arnefandCopilot
ab3c7f44d5
New internal/web package mounted at /ui/, separate from DAV Basic Auth: - Cookie-based sessions (opaque random tokens in a new web_sessions SQLite table, internal/db/sessions.go), checked against the same cfg.Users/bcrypt credentials as DAV Basic Auth. - Dashboard listing the logged-in user's own calendars/address books, who they're shared with, and what's shared with them. - Share/unshare directly from the dashboard, updated in place via htmx partial swaps (POST to create/update, DELETE to revoke). Always verifies the resource actually belongs to the logged-in user before granting a share. - Templates written in templ (internal/web/templates/*.templ, generated *_templ.go committed), styled with Tailwind CSS v4 (web/input.css, compiled to web/static/app.css), with htmx vendored as a static file for the dynamic bits. Both are embedded into the binary at build time (web/staticassets.go) so the compiled server has no Node.js/web/ runtime dependency. - Wired into cmd/server/main.go at /ui/ alongside the existing /cal/, /card/, /files/ routes; welcome page links to it. - Tests: internal/web/server_test.go covers login success/failure, the login-required redirect, dashboard rendering, share/unshare including the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting shares of resources the user doesn't own. - Docs: README (new 'Web UI' section, updated sharing section, project layout, dependencies) and copilot-instructions updated accordingly. Makefile: new templ-generate/web-deps/web-css targets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
89 lines
2.6 KiB
Go
89 lines
2.6 KiB
Go
// Package db provides a lightweight SQLite-backed store for data that
|
|
// doesn't fit the plain-file model used by internal/store — currently
|
|
// calendar/address-book sharing grants. It's intentionally small: no ORM,
|
|
// just database/sql with hand-written queries, so it stays easy to
|
|
// extend when user management and the web UI are added later.
|
|
package db
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
_ "modernc.org/sqlite"
|
|
)
|
|
|
|
// DB wraps a SQLite connection and exposes typed helpers for the
|
|
// application's tables.
|
|
type DB struct {
|
|
conn *sql.DB
|
|
}
|
|
|
|
// Open opens (creating if necessary) the SQLite database at path and runs
|
|
// schema migrations. The parent directory of path is created if it
|
|
// doesn't already exist.
|
|
func Open(path string) (*DB, error) {
|
|
if dir := filepath.Dir(path); dir != "" && dir != "." {
|
|
if err := os.MkdirAll(dir, 0o755); err != nil {
|
|
return nil, fmt.Errorf("creating database directory %q: %w", dir, err)
|
|
}
|
|
}
|
|
|
|
conn, err := sql.Open("sqlite", path)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("opening database %q: %w", path, err)
|
|
}
|
|
// SQLite only supports one writer at a time; a single connection avoids
|
|
// "database is locked" errors under concurrent access.
|
|
conn.SetMaxOpenConns(1)
|
|
|
|
d := &DB{conn: conn}
|
|
if err := d.migrate(); err != nil {
|
|
conn.Close()
|
|
return nil, fmt.Errorf("migrating database: %w", err)
|
|
}
|
|
return d, nil
|
|
}
|
|
|
|
// Close closes the underlying connection.
|
|
func (d *DB) Close() error {
|
|
return d.conn.Close()
|
|
}
|
|
|
|
func (d *DB) migrate() error {
|
|
const schema = `
|
|
CREATE TABLE IF NOT EXISTS calendar_shares (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
owner TEXT NOT NULL,
|
|
calendar_name TEXT NOT NULL,
|
|
shared_with TEXT NOT NULL,
|
|
permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (owner, calendar_name, shared_with)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS addressbook_shares (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
owner TEXT NOT NULL,
|
|
addressbook_name TEXT NOT NULL,
|
|
shared_with TEXT NOT NULL,
|
|
permission TEXT NOT NULL CHECK (permission IN ('read', 'write')),
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
UNIQUE (owner, addressbook_name, shared_with)
|
|
);
|
|
|
|
-- Web UI login sessions. Sessions are opaque random tokens stored server
|
|
-- side (not JWTs) so they can be revoked instantly by deleting the row.
|
|
CREATE TABLE IF NOT EXISTS web_sessions (
|
|
token TEXT PRIMARY KEY,
|
|
username TEXT NOT NULL,
|
|
created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
expires_at DATETIME NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS idx_web_sessions_expires_at ON web_sessions (expires_at);
|
|
`
|
|
_, err := d.conn.Exec(schema)
|
|
return err
|
|
}
|