first working version

pkg/server/context.go

@@ -12,6 +12,14 @@ import (
 	"time"
 )
 
+const (
+	userClaim    = "user"
+	adminClaim   = "admin"
+	sharedClaim  = "shared"
+	sectionClaim = "section"
+	titleClaim   = "title"
+)
+
 func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Context) {
 	h := w.Header()
 	h.Set("X-Frame-Options", "DENY")
@@ -65,6 +73,8 @@ type webData struct {
 	Admin bool
 	Login bool
 
+	Key string
+
 	User   string
 	Token  string
 	Msg    string
@@ -86,10 +96,11 @@ func (c *Context) Exec() {
 	if c.Data.BodyTitle == "" {
 		c.Data.BodyTitle = c.Data.Title
 	}
-	c.Data.Admin = c.GetAdmin()
-	c.Data.User = c.GetUser()
+	c.Data.Admin = c.Admin()
+	c.Data.User = c.User()
 	c.Data.Login = c.LoggedOn()
 	c.Data.Time = time.Since(c.Time).Nanoseconds() / 1e6
+
 	c.Err = c.T.Execute(c.Response, c.Data)
 	if c.Err != nil {
 		c.Status = http.StatusInternalServerError
@@ -114,6 +125,7 @@ func (c *Context) NotFound() {
 	c.Response.WriteHeader(http.StatusNotFound)
 	c.Exec()
 }
+
 func (c *Context) Template(name string) {
 	c.T = c.Srv.templ[name]
 }
@@ -128,6 +140,9 @@ func (c *Context) SetHeader(name, value string) {
 }
 
 func (c *Context) Redirect(uri string, code int) {
+	if len(uri) > 0 && uri[0] != '/' {
+		uri = "/" + uri
+	}
 	log.Printf("%s %s %s %d %s\n", c.Request.RemoteAddr, c.Request.Method, c.Request.URL, code, uri)
 	http.Redirect(c.Response, c.Request, uri, code)
 }
@@ -146,9 +161,8 @@ func (c *Context) FormSlice(name string) []string {
 	return c.Request.PostForm[name]
 }
 
-func (c *Context) Form(name string) (ret string) {
-	ret = c.Request.PostFormValue(name)
-	return
+func (c *Context) Form(name string) string {
+	return c.Request.PostFormValue(name)
 }
 
 func (c *Context) Var(name string) (ret string) {
@@ -156,6 +170,7 @@ func (c *Context) Var(name string) (ret string) {
 	return
 }
 
+// TODO remove f
 // CheckToken validates the xsrf token
 func (c *Context) CheckXsrf(f func()) (ok bool) {
 	ok = checkXsrf(c.Form("token"), c.Token.RawSig()[:keySize])
@@ -171,7 +186,27 @@ func (c *Context) CheckXsrf(f func()) (ok bool) {
 }
 
 func (c *Context) LoggedOn() (ok bool) {
-	_, ok = c.Token.Claims["user"]
+	_, ok = c.Token.Claims.Get(userClaim)
+	return
+}
+
+func newCookie(value string, maxAge int) (cookie *http.Cookie) {
+	cookie = &http.Cookie{
+		Name:   cookieName,
+		Value:  value,
+		Path:   "/",
+		MaxAge: maxAge,
+		//TODO make secure configurable
+		Secure:   false,
+		HttpOnly: true,
+		SameSite: http.SameSiteStrictMode,
+	}
+	if maxAge > 0 {
+		d := time.Duration(maxAge) * time.Second
+		cookie.Expires = time.Now().Add(d)
+	} else if maxAge < 0 {
+		cookie.Expires = time.Unix(1, 0)
+	}
 	return
 }
 
@@ -182,28 +217,15 @@ func (c *Context) SetCookie(claims map[string]interface{}) {
 		return
 	}
 	c.Token = *t
-	http.SetCookie(c.Response, &http.Cookie{
-		Name:     cookieName,
-		Value:    t.Sig(),
-		MaxAge:   3600 * 12,
-		Secure:   true,
-		HttpOnly: true,
-		SameSite: http.SameSiteStrictMode,
-	})
+	http.SetCookie(c.Response, newCookie(c.Token.String(), int(jwt.DefaultExpiry.Seconds())))
 }
 
-func (c *Context) GetUser() string {
-	if ret, ok := c.Token.Claims["user"].(string); ok {
-		return ret
-	}
-	return ""
+func (c *Context) User() string {
+	return c.Token.Claims.GetString(userClaim)
 }
 
-func (c *Context) GetAdmin() bool {
-	if ret, ok := c.Token.Claims["admin"].(bool); ok {
-		return ret
-	}
-	return false
+func (c *Context) Admin() bool {
+	return c.Token.Claims.GetBool(adminClaim)
 }
 
 type ctxHandler func(*Context)