Savininko paviršius: užklausos, valdikliai, rodiniai, maršrutai

Keturi failai kortelėse, priklausomybių tvarka: documents.sql → documents.go → documents.templ → router.go — užklausos, valdikliai, rodiniai, maršrutai.

1. internal/db/queries/documents.sql (keitimas) — dvi naujos užklausos šalia praėjusios pamokos: GetDocumentForOwner (WHERE id = $1 AND owner_id = $2) ir DeleteDraftDocument (WHERE id = $1 AND owner_id = $2 AND status = 'draft', :execrows). Paleisk sqlc generate.

2. internal/handlers/documents.go (keitimas) — trys valdikliai ir du pagalbininkai:

ViewDocument ir DownloadDocument abu prasideda nuo ownedDocument, kuri paleidžia GetDocumentForOwner ir įrašo 404 esant ErrNoRows. Vienas pagalbininkas, tad savininko patikros nepamirši nei viename maršrute.
DownloadDocument atveria failą su Store.Open ir srautu jį siunčia su Content-Disposition: attachment antrašte — originalus failo vardas, ir ASCII, ir UTF-8, pagal RFC 6266.
DeleteDocument paleidžia išankstinę patikrą (svetimas → 404, išsiųstas → 422), tada DeleteDraftDocument; n == 1 reiškia, kad tikrai ištrynė, tad failas pašalinamas ir sąrašas atnaujinamas.
parseUUID paverčia {id} kelio parametrą į pgtype.UUID, grąžindama 404 esant netaisyklingam ID, dar prieš pasiekiant duomenų bazę.

func (h *Handlers) ownedDocument(w http.ResponseWriter, r *http.Request) (db.Document, bool) {
	user := mustUser(r)
	id, ok := parseUUID(chiURLParam(r, "id"))
	if !ok {
		http.NotFound(w, r)
		return db.Document{}, false
	}
	doc, err := h.Queries.GetDocumentForOwner(r.Context(), db.GetDocumentForOwnerParams{ID: id, OwnerID: user.ID})
	if errors.Is(err, pgx.ErrNoRows) {
		http.NotFound(w, r) // svetimas ar neegzistuojantis — neatskiriama, tyčia
		return db.Document{}, false
	}
	// ...
	return doc, true
}

3. internal/web/documents.templ (keitimas) — sąrašas įgyja veiksmus: failo vardas ir View mygtukas veda į /documents/{id}, o juodraščio eilutė gauna Delete mygtuką (hx-post, hx-confirm, taikosi į #doc-list). Ir naujas DocumentDetail puslapis: metaduomenys, SHA-256, Download mygtukas ir — tik juodraščiui — Delete forma. Trynimo valdikliams nereikia paslėpto CSRF lauko: praėjusios pamokos X-CSRF-Token antraštės sujungimas apima kiekvieną htmx užklausą, įskaitant šią.

4. internal/handlers/router.go (keitimas) — trys maršrutai autentifikuotoje grupėje:

pr.Get("/documents/{id}", h.ViewDocument)
pr.Get("/documents/{id}/download", h.DownloadDocument)
pr.Post("/documents/{id}/delete", h.DeleteDocument)

Patikra — perseeduok, paleisk, prisijunk, įkelk vieną ar du failus, tada:

Spustelk failo vardą → detalės puslapis rodo tipą, dydį, įkėlimo laiką ir pilną SHA-256.
Spustelk Download → failas grįžta su originaliu vardu; atsisiųsto failo sha256sum sutampa su puslapyje rodomu file_hash.
Spustelk Delete ant juodraščio → patvirtink, ir eilutė dingsta sąrašui pasikeičiant vietoje. Terminale užrašoma document deleted.

Dabar įrodyk dvi saugumo taisykles.

