first working version

pkg/server/handler.go

@@ -5,7 +5,8 @@ package server
 import (
 	"git.giftfish.de/ston1th/gowiki/pkg/core"
 	"git.giftfish.de/ston1th/gowiki/pkg/log"
-	"html/template"
+	"git.giftfish.de/ston1th/gowiki/pkg/util"
+	"git.giftfish.de/ston1th/jwt"
 	"net/http"
 	"time"
 )
@@ -20,7 +21,7 @@ func (nf *notFoundHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 func adminAuthHandler(h ctxHandler) ctxHandler {
 	return func(ctx *Context) {
-		if ctx.GetAdmin() {
+		if ctx.Admin() {
 			h(ctx)
 			return
 		}
@@ -30,11 +31,11 @@ func adminAuthHandler(h ctxHandler) ctxHandler {
 
 func userAuthHandler(h ctxHandler) ctxHandler {
 	return func(ctx *Context) {
-		if ctx.GetAdmin() {
+		if ctx.Admin() {
 			h(ctx)
 			return
 		}
-		if ctx.GetUser() == ctx.Var("user") {
+		if ctx.User() == ctx.Var("user") {
 			h(ctx)
 			return
 		}
@@ -68,12 +69,12 @@ func staticHandler(ctx *Context) {
 }
 
 func indexHandler(ctx *Context) {
-	ctx.Redirect("/wiki/Index", 302)
+	ctx.Redirect(core.IndexURI, 302)
 }
 
 func loginHandler(ctx *Context) {
 	if ctx.LoggedOn() {
-		ctx.Redirect("/wiki/Index", 302)
+		ctx.Redirect(core.IndexURI, 302)
 		return
 	}
 	ctx.Template("loginHandler")
@@ -87,11 +88,10 @@ func loginHandler(ctx *Context) {
 	case "POST":
 		user := ctx.Form("user")
 		password := ctx.Form("password")
-		submit := ctx.Form("submit")
 		if !ctx.CheckXsrf(nil) {
 			return
 		}
-		if user == "" || password == "" || submit != "Login" {
+		if user == "" || password == "" {
 			ctx.Data.Msg = "wrong inputs"
 			ctx.Exec()
 			return
@@ -102,8 +102,8 @@ func loginHandler(ctx *Context) {
 			ctx.Exec()
 			return
 		}
-		ctx.SetCookie(map[string]interface{}{"username": u.Username, "admin": u.Admin})
-		ctx.Redirect("/wiki/Index", 302)
+		ctx.SetCookie(map[string]interface{}{userClaim: u.Username, adminClaim: u.Admin})
+		ctx.Redirect(core.IndexURI, 302)
 	}
 }
 
@@ -118,15 +118,9 @@ func searchHandler(ctx *Context) {
 		ctx.Exec()
 	case "POST":
 		search := ctx.Form("search")
-		submit := ctx.Form("submit")
 		if !ctx.CheckXsrf(nil) {
 			return
 		}
-		if submit != "Search" {
-			ctx.Data.Msg = "wrong inputs"
-			ctx.Exec()
-			return
-		}
 
 		res, err := ctx.Srv.DB.Index.Search(search)
 		if err != nil {
@@ -135,7 +129,7 @@ func searchHandler(ctx *Context) {
 			return
 		}
 		ctx.Data.Search = search
-		ctx.Data.Data = template.HTML(res)
+		ctx.Data.Data = res
 		ctx.Exec()
 	}
 }
@@ -143,167 +137,213 @@ func searchHandler(ctx *Context) {
 func allHandler(ctx *Context) {
 	ctx.Template("allHandler")
 	ctx.Data = webData{
-		Title:     "All Articles",
-		BodyTitle: "All Articles",
-		Admin:     ctx.GetAdmin(),
+		Title:     "All Pages",
+		BodyTitle: "All Pages",
+		Admin:     ctx.Admin(),
 	}
-	all, err := ctx.Srv.DB.Index.GetAll(!ctx.LoggedOn())
-	if err != nil {
-		ctx.Data.Msg = err.Error()
-	}
-	ctx.Data.Data = all
+	ctx.Data.Data = ctx.Srv.DB.GetAllPages(ctx.User())
 	ctx.Exec()
 }
 
