steve
9968c06243
Build image / build-and-push (push) Successful in 8s
Per-garden public read-only link: unauthenticated GET /api/v1/public/gardens/:token (no requireAuth, no OIDC), owner-only enable/rotate/disable, and a /g/$token page rendering GardenCanvas read-only. Review fixes: redact plant owner ids, Cache-Control: no-store, 400 on malformed body, shared resetTransient store action. Closes #41. Co-authored-by: Steve Dudenhoeffer <[email protected]>
98 lines
3.2 KiB
Go
98 lines
3.2 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
|
|
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
|
|
)
|
|
|
|
// PublicShareLink is the owner-visible state of a garden's public read-only link.
|
|
// Token is omitted (and empty) when the link is disabled.
|
|
type PublicShareLink struct {
|
|
Enabled bool `json:"enabled"`
|
|
Token string `json:"token,omitempty"`
|
|
}
|
|
|
|
func linkState(token *string) *PublicShareLink {
|
|
if token == nil {
|
|
return &PublicShareLink{Enabled: false}
|
|
}
|
|
return &PublicShareLink{Enabled: true, Token: *token}
|
|
}
|
|
|
|
// PublicGarden returns the read-only /full payload for the garden addressed by a
|
|
// public share token. The token is the capability — anyone holding a valid one
|
|
// may read — so there is no actor or ACL check. An unknown, empty, or disabled
|
|
// token yields domain.ErrNotFound (existence is masked, same as a private row).
|
|
func (s *Service) PublicGarden(ctx context.Context, token string) (*FullGarden, error) {
|
|
token = strings.TrimSpace(token)
|
|
if token == "" {
|
|
return nil, domain.ErrNotFound
|
|
}
|
|
g, err := s.store.GetGardenByPublicToken(ctx, token)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
full, err := s.assembleFull(ctx, g)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
// Minimize what an anonymous viewer learns: no role, and no owner user id —
|
|
// neither the garden's owner nor the owner of any referenced custom plant
|
|
// (built-ins already have a nil OwnerID). The page renders fine without them.
|
|
full.Garden.MyRole = ""
|
|
full.Garden.OwnerID = 0
|
|
for i := range full.Plants {
|
|
full.Plants[i].OwnerID = nil
|
|
}
|
|
return full, nil
|
|
}
|
|
|
|
// GetPublicShareLink reports whether the garden's public link is on, and (to the
|
|
// owner) the current token. Owner only.
|
|
func (s *Service) GetPublicShareLink(ctx context.Context, actorID, gardenID int64) (*PublicShareLink, error) {
|
|
if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
|
|
return nil, err
|
|
}
|
|
token, err := s.store.GetGardenPublicToken(ctx, gardenID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return linkState(token), nil
|
|
}
|
|
|
|
// EnablePublicShareLink turns the public link on and returns the token. It is
|
|
// idempotent when rotate is false (an existing link keeps its token); when rotate
|
|
// is true it always issues a fresh token, invalidating the previous URL. Owner
|
|
// only.
|
|
func (s *Service) EnablePublicShareLink(ctx context.Context, actorID, gardenID int64, rotate bool) (*PublicShareLink, error) {
|
|
if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
|
|
return nil, err
|
|
}
|
|
token, err := s.store.GetGardenPublicToken(ctx, gardenID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if token == nil || rotate {
|
|
fresh, err := newPublicToken()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := s.store.SetGardenPublicToken(ctx, gardenID, &fresh); err != nil {
|
|
return nil, err
|
|
}
|
|
token = &fresh
|
|
}
|
|
return linkState(token), nil
|
|
}
|
|
|
|
// DisablePublicShareLink turns the public link off (clears the token). Owner
|
|
// only; idempotent (disabling an already-disabled link is a no-op success).
|
|
func (s *Service) DisablePublicShareLink(ctx context.Context, actorID, gardenID int64) error {
|
|
if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
|
|
return err
|
|
}
|
|
return s.store.SetGardenPublicToken(ctx, gardenID, nil)
|
|
}
|