404, ne 403. Paimk dokumento ID iš savo paskyros, tada užsiregistruok antra paskyra ir, kaip tas vartotojas, paprašyk pirmojo vartotojo dokumento. GET nereikia CSRF žetono, tad tai vienaeilutis:

$ curl -si http://localhost:8080/documents/<pirmo-vartotojo-id> \
       -H "Cookie: session=<antro-vartotojo-sesija>"
HTTP/1.1 404 Not Found

Antras vartotojas negali pasakyti, ar tas ID egzistuoja — 404 svetimam dokumentui yra tas pats atsakymas kaip 404 netikram.

Trinti tik juodraštį. sent dokumentas nerodo jokio Delete mygtuko — jis už if d.IsDraft. Ir taisyklė galioja serveryje. Ranka perjunk dokumentą į sent, ir trynimas nieko neištrina:

$ psql "$DATABASE_URL" -c "update documents set status='sent' where id='<id>';"

DeleteDraftDocument dabar atitinka nulį eilučių tam ID. Užkomentuok valdiklio if doc.Status != "draft" patikrą, ir jis vis tiek atsisako — nes tikras sargas yra WHERE status = 'draft' užklausoje, ne Go if.

documents.sql MODIFIKUOTI 12 eilučių pakeista

Redaguok šį failą kataloge internal/db/queries/

-- name: CreateDocument :one
INSERT INTO documents (owner_id, filename, content_type, size, file_hash, storage_key)
VALUES ($1, $2, $3, $4, $5, $6)
RETURNING *;

-- name: ListDocumentsByOwner :many
SELECT * FROM documents
WHERE owner_id = $1
ORDER BY created_at DESC;

-- name: GetDocumentForOwner :one
-- Owner-scoped read: returns nothing if the document belongs to someone else,
-- so authorization is enforced in the query, not just the handler.
SELECT * FROM documents
WHERE id = $1 AND owner_id = $2;

-- name: DeleteDraftDocument :execrows
-- Deletes only if the caller owns it AND it is still a draft. Returns the number
-- of rows affected so the handler can tell "deleted" from "not allowed".
DELETE FROM documents
WHERE id = $1 AND owner_id = $2 AND status = 'draft';

documents.go MODIFIKUOTI 112 eilučių pakeista

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgtype"

	"github.com/programuoki/signflow/internal/db"
	"github.com/programuoki/signflow/internal/web"
)

// Dashboard lists the signed-in user's documents.
func (h *Handlers) Dashboard(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.Dashboard(h.nav(r), viewDocuments(docs)))
}

// UploadDocument accepts a multipart file, hashes and stores it, and records it
// as a draft owned by the current user.
func (h *Handlers) UploadDocument(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)

	// Cap the request body. +1KiB slack covers multipart field overhead so a
	// file exactly at the limit still succeeds.
	r.Body = http.MaxBytesReader(w, r.Body, h.Cfg.MaxUploadBytes+1024)

	file, header, err := r.FormFile("file")
	if err != nil {
		// Covers both "no file" and "too large" (MaxBytesReader error).
		h.Log.Warn("upload rejected", "err", err, "user", user.Email)
		http.Error(w, "upload failed: file missing or too large", http.StatusRequestEntityTooLarge)
		return
	}
	defer file.Close()

	if header.Size == 0 {
		http.Error(w, "upload failed: empty file", http.StatusBadRequest)
		return
	}

	contentType := header.Header.Get("Content-Type")
	if contentType == "" {
		contentType = "application/octet-stream"
	}

