You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
425 lines
16 KiB
425 lines
16 KiB
// Package web provides the login-gated HTTP surface for the application.
|
|
package web
|
|
|
|
import (
|
|
"errors"
|
|
"html/template"
|
|
"mime"
|
|
"net/http"
|
|
"net/url"
|
|
"path"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"webfilebrowser/internal/auth"
|
|
"webfilebrowser/internal/browser"
|
|
"webfilebrowser/internal/config"
|
|
)
|
|
|
|
const (
|
|
loginPath = "/login"
|
|
logoutPath = "/logout"
|
|
changePasswordPath = "/change-password"
|
|
browsePath = "/browse"
|
|
downloadPath = "/download"
|
|
streamPath = "/stream"
|
|
sessionCookieName = "webfilebrowser_session"
|
|
)
|
|
|
|
var (
|
|
loginTemplate = template.Must(template.New("login").Parse(`<!doctype html>
|
|
<html lang="en"><head><meta charset="utf-8"><title>Sign in</title></head>
|
|
<body><main><h1>Sign in</h1>{{if .Error}}<p role="alert">{{.Error}}</p>{{end}}
|
|
<form method="post" action="/login"><label>Email <input type="email" name="email" required></label>
|
|
<label>Password <input type="password" name="password" required></label><button type="submit">Sign in</button></form></main></body></html>`))
|
|
changePasswordTemplate = template.Must(template.New("change-password").Parse(`<!doctype html>
|
|
<html lang="en"><head><meta charset="utf-8"><title>Change password</title></head>
|
|
<body><main><h1>Change your password</h1><p>You must choose a new password before continuing.</p>{{if .Error}}<p role="alert">{{.Error}}</p>{{end}}
|
|
<form method="post" action="/change-password"><label>Current password <input type="password" name="current_password" required></label>
|
|
<label>New password <input type="password" name="new_password" required></label><button type="submit">Change password</button></form></main></body></html>`))
|
|
rootsTemplate = template.Must(template.New("roots").Parse(pageStart + `
|
|
<main><header><h1>webFileBrowser</h1><button id="theme-toggle" type="button">Toggle theme</button></header>
|
|
<p>Signed in as {{.UserEmail}}.</p><h2>Roots</h2><ul class="roots">{{range .Roots}}<li><a href="{{.URL}}">{{.Name}}</a></li>{{else}}<li>No roots are configured.</li>{{end}}</ul>` + signOutForm + pageEnd))
|
|
directoryTemplate = template.Must(template.New("directory").Parse(pageStart + `
|
|
<main><header><h1>webFileBrowser</h1><button id="theme-toggle" type="button">Toggle theme</button></header>
|
|
<p>Signed in as {{.UserEmail}}.</p><nav aria-label="Breadcrumb"><ol class="breadcrumbs">{{range .Breadcrumbs}}<li><a href="{{.URL}}">{{.Name}}</a></li>{{end}}</ol></nav>
|
|
<table><thead><tr><th>Name</th><th>Type</th><th>Size</th><th>Modified</th><th>Actions</th></tr></thead><tbody>{{range .Entries}}<tr><td>{{if .URL}}<a href="{{.URL}}">{{.Name}}</a>{{else}}{{.Name}}{{end}}</td><td>{{.Type}}</td><td>{{.Size}}</td><td>{{.Modified}}</td><td>{{if .DownloadURL}}<a href="{{.DownloadURL}}">Download</a>{{end}}{{if .StreamURL}} · <a href="{{.StreamURL}}">Stream</a>{{end}}</td></tr>{{else}}<tr><td colspan="5">This folder is empty.</td></tr>{{end}}</tbody></table>` + signOutForm + pageEnd))
|
|
)
|
|
|
|
const pageStart = `<!doctype html><html lang="en" data-theme="light"><head><meta charset="utf-8"><title>webFileBrowser</title><style>
|
|
