arnefandCopilot
ab3c7f44d5
New internal/web package mounted at /ui/, separate from DAV Basic Auth: - Cookie-based sessions (opaque random tokens in a new web_sessions SQLite table, internal/db/sessions.go), checked against the same cfg.Users/bcrypt credentials as DAV Basic Auth. - Dashboard listing the logged-in user's own calendars/address books, who they're shared with, and what's shared with them. - Share/unshare directly from the dashboard, updated in place via htmx partial swaps (POST to create/update, DELETE to revoke). Always verifies the resource actually belongs to the logged-in user before granting a share. - Templates written in templ (internal/web/templates/*.templ, generated *_templ.go committed), styled with Tailwind CSS v4 (web/input.css, compiled to web/static/app.css), with htmx vendored as a static file for the dynamic bits. Both are embedded into the binary at build time (web/staticassets.go) so the compiled server has no Node.js/web/ runtime dependency. - Wired into cmd/server/main.go at /ui/ alongside the existing /cal/, /card/, /files/ routes; welcome page links to it. - Tests: internal/web/server_test.go covers login success/failure, the login-required redirect, dashboard rendering, share/unshare including the htmx-v2-sends-DELETE-params-as-query-string quirk, and rejecting shares of resources the user doesn't own. - Docs: README (new 'Web UI' section, updated sharing section, project layout, dependencies) and copilot-instructions updated accordingly. Makefile: new templ-generate/web-deps/web-css targets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
81 lines
2.2 KiB
Go
81 lines
2.2 KiB
Go
package db
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"database/sql"
|
|
"encoding/hex"
|
|
"errors"
|
|
"time"
|
|
)
|
|
|
|
// ErrSessionNotFound is returned when a session token doesn't exist or has
|
|
// expired.
|
|
var ErrSessionNotFound = errors.New("session not found")
|
|
|
|
// SessionTTL is how long a web UI login session stays valid after creation.
|
|
const SessionTTL = 7 * 24 * time.Hour
|
|
|
|
// CreateSession generates a new random session token for username and
|
|
// stores it with an expiry SessionTTL from now. Returns the token to be
|
|
// set as a cookie value.
|
|
func (d *DB) CreateSession(username string) (string, error) {
|
|
token, err := randomToken()
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
expires := time.Now().Add(SessionTTL)
|
|
_, err = d.conn.Exec(
|
|
`INSERT INTO web_sessions (token, username, expires_at) VALUES (?, ?, ?)`,
|
|
token, username, expires,
|
|
)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return token, nil
|
|
}
|
|
|
|
// SessionUser returns the username associated with token, provided it
|
|
// exists and hasn't expired. Returns ErrSessionNotFound otherwise.
|
|
func (d *DB) SessionUser(token string) (string, error) {
|
|
var username string
|
|
var expiresAt time.Time
|
|
err := d.conn.QueryRow(
|
|
`SELECT username, expires_at FROM web_sessions WHERE token = ?`,
|
|
token,
|
|
).Scan(&username, &expiresAt)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return "", ErrSessionNotFound
|
|
}
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if time.Now().After(expiresAt) {
|
|
_ = d.DeleteSession(token)
|
|
return "", ErrSessionNotFound
|
|
}
|
|
return username, nil
|
|
}
|
|
|
|
// DeleteSession removes a session (used on logout). It's not an error if
|
|
// the token doesn't exist.
|
|
func (d *DB) DeleteSession(token string) error {
|
|
_, err := d.conn.Exec(`DELETE FROM web_sessions WHERE token = ?`, token)
|
|
return err
|
|
}
|
|
|
|
// PruneExpiredSessions deletes all sessions past their expiry. Intended to
|
|
// be called periodically (e.g. on server startup and via a background
|
|
// ticker) to keep the table small.
|
|
func (d *DB) PruneExpiredSessions() error {
|
|
_, err := d.conn.Exec(`DELETE FROM web_sessions WHERE expires_at < ?`, time.Now())
|
|
return err
|
|
}
|
|
|
|
func randomToken() (string, error) {
|
|
buf := make([]byte, 32)
|
|
if _, err := rand.Read(buf); err != nil {
|
|
return "", err
|
|
}
|
|
return hex.EncodeToString(buf), nil
|
|
}
|