file-service/src/handlers.rs

@@ -88,24 +88,21 @@ pub async fn handle_auth(
     form: HashMap<String, String>,
 ) -> Result<http::Response<String>, Error> {
     match form.get("token") {
-        Some(token) => {
+        Some(token) => match app.authenticate(AuthToken::from(token.clone())).await {
-            println!("token: {:?}", token);
+            Ok(Some(session_token)) => Response::builder()
-            match app.authenticate(AuthToken::from(token.clone())).await {
+                .header("location", "/")
-                Ok(Some(session_token)) => Response::builder()
+                .header(
-                    .header("location", "/")
+                    "set-cookie",
-                    .header(
+                    format!(
-                        "set-cookie",
+                        "session={}; Secure; HttpOnly; SameSite=Strict",
-                        format!(
+                        *session_token
-                            "session={}; Secure; HttpOnly; SameSite=Strict",
+                    ),
-                            *session_token
+                )
-                        ),
+                .status(StatusCode::SEE_OTHER)
-                    )
+                .body("".to_owned()),
-                    .status(StatusCode::SEE_OTHER)
+            Ok(None) => render_auth_page(Some("no user found".to_owned())),
-                    .body("".to_owned()),
+            Err(_) => render_auth_page(Some("invalid auth token".to_owned())),
-                Ok(None) => render_auth_page(Some("no user found".to_owned())),
+        },
-                Err(_) => render_auth_page(Some("invalid auth token".to_owned())),
-            }
-        }
         None => render_auth_page(Some("no token available".to_owned())),
     }
 }
@@ -137,25 +134,6 @@ pub async fn handle_upload(
     }
 }
 
-pub async fn handle_delete(
-    app: App,
-    token: SessionToken,
-    id: FileId,
-) -> Result<http::Response<String>, Error> {
-    match app.validate_session(token).await {
-        Ok(Some(_)) => match app.delete_file(id).await {
-            Ok(_) => Response::builder()
-                .header("location", "/")
-                .status(StatusCode::SEE_OTHER)
-                .body("".to_owned()),
-            Err(_) => unimplemented!(),
-        },
-        _ => Response::builder()
-            .status(StatusCode::UNAUTHORIZED)
-            .body("".to_owned()),
-    }
-}
-
 fn serve_file<F>(
     info: FileInfo,
     file: F,

file-service/src/html.rs

@@ -74,7 +74,7 @@ impl Html for Form {
             None => "".to_owned(),
         };
         format!(
-            "<form action=\"{path}\" method=\"{method}\" {encoding}>\n{elements}\n</form>\n",
+            "<form action=\"{path}\" method=\"{method}\" {encoding}\n{elements}\n</form>\n",
             path = self.path,
             method = self.method,
             encoding = encoding,

file-service/src/lib.rs

@@ -1,6 +1,6 @@
 mod store;
 
 pub use store::{
-    AuthDB, AuthError, AuthToken, DeleteFileError, FileHandle, FileId, FileInfo, ReadFileError,
+    AuthDB, AuthError, AuthToken, FileHandle, FileId, FileInfo, ReadFileError, SessionToken, Store,
-    SessionToken, Store, Username, WriteFileError,
+    Username, WriteFileError,
 };

file-service/src/main.rs

@@ -1,7 +1,7 @@
 extern crate log;
 
 use cookie::Cookie;
-use handlers::{file, handle_auth, handle_css, handle_delete, handle_upload, thumbnail};
+use handlers::{file, handle_auth, handle_css, handle_upload, thumbnail};
 use std::{
     collections::{HashMap, HashSet},
     convert::Infallible,
@@ -19,8 +19,8 @@ mod pages;
 const MAX_UPLOAD: u64 = 15 * 1024 * 1024;
 
 pub use file_service::{
-    AuthDB, AuthError, AuthToken, DeleteFileError, FileHandle, FileId, FileInfo, ReadFileError,
+    AuthDB, AuthError, AuthToken, FileHandle, FileId, FileInfo, ReadFileError, SessionToken, Store,
-    SessionToken, Store, Username, WriteFileError,
+    Username, WriteFileError,
 };
 pub use handlers::handle_index;
 