:root{color-scheme:light;--background:#f6f7fb;--surface:#fff;--text:#202534;--muted:#5d6577;--border:#d7dce8;--link:#2251b5}:root[data-theme="dark"]{color-scheme:dark;--background:#151821;--surface:#202532;--text:#f1f4fb;--muted:#b7c0d2;--border:#3c465b;--link:#9ec0ff}*{box-sizing:border-box}body{margin:0;background:var(--background);color:var(--text);font:16px system-ui,sans-serif}main{max-width:960px;margin:2rem auto;padding:2rem;background:var(--surface);border:1px solid var(--border);border-radius:12px}header{display:flex;justify-content:space-between;align-items:center;gap:1rem}h1{margin:0}a{color:var(--link)}button{font:inherit;padding:.45rem .75rem}table{width:100%;border-collapse:collapse}th,td{padding:.7rem;text-align:left;border-bottom:1px solid var(--border)}.roots,.breadcrumbs{padding-left:1.2rem}.breadcrumbs{display:flex;gap:.5rem;flex-wrap:wrap}.breadcrumbs li+li:before{content:"/";margin-right:.5rem;color:var(--muted)}form{margin-top:1.5rem}</style></head><body>`
|
|
|
|
const signOutForm = `<form method="post" action="/logout"><button type="submit">Sign out</button></form>`
|
|
|
|
const pageEnd = `<script>
|
|
(() => {
|
|
const key = "webfilebrowser-theme";
|
|
const button = document.getElementById("theme-toggle");
|
|
const apply = (theme) => {
|
|
document.documentElement.dataset.theme = theme;
|
|
button.textContent = theme === "dark" ? "Use light theme" : "Use dark theme";
|
|
};
|
|
const saved = localStorage.getItem(key);
|
|
apply(saved === "dark" ? "dark" : "light");
|
|
button.addEventListener("click", () => {
|
|
const next = document.documentElement.dataset.theme === "dark" ? "light" : "dark";
|
|
localStorage.setItem(key, next);
|
|
apply(next);
|
|
});
|
|
})();
|
|
</script></body></html>`
|
|
|
|
// New returns an HTTP handler that requires a valid server-side session for
|
|
// every route other than the login endpoint.
|
|
func New(store *auth.Store, roots ...config.Root) http.Handler {
|
|
fileBrowser, err := browser.New(roots)
|
|
return &application{store: store, browser: fileBrowser, browserError: err}
|
|
}
|
|
|
|
type application struct {
|
|
store *auth.Store
|
|
browser *browser.Browser
|
|
browserError error
|
|
}
|
|
|
|
func (app *application) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
|
|
if request.URL.Path == loginPath {
|
|
app.handleLogin(writer, request)
|
|
return
|
|
}
|
|
|
|
user, token, ok := app.currentUser(writer, request)
|
|
if !ok {
|
|
return
|
|
}
|
|
if request.URL.Path == logoutPath {
|
|
app.handleLogout(writer, request, token)
|
|
return
|
|
}
|
|
if user.MustChangePassword {
|
|
if request.URL.Path != changePasswordPath {
|
|
http.Redirect(writer, request, changePasswordPath, http.StatusSeeOther)
|
|
return
|
|
}
|
|
app.handleChangePassword(writer, request, user)
|
|
return
|
|
}
|
|
if request.URL.Path == changePasswordPath {
|
|
http.Redirect(writer, request, "/", http.StatusSeeOther)
|
|
return
|
|
}
|
|
switch request.URL.Path {
|
|
case "/":
|
|
app.handleRoots(writer, request, user)
|
|
case browsePath:
|
|
app.handleBrowse(writer, request, user)
|
|
case downloadPath:
|
|
app.handleFileDelivery(writer, request, true)
|
|
case streamPath:
|
|
app.handleFileDelivery(writer, request, false)
|
|
default:
|
|
http.NotFound(writer, request)
|
|
}
|
|
}
|
|
|
|
func (app *application) handleLogin(writer http.ResponseWriter, request *http.Request) {
|
|
switch request.Method {
|
|
case http.MethodGet:
|
|
renderLogin(writer, http.StatusOK, "")
|
|
case http.MethodPost:
|
|
if err := request.ParseForm(); err != nil {
|
|
renderLogin(writer, http.StatusBadRequest, "Unable to read sign-in details.")
