Jan Dittberner
335ce16547
- drop migration 2022052601_drop_unused_decisions_colums because it was implicitly part of an earlier migration - add /health endpoint for database health check - add tests for the health check endpoint - add tests for middleware secureHeaders, logRequest and tryAuthenticate - add models.UserModel.CreateUser method
421 lines
9.9 KiB
Go
421 lines
9.9 KiB
Go
/*
|
|
Copyright 2017-2022 CAcert Inc.
|
|
SPDX-License-Identifier: Apache-2.0
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package main
|
|
|
|
import (
|
|
"database/sql"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/julienschmidt/httprouter"
|
|
|
|
"git.cacert.org/cacert-boardvoting/internal/models"
|
|
"git.cacert.org/cacert-boardvoting/internal/validator"
|
|
)
|
|
|
|
func checkRole(v *models.User, roles []string) (bool, error) {
|
|
hasRole, err := v.HasRole(roles)
|
|
if err != nil {
|
|
return false, fmt.Errorf("could not determine user roles: %w", err)
|
|
}
|
|
|
|
return hasRole, nil
|
|
}
|
|
|
|
type topLevelNavItem string
|
|
type subLevelNavItem string
|
|
|
|
const (
|
|
topLevelNavMotions topLevelNavItem = "motions"
|
|
topLevelNavUsers topLevelNavItem = "users"
|
|
|
|
subLevelNavMotionsAll subLevelNavItem = "all-motions"
|
|
subLevelNavMotionsUnvoted subLevelNavItem = "unvoted-motions"
|
|
subLevelNavUsers subLevelNavItem = "users"
|
|
)
|
|
|
|
func (m *templateData) motionPaginationOptions(limit int, first, last *time.Time) error {
|
|
motions := m.Motions
|
|
|
|
if len(motions) == limit && first.Before(motions[len(motions)-1].Proposed) {
|
|
marshalled, err := motions[len(motions)-1].Proposed.MarshalText()
|
|
if err != nil {
|
|
return fmt.Errorf("could not serialize timestamp: %w", err)
|
|
}
|
|
|
|
m.NextPage = string(marshalled)
|
|
}
|
|
|
|
if len(motions) > 0 && last.After(motions[0].Proposed) {
|
|
marshalled, err := motions[0].Proposed.MarshalText()
|
|
if err != nil {
|
|
return fmt.Errorf("could not serialize timestamp: %w", err)
|
|
}
|
|
|
|
m.PrevPage = string(marshalled)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (app *application) motionList(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != "/motions/" {
|
|
app.notFound(w)
|
|
|
|
return
|
|
}
|
|
|
|
var (
|
|
listOptions *models.MotionListOptions
|
|
err error
|
|
)
|
|
|
|
listOptions, err = app.calculateMotionListOptions(r)
|
|
if err != nil {
|
|
app.clientError(w, http.StatusBadRequest)
|
|
|
|
return
|
|
}
|
|
|
|
ctx := r.Context()
|
|
|
|
motions, err := app.motions.GetMotions(ctx, listOptions)
|
|
if err != nil {
|
|
app.serverError(w, err)
|
|
|
|
return
|
|
}
|
|
|
|
first, last, err := app.motions.TimestampRange(ctx, listOptions)
|
|
if err != nil {
|
|
app.serverError(w, err)
|
|
|
|
return
|
|
}
|
|
|
|
templateData := app.newTemplateData(r, "motions", "all-motions")
|
|
|
|
if listOptions.UnvotedOnly {
|
|
templateData.ActiveSubNav = subLevelNavMotionsUnvoted
|
|
}
|
|
|
|
templateData.Motions = motions
|
|
|
|
err = templateData.motionPaginationOptions(listOptions.Limit, first, last)
|
|
if err != nil {
|
|
app.serverError(w, err)
|
|
|
|
return
|
|
}
|
|
|
|
app.render(w, http.StatusOK, "motions.html", templateData)
|
|
}
|
|
|
|
func (app *application) calculateMotionListOptions(r *http.Request) (*models.MotionListOptions, error) {
|
|
const (
|
|
queryParamBefore = "before"
|
|
queryParamAfter = "after"
|
|
queryParamUnvoted = "unvoted"
