clawbot
07fc63d9fa
All checks were successful
check / check (push) Successful in 4s
Enforces authentication for the `/user/{username}` route group at the middleware layer, matching every other authenticated route group.
## Changes
- **`internal/server/routes.go`** (`setupUserRoutes`): added `r.Use(s.mw.RequireAuth())` immediately after the existing `r.Use(s.mw.CSRF())` on the `/user/{username}` group, so auth is enforced by design (CSRF first, then RequireAuth) — consistent with `/sources` and `/source/{sourceID}`.
- **`internal/handlers/profile.go`** (`HandleProfile`): removed the now-dead unauthenticated-redirect branch (RequireAuth guarantees an authenticated session before the handler runs). The handler still reads the username and user id from the session for the own-profile-only check; a request for another user's profile still returns 403. The session-retrieval error is now handled as a 500.
## Tests (`internal/handlers/profile_test.go`)
- own profile returns 200
- another user's profile returns 403
- an unauthenticated request to `/user/{username}` is redirected to `/pages/login` at the middleware layer and never reaches the endpoint handler (routing-level test replicating the CSRF + RequireAuth chain)
## Validation
`docker build .` (fmt-check, lint, test, build) passes.
Closes #60
Co-authored-by: sneak <sneak@sneak.berlin>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #71
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>
67 lines
1.6 KiB
Go
67 lines
1.6 KiB
Go
package handlers
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/go-chi/chi"
|
|
)
|
|
|
|
// HandleProfile returns a handler for the user profile page
|
|
func (h *Handlers) HandleProfile() http.HandlerFunc {
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
// Get username from URL
|
|
requestedUsername := chi.URLParam(r, "username")
|
|
if requestedUsername == "" {
|
|
http.NotFound(w, r)
|
|
|
|
return
|
|
}
|
|
|
|
// Get session. RequireAuth middleware guarantees an
|
|
// authenticated session before this handler runs, so we
|
|
// only need to guard against an unexpected retrieval error.
|
|
sess, err := h.session.Get(r)
|
|
if err != nil {
|
|
h.log.Error("failed to get session", "error", err)
|
|
http.Error(w, "Internal server error", http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
|
|
// Get user info from session
|
|
sessionUsername, ok := h.session.GetUsername(sess)
|
|
if !ok {
|
|
h.log.Error("authenticated session missing username")
|
|
http.Error(w, "Internal server error", http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
|
|
sessionUserID, ok := h.session.GetUserID(sess)
|
|
if !ok {
|
|
h.log.Error("authenticated session missing user ID")
|
|
http.Error(w, "Internal server error", http.StatusInternalServerError)
|
|
|
|
return
|
|
}
|
|
|
|
// For now, only allow users to view their own profile
|
|
if requestedUsername != sessionUsername {
|
|
http.Error(w, "Forbidden", http.StatusForbidden)
|
|
|
|
return
|
|
}
|
|
|
|
// Prepare data for template
|
|
data := map[string]any{
|
|
"User": &UserInfo{
|
|
ID: sessionUserID,
|
|
Username: sessionUsername,
|
|
},
|
|
}
|
|
|
|
// Render the profile page
|
|
h.renderTemplate(w, r, "profile.html", data)
|
|
}
|
|
}
|