-func wikiNewHandler(ctx *Context) {
-	ctx.Template("wikiNewHandler")
-	ctx.Data = webData{Title: "New Article"}
+func pageNewHandler(ctx *Context) {
+	ctx.Template("pageNewHandler")
+	ctx.Data = webData{Title: "New Page"}
 	switch ctx.Method() {
 	case "GET":
 		ctx.Exec()
 	case "POST":
+		section := ctx.Form("section")
 		title := ctx.Form("title")
-		text := ctx.Form("text")
-		public := ctx.Form("public")
-		pub := false
-		if public == "0" {
-			pub = true
-		}
-		submit := ctx.Form("submit")
+		markdown := ctx.Form("markdown")
+		perm := ctx.Form("perm")
 		p := core.Page{
-			Title: title,
-			MD:    text,
+			Title:    title,
+			Markdown: markdown,
 		}
 		ctx.Data.Data = p
 		if !ctx.CheckXsrf(nil) {
 			return
 		}
-		if submit != "Submit" {
-			ctx.Data.Msg = "wrong inputs"
-			ctx.Exec()
-			return
+		if section != core.WikiSection {
+			section = ctx.User()
 		}
-		newTitle, err := ctx.Srv.DB.Index.Index(title, text, ctx.GetUser(), pub)
+		page, err := ctx.Srv.DB.CreatePage(title, section, markdown, ctx.User(), core.ParsePermString(perm))
 		if err != nil {
 			ctx.Data.Msg = err.Error()
 			ctx.Exec()
 			return
 		}
-		ctx.Redirect("/wiki/"+newTitle, 302)
+		ctx.Redirect(page.StoreTitle, 302)
 	}
 }
 
-func wikiHandler(ctx *Context) {
-	if ctx.T == nil {
-		ctx.Template("wikiHandler")
-	}
+func pageHandler(ctx *Context) {
 	ctx.Data = webData{
-		Admin: ctx.GetAdmin(),
+		Admin: ctx.Admin(),
 	}
+	section := ctx.Var("section")
 	title := ctx.Var("title")
-	art, err := ctx.Srv.DB.Index.Get(!ctx.LoggedOn(), title)
+	user := ctx.User()
+	if key := ctx.Var("key"); key != "" {
+		t, err := jwt.DecodeToken(key)
+		if err != nil {
+			log.Println("DecodeToken:", err)
+			ctx.NotFound()
+			return
+		}
+		if err = ctx.Srv.JWT.Verify(t); err != nil {
+			log.Println("VerifyToken:", err)
+			ctx.NotFound()
+			return
+		}
+		user = t.Claims.GetString(sharedClaim)
+		section = t.Claims.GetString(sectionClaim)
+		title = t.Claims.GetString(titleClaim)
+		ctx.Data.Key = key
+		if ctx.T == nil {
+			ctx.Template("pageViewHandler")
+		}
+	} else {
+		if ctx.T == nil {
+			ctx.Template("pageHandler")
+		}
+	}
+	page, err := ctx.Srv.DB.GetPage(util.StoreTitle(section, title), user)
 	if err != nil {
+		log.Println(err)
 		ctx.NotFound()
 		return
 	}
-	art.LinkTitle = title
-	ctx.Data.Data = art
-	ctx.Data.Title = art.Title
-	ctx.Data.BodyTitle = art.Title
+	ctx.Data.Data = page
+	ctx.Data.Title = page.Title
+	ctx.Data.BodyTitle = page.Title
 	ctx.Exec()
 }
 
-func wikiMDHandler(f ctxHandler) ctxHandler {
+func pageMDHandler(f ctxHandler) ctxHandler {
 	return func(ctx *Context) {
-		ctx.Template("wikiMDHandler")
+		ctx.Template("pageMDHandler")
 		f(ctx)
 	}
 }
 