|
|
return
|
|
}
|
|
user, err := app.store.Authenticate(request.FormValue("email"), request.FormValue("password"))
|
|
if err != nil {
|
|
renderLogin(writer, http.StatusUnauthorized, "Invalid email or password.")
|
|
return
|
|
}
|
|
token, err := app.store.CreateSession(user.ID)
|
|
if err != nil {
|
|
http.Error(writer, "Unable to create session.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
app.setSessionCookie(writer, token)
|
|
destination := "/"
|
|
if user.MustChangePassword {
|
|
destination = changePasswordPath
|
|
}
|
|
http.Redirect(writer, request, destination, http.StatusSeeOther)
|
|
default:
|
|
writer.Header().Set("Allow", http.MethodGet+", "+http.MethodPost)
|
|
http.Error(writer, "Method not allowed.", http.StatusMethodNotAllowed)
|
|
}
|
|
}
|
|
|
|
func (app *application) handleChangePassword(writer http.ResponseWriter, request *http.Request, user auth.User) {
|
|
switch request.Method {
|
|
case http.MethodGet:
|
|
renderChangePassword(writer, http.StatusOK, "")
|
|
case http.MethodPost:
|
|
if err := request.ParseForm(); err != nil {
|
|
renderChangePassword(writer, http.StatusBadRequest, "Unable to read password details.")
|
|
return
|
|
}
|
|
err := app.store.ChangePassword(user.ID, request.FormValue("current_password"), request.FormValue("new_password"))
|
|
if errors.Is(err, auth.ErrPasswordUnchanged) {
|
|
renderChangePassword(writer, http.StatusBadRequest, "Your new password must differ from the current password.")
|
|
return
|
|
}
|
|
if errors.Is(err, auth.ErrInvalidCredentials) {
|
|
renderChangePassword(writer, http.StatusBadRequest, "Your current password is incorrect.")
|
|
return
|
|
}
|
|
if err != nil {
|
|
http.Error(writer, "Unable to change password.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
http.Redirect(writer, request, "/", http.StatusSeeOther)
|
|
default:
|
|
writer.Header().Set("Allow", http.MethodGet+", "+http.MethodPost)
|
|
http.Error(writer, "Method not allowed.", http.StatusMethodNotAllowed)
|
|
}
|
|
}
|
|
|
|
func (app *application) handleLogout(writer http.ResponseWriter, request *http.Request, token string) {
|
|
if request.Method != http.MethodPost {
|
|
methodNotAllowed(writer, http.MethodPost)
|
|
return
|
|
}
|
|
if err := app.store.DeleteSession(token); err != nil {
|
|
http.Error(writer, "Unable to end session.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
app.clearSessionCookie(writer)
|
|
http.Redirect(writer, request, loginPath, http.StatusSeeOther)
|
|
}
|
|
|
|
func (app *application) handleRoots(writer http.ResponseWriter, request *http.Request, user auth.User) {
|
|
if request.Method != http.MethodGet {
|
|
methodNotAllowed(writer, http.MethodGet)
|
|
return
|
|
}
|
|
if app.browserError != nil {
|
|
http.Error(writer, "Unable to load configured roots.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
roots := make([]rootLink, 0, len(app.browser.Roots()))
|
|
for _, root := range app.browser.Roots() {
|
|
roots = append(roots, rootLink{Name: root.Name, URL: browseURL(root.Name, "")})
|
|
}
|
|
renderTemplate(writer, rootsTemplate, rootPage{UserEmail: user.Email, Roots: roots})
|
|
}
|
|
|
|
func (app *application) handleBrowse(writer http.ResponseWriter, request *http.Request, user auth.User) {
|
|
if request.Method != http.MethodGet {
|
|
methodNotAllowed(writer, http.MethodGet)
|
|
return
|
|
}
|
|
if app.browserError != nil {
|
|
http.Error(writer, "Unable to load configured roots.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