|
|
motionsPerPage = 10
|
|
)
|
|
|
|
listOptions := &models.MotionListOptions{Limit: motionsPerPage}
|
|
|
|
if r.URL.Query().Has(queryParamAfter) {
|
|
var after time.Time
|
|
|
|
err := after.UnmarshalText([]byte(r.URL.Query().Get(queryParamAfter)))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not unmarshal timestamp: %w", err)
|
|
}
|
|
|
|
listOptions.After = &after
|
|
} else if r.URL.Query().Has(queryParamBefore) {
|
|
var before time.Time
|
|
|
|
err := before.UnmarshalText([]byte(r.URL.Query().Get(queryParamBefore)))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not unmarshal timestamp: %w", err)
|
|
}
|
|
|
|
listOptions.Before = &before
|
|
}
|
|
|
|
if r.URL.Query().Has(queryParamUnvoted) {
|
|
listOptions.UnvotedOnly = true
|
|
|
|
voter, err := app.GetUser(r)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not get voter: %w", err)
|
|
}
|
|
|
|
if voter != nil {
|
|
listOptions.VoterID = voter.ID
|
|
}
|
|
}
|
|
|
|
return listOptions, nil
|
|
}
|
|
|
|
func (app *application) motionDetails(w http.ResponseWriter, r *http.Request) {
|
|
params := httprouter.ParamsFromContext(r.Context())
|
|
|
|
tag := params.ByName("tag")
|
|
|
|
showVotes := r.URL.Query().Has("showvotes")
|
|
|
|
motion, err := app.motions.GetMotionByTag(r.Context(), tag, showVotes)
|
|
if err != nil && !errors.Is(err, sql.ErrNoRows) {
|
|
app.serverError(w, err)
|
|
|
|
return
|
|
}
|
|
|
|
if motion == nil {
|
|
app.notFound(w)
|
|
|
|
return
|
|
}
|
|
|
|
data := app.newTemplateData(r, topLevelNavMotions, subLevelNavMotionsAll)
|
|
|
|
data.Motion = motion
|
|
|
|
app.render(w, http.StatusOK, "motion.html", data)
|
|
}
|
|
|
|
type NewMotionForm struct {
|
|
Title string `form:"title"`
|
|
Content string `form:"content"`
|
|
Type *models.VoteType `form:"type"`
|
|
Due int `form:"due"`
|
|
User *models.User `form:"-"`
|
|
validator.Validator `form:"-"`
|
|
}
|
|
|
|
func (app *application) newMotionForm(w http.ResponseWriter, r *http.Request) {
|
|
data := app.newTemplateData(r, "motions", "all-motions")
|
|
data.Form = &NewMotionForm{
|
|
User: data.User,
|
|
Type: models.VoteTypeMotion,
|
|
}
|
|
|
|
app.render(w, http.StatusOK, "create_motion.html", data)
|
|
}
|
|
|
|
func (form *NewMotionForm) Validate() {
|
|
const (
|
|
minimumTitleLength = 3
|
|
maximumTitleLength = 200
|
|
minimumContentLength = 3
|
|
maximumContentLength = 8000
|
|
|
|
threeDays = 3
|
|
oneWeek = 7
|
|
twoWeeks = 14
|
|
threeWeeks = 28
|
|
)
|
|
|
|
form.CheckField(
|
|
validator.NotBlank(form.Title),
|
|
"title",
|
|
"This field cannot be blank",
|
|
)
|
|
form.CheckField(
|
|
validator.MinChars(form.Title, minimumTitleLength),
|
|
"title",
|
|
fmt.Sprintf("This field must be at least %d characters long", minimumTitleLength),
|
|
)
|
|
form.CheckField(
|
|
validator.MaxChars(form.Title, maximumTitleLength),
|
|
"title",
|
|
fmt.Sprintf("This field must be at most %d characters long", maximumTitleLength),
|
|
)
|
|
form.CheckField(
|
|
validator.NotBlank(form.Content),
|
|
"content",
|
|
"This field cannot be blank",
|
|
)
|
|
form.CheckField(
|
|
validator.MinChars(form.Content, minimumContentLength),
|
|
"content",
|
|
fmt.Sprintf("This field must be at least %d characters long", minimumContentLength),
|
|
)
|
|
form.CheckField(
|
|
validator.MaxChars(form.Content, maximumContentLength),
|
|
"content",
|
|
fmt.Sprintf("This field must be at most %d characters long", maximumContentLength),
