+100

menu/src/auth.rs

reviewed

··· 1 1 + // SPDX-FileCopyrightText: 2026 Freshly Baked Cake 2 2 + // 3 3 + // SPDX-License-Identifier: MIT 4 4 + 5 5 + use axum::{ 6 6 + http::{HeaderMap, StatusCode}, 7 7 + response::{ErrorResponse, IntoResponse}, 8 8 + }; 9 9 + #[cfg(debug_assertions)] 10 10 + use std::collections::HashMap; 11 11 + use tower_sessions::Session; 12 12 + use uuid::Uuid; 13 13 + 14 14 + const TOKEN_KEY: &str = "token"; 15 15 + 16 16 + struct NotAuthenticated; 17 17 + impl IntoResponse for NotAuthenticated { 18 18 + fn into_response(self) -> axum::response::Response { 19 19 + return (StatusCode::UNAUTHORIZED, "Access over Tailscale only").into_response(); 20 20 + } 21 21 + } 22 22 + 23 23 + struct MissingToken; 24 24 + impl IntoResponse for MissingToken { 25 25 + fn into_response(self) -> axum::response::Response { 26 26 + return ( 27 27 + StatusCode::FORBIDDEN, 28 28 + "There's no session here - try going back and trying again?", 29 29 + ) 30 30 + .into_response(); 31 31 + } 32 32 + } 33 33 + 34 34 + struct InvalidToken; 35 35 + impl IntoResponse for InvalidToken { 36 36 + fn into_response(self) -> axum::response::Response { 37 37 + return ( 38 38 + StatusCode::FORBIDDEN, 39 39 + "This session is invalid - possible CSRF?", 40 40 + ) 41 41 + .into_response(); 42 42 + } 43 43 + } 44 44 + 45 45 + pub(crate) fn ensure_authenticated<'a>( 46 46 + headers: &'a HeaderMap, 47 47 + #[cfg(debug_assertions)] params: &'a HashMap<String, String>, 48 48 + ) -> Result<&'a str, ErrorResponse> { 49 49 + if let Some(user) = headers 50 50 + .get("X-Webauth-Login") 51 51 + .and_then(|header| header.to_str().ok()) 52 52 + { 53 53 + return Ok(user); 54 54 + } 55 55 + 56 56 + #[cfg(debug_assertions)] 57 57 + { 58 58 + use crate::DEVELOPMENT; 59 59 + 60 60 + if *DEVELOPMENT.get().unwrap() { 61 61 + if let Some(user) = params.get("dev_auth_as") { 62 62 + return Ok(user); 63 63 + } 64 64 + } 65 65 + } 66 66 + 67 67 + Err(NotAuthenticated {}.into()) 68 68 + } 69 69 + 70 70 + pub(crate) async fn get_token(session: &Session) -> String { 71 71 + let maybe_token = session.get(TOKEN_KEY).await.unwrap(); 72 72 + if let Some(token) = maybe_token { 73 73 + token 74 74 + } else { 75 75 + let new_token = Uuid::new_v4().to_string(); 76 76 + session.insert(TOKEN_KEY, &new_token).await.unwrap(); 77 77 + new_token 78 78 + } 79 79 + } 80 80 + 81 81 + pub(crate) async fn ensure_token<'a>( 82 82 + session: &Session, 83 83 + params: &'a HashMap<String, String>, 84 84 + ) -> Result<(), ErrorResponse> { 85 85 + let maybe_token: Option<String> = session.get(TOKEN_KEY).await.unwrap(); 86 86 + 87 87 + let Some(token) = maybe_token else { 88 88 + return Err(MissingToken {}.into()); 89 89 + }; 90 90 + 91 91 + if token == "" { 92 92 + return Err(MissingToken {}.into()); 93 93 + } 94 94 + 95 95 + if params.get("token").is_some_and(|val| *val == token) { 96 96 + return Ok(()); 97 97 + } 98 98 + 99 99 + Err(InvalidToken {}.into()) 100 100 + }

