nidus/internal/web/shares.go

package web

import (
	"context"
	"net/http"
	"strings"

	"github.com/yourusername/caldav-server/internal/web/templates"
)

// handleCalendarShare handles POST (create/update share) and DELETE
// (revoke share) for the current user's calendars, mounted at
// /shares/calendar. htmx sends the resource + shared_with (+ permission
// for POST) as form values and expects the updated resource card HTML
// back for an out-of-band swap.
func (s *Server) handleCalendarShare(w http.ResponseWriter, r *http.Request) {
	s.handleShare(w, r, "calendar")
}

func (s *Server) handleAddressBookShare(w http.ResponseWriter, r *http.Request) {
	s.handleShare(w, r, "addressbook")
}

func (s *Server) handleShare(w http.ResponseWriter, r *http.Request, kind string) {
	username := userFromContext(r.Context())

	// htmx v2 sends DELETE request parameters (including hx-vals) as URL
	// query parameters, not a request body — unlike POST/PUT/PATCH.
	if r.Method == http.MethodDelete {
		r.PostForm = r.URL.Query()
	} else if err := r.ParseForm(); err != nil {
		http.Error(w, "invalid form", http.StatusBadRequest)
		return
	}
	resource := strings.TrimSpace(r.PostForm.Get("resource"))
	sharedWith := strings.TrimSpace(r.PostForm.Get("shared_with"))
	if resource == "" || sharedWith == "" {
		http.Error(w, "resource and shared_with are required", http.StatusBadRequest)
		return
	}
	if sharedWith == username {
		http.Error(w, "cannot share a resource with yourself", http.StatusBadRequest)
		return
	}
	if !s.ownsResource(username, kind, resource) {
		http.Error(w, "not found", http.StatusNotFound)
		return
	}

	switch r.Method {
	case http.MethodPost:
		perm, ok := isValidPermission(r.PostForm.Get("permission"))
		if !ok {
			http.Error(w, "permission must be 'read' or 'write'", http.StatusBadRequest)
			return
		}
		var err error
		if kind == "calendar" {
			err = s.dbase.ShareCalendar(username, resource, sharedWith, perm)
		} else {
			err = s.dbase.ShareAddressBook(username, resource, sharedWith, perm)
		}
		if err != nil {
			s.logger.Error("sharing resource", "kind", kind, "error", err)
			http.Error(w, "internal error", http.StatusInternalServerError)
			return
		}
	case http.MethodDelete:
		var err error
		if kind == "calendar" {
			err = s.dbase.UnshareCalendar(username, resource, sharedWith)
		} else {
			err = s.dbase.UnshareAddressBook(username, resource, sharedWith)
		}
		if err != nil {
			s.logger.Warn("unsharing resource", "kind", kind, "error", err)
		}
	default:
		w.Header().Set("Allow", "POST, DELETE")
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
		return
	}

	card, err := s.resourceCardFor(username, kind, resource)
	if err != nil {
		s.logger.Error("rendering resource card", "error", err)
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	_ = templates.ResourceCardView(card).Render(context.Background(), w)
}

// ownsResource checks that resource (a calendar or address book name) is
// actually configured for username, to prevent sharing arbitrary/other
// users' resources via a forged form post.
func (s *Server) ownsResource(username, kind, resource string) bool {
	if kind == "calendar" {
		cals, err := s.dbase.ListCalendars(username)
		if err != nil {
			s.logger.Warn("checking resource ownership", "kind", kind, "error", err)
			return false
		}
		for _, c := range cals {
			if c.Name == resource {
				return true
			}
		}
		return false
	}
	list, err := s.dbase.ListAddressBooks(username)
	if err != nil {
		s.logger.Warn("checking resource ownership", "kind", kind, "error", err)
		return false
	}
	for _, n := range list {
		if n == resource {
			return true
		}
	}
	return false
}