-func wikiEditHandler(ctx *Context) {
-	ctx.Template("wikiEditHandler")
+// TODO add share token blacklisting
+func pageShareHandler(ctx *Context) {
+	ctx.Template("pageShareHandler")
 	ctx.Data = webData{}
+	section := ctx.Var("section")
 	title := ctx.Var("title")
+	user := ctx.User()
+	st := util.StoreTitle(section, title)
+	page, err := ctx.Srv.DB.GetPage(st, user)
+	if err != nil {
+		ctx.NotFound()
+		return
+	}
+	t := jwt.NewToken(map[string]interface{}{
+		sharedClaim:  user,
+		sectionClaim: section,
+		titleClaim:   title,
+		jwt.ExpClaim: jwt.NewExp(time.Hour * 24),
+	}, nil)
+
+	if err = ctx.Srv.JWT.Sign(t); err != nil {
+		log.Println("SignToken:", err)
+		ctx.NotFound()
+		return
+	}
+	/* TODO
+	host := ctx.Request.Header.Get("X-Forwarded-For")
+	if host == "" {
+		ctx.Request.Host
+	}
+	ctx.Data.Data = "https://" + host + "/view/" + t.String()
+	*/
+	ctx.Data.Key = t.String()
+	ctx.Data.Data = st
+	ctx.Data.Title = page.Title
+	ctx.Data.BodyTitle = page.Title
+	ctx.Exec()
+}
+
+func pageEditHandler(ctx *Context) {
+	ctx.Template("pageEditHandler")
+	ctx.Data = webData{}
+	section := ctx.Var("section")
+	title := ctx.Var("title")
+	page, err := ctx.Srv.DB.GetPage(util.StoreTitle(section, title), ctx.User())
+	if err != nil {
+		ctx.NotFound()
+		return
+	}
 	switch ctx.Method() {
 	case "GET":
-		art, err := ctx.Srv.DB.Index.Get(!ctx.LoggedOn(), title)
-		if err != nil {
-			ctx.NotFound()
-			return
-		}
-		art.LinkTitle = title
-		ctx.Data.Data = art
-		ctx.Data.Title = art.Title
-		ctx.Data.BodyTitle = art.Title
+		ctx.Data.Data = page
+		ctx.Data.Title = page.Title
+		ctx.Data.BodyTitle = page.Title
 		ctx.Exec()
 	case "POST":
-		ftitle := ctx.Form("title")
-		text := ctx.Form("text")
-		public := ctx.Form("public")
-		pub := false
-		if public == "0" {
-			pub = true
-		}
-		submit := ctx.Form("submit")
+		storeTitle := ctx.Form("store_title")
+		section, title = util.UnstoreTitle(storeTitle)
+		markdown := ctx.Form("markdown")
+		perm := core.ParsePermString(ctx.Form("perm"))
 		ctx.Data.Data = core.Page{
-			Title:     ftitle,
-			LinkTitle: title,
-			MD:        text,
-			Public:    pub,
+			Title:      page.Title,
+			StoreTitle: storeTitle,
+			Markdown:   markdown,
+			Perm:       perm,
 		}
-		ctx.Data.Title = ftitle
-		ctx.Data.BodyTitle = ftitle
+		ctx.Data.Title = page.Title
+		ctx.Data.BodyTitle = page.Title
 		if !ctx.CheckXsrf(nil) {
 			return
 		}
-		if submit != "Submit" {
-			ctx.Data.Msg = "wrong inputs"
-			ctx.Exec()
-			return
-		}
-		err := ctx.Srv.DB.Index.Update(title, text, ctx.GetUser(), pub)
+		err = ctx.Srv.DB.UpdatePage(title, section, markdown, ctx.User(), perm)
 		if err != nil {
 			ctx.Data.Msg = err.Error()
 			ctx.Exec()
 			return
 		}
-		ctx.Srv.Editors.Remove(title)
-		ctx.Redirect("/wiki/"+title, 302)
+		ctx.Redirect("/"+page.StoreTitle, 302)
 	}
 }
 
-func wikiDelHandler(ctx *Context) {
+func pageDelHandler(ctx *Context) {
+	section := ctx.Var("section")
 	title := ctx.Var("title")
-	submit := ctx.Form("submit")
-	f := func() {
-		ctx.Redirect("/wiki/"+title, 302)
+	st := util.StoreTitle(section, title)
+	ctx.Template("pageDelHandler")
+	ctx.Data.Data = st
+	ctx.Data.Title = title
+	ctx.Data.BodyTitle = title
+	switch ctx.Method() {
+	case "GET":
+		ctx.Exec()
+	case "POST":
+		if !ctx.CheckXsrf(nil) {
+			return
+		}
+		if err := ctx.Srv.DB.DeletePage(title, section, ctx.User()); err != nil {
+			ctx.Data.Msg = err.Error()
+			ctx.Exec()
+			return
+		}
+		ctx.Redirect(core.IndexURI, 302)
 	}
-	if !ctx.CheckXsrf(f) {
-		return
-	}
-	if submit != "Delete" {
-		f()
-		return
-	}
-	if err := ctx.Srv.Index.Delete(title); err != nil {
-		log.Println("delete:", err)
-		f()
-	}
-	ctx.Redirect("/wiki/Index", 302)
 }
 