+159

menu/src/direct.rs

reviewed

··· 1 1 + // SPDX-FileCopyrightText: 2026 Freshly Baked Cake 2 2 + // 3 3 + // SPDX-License-Identifier: MIT 4 4 + 5 5 + use axum::response::{Redirect, Result}; 6 6 + use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode}; 7 7 + use std::ops::DerefMut; 8 8 + 9 9 + use crate::{CreationResult, DeletionResult, STATE}; 10 10 + 11 11 + struct Link { 12 12 + from: String, 13 13 + to: String, 14 14 + owner: String, 15 15 + } 16 16 + 17 17 + pub(crate) async fn get_redirect(default_location: &str, go: &str) -> Redirect { 18 18 + let redirect = sqlx::query!( 19 19 + r#"SELECT ("to") FROM direct WHERE "from" = $1 LIMIT 1"#, 20 20 + go.to_lowercase() 21 21 + ) 22 22 + .fetch_one( 23 23 + STATE 24 24 + .get() 25 25 + .expect("Server must be initialized before processing connections") 26 26 + .sqlx_connection 27 27 + .lock() 28 28 + .await 29 29 + .deref_mut(), 30 30 + ) 31 31 + .await; 32 32 + 33 33 + if let Ok(record) = redirect { 34 34 + Redirect::temporary(&record.to) 35 35 + } else { 36 36 + Redirect::temporary(&("".to_string() + default_location + go)) 37 37 + } 38 38 + } 39 39 + 40 40 + pub(crate) async fn get_link_table(token: &str) -> Result<String> { 41 41 + let links_query = sqlx::query_as!( 42 42 + Link, 43 43 + r#"SELECT "from", "to", "owner" FROM direct ORDER BY direct."from" ASC"#, 44 44 + ) 45 45 + .fetch_all( 46 46 + STATE 47 47 + .get() 48 48 + .expect("Server must be initialized before processing connections") 49 49 + .sqlx_connection 50 50 + .lock() 51 51 + .await 52 52 + .deref_mut(), 53 53 + ) 54 54 + .await; 55 55 + 56 56 + let Ok(links) = links_query else { 57 57 + return Err("Failed to query database".into()); 58 58 + }; 59 59 + 60 60 + let mut rows = vec![]; 61 61 + 62 62 + for link in links { 63 63 + let from_attribute = html_escape::encode_quoted_attribute(&link.from); 64 64 + let from = html_escape::encode_text(&link.from); 65 65 + let from_url = utf8_percent_encode(&link.from, NON_ALPHANUMERIC); 66 66 + let to_attribute = html_escape::encode_quoted_attribute(&link.to); 67 67 + let to = html_escape::encode_text(&link.to); 68 68 + let to_url = utf8_percent_encode(&link.to, NON_ALPHANUMERIC); 69 69 + let owner = html_escape::encode_text(&link.owner); 70 70 + 71 71 + rows.push(format!( 72 72 + r#"<tr> 73 73 + <td><a href="{from_attribute}">{from}</a></td> 74 74 + <td><a href="{to_attribute}">{to}</a></td> 75 75 + <td>{owner}</td> 76 76 + <td>(<a href="/_/create?from={from_url}&to={to_url}&current={to_url}">edit</a>) (<a href="/_/delete/do?from={from_url}&current={to_url}&token={token}">delete</a>)</td> 77 77 + </tr>"#, 78 78 + )); 79 79 + } 80 80 + 81 81 + let link_table = rows.join("\n"); 82 82 + 83 83 + Ok(link_table) 84 84 + } 85 85 + 86 86 + pub(crate) async fn create( 87 87 + from: &str, 88 88 + to: &str, 89 89 + owner: &str, 90 90 + current: Option<&String>, 91 91 + ) -> CreationResult { 92 92 + println!("Attempting to make go/{} -> {}", from, to); 93 93 + 94 94 + let create_call = sqlx::query!( 95 95 + r#" 96 96 + WITH insertion AS ( 97 97 + INSERT INTO direct ("from", "to", "owner") 98 98 + VALUES ($1, $2, $3) 99 99 + ON CONFLICT ("from") 100 100 + DO UPDATE SET "to" = EXCLUDED.to, "owner" = EXCLUDED.owner WHERE direct.to = $4 101 101 + RETURNING direct.from 102 102 + ) 103 103 + SELECT direct.to FROM direct 104 104 + WHERE direct.from NOT IN (SELECT insertion.from FROM insertion) AND direct.from = $1 105 105 + "#, // Insert our URL, return a row with the same from that weren't updated (i.e. a conflict) 106 106 + from.to_lowercase(), 107 107 + to, 108 108 + owner, 109 109 + current, 110 110 + ) 111 111 + .fetch_optional( 112 112 + STATE 113 113 + .get() 114 114 + .expect("Server must be initialized before processing connections") 115 115 + .sqlx_connection 116 116 + .lock() 117 117 + .await 118 118 + .deref_mut(), 119 119 + ) 120 120 + .await; 121 121 + 122 122 + if let Ok(None) = &create_call { 123 123 + CreationResult::Success 124 124 + } else if let Ok(Some(conflict)) = create_call { 125 125 + CreationResult::Conflict(conflict.to) 126 126 + } else { 127 127 + CreationResult::Failure 128 128 + } 129 129 + } 130 130 + 131 131 + pub(crate) async fn delete(from: &str, current: &str) -> DeletionResult { 132 132 + println!("Attempting to delete go/{} -> {}", from, current); 133 133 + 134 134 + let delete_call = sqlx::query!( 135 135 + r#"DELETE FROM direct WHERE direct.from = $1 AND direct.to = $2"#, 136 136 + from.to_lowercase(), 137 137 + current, 138 138 + ) 139 139 + .execute( 140 140 + STATE 141 141 + .get() 142 142 + .expect("Server must be initialized before processing connections") 143 143 + .sqlx_connection 144 144 + .lock() 145 145 + .await 146 146 + .deref_mut(), 147 147 + ) 148 148 + .await; 149 149 + 150 150 + let Ok(delete_result) = &delete_call else { 151 151 + return DeletionResult::Failure; 152 152 + }; 153 153 + 154 154 + if delete_result.rows_affected() > 0 { 155 155 + DeletionResult::Success 156 156 + } else { 157 157 + DeletionResult::NotFound 158 158 + } 159 159 + }