directory, err := app.browser.List(request.URL.Query().Get("root"), request.URL.Query().Get("path"))
|
|
if errors.Is(err, browser.ErrRootNotFound) || errors.Is(err, browser.ErrPathOutsideRoot) || errors.Is(err, browser.ErrDirectoryNotFound) {
|
|
http.NotFound(writer, request)
|
|
return
|
|
}
|
|
if err != nil {
|
|
http.Error(writer, "Unable to read folder.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
entries := make([]directoryEntry, 0, len(directory.Entries))
|
|
for _, entry := range directory.Entries {
|
|
entryView := directoryEntry{
|
|
Name: entry.Name,
|
|
Type: "File",
|
|
Size: formatSize(entry.Size),
|
|
Modified: entry.ModifiedAt.Local().Format("2006-01-02 15:04"),
|
|
}
|
|
if entry.IsDirectory {
|
|
entryView.Type = "Folder"
|
|
entryView.URL = browseURL(directory.Root.Name, joinRelativePath(directory.RelativePath, entry.Name))
|
|
} else {
|
|
entryView.DownloadURL = fileURL(downloadPath, directory.Root.Name, joinRelativePath(directory.RelativePath, entry.Name))
|
|
if isVideoFile(entry.Name) {
|
|
entryView.StreamURL = fileURL(streamPath, directory.Root.Name, joinRelativePath(directory.RelativePath, entry.Name))
|
|
}
|
|
}
|
|
entries = append(entries, entryView)
|
|
}
|
|
renderTemplate(writer, directoryTemplate, directoryPage{
|
|
UserEmail: user.Email,
|
|
Breadcrumbs: breadcrumbLinks(directory.Root.Name, directory.RelativePath),
|
|
Entries: entries,
|
|
})
|
|
}
|
|
|
|
func (app *application) handleFileDelivery(writer http.ResponseWriter, request *http.Request, download bool) {
|
|
if request.Method != http.MethodGet && request.Method != http.MethodHead {
|
|
writer.Header().Set("Allow", http.MethodGet+", "+http.MethodHead)
|
|
http.Error(writer, "Method not allowed.", http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
if app.browserError != nil {
|
|
http.Error(writer, "Unable to load configured roots.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
file, metadata, err := app.browser.OpenFile(request.URL.Query().Get("root"), request.URL.Query().Get("path"))
|
|
if errors.Is(err, browser.ErrRootNotFound) || errors.Is(err, browser.ErrPathOutsideRoot) || errors.Is(err, browser.ErrDirectoryNotFound) {
|
|
http.NotFound(writer, request)
|
|
return
|
|
}
|
|
if err != nil {
|
|
http.Error(writer, "Unable to read file.", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
defer func() { _ = file.Close() }()
|
|
|
|
contentType := mime.TypeByExtension(strings.ToLower(filepath.Ext(metadata.Name)))
|
|
if contentType == "" {
|
|
contentType = "application/octet-stream"
|
|
}
|
|
dispositionType := "inline"
|
|
if download {
|
|
dispositionType = "attachment"
|
|
}
|
|
disposition := mime.FormatMediaType(dispositionType, map[string]string{"filename": metadata.Name})
|
|
writer.Header().Set("Content-Type", contentType)
|
|
writer.Header().Set("Content-Disposition", disposition)
|
|
http.ServeContent(writer, request, metadata.Name, metadata.ModifiedAt, file)
|
|
}
|
|
|
|
func (app *application) currentUser(writer http.ResponseWriter, request *http.Request) (auth.User, string, bool) {
|
|
cookie, err := request.Cookie(sessionCookieName)
|
|
if err != nil {
|
|
http.Redirect(writer, request, loginPath, http.StatusSeeOther)
|
|
return auth.User{}, "", false
|
|
}
|
|
user, err := app.store.LookupSession(cookie.Value)
|
|
if err != nil {
|
|
app.clearSessionCookie(writer)
|
|
http.Redirect(writer, request, loginPath, http.StatusSeeOther)
|