	// The store hashes while it writes — the file is never fully in memory.
	key, size, hash, err := h.Store.Save(r.Context(), file)
	if err != nil {
		h.serverError(w, r, "store file", err)
		return
	}

	doc, err := h.Queries.CreateDocument(r.Context(), db.CreateDocumentParams{
		OwnerID:     user.ID,
		Filename:    sanitizeFilename(header.Filename),
		ContentType: contentType,
		Size:        size,
		FileHash:    hash,
		StorageKey:  key,
	})
	if err != nil {
		_ = h.Store.Delete(r.Context(), key) // don't orphan the blob
		h.serverError(w, r, "create document", err)
		return
	}
	h.Log.Info("document uploaded", "id", doc.ID.String(), "owner", user.Email, "size", size, "sha256", hash)

	h.respondWithDocList(w, r, user)
}

// ViewDocument renders a single document's detail page. Owner only: ownedDocument
// enforces that in the query, returning 404 for anything the user doesn't own.
func (h *Handlers) ViewDocument(w http.ResponseWriter, r *http.Request) {
	doc, ok := h.ownedDocument(w, r)
	if !ok {
		return
	}
	render(w, r, http.StatusOK, web.DocumentDetail(h.nav(r), viewDocument(doc)))
}

// DownloadDocument streams the stored file back with its original name (owner only).
func (h *Handlers) DownloadDocument(w http.ResponseWriter, r *http.Request) {
	doc, ok := h.ownedDocument(w, r)
	if !ok {
		return
	}
	rc, err := h.Store.Open(r.Context(), doc.StorageKey)
	if err != nil {
		h.serverError(w, r, "open file", err)
		return
	}
	defer rc.Close()

	safe := sanitizeFilename(doc.Filename)
	w.Header().Set("Content-Type", doc.ContentType)
	w.Header().Set("Content-Length", fmt.Sprintf("%d", doc.Size))
	// Provide both a plain ASCII filename and a UTF-8 one per RFC 6266.
	w.Header().Set("Content-Disposition",
		fmt.Sprintf("attachment; filename=%q; filename*=UTF-8''%s", safe, url.PathEscape(doc.Filename)))
	if _, err := io.Copy(w, rc); err != nil {
		h.Log.Warn("stream download", "err", err, "id", doc.ID.String())
	}
}

// DeleteDocument deletes a draft the user owns. Non-drafts are refused — the
// first real business rule: once a document is sent, its record is immutable.
func (h *Handlers) DeleteDocument(w http.ResponseWriter, r *http.Request) {
	user := mustUser(r)
	id, ok := parseUUID(chiURLParam(r, "id"))
	if !ok {
		http.NotFound(w, r)
		return
	}

	doc, err := h.Queries.GetDocumentForOwner(r.Context(), db.GetDocumentForOwnerParams{ID: id, OwnerID: user.ID})
	if errors.Is(err, pgx.ErrNoRows) {
		http.NotFound(w, r) // not owned / not found — don't leak which
		return
	}
	if err != nil {
		h.serverError(w, r, "get document", err)
		return
	}
	if doc.Status != "draft" {
		http.Error(w, "only draft documents can be deleted", http.StatusUnprocessableEntity)
		return
	}

	// The query is the real guard: it filters owner_id AND status='draft', so even
	// without the check above a sent or foreign document deletes zero rows.
	n, err := h.Queries.DeleteDraftDocument(r.Context(), db.DeleteDraftDocumentParams{ID: id, OwnerID: user.ID})
	if err != nil {
		h.serverError(w, r, "delete document", err)
		return
	}
	if n == 1 {
		// Best-effort blob cleanup; a leftover file is harmless.
		_ = h.Store.Delete(r.Context(), doc.StorageKey)
		h.Log.Info("document deleted", "id", doc.ID.String(), "owner", user.Email)
	}

	h.respondWithDocList(w, r, user)
}

// --- helpers ---

// ownedDocument loads the {id} document if the current user owns it, else writes
// a 404 and returns ok=false.
func (h *Handlers) ownedDocument(w http.ResponseWriter, r *http.Request) (db.Document, bool) {
	user := mustUser(r)
	id, ok := parseUUID(chiURLParam(r, "id"))
	if !ok {
		http.NotFound(w, r)
		return db.Document{}, false
	}
	doc, err := h.Queries.GetDocumentForOwner(r.Context(), db.GetDocumentForOwnerParams{ID: id, OwnerID: user.ID})
	if errors.Is(err, pgx.ErrNoRows) {
		http.NotFound(w, r)
		return db.Document{}, false
	}
	if err != nil {
		h.serverError(w, r, "get document", err)
		return db.Document{}, false
	}
	return doc, true
}

