handlers.go · rin/polar

Код Задачи Пул-реквесты Релизы 9 Активность

handlers.go · 363 строки · 12.8 KB

1	package handlers
2
3	import (
4	"bytes"
5	"fmt"
6	"log/slog"
7	"net/http"
8	"net/url"
9	"strings"
10	"time"
11
12	"polar/internal/auth"
13	"polar/internal/config"
14	"polar/internal/db"
15	"polar/internal/i18n"
16	"polar/internal/repo"
17	"polar/internal/user"
18	"polar/internal/web/middleware"
19	"polar/internal/web/static"
20	"polar/internal/web/views"
21
22	"github.com/gofiber/fiber/v2"
23	"github.com/gofiber/fiber/v2/middleware/filesystem"
24	)
25
26	type Handler struct {
27	cfg config.Config
28	db *db.DB
29	authSvc *auth.Service
30	userSvc *user.Service
31	repoSvc *repo.Service
32	views *views.Engine
33	logger *slog.Logger
34	}
35
36	func New(
37	cfg config.Config,
38	database *db.DB,
39	authSvc *auth.Service,
40	userSvc *user.Service,
41	repoSvc *repo.Service,
42	viewsEngine *views.Engine,
43	logger *slog.Logger,
44	) *Handler {
45	return &Handler{
46	cfg: cfg,
47	db: database,
48	authSvc: authSvc,
49	userSvc: userSvc,
50	repoSvc: repoSvc,
51	views: viewsEngine,
52	logger: logger,
53	}
54	}
55
56	func (h Handler) RegisterRoutes(app fiber.App) {
57	app.Use(middleware.RecoverAndLog(h.logger))
58	app.Use(middleware.SecurityHeaders())
59
60	app.Get("/healthz", h.Healthz)
61
62	app.Use("/static", filesystem.New(filesystem.Config{
63	Root: http.FS(static.FS),
64	Browse: false,
65	MaxAge: 0,
66	}))
67
68	app.Use(middleware.LocaleAndTheme(h.cfg.Landing.DefaultLang))
69	app.Use(middleware.SessionAuth(h.authSvc, h.userSvc))
70	app.Use(middleware.CSRFProtection())
71
72	authLimiter := middleware.NewRateLimiter(20, time.Minute)
73
74	// Public & Root routes
75	app.Get("/", h.Home)
76	app.Get("/explore", h.Explore)
77	app.Get("/agents", h.AgentsPage)
78
79	// Auth routes
80	app.Get("/login", h.LoginPage)
81	app.Post("/login", authLimiter.Handler(), h.LoginSubmit)
82	app.Get("/register", h.RegisterPage)
83	app.Post("/register", authLimiter.Handler(), h.RegisterSubmit)
84	app.Post("/logout", h.LogoutSubmit)
85	app.Get("/login/device", h.DeviceVerifyPage)
86	app.Post("/login/device", h.DeviceVerifySubmit)
87	app.Post("/api/v1/device/code", h.DeviceCodeAPI)
88	app.Post("/api/v1/device/token", h.DeviceTokenAPI)
89
90	// Authenticated user routes
91	app.Get("/repos", h.LegacyReposRedirect)
92	app.Get("/new", middleware.RequireAuth(), h.NewRepoPage)
93	app.Post("/new", middleware.RequireAuth(), h.NewRepoSubmit)
94	app.Get("/settings", middleware.RequireAuth(), h.SettingsPage)
95	app.Post("/settings/profile", middleware.RequireAuth(), h.UpdateProfileSubmit)
96	app.Post("/settings/password", middleware.RequireAuth(), h.UpdatePasswordSubmit)
97	app.Post("/settings/tokens", middleware.RequireAuth(), h.CreateTokenSubmit)
98	app.Post("/settings/tokens/:id/revoke", middleware.RequireAuth(), h.RevokeTokenSubmit)
99
100	// Admin routes
101	app.Get("/admin", middleware.RequireAdmin(), h.AdminPage)
102	app.Post("/admin/settings", middleware.RequireAdmin(), h.AdminSettingsSubmit)
103
104	// Git Smart HTTP endpoints (supports both /:owner/:repo.git/* and /:owner/:repo/*)
105	app.Get("/:owner/:repo/info/refs", h.GitInfoRefs)
106	app.Post("/:owner/:repo/git-upload-pack", h.GitUploadPack)
107	app.Post("/:owner/:repo/git-receive-pack", h.GitReceivePack)
108
109	// Repository Web UI routes
110	app.Get("/:owner/:repo/settings", middleware.RequireAuth(), h.RepoSettingsPage)
111	app.Post("/:owner/:repo/settings", middleware.RequireAuth(), h.RepoSettingsSubmit)