+34 -382

menu/src/main.rs

reviewed

··· 1 1 // SPDX-FileCopyrightText: 2026 Freshly Baked Cake 2 2 // 3 3 // SPDX-License-Identifier: MIT 4 4 + mod auth; 5 5 + mod direct; 6 6 + mod static_html; 7 7 + 4 8 use axum::{ 5 9 Router, ServiceExt, 6 10 body::Body, 7 11 extract::{Path, Query, Request}, 8 12 http::{HeaderMap, Response, StatusCode}, 9 9 - response::{ErrorResponse, Html, IntoResponse, Redirect, Result}, 13 13 + response::{Html, IntoResponse, Redirect, Result}, 10 14 routing::get, 11 15 }; 12 16 use include_dir::{Dir, include_dir}; 13 17 use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode}; 14 14 - use regex::Captures; 15 18 use sqlx::{Connection, PgConnection}; 16 19 use tower_sessions::{MemoryStore, Session, SessionManagerLayer}; 17 17 - use uuid::Uuid; 18 20 19 19 - #[cfg(debug_assertions)] 20 20 - use std::fs; 21 21 - 22 22 - use std::{collections::HashMap, env, ops::DerefMut, sync::OnceLock}; 21 21 + use std::{collections::HashMap, env, sync::OnceLock}; 23 22 use tokio::{ 24 23 sync::Mutex, 25 24 time::{Duration, sleep}, ··· 28 27 use tower_layer::Layer; 29 28 use tower_serve_static; 30 29 30 30 + use crate::{ 31 31 + auth::{ensure_authenticated, ensure_token}, 32 32 + static_html::{StaticPageType, handle_static_page}, 33 33 + }; 34 34 + 31 35 static PUBLIC_DIR: Dir<'static> = include_dir!("src/html/public"); 32 36 33 37 #[cfg(debug_assertions)] 34 38 static DEVELOPMENT: OnceLock<bool> = OnceLock::new(); 35 39 36 36 - const TOKEN_KEY: &str = "token"; 37 37 - 38 38 - #[derive(Clone)] 39 39 - enum AnyString<'a> { 40 40 - Owned(String), 41 41 - Ref(&'a str), 42 42 - } 43 43 - 44 44 - fn template_html<'a>( 45 45 - html: String, 46 46 - replacements: HashMap<&str, Box<dyn 'a + Send + Fn() -> Option<AnyString<'a>>>>, 47 47 - ) -> String { 48 48 - let re = regex_static::static_regex!(r"\{([a-z_]+)(?::([a-z_]+))?\}"); 49 49 - re.replace_all(&html, |captures: &Captures| { 50 50 - let replacement_name = &captures[1]; 51 51 - let replacement = replacements 52 52 - .get(replacement_name) 53 53 - .and_then(|maybe_replacement| maybe_replacement()) 54 54 - .unwrap_or_else(|| AnyString::Ref("")) 55 55 - .clone(); 56 56 - let replacement_owned = match replacement { 57 57 - AnyString::Owned(owned) => owned, 58 58 - AnyString::Ref(str) => str.to_string(), 59 59 - }; 60 60 - 61 61 - match captures.get(2).and_then(|m| Some(m.as_str())) { 62 62 - Some("dangerous_raw") => replacement_owned, 63 63 - Some("attribute") => { 64 64 - html_escape::encode_quoted_attribute(&replacement_owned).to_string() 65 65 - } 66 66 - Some("url") => utf8_percent_encode(&replacement_owned, NON_ALPHANUMERIC).to_string(), 67 67 - None => html_escape::encode_text(&replacement_owned).to_string(), 68 68 - Some(_) => "UNKNOWN_MATCH_TYPE".to_string(), 69 69 - } 70 70 - }) 71 71 - .to_string() 72 72 - } 73 73 - 74 74 - /// include_str, but if DEVELOPMENT then the string is dynamically fetched for easy reloading 75 75 - /// to support this, the string is *always* owned. 76 76 - #[cfg(debug_assertions)] 77 77 - macro_rules! include_String_dynamic { 78 78 - ($file:expr $(,)?) => { 79 79 - if (*DEVELOPMENT.get().unwrap()) { 80 80 - fs::read_to_string("src/".to_string() + $file) 81 81 - .expect(format!("Unable to read file {}", $file).as_str()) 82 82 - } else { 83 83 - include_str!($file).to_owned() 84 84 - } 85 85 - }; 86 86 - } 87 87 - #[cfg(not(debug_assertions))] 88 88 - macro_rules! include_String_dynamic { 89 89 - ($file:expr $(,)?) => { 90 90 - include_str!($file).to_owned() 91 91 - }; 92 92 - } 93 93 - 94 40 #[derive(Debug)] 95 41 struct State { 96 42 sqlx_connection: Mutex<PgConnection>, ··· 112 58 return "go"; 113 59 } 114 60 115 115 - async fn get_redirect(default_location: &str, go: &str) -> Redirect { 116 116 - let redirect = sqlx::query!