-func usersHandler(ctx *Context) {
+func userHandler(ctx *Context) {
 	if !ctx.LoggedOn() {
 		ctx.NotFound()
 		return
 	}
-	ctx.Template("usersHandler")
+	ctx.Template("userHandler")
 	ctx.Data = webData{
 		Title:     "Users",
 		BodyTitle: "Users",
-		User:      ctx.GetUser(),
+		User:      ctx.User(),
 	}
-	us, err := ctx.Srv.BS.GetUsers()
+	us, err := ctx.Srv.DB.GetUsers()
 	if err != nil {
 		ctx.Data.Msg = err.Error()
 	}
@@ -329,21 +369,20 @@ func userNewHandler(ctx *Context) {
 		if admin == "0" {
 			adm = true
 		}
-		submit := ctx.Form("submit")
 		if !ctx.CheckXsrf(nil) {
 			return
 		}
-		if user == "" || password == "" || password != repeat || submit != "Submit" {
+		if user == "" || password == "" || password != repeat {
 			ctx.Data.Msg = "wrong inputs"
 			ctx.Exec()
 			return
 		}
-		if err := ctx.Srv.BS.CreateUser(user, password, adm); err != nil {
+		if err := ctx.Srv.DB.CreateUser(user, password, adm); err != nil {
 			ctx.Data.Msg = err.Error()
 			ctx.Exec()
 			return
 		}
-		ctx.Redirect("/users", 302)
+		ctx.Redirect("/user", 302)
 	}
 }
 
@@ -355,7 +394,7 @@ func userEditHandler(ctx *Context) {
 	}
 	switch ctx.Method() {
 	case "GET":
-		u, err := ctx.Srv.BS.GetUserWithoutPassword(ctx.Var("user"))
+		u, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user"))
 		if err != nil {
 			ctx.Data.Msg = err.Error()
 			ctx.Exec()
@@ -372,42 +411,41 @@ func userEditHandler(ctx *Context) {
 		if admin == "0" {
 			adm = true
 		}
-		submit := ctx.Form("submit")
 		if !ctx.CheckXsrf(nil) {
 			return
 		}
-		if user == "" || password != repeat || submit != "Submit" {
+		if user == "" || password != repeat {
 			ctx.Data.Msg = "wrong inputs"
 			ctx.Exec()
 			return
 		}
-		if ctx.GetAdmin() {
-			if err := ctx.Srv.BS.AdminUpdateUser(user, password, adm); err != nil {
+		if ctx.Admin() {
+			if err := ctx.Srv.DB.AdminUpdateUser(user, password, adm); err != nil {
 				ctx.Data.Msg = err.Error()
 				ctx.Exec()
 				return
 			}
 		} else {
-			if user == ctx.GetUser() {
-				if err := ctx.Srv.BS.UpdateUserPassword(user, password); err != nil {
+			if user == ctx.User() {
+				if err := ctx.Srv.DB.UpdateUserPassword(user, password); err != nil {
 					ctx.Data.Msg = err.Error()
 					ctx.Exec()
 					return
 				}
-				ctx.Redirect("/wiki/Index", 302)
+				ctx.Redirect(core.IndexURI, 302)
 				return
 			}
 		}
-		ctx.Redirect("/users", 302)
+		ctx.Redirect("/user", 302)
 	}
 }
 
 func userUnlockHandler(ctx *Context) {
 	user := ctx.Var("user")
-	if err := ctx.Srv.BS.UnlockUser(user); err != nil {
+	if err := ctx.Srv.DB.UnlockUser(user); err != nil {
 		log.Println("unlock:", err)
 	}
-	ctx.Redirect("/users", 302)
+	ctx.Redirect("/user", 302)
 }
 
 func userDelHandler(ctx *Context) {
@@ -418,7 +456,7 @@ func userDelHandler(ctx *Context) {
 	}
 	switch ctx.Method() {
 	case "GET":
-		user, err := ctx.Srv.BS.GetUserWithoutPassword(ctx.Var("user"))
+		user, err := ctx.Srv.DB.GetUserWithoutPassword(ctx.Var("user"))
 		if err != nil {
 			ctx.Data.Msg = err.Error()
 			ctx.Exec()
@@ -427,14 +465,14 @@ func userDelHandler(ctx *Context) {
 		ctx.Data.Data = user
 		ctx.Exec()
 	case "POST":
-		if err := ctx.Srv.BS.DeleteUser(ctx.Var("user")); err != nil {
+		if err := ctx.Srv.DB.DeleteUser(ctx.Var("user")); err != nil {
 			log.Println("delete:", err)
 		}
-		ctx.Redirect("/users", 302)
+		ctx.Redirect("/user", 302)
 	}
 }
 
 func logoutHandler(ctx *Context) {
 	ctx.SetCookie(nil)
-	ctx.Redirect("/wiki/Index", 302)
+	ctx.Redirect(core.IndexURI, 302)
 }