|
return auth.User{}, "", false
|
|
}
|
|
app.setSessionCookie(writer, cookie.Value)
|
|
return user, cookie.Value, true
|
|
}
|
|
|
|
func (app *application) setSessionCookie(writer http.ResponseWriter, token string) {
|
|
http.SetCookie(writer, &http.Cookie{
|
|
Name: sessionCookieName,
|
|
Value: token,
|
|
Path: "/",
|
|
Expires: time.Now().Add(app.store.SessionLifetime()),
|
|
HttpOnly: true,
|
|
Secure: true,
|
|
SameSite: http.SameSiteLaxMode,
|
|
})
|
|
}
|
|
|
|
func (app *application) clearSessionCookie(writer http.ResponseWriter) {
|
|
http.SetCookie(writer, &http.Cookie{
|
|
Name: sessionCookieName,
|
|
Value: "",
|
|
Path: "/",
|
|
MaxAge: -1,
|
|
HttpOnly: true,
|
|
Secure: true,
|
|
SameSite: http.SameSiteLaxMode,
|
|
})
|
|
}
|
|
|
|
type rootPage struct {
|
|
UserEmail string
|
|
Roots []rootLink
|
|
}
|
|
|
|
type rootLink struct {
|
|
Name string
|
|
URL string
|
|
}
|
|
|
|
type directoryPage struct {
|
|
UserEmail string
|
|
Breadcrumbs []rootLink
|
|
Entries []directoryEntry
|
|
}
|
|
|
|
type directoryEntry struct {
|
|
Name string
|
|
URL string
|
|
DownloadURL string
|
|
StreamURL string
|
|
Type string
|
|
Size string
|
|
Modified string
|
|
}
|
|
|
|
func browseURL(rootName, relativePath string) string {
|
|
return fileURL(browsePath, rootName, relativePath)
|
|
}
|
|
|
|
func fileURL(endpoint, rootName, relativePath string) string {
|
|
query := url.Values{"root": {rootName}}
|
|
if relativePath != "" {
|
|
query.Set("path", relativePath)
|
|
}
|
|
return endpoint + "?" + query.Encode()
|
|
}
|
|
|
|
func breadcrumbLinks(rootName, relativePath string) []rootLink {
|
|
breadcrumbs := []rootLink{{Name: rootName, URL: browseURL(rootName, "")}}
|
|
pathSoFar := ""
|
|
for _, part := range strings.Split(relativePath, "/") {
|
|
if part == "" {
|
|
continue
|
|
}
|
|
pathSoFar = joinRelativePath(pathSoFar, part)
|
|
breadcrumbs = append(breadcrumbs, rootLink{Name: part, URL: browseURL(rootName, pathSoFar)})
|
|
}
|
|
return breadcrumbs
|
|
}
|
|
|
|
func joinRelativePath(parent, child string) string {
|
|
if parent == "" {
|
|
return child
|
|
}
|
|
return path.Join(parent, child)
|
|
}
|
|
|
|
func formatSize(size int64) string {
|
|
return strconv.FormatInt(size, 10) + " B"
|
|
}
|
|
|
|
func isVideoFile(name string) bool {
|
|
return strings.HasPrefix(mime.TypeByExtension(strings.ToLower(filepath.Ext(name))), "video/")
|
|
}
|
|
|
|
func methodNotAllowed(writer http.ResponseWriter, allowedMethod string) {
|
|
writer.Header().Set("Allow", allowedMethod)
|
|
http.Error(writer, "Method not allowed.", http.StatusMethodNotAllowed)
|
|
}
|
|
|
|
func renderLogin(writer http.ResponseWriter, status int, message string) {
|
|
writer.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
writer.WriteHeader(status)
|
|
_ = loginTemplate.Execute(writer, struct{ Error string }{Error: message})
|
|
}
|
|
|
|
func renderChangePassword(writer http.ResponseWriter, status int, message string) {
|
|
writer.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
writer.WriteHeader(status)
|
|
_ = changePasswordTemplate.Execute(writer, struct{ Error string }{Error: message})
|
|
}
|
|
|
|
func renderTemplate(writer http.ResponseWriter, pageTemplate *template.Template, data any) {
|
|
writer.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
if err := pageTemplate.Execute(writer, data); err != nil {
|
|
http.Error(writer, "Unable to render page.", http.StatusInternalServerError)
|
|
}
|
|
|
|
}
|
|
|