notes

4.6 KB

1. // lib/api.hl — THE FUNCTION ROUTES (notes mission 002, code order): thin wrappers — check the input and the session,
2. // call the topic (lib/notes.hl, lib/users.hl), answer.
3. //
4. // THE LOGIN BUTTON'S RETURN (ident README "How apps use ident"): /login/callback?ident_code=&next= → the user
5. // (lib/users.hl userOfLoginCode) → the session is signed in → back to `next` (lib/api-helpers.hl safePath). A FAILED
6. // LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed.
7. // These two write the session: project.hl hands them the request and the session store BY REFERENCE (&req, &sessions);
8. // a by-value copy would lose the write (tickets mission 010, gitoria mission 002).
9. //
10. // THE SYNC API (ticket notes#2): what the browser's offline copy talks to. JSON, the session cookie is the login.
11. // GET /api/me → { user } (an opaque id of the signed-in user, or null)
12. // GET /api/notes → { notes: [{ id, edited, gone }] } every note of the user, tombstones included
13. // GET /api/notes?id=<id> → { id, text, edited, created }
14. // POST /api/notes { op: 'save', id, local, text, base, at } → { id, edited, text, copy? }
15. // POST /api/notes { op: 'delete', id, base } → { ok } | { kept, id, edited, text }
16. // Invalid JSON is refused by lib/jsoncheck.hl before JSON.parse sees it (hybriel #6); unknown/mistyped fields → 400.
17. import { Response } from 'hl:http1'
18. import { randomBytes } from 'hl:crypto'
19. import { userOfLoginCode, userIdOfSession } from './users.hl'
20. import { metaRows, noteView, pushNote, removeNote } from './notes.hl'
21. import { jsonErrorAt } from './jsoncheck.hl'
22. import { reply, isText, isTime, safePath } from './api-helpers.hl'
24. static loginFailed = (&req, &sessions, why) => {
25. let s = req.session
26. fresh = s == null
27. if (fresh) { s = sessions.mint() }
28. s.data.loginError = why
29. sessions.save(s)
30. res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
31. if (fresh) { res.headers['Set-Cookie'] = sessions.cookieHeader(s.id) }
32. return res
33. }
35. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
36. static loginCallback = (route, &req, &sessions) => {
37. if (req.method != 'GET') { return loginFailed(&req, &sessions, 'GET only') }
38. q = req.query != null ? req.query : {}
39. code = q.ident_code
40. if (code == null || code == '') { return loginFailed(&req, &sessions, 'ident sent no login code') }
41. x = userOfLoginCode(code)
42. if (x.error != null) { return loginFailed(&req, &sessions, x.error) }
43. let s = req.session
44. fresh = s == null
45. if (fresh) { s = sessions.mint() }
46. s.user = { id = x.user.id }
47. s.data.tag = randomBytes(16)
48. s.data.loginError = null
49. sessions.save(s)
50. res = new Response('logged in', { status = 302 headers = { 'Location' = safePath(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
51. if (fresh) { res.headers['Set-Cookie'] = sessions.cookieHeader(s.id) }
52. return res
53. }
55. static apiMe = (route, req) => {
56. u = userIdOfSession(req.session)
57. return reply(200, { user = u })
58. }
60. static apiNotes = (route, req) => {
61. u = userIdOfSession(req.session)
62. if (u == null) { return reply(401, { error = 'log in with ident first' }) }
63. q = req.query != null ? req.query : {}
64. if (req.method == 'GET') {
65. if (q.id != null) {
66. v = noteView(u, q.id)
67. if (v == null) { return reply(404, { error = 'no such note' }) }
68. return reply(200, v)
69. }
70. return reply(200, { notes = metaRows(u) })
71. }
72. if (req.method != 'POST') { return reply(405, { error = 'GET or POST only' }) }
73. if (req.body == null || req.body == '') { return reply(400, { error = 'a JSON body is needed' }) }
74. at = jsonErrorAt(req.body)
75. if (at >= 0) { return reply(400, { error = 'invalid JSON at character ' + at }) }
76. b = JSON.parse(req.body)
77. if (b == null || hlTypeName(b) != 'Hybrid') { return reply(400, { error = 'the body must be a JSON object' }) }
78. if (b.op == 'save') {
79. if (!isText(b.id) || !isText(b.local) || !isText(b.text) || !isTime(b.base) || !isTime(b.at)) { return reply(400, { error = 'save needs id, local, text (strings) and base, at (numbers)' }) }
80. if (b.local.length > 64 || b.id.length > 64) { return reply(400, { error = 'id / local too long' }) }
81. r = pushNote(u, b.id, b.local, b.text, b.base, b.at)
82. if (r.error != null) { return reply(400, r) }
83. return reply(200, r)
84. }
85. if (b.op == 'delete') {
86. if (!isText(b.id) || !isTime(b.base)) { return reply(400, { error = 'delete needs id (string) and base (number)' }) }
87. return reply(200, removeNote(u, b.id, b.base))
88. }
89. return reply(400, { error = "op must be 'save' or 'delete'" })
90. }