( 117 117 - r#"SELECT ("to") FROM direct WHERE "from" = $1 LIMIT 1"#, 118 118 - go.to_lowercase() 119 119 - ) 120 120 - .fetch_one( 121 121 - STATE 122 122 - .get() 123 123 - .expect("Server must be initialized before processing connections") 124 124 - .sqlx_connection 125 125 - .lock() 126 126 - .await 127 127 - .deref_mut(), 128 128 - ) 129 129 - .await; 130 130 - 131 131 - if let Ok(record) = redirect { 132 132 - Redirect::temporary(&record.to) 133 133 - } else { 134 134 - Redirect::temporary(&("".to_string() + default_location + go)) 135 135 - } 136 136 - } 137 137 - 138 61 async fn get_redirect_base(go: &str) -> Redirect { 139 139 - get_redirect( 62 62 + direct::get_redirect( 140 63 "/_/create?from=", 141 64 &utf8_percent_encode(go, NON_ALPHANUMERIC).to_string(), 142 65 ) ··· 144 67 } 145 68 146 69 async fn get_redirect_search(go: &str) -> Redirect { 147 147 - get_redirect( 70 70 + direct::get_redirect( 148 71 "https://kagi.com/search?q=", 149 72 &utf8_percent_encode(go, NON_ALPHANUMERIC).to_string(), 150 73 ) ··· 172 95 } 173 96 } 174 97 175 175 - struct Link { 176 176 - from: String, 177 177 - to: String, 178 178 - owner: String, 179 179 - } 180 180 - 181 181 - #[derive(Clone)] 182 182 - enum StaticPageType { 183 183 - Create, 184 184 - CreateConflict, 185 185 - CreateFailure, 186 186 - CreateSuccess, 187 187 - DeleteFailure, 188 188 - DeleteSuccess, 189 189 - Index, 98 98 + enum CreationResult { 99 99 + Success, 100 100 + Conflict(String), 101 101 + Failure, 190 102 } 191 103 192 192 - async fn handle_static_page<'a>( 193 193 - page_type: StaticPageType, 194 194 - session: Session, 195 195 - params: &'a HashMap<String, String>, 196 196 - headers: &'a HeaderMap, 197 197 - ) -> Result<Html<String>> { 198 198 - let auth_required = match page_type { 199 199 - _ => true, 200 200 - }; 201 201 - 202 202 - let html = match page_type { 203 203 - StaticPageType::Create => include_String_dynamic!("./html/create.html"), 204 204 - StaticPageType::CreateConflict => include_String_dynamic!("./html/create/conflict.html"), 205 205 - StaticPageType::CreateFailure => include_String_dynamic!("./html/create/failure.html"), 206 206 - StaticPageType::CreateSuccess => include_String_dynamic!("./html/create/success.html"), 207 207 - StaticPageType::DeleteFailure => include_String_dynamic!("./html/delete/failure.html"), 208 208 - StaticPageType::DeleteSuccess => include_String_dynamic!("./html/delete/success.html"), 209 209 - StaticPageType::Index => include_String_dynamic!("./html/index.html"), 210 210 - }; 211 211 - 212 212 - let username = if auth_required { 213 213 - Some(ensure_authenticated( 214 214 - headers, 215 215 - #[cfg(debug_assertions)] 216 216 - params, 217 217 - )?) 218 218 - } else { 219 219 - None 220 220 - }; 221 221 - 222 222 - let mut replacements: HashMap<&str, Box<dyn 'a + Send + Fn() -> Option<AnyString<'a>>>> = 223 223 - HashMap::new(); 224 224 - replacements.insert( 225 225 - "host", 226 226 - Box::new(|| { 227 227 - Some(AnyString::Ref(clean_host( 228 228 - headers 229 229 - .get("host") 230 230 - .and_then(|header| Some(header.to_str().unwrap_or_else(|_| "go"))) 231 231 - .unwrap_or_else(|| "go"), 232 232 - ))) 233 233 - }), 234 234 - ); 235 235 - replacements.insert( 236 236 - "from", 237 237 - Box::new(|| { 238 238 - params 239 239 - .get("from") 240 240 - .and_then(|from| Some(AnyString::Ref(from.as_str()))) 241 241 - }), 242 242 - ); 243 243 - replacements.insert( 244 244 - "to", 245 245 - Box::new(|| { 246 246 - params 247 247 - .get("to") 248 248 - .and_then(|to| Some(AnyString::Ref(to.as_str()))) 249 249 - }), 250 250 - ); 251 251 - replacements.insert( 252 252 - "current", 253 253 - Box::new(|| { 254 254 - params 255 255 - .get("current") 256 256 - .and_then(|current| Some(AnyString::Ref(current.as_str()))) 257 257 - }), 258 258 - ); 259 259 - replacements.insert( 260 260 - "username", 261 261 - Box::new(move || username.and_then(|name| Some(AnyString::Ref(name)))), 262 262 - ); 263 263 - 264 264 - let token: String = { 265 265 - let maybe_token = session.get(TOKEN_KEY).await.unwrap(); 266 266 - if let Some(token) = maybe_token { 267 267 - token 268 268 - } else { 269 269 - let new_token = Uuid::new_v4().to_string(); 270 270 - session.insert(TOKEN_KEY, &new_token).await.unwrap(); 271 271 - new_token 272 272 - } 273 273 - }; 274 274 - 275 275 - if matches!(page_type, StaticPageType::Index) { 276 276 - let links_query = sqlx::query_as!