112	app.Post("/:owner/:repo/settings/rename", middleware.RequireAuth(), h.RepoRenameSubmit)
113	app.Post("/:owner/:repo/settings/delete", middleware.RequireAuth(), h.RepoDeleteSubmit)
114	app.Post("/:owner/:repo/settings/collaborators/add", middleware.RequireAuth(), h.RepoCollaboratorAddSubmit)
115	app.Post("/:owner/:repo/settings/collaborators/remove", middleware.RequireAuth(), h.RepoCollaboratorRemoveSubmit)
116
117	app.Get("/:owner/:repo/branches", h.RepoBranchesPage)
118	app.Post("/:owner/:repo/branches", middleware.RequireAuth(), h.RepoCreateBranchSubmit)
119	app.Post("/:owner/:repo/branches/delete", middleware.RequireAuth(), h.RepoDeleteBranchSubmit)
120	app.Post("/:owner/:repo/tags", middleware.RequireAuth(), h.RepoCreateTagSubmit)
121	app.Post("/:owner/:repo/tags/delete", middleware.RequireAuth(), h.RepoDeleteTagSubmit)
122	app.Get("/:owner/:repo/archive/*", h.RepoArchiveZip)
123	app.Get("/:owner/:repo/new-file", middleware.RequireAuth(), h.RepoNewFilePage)
124	app.Post("/:owner/:repo/new-file", middleware.RequireAuth(), h.RepoCreateFileSubmit)
125	app.Get("/:owner/:repo/new-folder", middleware.RequireAuth(), h.RepoNewFolderPage)
126	app.Post("/:owner/:repo/new-folder", middleware.RequireAuth(), h.RepoCreateFolderSubmit)
127	app.Get("/:owner/:repo/upload", middleware.RequireAuth(), h.RepoUploadPage)
128	app.Post("/:owner/:repo/upload", middleware.RequireAuth(), h.RepoUploadSubmit)
129
130	app.Post("/:owner/:repo/fork", middleware.RequireAuth(), h.RepoForkSubmit)
131	app.Get("/:owner/:repo/forks", h.RepoForksPage)
132
133	app.Get("/:owner/:repo/issues", h.RepoIssuesPage)
134	app.Get("/:owner/:repo/issues/new", middleware.RequireAuth(), h.RepoNewIssuePage)
135	app.Post("/:owner/:repo/issues/new", middleware.RequireAuth(), h.RepoNewIssueSubmit)
136	app.Get("/:owner/:repo/issues/:number", h.RepoIssueDetailPage)
137	app.Post("/:owner/:repo/issues/:number/comments", middleware.RequireAuth(), h.RepoIssueCommentSubmit)
138	app.Post("/:owner/:repo/issues/:number/state", middleware.RequireAuth(), h.RepoIssueStateSubmit)
139
140	// Pull Requests
141	app.Get("/:owner/:repo/pulls", h.RepoPullsPage)
142	app.Get("/:owner/:repo/pulls/new", middleware.RequireAuth(), h.RepoNewPullPage)
143	app.Post("/:owner/:repo/pulls/new", middleware.RequireAuth(), h.RepoNewPullSubmit)
144	app.Get("/:owner/:repo/pulls/:number", h.RepoPullDetailPage)
145	app.Post("/:owner/:repo/pulls/:number/comments", middleware.RequireAuth(), h.RepoPullCommentSubmit)
146	app.Post("/:owner/:repo/pulls/:number/state", middleware.RequireAuth(), h.RepoPullStateSubmit)
147	app.Post("/:owner/:repo/pulls/:number/merge", middleware.RequireAuth(), h.RepoPullMergeSubmit)
148	app.Post("/:owner/:repo/pulls/:number/review", middleware.RequireAuth(), h.RepoPullReviewSubmit)
149
150	// Releases
151	app.Get("/:owner/:repo/releases", h.RepoReleasesPage)
152	app.Get("/:owner/:repo/releases/new", middleware.RequireAuth(), h.RepoNewReleasePage)
153	app.Post("/:owner/:repo/releases/new", middleware.RequireAuth(), h.RepoNewReleaseSubmit)
154	app.Post("/:owner/:repo/releases/:id/delete", middleware.RequireAuth(), h.RepoDeleteReleaseSubmit)
155	app.Get("/:owner/:repo/releases/:id/assets/:assetID/download", h.RepoReleaseAssetDownload)
156	app.Post("/:owner/:repo/releases/:id/assets/:assetID/delete", middleware.RequireAuth(), h.RepoDeleteReleaseAssetSubmit)
157
158	// Activity
159	app.Get("/:owner/:repo/activity", h.RepoActivityPage)
160
