5 Commits

Include renames

Author	SHA1	Message	Date
sneak	afe6e60b9e	Render admin page errors in the normal layout (closes #382) ... Every 400, 403, 404 and 500 on an admin page now answers with an error page in the normal layout: one fixed line for the status and a link back to the webhook list, or to sign-in when nobody is signed in. The router's handler for unknown paths, the CSRF middleware's refusal and a panic in an admin page route group use the same page; each such group has its own recoverer and error reporting for that. The page always sends Cache-Control: no-store. Status codes are unchanged. The receiver, the healthcheck and /metrics keep their plain answers. If the error page fails to render, the answer is the same status in plain text; if it panics, the answer is a 500. Model: opus-5-5	2026-10-02 05:27:22 +00:00
clawbot	7d360babed	Logging in returns to the page that was asked for (closes #384) ... A logged-out GET of an admin page now redirects to /pages/login with its path and query in a next parameter, when they fit in 2048 bytes. The login form carries next as a hidden field; a successful login redirects there, and a failed one shows the page again with the same next. A POST still redirects to plain /pages/login. The value is client-chosen, so every read of it goes through one check: after percent-decoding it must start with exactly one / and contain no backslash or control character; anything else becomes /. gosec's open-redirect rule is suppressed on the two redirects that follow it. The login page's navigation bar no longer links to itself. Model: opus-5-5	2026-10-02 06:57:51 +02:00
clawbot	a56f1fe0c8	Remove the fixed Account Type row from the profile page (closes #401) ... The profile page no longer shows the fixed "Account Type: Standard User" row. webhooker has one account, the administrator it creates, and no account types, so the row was untrue. The Account Information section now lists the username alone, and a test checks the row stays gone. Model: opus-5-5	2026-10-01 23:24:41 +02:00
clawbotandsneak	4f5ecb18e5	Add admin password change flow (closes #65) (#83) ... Adds an authenticated, CSRF-protected flow that lets a user change their own password from the profile page. ## Route - New `POST /password` under the `/user/{username}` group in `setupUserRoutes` (`internal/server/routes.go`). That group already applies `CSRF`, `NoCache`, and `RequireAuth`, so the new endpoint inherits all three. ## Handler (`internal/handlers/profile.go`) - `HandlePasswordChange` enforces own-user access: the `{username}` path parameter must equal the session username (same 403 rule `HandleProfile` uses). This check plus the session lookup is factored into a shared `profileOwnerOrDeny` helper now used by both handlers. - Parses `current_password`, `new_password`, and `confirm_password` (body size limited via `http.MaxBytesReader`). - Verifies the current password with `database.VerifyPassword` against the stored hash. - Requires the new password to be non-empty and equal to the confirmation. - Hashes the new password with `database.HashPassword` — the same Argon2id helper used to bootstrap the admin user — and persists it on the user row. No new crypto. - Re-renders the profile page with a clear success or error message. Wrong current password, empty new password, and mismatched confirmation are each rejected with their own message and leave the stored hash unchanged. ## Template (`templates/profile.html`) - Adds a "Change Password" card with current / new / confirm password fields plus the hidden `csrf_token` (matching the login form's CSRF embedding). - Renders success/error alerts using the existing `alert-success` / `alert-error` styles. No new CSS classes, so no Tailwind rebuild is required. ## Tests (`internal/handlers/profile_test.go`) - `TestHandlePasswordChange_Success`: seeds a user, posts a valid change, asserts success message and that the stored hash changed and verifies against the new password. - `TestHandlePasswordChange_WrongCurrentPassword`: posts a wrong current password, asserts the rejection message and that the stored hash is unchanged. Validated with `docker build .` (fmt-check, lint, test, build) — exit 0. Closes #65 Co-authored-by: sneak <sneak@sneak.berlin> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #83 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-08-07 23:23:05 +02:00
clawbotandsneak	07fc63d9fa	Wrap /user/{username} in RequireAuth middleware (closes #60) (#71) ... Enforces authentication for the `/user/{username}` route group at the middleware layer, matching every other authenticated route group. ## Changes - **`internal/server/routes.go`** (`setupUserRoutes`): added `r.Use(s.mw.RequireAuth())` immediately after the existing `r.Use(s.mw.CSRF())` on the `/user/{username}` group, so auth is enforced by design (CSRF first, then RequireAuth) — consistent with `/sources` and `/source/{sourceID}`. - **`internal/handlers/profile.go`** (`HandleProfile`): removed the now-dead unauthenticated-redirect branch (RequireAuth guarantees an authenticated session before the handler runs). The handler still reads the username and user id from the session for the own-profile-only check; a request for another user's profile still returns 403. The session-retrieval error is now handled as a 500. ## Tests (`internal/handlers/profile_test.go`) - own profile returns 200 - another user's profile returns 403 - an unauthenticated request to `/user/{username}` is redirected to `/pages/login` at the middleware layer and never reaches the endpoint handler (routing-level test replicating the CSRF + RequireAuth chain) ## Validation `docker build .` (fmt-check, lint, test, build) passes. Closes #60 Co-authored-by: sneak <sneak@sneak.berlin> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #71 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-08-07 14:00:16 +02:00