( 277 277 - Link, 278 278 - r#"SELECT "from", "to", "owner" FROM direct ORDER BY direct."from" ASC"#, 279 279 - ) 280 280 - .fetch_all( 281 281 - STATE 282 282 - .get() 283 283 - .expect("Server must be initialized before processing connections") 284 284 - .sqlx_connection 285 285 - .lock() 286 286 - .await 287 287 - .deref_mut(), 288 288 - ) 289 289 - .await; 290 290 - 291 291 - let Ok(links) = links_query else { 292 292 - return Err("Failed to query database".into()); 293 293 - }; 294 294 - 295 295 - let mut rows = vec![]; 296 296 - 297 297 - for link in links { 298 298 - let from_attribute = html_escape::encode_quoted_attribute(&link.from); 299 299 - let from = html_escape::encode_text(&link.from); 300 300 - let from_url = utf8_percent_encode(&link.from, NON_ALPHANUMERIC); 301 301 - let to_attribute = html_escape::encode_quoted_attribute(&link.to); 302 302 - let to = html_escape::encode_text(&link.to); 303 303 - let to_url = utf8_percent_encode(&link.to, NON_ALPHANUMERIC); 304 304 - let owner = html_escape::encode_text(&link.owner); 305 305 - 306 306 - rows.push(format!( 307 307 - r#"<tr> 308 308 - <td><a href="{from_attribute}">{from}</a></td> 309 309 - <td><a href="{to_attribute}">{to}</a></td> 310 310 - <td>{owner}</td> 311 311 - <td>(<a href="/_/create?from={from_url}&to={to_url}&current={to_url}">edit</a>) (<a href="/_/delete/do?from={from_url}&current={to_url}&token={token}">delete</a>)</td> 312 312 - </tr>"#, 313 313 - )); 314 314 - } 315 315 - 316 316 - let link_table = rows.join("\n"); 317 317 - replacements.insert( 318 318 - "links", 319 319 - Box::new(move || Some(AnyString::Owned(link_table.clone()))), 320 320 - ); 321 321 - } 322 322 - 323 323 - replacements.insert( 324 324 - "token", 325 325 - Box::new(move || Some(AnyString::Owned(token.clone()))), 326 326 - ); 327 327 - 328 328 - let result = template_html(html, replacements); 329 329 - Ok(Html(result)) 104 104 + enum DeletionResult { 105 105 + Success, 106 106 + NotFound, 107 107 + Failure, 330 108 } 331 109 332 110 async fn handle_create_page( ··· 374 152 handle_static_page(StaticPageType::DeleteFailure, session, &params, &headers).await 375 153 } 376 154 377 377 - struct NotAuthenticated; 378 378 - impl IntoResponse for NotAuthenticated { 379 379 - fn into_response(self) -> axum::response::Response { 380 380 - return (StatusCode::UNAUTHORIZED, "Access over Tailscale only").into_response(); 381 381 - } 382 382 - } 383 383 - 384 384 - struct MissingToken; 385 385 - impl IntoResponse for MissingToken { 386 386 - fn into_response(self) -> axum::response::Response { 387 387 - return ( 388 388 - StatusCode::FORBIDDEN, 389 389 - "There's no session here - try going back and trying again?", 390 390 - ) 391 391 - .into_response(); 392 392 - } 393 393 - } 394 394 - 395 395 - struct InvalidToken; 396 396 - impl IntoResponse for InvalidToken { 397 397 - fn into_response(self) -> axum::response::Response { 398 398 - return ( 399 399 - StatusCode::FORBIDDEN, 400 400 - "This session is invalid - possible CSRF?", 401 401 - ) 402 402 - .into_response(); 403 403 - } 404 404 - } 405 405 - 406 406 - fn ensure_authenticated<'a>( 407 407 - headers: &'a HeaderMap, 408 408 - #[cfg(debug_assertions)] params: &'a HashMap<String, String>, 409 409 - ) -> Result<&'a str, ErrorResponse> { 410 410 - if let Some(user) = headers 411 411 - .get("X-Webauth-Login") 412 412 - .and_then(|header| header.to_str().ok()) 413 413 - { 414 414 - return Ok(user); 415 415 - } 416 416 - 417 417 - #[cfg(debug_assertions)] 418 418 - { 419 419 - if *DEVELOPMENT.get().unwrap() { 420 420 - if let Some(user) = params.get("dev_auth_as") { 421 421 - return Ok(user); 422 422 - } 423 423 - } 424 424 - } 425 425 - 426 426 - Err(NotAuthenticated {}.into()) 427 427 - } 428 428 - 429 429 - async fn ensure_token<'a>( 430 430 - session: &Session, 431 431 - params: &'a HashMap<String, String>, 432 432 - ) -> Result<(), ErrorResponse> { 433 433 - let maybe_token: Option<String> = session.get(TOKEN_KEY).await.unwrap(); 434 434 - 435 435 - let Some(token) = maybe_token else { 436 436 - return Err(MissingToken {}.into()); 437 437 - }; 438 438 - 439 439 - if token == "" { 440 440 - return Err(MissingToken {}.into()); 441 441 - } 442 442 - 443 443 - if params.get("token").is_some_and(|val| *val == token) { 444 444 - return Ok(()); 445 445 - } 446 446 - 447 447 - Err(InvalidToken {}.into()) 448 448 - } 449 449 - 450 155 #[axum::debug_handler] 451 156 async fn handle_create_do( 452 157 session: Session, ··· 463 168 let from = params.get("from").ok_or("Missing from query")?; 464 169 let to = params.get("to").ok_or("Missing to query")?; 465 170 466 466 - println!