161	app.Get("/:owner/:repo/commits/:ref", h.RepoCommitsPage)
162	app.Get("/:owner/:repo/commit/:hash", h.RepoCommitDetailPage)
163	app.Get("/:owner/:repo/tree/:ref/*", h.RepoTreePage)
164	app.Get("/:owner/:repo/tree/:ref", h.RepoTreePage)
165	app.Get("/:owner/:repo/blob/:ref/*", h.RepoBlobPage)
166	app.Get("/:owner/:repo/raw/:ref/*", h.RepoRawBlob)
167	app.Get("/:owner/:repo", h.RepoHomePage)
168
169	// User profile page
170	app.Get("/:username", h.UserProfilePage)
171	}
172
173	func (h Handler) Healthz(c fiber.Ctx) error {
174	if err := h.db.PingContext(c.UserContext()); err != nil {
175	return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
176	"status": "error",
177	"db": "unreachable",
178	})
179	}
180	return c.Status(fiber.StatusOK).JSON(fiber.Map{
181	"status": "ok",
182	"service": "polar",
183	})
184	}
185
186	func (h Handler) baseData(c fiber.Ctx, title string) map[string]any {
187	u := middleware.CurrentUser(c)
188	lang := h.langOf(c)
189	theme, _ := c.Locals("theme").(string)
190	if theme == "" {
191	theme = "system"
192	}
193	csrf, _ := c.Locals("csrf_token").(string)
194
195	flash := c.Cookies("polar_flash")
196	if flash != "" {
197	if decoded, err := url.QueryUnescape(flash); err == nil {
198	flash = decoded
199	}
200	c.ClearCookie("polar_flash")
201	}
202
203	ctx := c.UserContext()
204	anonRead := h.db.IsAnonymousReadEnabled(ctx)
205	var paletteRepos []repo.Repository
206	if u != nil \|\| anonRead {
207	paletteRepos, _ = h.repoSvc.ListAccessible(ctx, u, 25)
208	}
209
210	data := map[string]any{
211	"Title": title,
212	"Lang": lang,
213	"Theme": theme,
214	"CSRFToken": csrf,
215	"CurrentUser": u,
216	"Flash": flash,
217	"RegistrationEnabled": h.isRegistrationAllowed(c),
218	"ExploreEnabled": h.db.IsExploreEnabled(ctx),
219	"LandingEnabled": h.db.IsLandingEnabled(ctx, h.cfg.Landing.Enabled),
220	"AnonymousReadEnabled": anonRead,
221	"IssuesEnabled": h.db.IsIssuesEnabled(ctx),
222	"PaletteRepos": paletteRepos,
223	}
224	if extra := h.repoNavData(c); extra != nil {
225	for k, v := range extra {
226	data[k] = v
227	}
228	}
229	return data
230	}
231
232	// repoNavData enriches template data for /:owner/:repo routes with fork
233	// navigation state used by the repository header.
234	func (h Handler) repoNavData(c fiber.Ctx) map[string]any {
235	owner, name := c.Params("owner"), strings.TrimSuffix(c.Params("repo"), ".git")
236	if owner == "" \|\| name == "" {
237	return nil
238	}
239	ctx := c.UserContext()
240	nr, err := h.repoSvc.GetByOwnerAndName(ctx, owner, name)
241	if err != nil \|\| nr == nil {
242	return nil
243	}
244	u := middleware.CurrentUser(c)
245	data := map[string]any{"NavRepo": nr}
246	data["IsRepoOwner"] = u != nil && u.ID == nr.OwnerID
247	if u != nil && u.ID != nr.OwnerID {
248	if fork, ferr := h.repoSvc.FindForkByOwner(ctx, nr.ID, u.ID); ferr == nil && fork != nil {
249	data["ViewerFork"] = fork
250	}
251	}
252	return data
253	}
254
255	func (h Handler) setFlash(c fiber.Ctx, msg string) {
256	c.Cookie(&fiber.Cookie{
257	Name: "polar_flash",
258	Value: url.QueryEscape(msg),
259	Path: "/",
260	MaxAge: 30,
261	HTTPOnly: true,
262	SameSite: "Lax",
263	})
264	}
265
266	// langOf resolves the active UI language for the current request.
267	func (h Handler) langOf(c fiber.Ctx) i18n.Lang {
268	lang, _ := c.Locals("lang").(i18n.Lang)
269	if lang == "" {
270	lang = i18n.Normalize(h.cfg.Landing.DefaultLang)
271	}
272	return lang
273	}
274
275	// tr translates key for the current request and formats it with args.