@@ -64,11 +64,6 @@ impl App {
     ) -> Result<FileHandle, WriteFileError> {
         self.store.write().await.add_file(filename, content)
     }
-
-    pub async fn delete_file(&self, id: FileId) -> Result<(), DeleteFileError> {
-        self.store.write().await.delete_file(&id)?;
-        Ok(())
-    }
 }
 
 fn with_app(app: App) -> impl Filter<Extract = (App,), Error = Infallible> + Clone {
@@ -139,12 +134,6 @@ pub async fn main() {
         .and(warp::multipart::form().max_length(MAX_UPLOAD))
         .then(handle_upload);
 
-    let delete_via_form = warp::path!("delete" / String)
-        .and(warp::post())
-        .and(with_app(app.clone()))
-        .and(with_session())
-        .then(|id, app, token| handle_delete(app, token, FileId::from(id)));
-
     let thumbnail = warp::path!(String / "tn")
         .and(warp::get())
         .and(warp::header::optional::<String>("if-none-match"))
@@ -161,7 +150,6 @@ pub async fn main() {
         root.or(styles)
             .or(auth)
             .or(upload_via_form)
-            .or(delete_via_form)
             .or(thumbnail)
             .or(file)
             .with(log),

file-service/src/pages.rs

@@ -102,8 +102,9 @@ pub fn thumbnail(info: &FileInfo) -> Container {
                 )
                 .with_html(
                     Form::new()
-                        .with_path(&format!("/delete/{}", *info.id))
+                        .with_path(&format!("/{}", *info.id))
                         .with_method("post")
+                        .with_html(Input::new("hidden", "_method").with_value("delete"))
                         .with_html(Button::new("Delete")),
                 ),
         )

file-service/src/store/mod.rs

@@ -53,6 +53,9 @@ pub enum ReadFileError {
     #[error("permission denied")]
     PermissionDenied,
 
+    #[error("invalid path")]
+    InvalidPath,
+
     #[error("JSON error")]
     JSONError(#[from] serde_json::error::Error),
 
@@ -60,36 +63,6 @@ pub enum ReadFileError {
     IOError(#[from] std::io::Error),
 }
 
-#[derive(Debug, Error)]
-pub enum DeleteFileError {
-    #[error("file not found")]
-    FileNotFound(PathBuf),
-
-    #[error("metadata path is not a file")]
-    NotAFile,
-
-    #[error("cannot read metadata")]
-    PermissionDenied,
-
-    #[error("invalid metadata path")]
-    MetadataParseError(serde_json::error::Error),
-
-    #[error("IO error")]
-    IOError(#[from] std::io::Error),
-}
-
-impl From<ReadFileError> for DeleteFileError {
-    fn from(err: ReadFileError) -> Self {
-        match err {
-            ReadFileError::FileNotFound(path) => DeleteFileError::FileNotFound(path),
-            ReadFileError::NotAFile => DeleteFileError::NotAFile,
-            ReadFileError::PermissionDenied => DeleteFileError::PermissionDenied,
-            ReadFileError::JSONError(err) => DeleteFileError::MetadataParseError(err),
-            ReadFileError::IOError(err) => DeleteFileError::IOError(err),
-        }
-    }
-}
-
 #[derive(Debug, Error)]
 pub enum AuthError {
     #[error("authentication token is duplicated")]
@@ -396,7 +369,7 @@ impl Store {
         FileHandle::load(id, &self.files_root)
     }
 
-    pub fn delete_file(&mut self, id: &FileId) -> Result<(), DeleteFileError> {
+    pub fn delete_file(&mut self, id: &FileId) -> Result<(), WriteFileError> {
         let handle = FileHandle::load(id, &self.files_root)?;
         handle.delete();
         Ok(())