("Attempting to make go/{} -> {}", from, to); 467 467 - 468 468 - let create_call = sqlx::query!( 469 469 - r#" 470 470 - WITH insertion AS ( 471 471 - INSERT INTO direct ("from", "to", "owner") 472 472 - VALUES ($1, $2, $3) 473 473 - ON CONFLICT ("from") 474 474 - DO UPDATE SET "to" = EXCLUDED.to, "owner" = EXCLUDED.owner WHERE direct.to = $4 475 475 - RETURNING direct.from 476 476 - ) 477 477 - SELECT direct.to FROM direct 478 478 - WHERE direct.from NOT IN (SELECT insertion.from FROM insertion) AND direct.from = $1 479 479 - "#, // Insert our URL, return a row with the same from that weren't updated (i.e. a conflict) 480 480 - from.to_lowercase(), 481 481 - to, 482 482 - owner, 483 483 - params.get("current"), 484 484 - ) 485 485 - .fetch_optional( 486 486 - STATE 487 487 - .get() 488 488 - .expect("Server must be initialized before processing connections") 489 489 - .sqlx_connection 490 490 - .lock() 491 491 - .await 492 492 - .deref_mut(), 493 493 - ) 494 494 - .await; 495 495 - 496 496 - if let Ok(None) = &create_call { 497 497 - Ok(Redirect::to(&format!( 171 171 + match direct::create(from, to, owner, params.get("current")).await { 172 172 + CreationResult::Success => Ok(Redirect::to(&format!( 498 173 "/_/create/success?from={}&to={}", 499 174 utf8_percent_encode(&from, NON_ALPHANUMERIC).to_string(), 500 175 utf8_percent_encode(&to, NON_ALPHANUMERIC).to_string(), 501 176 )) 502 502 - .into_response()) 503 503 - } else if let Ok(Some(conflict)) = create_call { 504 504 - Ok(Redirect::to(&format!( 177 177 + .into_response()), 178 178 + CreationResult::Conflict(conflict) => Ok(Redirect::to(&format!( 505 179 "/_/create/conflict?from={}&to={}&current={}", 506 180 utf8_percent_encode(&from, NON_ALPHANUMERIC).to_string(), 507 181 utf8_percent_encode(&to, NON_ALPHANUMERIC).to_string(), 508 508 - utf8_percent_encode(&conflict.to, NON_ALPHANUMERIC).to_string(), 182 182 + utf8_percent_encode(&conflict, NON_ALPHANUMERIC).to_string(), 509 183 )) 510 510 - .into_response()) 511 511 - } else { 512 512 - Ok(Redirect::to(&format!( 184 184 + .into_response()), 185 185 + CreationResult::Failure => Ok(Redirect::to(&format!( 513 186 "/_/create/failure?from={}&to={}", 514 187 utf8_percent_encode(&from, NON_ALPHANUMERIC).to_string(), 515 188 utf8_percent_encode(&to, NON_ALPHANUMERIC).to_string(), 516 189 )) 517 517 - .into_response()) 190 190 + .into_response()), 518 191 } 519 192 } 520 193 ··· 534 207 let from = params.get("from").ok_or("Missing from query")?; 535 208 let current = params.get("current").ok_or("Missing current query")?; 536 209 537 537 - println!("Attempting to delete go/{} -> {}", from, current); 538 538 - 539 539 - let delete_call = sqlx::query!( 540 540 - r#"DELETE FROM direct WHERE direct.from = $1 AND direct.to = $2"#, 541 541 - from.to_lowercase(), 542 542 - current, 543 543 - ) 544 544 - .execute( 545 545 - STATE 546 546 - .get() 547 547 - .expect("Server must be initialized before processing connections") 548 548 - .sqlx_connection 549 549 - .lock() 550 550 - .await 551 551 - .deref_mut(), 552 552 - ) 553 553 - .await; 554 554 - 555 555 - if let Ok(delete_result) = &delete_call 556 556 - && delete_result.rows_affected() > 0 557 557 - { 558 558 - Ok(Redirect::to(&format!( 210 210 + match direct::delete(from, current).await { 211 211 + DeletionResult::Success => Ok(Redirect::to(&format!( 559 212 "/_/delete/success?from={}&current={}", 560 213 utf8_percent_encode(&from, NON_ALPHANUMERIC).to_string(), 561 214 utf8_percent_encode(&current, NON_ALPHANUMERIC).to_string(), 562 215 )) 563 563 - .into_response()) 564 564 - } else { 565 565 - Ok(Redirect::to(&format!( 216 216 + .into_response()), 217 217 + _ => Ok(Redirect::to(&format!( 566 218 "/_/delete/failure?from={}&to={}", 567 219 utf8_percent_encode(&from, NON_ALPHANUMERIC).to_string(), 568 220 utf8_percent_encode(&current, NON_ALPHANUMERIC).to_string(), 569 221 )) 570 570 - .into_response()) 222 222 + .into_response()), 571 223 } 572 224 } 573 225