// respondWithDocList returns the refreshed list partial to HTMX callers, or
// redirects to the dashboard for a plain form post.
func (h *Handlers) respondWithDocList(w http.ResponseWriter, r *http.Request, user db.User) {
	if r.Header.Get("HX-Request") == "" {
		http.Redirect(w, r, "/dashboard", http.StatusSeeOther)
		return
	}
	docs, err := h.Queries.ListDocumentsByOwner(r.Context(), user.ID)
	if err != nil {
		h.serverError(w, r, "list documents", err)
		return
	}
	render(w, r, http.StatusOK, web.DocumentList(viewDocuments(docs)))
}

func mustUser(r *http.Request) db.User {
	u, _ := UserFrom(r.Context()) // routes are behind RequireAuth
	return u
}

func parseUUID(s string) (pgtype.UUID, bool) {
	var u pgtype.UUID
	if err := u.Scan(s); err != nil {
		return u, false
	}
	return u, u.Valid
}

// sanitizeFilename strips path separators and control characters so a filename
// can't traverse directories or inject headers.
func sanitizeFilename(name string) string {
	name = strings.ReplaceAll(name, "\\", "/")
	if i := strings.LastIndex(name, "/"); i >= 0 {
		name = name[i+1:]
	}
	name = strings.Map(func(rn rune) rune {
		if rn < 0x20 || rn == 0x7f || rn == '"' {
			return -1
		}
		return rn
	}, name)
	name = strings.TrimSpace(name)
	if name == "" {
		return "document"
	}
	return name
}

documents.templ MODIFIKUOTI 51 eilutė pakeista

Redaguok šį failą kataloge internal/web/

package web

import "fmt"

// DocumentList is the swappable partial that HTMX refreshes after upload/delete.
// Its id="doc-list" is the hx-target the upload form swaps.
templ DocumentList(docs []DocumentView) {
	<section id="doc-list" class="card">
		<h2>Documents</h2>
		if len(docs) == 0 {
			<p class="muted">No documents yet. Upload one above to get started.</p>
		} else {
			<table class="table">
				<thead>
					<tr>
						<th>Name</th>
						<th>Status</th>
						<th>Size</th>
						<th>Uploaded</th>
						<th></th>
					</tr>
				</thead>
				<tbody>
					for _, d := range docs {
						@documentRow(d)
					}
				</tbody>
			</table>
		}
	</section>
}

templ documentRow(d DocumentView) {
	<tr>
		<td><a href={ templ.SafeURL("/documents/" + d.ID) }>{ d.Filename }</a></td>
		<td><span class={ "pill", "pill-" + d.Status }>{ d.Status }</span></td>
		<td>{ d.SizeHuman }</td>
		<td>{ d.CreatedAt }</td>
		<td class="row-actions">
			<a class="btn btn-ghost btn-sm" href={ templ.SafeURL("/documents/" + d.ID) }>View</a>
			if d.IsDraft {
				<button
					class="btn btn-danger btn-sm"
					hx-post={ "/documents/" + d.ID + "/delete" }
					hx-target="#doc-list"
					hx-swap="outerHTML"
					hx-confirm={ fmt.Sprintf("Delete draft %q? This can't be undone.", d.Filename) }
				>Delete</button>
			}
		</td>
	</tr>
}