|
|
)
|
|
|
|
form.CheckField(validator.PermittedInt(
|
|
form.Due, threeDays, oneWeek, twoWeeks, threeWeeks), "due", "invalid duration choice",
|
|
)
|
|
}
|
|
|
|
func (app *application) newMotionSubmit(w http.ResponseWriter, r *http.Request) {
|
|
const hoursInDay = 24
|
|
|
|
var form NewMotionForm
|
|
|
|
err := app.decodePostForm(r, &form)
|
|
if err != nil {
|
|
app.clientError(w, http.StatusBadRequest)
|
|
|
|
return
|
|
}
|
|
|
|
form.Validate()
|
|
|
|
if !form.Valid() {
|
|
form.User = &models.User{}
|
|
|
|
data := app.newTemplateData(r, topLevelNavMotions, subLevelNavMotionsAll)
|
|
data.Form = form
|
|
|
|
app.render(w, http.StatusUnprocessableEntity, "create_motion.html", data)
|
|
|
|
return
|
|
}
|
|
|
|
user, err := app.GetUser(r)
|
|
if err != nil {
|
|
app.clientError(w, http.StatusUnauthorized)
|
|
|
|
return
|
|
}
|
|
|
|
now := time.Now().UTC()
|
|
dueDuration := time.Duration(form.Due) * hoursInDay * time.Hour
|
|
|
|
decisionID, err := app.motions.Create(
|
|
r.Context(),
|
|
user,
|
|
form.Type,
|
|
form.Title,
|
|
form.Content,
|
|
now,
|
|
now.Add(dueDuration),
|
|
)
|
|
if err != nil {
|
|
app.serverError(w, err)
|
|
|
|
return
|
|
}
|
|
|
|
decision, err := app.motions.GetByID(r.Context(), decisionID)
|
|
if err != nil {
|
|
app.serverError(w, err)
|
|
|
|
return
|
|
}
|
|
|
|
app.mailNotifier.notifyChannel <- &NewDecisionNotification{
|
|
decision: &models.NewMotion{Decision: decision, Proposer: user},
|
|
}
|
|
|
|
app.sessionManager.Put(r.Context(), "flash", fmt.Sprintf("Started new motion %s: %s", decision.Tag, decision.Title))
|
|
|
|
http.Redirect(w, r, fmt.Sprintf("/motions/%s", decision.Tag), http.StatusSeeOther)
|
|
}
|
|
|
|
func (app *application) editMotionForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) editMotionSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) withdrawMotionForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) withdrawMotionSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) voteForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) voteSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) proxyVoteForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) proxyVoteSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) userList(w http.ResponseWriter, r *http.Request) {
|
|
data := app.newTemplateData(r, topLevelNavUsers, subLevelNavUsers)
|
|
|
|
app.render(w, http.StatusOK, "users.html", data)
|
|
}
|
|
|
|
func (app *application) submitUserRoles(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) editUserForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
func (app *application) editUserSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) userAddEmailForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) userAddEmailSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) deleteUserForm(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) deleteUserSubmit(_ http.ResponseWriter, _ *http.Request) {
|
|
panic("not implemented")
|
|
}
|
|
|
|
func (app *application) healthCheck(w http.ResponseWriter, _ *http.Request) {
|
|
response := struct {
|
|
DB string `json:"database"`
|
|
}{DB: "ok"}
|
|
|
|
enc := json.NewEncoder(w)
|
|
|
|
w.Header().Set("Content-Type", "application/json")
|
|
|
|
err := app.motions.DB.Ping()
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
|
|
response.DB = "FAILED"
|
|
}
|
|
|
|
_ = enc.Encode(response)
|
|
}
|