8f752ed86b
Each Reader's userscript credential is derived from TOKEN_KEY, their Discord id and a token epoch (HMAC-SHA256, hex); only its SHA-256 sits in readers.token_sha256, so install URLs survive restarts while a database leak yields nothing but hashes. One credential authenticates the script download path and the API bearer header. - internal/token: derivation + hashing; migration 0006 adds token_epoch - seed refreshes the owner's epoch-0 hash only before first rotation - httpmw.Auth resolves the acting Reader from the credential hash and stashes it in the request context; the retired API_TOKEN resolves to the owner until API_TOKEN_GRACE_UNTIL, logged per use, on both the bearer and script-download paths - userscript handler renders the bindmounted file with the resolved Reader's credential substituted for __API_TOKEN__; a legacy-path request during grace serves the derived credential, so devices self-migrate on their next update poll - web UI: Userscripts panel with session-gated install endpoints that render the script directly (credential never in markup, address bar or a redirect) and confirm-gated rotation; atomic epoch bump + hash rewrite in the store - both userscripts carry __API_TOKEN__ placeholders; the committed global-token literal is removed (rotating at deploy retires it for real — it survives in git history) - env: TOKEN_KEY required, API_TOKEN/API_TOKEN_GRACE_UNTIL retire the legacy credential; docs and compose updated
127 lines
3.6 KiB
Go
127 lines
3.6 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"log"
|
|
"net/http"
|
|
"strings"
|
|
"time"
|
|
|
|
"bookmarkmanager/backend/internal/httpmw"
|
|
"bookmarkmanager/backend/internal/store"
|
|
)
|
|
|
|
// Handler serves the userscript-facing JSON bookmark API.
|
|
type Handler struct {
|
|
Store *store.Store
|
|
}
|
|
|
|
func writeJSON(w http.ResponseWriter, status int, v any) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(status)
|
|
if v != nil {
|
|
if err := json.NewEncoder(w).Encode(v); err != nil {
|
|
log.Printf("encode response: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// List returns all bookmarks of the acting Reader. GET /bookmarks
|
|
func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
|
|
items, err := h.Store.List(httpmw.ReaderID(r))
|
|
if err != nil {
|
|
log.Printf("list: %v", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
writeJSON(w, http.StatusOK, items)
|
|
}
|
|
|
|
// Put upserts one bookmark. PUT /bookmarks/{key}
|
|
func (h *Handler) Put(w http.ResponseWriter, r *http.Request) {
|
|
key := r.PathValue("key")
|
|
if key == "" {
|
|
http.Error(w, "missing key", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
var b store.Bookmark
|
|
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<16)).Decode(&b); err != nil {
|
|
http.Error(w, "invalid JSON body", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
// Path key is authoritative; derive site/series_id from it when the body
|
|
// omits them so the stored row is always self-consistent.
|
|
b.Key = key
|
|
if b.Site == "" || b.SeriesID == "" {
|
|
if site, series, ok := strings.Cut(key, ":"); ok {
|
|
if b.Site == "" {
|
|
b.Site = site
|
|
}
|
|
if b.SeriesID == "" {
|
|
b.SeriesID = series
|
|
}
|
|
}
|
|
}
|
|
|
|
// An empty status is "no opinion" and Upsert keeps the stored bucket.
|
|
// Finishing a series is a web-UI decision, so the JSON API refuses it
|
|
// rather than trusting every client to leave it alone.
|
|
switch b.Status {
|
|
case "", store.StatusReading, store.StatusArchived:
|
|
case store.StatusFinished:
|
|
http.Error(w, "status "+store.StatusFinished+" can only be set from the web UI",
|
|
http.StatusBadRequest)
|
|
return
|
|
default:
|
|
http.Error(w, "invalid status", http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
// Same rule as status: empty means "keep the stored value". An unknown
|
|
// value is a client bug, not something to silently coerce to manga.
|
|
switch b.Kind {
|
|
case "", store.KindManga, store.KindNovel:
|
|
default:
|
|
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid kind"})
|
|
return
|
|
}
|
|
|
|
// Candidate timestamp, not a decision: Upsert keeps the stored one unless
|
|
// reading progress actually moved. Any client value is ignored.
|
|
b.UpdatedAt = time.Now().UnixMilli()
|
|
|
|
stored, err := h.Store.Upsert(httpmw.ReaderID(r), b)
|
|
if err != nil {
|
|
log.Printf("upsert: %v", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
// Echo the stored row: clients adopt this as their cached copy, so it must
|
|
// carry the authoritative updated_at rather than the candidate above.
|
|
writeJSON(w, http.StatusOK, stored)
|
|
}
|
|
|
|
// Delete removes one bookmark. DELETE /bookmarks/{key}
|
|
func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
|
|
key := r.PathValue("key")
|
|
if key == "" {
|
|
http.Error(w, "missing key", http.StatusBadRequest)
|
|
return
|
|
}
|
|
if err := h.Store.Delete(httpmw.ReaderID(r), key); err != nil {
|
|
log.Printf("delete: %v", err)
|
|
http.Error(w, "internal error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}
|
|
|
|
// Healthz answers the unauthenticated liveness check. GET /healthz
|
|
func Healthz(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "text/plain")
|
|
w.WriteHeader(http.StatusOK)
|
|
_, _ = w.Write([]byte("ok"))
|
|
}
|