method != "GET" || r.Header.Get("Upgrade") == "websocket" { h.ServeHTTP(rw, r) return } diff --git a/srv/src/api/render.go b/srv/src/api/render.go index dfa665f..c0d0777 100644 --- a/srv/src/api/render.go +++ b/srv/src/api/render.go @@ -51,6 +51,39 @@ func (a *api) mustParseTpl(name string) *template.Template { return tpl } +type tplData struct { + Payload interface{} + CSRFToken string +} + +func (t tplData) CSRFFormInput() template.HTML { + return template.HTML(fmt.Sprintf( + ``, + csrfTokenFormName, t.CSRFToken, + )) +} + +// executeTemplate expects to be the final action in an http.Handler +func executeTemplate( + rw http.ResponseWriter, r *http.Request, + tpl *template.Template, payload interface{}, +) { + + csrfToken, _ := apiutil.GetCookie(r, csrfTokenCookieName, "") + + tplData := tplData{ + Payload: payload, + CSRFToken: csrfToken, + } + + if err := tpl.Execute(rw, tplData); err != nil { + apiutil.InternalServerError( + rw, r, fmt.Errorf("rendering template: %w", err), + ) + return + } +} + func (a *api) renderIndexHandler() http.Handler { tpl := a.mustParseTpl("index.html") @@ -79,7 +112,7 @@ func (a *api) renderIndexHandler() http.Handler { return } - tplData := struct { + tplPayload := struct { Posts []post.StoredPost PrevPage, NextPage int }{ @@ -89,19 +122,14 @@ func (a *api) renderIndexHandler() http.Handler { } if page > 0 { - tplData.PrevPage = page - 1 + tplPayload.PrevPage = page - 1 } if hasMore { - tplData.NextPage = page + 1 + tplPayload.NextPage = page + 1 } - if err := tpl.Execute(rw, tplData); err != nil { - apiutil.InternalServerError( - rw, r, fmt.Errorf("rendering index: %w", err), - ) - return - } + executeTemplate(rw, r, tpl, tplPayload) }) } @@ -133,7 +161,7 @@ func (a *api) renderPostHandler() http.Handler { renderedBody := markdown.ToHTML([]byte(storedPost.Body), parser, htmlRenderer) - tplData := struct { + tplPayload := struct { post.StoredPost SeriesPrevious, SeriesNext *post.StoredPost Body template.HTML @@ -165,21 +193,16 @@ func (a *api) renderPostHandler() http.Handler { } if !foundThis { - tplData.SeriesPrevious = &seriesPost + tplPayload.SeriesPrevious = &seriesPost continue } - tplData.SeriesNext = &seriesPost + tplPayload.SeriesNext = &seriesPost break } } - if err := tpl.Execute(rw, tplData); err != nil { - apiutil.InternalServerError( - rw, r, fmt.Errorf("rendering post with id %q: %w", id, err), - ) - return - } + executeTemplate(rw, r, tpl, tplPayload) }) } @@ -212,17 +235,12 @@ func (a *api) renderPostAssetsIndexHandler() http.Handler { return } - tplData := struct { + tplPayload := struct { IDs []string }{ IDs: ids, } - if err := tpl.Execute(rw, tplData); err != nil { - apiutil.InternalServerError( - rw, r, fmt.Errorf("rendering: %w", err), - ) - return - } + executeTemplate(rw, r, tpl, tplPayload) }) } diff --git a/srv/src/api/tpl/admin-assets.html b/srv/src/api/tpl/admin-assets.html index d871a3e..036002e 100644 --- a/srv/src/api/tpl/admin-assets.html +++ b/srv/src/api/tpl/admin-assets.html @@ -1,8 +1,32 @@ {{ define "body" }} +

Upload Asset

+ +

+ If the given ID is the same as an existing asset's ID, then that asset will be + overwritten. +

+ +
+ {{ .CSRFFormInput }} +
+
+ +
+
+
+
+
+ +
+
+
+ +

Existing Assets

+ - {{ range .IDs }} + {{ range .Payload.IDs }}
{{ . }} diff --git a/srv/src/api/tpl/index.html b/srv/src/api/tpl/index.html index 1858ea8..b634169 100644 --- a/srv/src/api/tpl/index.html +++ b/srv/src/api/tpl/index.html @@ -2,7 +2,7 @@
    - {{ range .Posts }} + {{ range .Payload.Posts }}

  • {{ .Title }} @@ -17,15 +17,15 @@

- {{ if or (ge .PrevPage 0) (ge .NextPage 0) }} + {{ if or (ge .Payload.PrevPage 0) (ge .Payload.NextPage 0) }}
- {{ if ge .PrevPage 0 }} - Newer + {{ if ge .Payload.PrevPage 0 }} + Newer {{ end }} - {{ if ge .NextPage 0 }} - Older + {{ if ge .Payload.NextPage 0 }} + Older {{ end }}
diff --git a/srv/src/api/tpl/post.html b/srv/src/api/tpl/post.html index 22a5b97..c5c3c96 100644 --- a/srv/src/api/tpl/post.html +++ b/srv/src/api/tpl/post.html @@ -2,43 +2,43 @@

- {{ .Title }} + {{ .Payload.Title }}

- {{ .PublishedAt.Format "2006-01-02" }} + {{ .Payload.PublishedAt.Format "2006-01-02" }}  •  - {{ if not .LastUpdatedAt.IsZero }} - (Updated {{ .LastUpdatedAt.Format "2006-01-02" }}) + {{ if not .Payload.LastUpdatedAt.IsZero }} + (Updated {{ .Payload.LastUpdatedAt.Format "2006-01-02" }})  •  {{ end }} - {{ .Description }} + {{ .Payload.Description }}
-{{ if (or .SeriesPrevious .SeriesNext) }} +{{ if (or .Payload.SeriesPrevious .Payload.SeriesNext) }}

This post is part of a series:
- {{ if .SeriesPrevious }} - Previously: {{ .SeriesPrevious.Title }}
+ {{ if .Payload.SeriesPrevious }} + Previously: {{ .Payload.SeriesPrevious.Title }}
{{ end }} - {{ if .SeriesNext }} - Next: {{ .SeriesNext.Title }}
+ {{ if .Payload.SeriesNext }} + Next: {{ .Payload.SeriesNext.Title }}
{{ end }}

{{ end }}
- {{ .Body }} + {{ .Payload.Body }}
-{{ if (or .SeriesPrevious .SeriesNext) }} +{{ if (or .Payload.SeriesPrevious .Payload.SeriesNext) }}

If you liked this post, consider checking out other posts in the series:
- {{ if .SeriesPrevious }} - Previously: {{ .SeriesPrevious.Title }}
+ {{ if .Payload.SeriesPrevious }} + Previously: {{ .Payload.SeriesPrevious.Title }}
{{ end }} - {{ if .SeriesNext }} - Next: {{ .SeriesNext.Title }}
+ {{ if .Payload.SeriesNext }} + Next: {{ .Payload.SeriesNext.Title }}
{{ end }}

{{ end }}