+170

menu/src/static_html.rs

reviewed

··· 1 1 + // SPDX-FileCopyrightText: 2026 Freshly Baked Cake 2 2 + // 3 3 + // SPDX-License-Identifier: MIT 4 4 + use axum::{http::HeaderMap, response::Html, response::Result}; 5 5 + use percent_encoding::{NON_ALPHANUMERIC, utf8_percent_encode}; 6 6 + use regex::Captures; 7 7 + use std::collections::HashMap; 8 8 + #[cfg(debug_assertions)] 9 9 + use std::fs; 10 10 + use tower_sessions::Session; 11 11 + 12 12 + use crate::{auth::get_token, clean_host, direct, ensure_authenticated}; 13 13 + 14 14 + /// include_str, but if DEVELOPMENT then the string is dynamically fetched for easy reloading 15 15 + /// to support this, the string is *always* owned. 16 16 + #[cfg(debug_assertions)] 17 17 + macro_rules! include_String_dynamic { 18 18 + ($file:expr $(,)?) => { 19 19 + if (*crate::DEVELOPMENT.get().unwrap()) { 20 20 + fs::read_to_string("src/".to_string() + $file) 21 21 + .expect(format!("Unable to read file {}", $file).as_str()) 22 22 + } else { 23 23 + include_str!($file).to_owned() 24 24 + } 25 25 + }; 26 26 + } 27 27 + #[cfg(not(debug_assertions))] 28 28 + macro_rules! include_String_dynamic { 29 29 + ($file:expr $(,)?) => { 30 30 + include_str!($file).to_owned() 31 31 + }; 32 32 + } 33 33 + 34 34 + #[derive(Clone)] 35 35 + enum AnyString<'a> { 36 36 + Owned(String), 37 37 + Ref(&'a str), 38 38 + } 39 39 + 40 40 + #[derive(Clone)] 41 41 + pub(crate) enum StaticPageType { 42 42 + Create, 43 43 + CreateConflict, 44 44 + CreateFailure, 45 45 + CreateSuccess, 46 46 + DeleteFailure, 47 47 + DeleteSuccess, 48 48 + Index, 49 49 + } 50 50 + 51 51 + pub(crate) async fn handle_static_page<'a>( 52 52 + page_type: StaticPageType, 53 53 + session: Session, 54 54 + params: &'a HashMap<String, String>, 55 55 + headers: &'a HeaderMap, 56 56 + ) -> Result<Html<String>> { 57 57 + let auth_required = match page_type { 58 58 + _ => true, 59 59 + }; 60 60 + 61 61 + let html = match page_type { 62 62 + StaticPageType::Create => include_String_dynamic!("./html/create.html"), 63 63 + StaticPageType::CreateConflict => include_String_dynamic!("./html/create/conflict.html"), 64 64 + StaticPageType::CreateFailure => include_String_dynamic!("./html/create/failure.html"), 65 65 + StaticPageType::CreateSuccess => include_String_dynamic!("./html/create/success.html"), 66 66 + StaticPageType::DeleteFailure => include_String_dynamic!("./html/delete/failure.html"), 67 67 + StaticPageType::DeleteSuccess => include_String_dynamic!("./html/delete/success.html"), 68 68 + StaticPageType::Index => include_String_dynamic!("./html/index.html"), 69 69 + }; 70 70 + 71 71 + let username = if auth_required { 72 72 + Some(ensure_authenticated( 73 73 + headers, 74 74 + #[cfg(debug_assertions)] 75 75 + params, 76 76 + )?) 