// DocumentDetail shows a document's metadata and integrity hash, with download
// and (while it is a draft) delete. The signer roster and audit trail arrive in
// later lessons.
templ DocumentDetail(nav Nav, d DocumentView) {
	@Layout(d.Filename, nav) {
		<p><a href="/dashboard">← Back to documents</a></p>
		<section class="card">
			<div class="doc-head">
				<h1>{ d.Filename }</h1>
				<span class={ "pill", "pill-" + d.Status }>{ d.Status }</span>
			</div>
			<dl class="meta">
				<dt>Type</dt>
				<dd>{ d.ContentType }</dd>
				<dt>Size</dt>
				<dd>{ d.SizeHuman }</dd>
				<dt>Uploaded</dt>
				<dd>{ d.CreatedAt }</dd>
				<dt>SHA-256</dt>
				<dd><code class="hash">{ d.FileHash }</code></dd>
			</dl>
			<div class="cta-row">
				<a class="btn btn-primary" href={ templ.SafeURL("/documents/" + d.ID + "/download") }>Download</a>
				if d.IsDraft {
					<form method="post" action={ templ.SafeURL("/documents/" + d.ID + "/delete") } class="inline-form">
						@authCSRF(nav.CSRFToken)
						<button class="btn btn-danger" type="submit">Delete draft</button>
					</form>
				}
			</div>
		</section>
	}
}

router.go MODIFIKUOTI 3 eilutės pakeistos

Redaguok šį failą kataloge internal/handlers/

package handlers

import (
	"io/fs"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	"github.com/gorilla/csrf"
)

// Router builds the Chi router with the middleware stack and all routes.
//
// csrfKey must be 32 bytes; it authenticates the CSRF token cookie.
func (h *Handlers) Router(staticFS fs.FS, csrfKey []byte) http.Handler {
	r := chi.NewRouter()

	// Base middleware, outermost first.
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)    // request logging
	r.Use(middleware.Recoverer) // turn panics into 500s instead of crashing

	// In dev we serve plaintext HTTP on localhost. gorilla/csrf otherwise assumes
	// TLS and enforces a strict Origin/Referer check that rejects http:// origins.
	// Marking dev requests plaintext relaxes that ONE check while keeping the
	// token check. Production (HTTPS at Railway's edge) is NOT marked, so it keeps
	// the full strict-origin protection.
	if !h.Cfg.IsProd() {
		r.Use(func(next http.Handler) http.Handler {
			return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
				next.ServeHTTP(w, csrf.PlaintextHTTPRequest(req))
			})
		})
	}

	// CSRF: enforced on all unsafe methods (POST/PUT/PATCH/DELETE). Safe methods
	// pass through but get the token cookie set so forms can embed it. The field
	// name matches the hidden input our templates render.
	csrfMW := csrf.Protect(
		csrfKey,
		csrf.Secure(h.Cfg.IsProd()),
		csrf.Path("/"),
		csrf.SameSite(csrf.SameSiteLaxMode),
		csrf.FieldName("gorilla.csrf.Token"),
	)
	r.Use(csrfMW)

	// Resolve the session cookie into the request context for every route.
	r.Use(h.LoadUser)

	// Static assets (CSS, vendored htmx), served from the embedded FS.
	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.FS(staticFS))))

	// Public routes.
	r.Get("/", h.Home)
	r.Get("/healthz", h.Health)

	// Auth routes.
	r.Get("/register", h.RegisterForm)
	r.Post("/register", h.Register)
	r.Get("/login", h.LoginForm)
	r.Post("/login", h.Login)
	r.Post("/logout", h.Logout)
	r.Get("/forgot", h.ForgotForm)
	r.Post("/forgot", h.Forgot)
	r.Get("/reset/{token}", h.ResetForm)
	r.Post("/reset/{token}", h.Reset)

	// Authenticated routes.
	r.Group(func(pr chi.Router) {
		pr.Use(h.RequireAuth)
		pr.Get("/dashboard", h.Dashboard)
		pr.Post("/documents", h.UploadDocument)
		pr.Get("/documents/{id}", h.ViewDocument)
		pr.Get("/documents/{id}/download", h.DownloadDocument)
		pr.Post("/documents/{id}/delete", h.DeleteDocument)
	})

	return r
}