276	func (h Handler) tr(c fiber.Ctx, key string, args ...any) string {
277	return fmt.Sprintf(i18n.T(h.langOf(c), key), args...)
278	}
279
280	// setFlashT stores a localized flash message.
281	func (h Handler) setFlashT(c fiber.Ctx, key string, args ...any) {
282	h.setFlash(c, h.tr(c, key, args...))
283	}
284
285	// renderErrorT renders an error page with localized title and message.
286	func (h Handler) renderErrorT(c fiber.Ctx, status int, titleKey, msgKey string, args ...any) error {
287	return h.renderError(c, status, i18n.T(h.langOf(c), titleKey), h.tr(c, msgKey, args...))
288	}
289
290	func (h Handler) isRegistrationAllowed(c fiber.Ctx) bool {
291	if cnt, err := h.userSvc.Count(c.UserContext()); err == nil && cnt == 0 {
292	return true
293	}
294	return h.db.IsRegistrationEnabled(c.UserContext(), h.cfg.Auth.RegistrationEnabled)
295	}
296
297	func (h Handler) render(c fiber.Ctx, status int, page string, data map[string]any) error {
298	var buf bytes.Buffer
299	if err := h.views.Render(&buf, page, data); err != nil {
300	h.logger.Error("render template failed", "page", page, "err", err)
301	return c.Status(fiber.StatusInternalServerError).SendString("Template render error")
302	}
303	c.Status(status)
304	c.Set(fiber.HeaderContentType, fiber.MIMETextHTMLCharsetUTF8)
305	return c.Send(buf.Bytes())
306	}
307
308	func (h Handler) renderError(c fiber.Ctx, status int, title, message string) error {
309	data := h.baseData(c, title)
310	data["StatusCode"] = status
311	data["Title"] = title
312	data["Message"] = message
313	return h.render(c, status, "error", data)
314	}
315
316	func (h Handler) Home(c fiber.Ctx) error {
317	if !h.db.IsLandingEnabled(c.UserContext(), h.cfg.Landing.Enabled) {
318	if u := middleware.CurrentUser(c); u != nil {
319	if h.db.IsExploreEnabled(c.UserContext()) {
320	return c.Redirect("/explore", fiber.StatusSeeOther)
321	}
322	return c.Redirect("/"+u.Username, fiber.StatusSeeOther)
323	}
324	return c.Redirect("/login", fiber.StatusSeeOther)
325	}
326	data := h.baseData(c, "")
327	if h.db.IsExploreEnabled(c.UserContext()) && (middleware.CurrentUser(c) != nil \|\| h.db.IsAnonymousReadEnabled(c.UserContext())) {
328	repos, _ := h.repoSvc.ListPublic(c.UserContext(), 10)
329	data["Repos"] = repos
330	}
331	return h.render(c, fiber.StatusOK, "landing", data)
332	}
333
334	func (h Handler) Explore(c fiber.Ctx) error {
335	if !h.db.IsExploreEnabled(c.UserContext()) {
336	return h.renderErrorT(c, fiber.StatusNotFound, "err.not_found", "err.explore_disabled")
337	}
338	if middleware.CurrentUser(c) == nil && !h.db.IsAnonymousReadEnabled(c.UserContext()) {
339	return c.Redirect("/login", fiber.StatusSeeOther)
340	}
341	lang, _ := c.Locals("lang").(i18n.Lang)
342	data := h.baseData(c, i18n.T(lang, "nav.explore"))
343	repos, _ := h.repoSvc.ListPublic(c.UserContext(), 100)
344	data["PageHeading"] = i18n.T(lang, "nav.explore")
345	data["Repos"] = repos
346	return h.render(c, fiber.StatusOK, "repos", data)
347	}
348
349	// LegacyReposRedirect keeps old /repos links working: the repository
350	// catalog is served by Explore.
351	func (h Handler) LegacyReposRedirect(c fiber.Ctx) error {
352	return c.Redirect("/explore", fiber.StatusSeeOther)
353	}
354
355	func (h Handler) cloneURL(c fiber.Ctx, ownerUsername, repoName string) string {
356	base := strings.TrimRight(h.cfg.Server.BaseURL, "/")
357	if base == "" \|\| strings.Contains(base, "localhost:3000") {
358	if reqBase := c.BaseURL(); reqBase != "" {
359	base = strings.TrimRight(reqBase, "/")
360	}
361	}
362	return base + "/" + ownerUsername + "/" + repoName + ".git"
363	}
364