77 77 + } else { 78 78 + None 79 79 + }; 80 80 + 81 81 + let mut replacements: HashMap<&str, Box<dyn 'a + Send + Fn() -> Option<AnyString<'a>>>> = 82 82 + HashMap::new(); 83 83 + replacements.insert( 84 84 + "host", 85 85 + Box::new(|| { 86 86 + Some(AnyString::Ref(clean_host( 87 87 + headers 88 88 + .get("host") 89 89 + .and_then(|header| Some(header.to_str().unwrap_or_else(|_| "go"))) 90 90 + .unwrap_or_else(|| "go"), 91 91 + ))) 92 92 + }), 93 93 + ); 94 94 + replacements.insert( 95 95 + "from", 96 96 + Box::new(|| { 97 97 + params 98 98 + .get("from") 99 99 + .and_then(|from| Some(AnyString::Ref(from.as_str()))) 100 100 + }), 101 101 + ); 102 102 + replacements.insert( 103 103 + "to", 104 104 + Box::new(|| { 105 105 + params 106 106 + .get("to") 107 107 + .and_then(|to| Some(AnyString::Ref(to.as_str()))) 108 108 + }), 109 109 + ); 110 110 + replacements.insert( 111 111 + "current", 112 112 + Box::new(|| { 113 113 + params 114 114 + .get("current") 115 115 + .and_then(|current| Some(AnyString::Ref(current.as_str()))) 116 116 + }), 117 117 + ); 118 118 + replacements.insert( 119 119 + "username", 120 120 + Box::new(move || username.and_then(|name| Some(AnyString::Ref(name)))), 121 121 + ); 122 122 + 123 123 + let token = get_token(&session).await; 124 124 + if matches!(page_type, StaticPageType::Index) { 125 125 + let link_table = direct::get_link_table(&token).await?; 126 126 + 127 127 + replacements.insert( 128 128 + "links", 129 129 + Box::new(move || Some(AnyString::Owned(link_table.clone()))), 130 130 + ); 131 131 + } 132 132 + 133 133 + replacements.insert( 134 134 + "token", 135 135 + Box::new(move || Some(AnyString::Owned(token.clone()))), 136 136 + ); 137 137 + 138 138 + let result = template_html(html, replacements); 139 139 + Ok(Html(result)) 140 140 + } 141 141 + 142 142 + fn template_html<'a>( 143 143 + html: String, 144 144 + replacements: HashMap<&str, Box<dyn 'a + Send + Fn() -> Option<AnyString<'a>>>>, 145 145 + ) -> String { 146 146 + let re = regex_static::static_regex!(r"\{([a-z_]+)(?::([a-z_]+))?\}"); 147 147 + re.replace_all(&html, |captures: &Captures| { 148 148 + let replacement_name = &captures[1]; 149 149 + let replacement = replacements 150 150 + .get(replacement_name) 151 151 + .and_then(|maybe_replacement| maybe_replacement()) 152 152 + .unwrap_or_else(|| AnyString::Ref("")) 153 153 + .clone(); 154 154 + let replacement_owned = match replacement { 155 155 + AnyString::Owned(owned) => owned, 156 156 + AnyString::Ref(str) => str.to_string(), 157 157 + }; 158 158 + 159 159 + match captures.get(2).and_then(|m| Some(m.as_str())) { 160 160 + Some("dangerous_raw") => replacement_owned, 161 161 + Some("attribute") => { 162 162 + html_escape::encode_quoted_attribute(&replacement_owned).to_string() 163 163 + } 164 164 + Some("url") => utf8_percent_encode(&replacement_owned, NON_ALPHANUMERIC).to_string(), 165 165 + None => html_escape::encode_text(&replacement_owned).to_string(), 166 166 + Some(_) => "UNKNOWN_MATCH_TYPE".to_string(), 167 167 + } 168 168 + }) 169 169 + .to_string() 170 170 + }