This is some html, which is allowed in short descriptions.
", + }) + if err != nil { + panic(err) + } + bodyBytes := requestBody.Bytes() + + // set up the request + recorder := httptest.NewRecorder() + ctx := suite.newContext(recorder, http.MethodPatch, bodyBytes, instance.InstanceInformationPath, w.FormDataContentType()) + + ctx.Set(oauth.SessionAuthorizedAccount, suite.testAccounts["local_account_1"]) + ctx.Set(oauth.SessionAuthorizedToken, oauth.DBTokenToToken(suite.testTokens["local_account_1"])) + ctx.Set(oauth.SessionAuthorizedApplication, suite.testApplications["application_1"]) + ctx.Set(oauth.SessionAuthorizedUser, suite.testUsers["local_account_1"]) + + // call the handler + suite.instanceModule.InstanceUpdatePATCHHandler(ctx) + + suite.Equal(http.StatusForbidden, recorder.Code) + + result := recorder.Result() + defer result.Body.Close() + + b, err := io.ReadAll(result.Body) + suite.NoError(err) + + suite.Equal(`{"error":"Forbidden: user is not an admin so cannot update instance settings"}`, string(b)) +} + func TestInstancePatchTestSuite(t *testing.T) { suite.Run(t, &InstancePatchTestSuite{}) } diff --git a/internal/api/client/list/listsgets.go b/internal/api/client/list/listsgets.go index 184830290..246a1216a 100644 --- a/internal/api/client/list/listsgets.go +++ b/internal/api/client/list/listsgets.go @@ -5,12 +5,19 @@ import ( "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" + "github.com/superseriousbusiness/gotosocial/internal/oauth" ) // ListsGETHandler returns a list of lists created by/for the authed account func (m *Module) ListsGETHandler(c *gin.Context) { + if _, err := oauth.Authed(c, true, true, true, true); err != nil { + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) + return + } + if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } diff --git a/internal/api/client/media/mediacreate.go b/internal/api/client/media/mediacreate.go index ed6a12d37..f51d272b6 100644 --- a/internal/api/client/media/mediacreate.go +++ b/internal/api/client/media/mediacreate.go @@ -23,12 +23,11 @@ import ( "fmt" "net/http" - "github.com/sirupsen/logrus" - "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/config" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -80,46 +79,36 @@ import ( // description: bad request // '401': // description: unauthorized -// '403': -// description: forbidden // '422': // description: unprocessable +// '500': +// description: internal server error func (m *Module) MediaCreatePOSTHandler(c *gin.Context) { - l := logrus.WithField("func", "statusCreatePOSTHandler") - authed, err := oauth.Authed(c, true, true, true, true) // posting new media is serious business so we want *everything* + authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("couldn't auth: %s", err) - c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } - // extract the media create form from the request context - l.Tracef("parsing request form: %s", c.Request.Form) form := &model.AttachmentRequest{} if err := c.ShouldBind(&form); err != nil { - l.Debugf("error parsing form: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Errorf("could not parse form: %s", err)}) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - // Give the fields on the request form a first pass to make sure the request is superficially valid. - l.Tracef("validating form %+v", form) if err := validateCreateMedia(form); err != nil { - l.Debugf("error validating form: %s", err) - c.JSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - l.Debug("calling processor media create func") - apiAttachment, err := m.processor.MediaCreate(c.Request.Context(), authed, form) + apiAttachment, errWithCode := m.processor.MediaCreate(c.Request.Context(), authed, form) if err != nil { - l.Debugf("error creating attachment: %s", err) - c.JSON(http.StatusUnprocessableEntity, gin.H{"error": err.Error()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } @@ -143,6 +132,7 @@ func validateCreateMedia(form *model.AttachmentRequest) error { if maxImageSize > maxSize { maxSize = maxImageSize } + if form.File.Size > int64(maxSize) { return fmt.Errorf("file size limit exceeded: limit is %d bytes but attachment was %d bytes", maxSize, form.File.Size) } diff --git a/internal/api/client/media/mediacreate_test.go b/internal/api/client/media/mediacreate_test.go index f39e756f7..47dd9ac3f 100644 --- a/internal/api/client/media/mediacreate_test.go +++ b/internal/api/client/media/mediacreate_test.go @@ -247,15 +247,14 @@ func (suite *MediaCreateTestSuite) TestMediaCreateLongDescription() { suite.mediaModule.MediaCreatePOSTHandler(ctx) // check response - suite.EqualValues(http.StatusUnprocessableEntity, recorder.Code) + suite.EqualValues(http.StatusBadRequest, recorder.Code) result := recorder.Result() defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) suite.NoError(err) - expectedErr := fmt.Sprintf(`{"error":"image description length must be between 0 and 500 characters (inclusive), but provided image description was %d chars"}`, len(description)) - suite.Equal(expectedErr, string(b)) + suite.Equal(`{"error":"Bad Request: image description length must be between 0 and 500 characters (inclusive), but provided image description was 6667 chars"}`, string(b)) } func (suite *MediaCreateTestSuite) TestMediaCreateTooShortDescription() { diff --git a/internal/api/client/media/mediaget.go b/internal/api/client/media/mediaget.go index 46057d219..c2a0ab7a0 100644 --- a/internal/api/client/media/mediaget.go +++ b/internal/api/client/media/mediaget.go @@ -19,12 +19,12 @@ package media import ( + "errors" "net/http" - "github.com/sirupsen/logrus" - "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -59,33 +59,34 @@ import ( // description: bad request // '401': // description: unauthorized -// '403': -// description: forbidden -// '422': -// description: unprocessable +// '404': +// description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) MediaGETHandler(c *gin.Context) { - l := logrus.WithField("func", "MediaGETHandler") authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("couldn't auth: %s", err) - c.JSON(http.StatusForbidden, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } attachmentID := c.Param(IDKey) if attachmentID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no attachment ID given in request"}) + err := errors.New("no attachment id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } attachment, errWithCode := m.processor.MediaGet(c.Request.Context(), authed, attachmentID) if errWithCode != nil { - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/media/mediaupdate.go b/internal/api/client/media/mediaupdate.go index 21b8c9c8e..32aef9cff 100644 --- a/internal/api/client/media/mediaupdate.go +++ b/internal/api/client/media/mediaupdate.go @@ -23,12 +23,11 @@ import ( "fmt" "net/http" - "github.com/sirupsen/logrus" - "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/config" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -89,50 +88,45 @@ import ( // description: bad request // '401': // description: unauthorized -// '403': -// description: forbidden -// '422': -// description: unprocessable +// '404': +// description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) MediaPUTHandler(c *gin.Context) { - l := logrus.WithField("func", "MediaGETHandler") authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("couldn't auth: %s", err) - c.JSON(http.StatusForbidden, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } attachmentID := c.Param(IDKey) if attachmentID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no attachment ID given in request"}) + err := errors.New("no attachment id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - // extract the media update form from the request context - l.Tracef("parsing request form: %s", c.Request.Form) - var form model.AttachmentUpdateRequest - if err := c.ShouldBind(&form); err != nil { - l.Debugf("could not parse form from request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "missing one or more required form values"}) + form := &model.AttachmentUpdateRequest{} + if err := c.ShouldBind(form); err != nil { + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - // Give the fields on the request form a first pass to make sure the request is superficially valid. - l.Tracef("validating form %+v", form) - if err := validateUpdateMedia(&form); err != nil { - l.Debugf("error validating form: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + if err := validateUpdateMedia(form); err != nil { + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - attachment, errWithCode := m.processor.MediaUpdate(c.Request.Context(), authed, attachmentID, &form) + attachment, errWithCode := m.processor.MediaUpdate(c.Request.Context(), authed, attachmentID, form) if errWithCode != nil { - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/media/mediaupdate_test.go b/internal/api/client/media/mediaupdate_test.go index fbf794e1d..d25eddd4d 100644 --- a/internal/api/client/media/mediaupdate_test.go +++ b/internal/api/client/media/mediaupdate_test.go @@ -232,7 +232,7 @@ func (suite *MediaUpdateTestSuite) TestUpdateImageShortDescription() { suite.NoError(err) // reply should be an error message - suite.Equal(`{"error":"image description length must be between 50 and 500 characters (inclusive), but provided image description was 16 chars"}`, string(b)) + suite.Equal(`{"error":"Bad Request: image description length must be between 50 and 500 characters (inclusive), but provided image description was 16 chars"}`, string(b)) } func TestMediaUpdateTestSuite(t *testing.T) { diff --git a/internal/api/client/notification/notificationsget.go b/internal/api/client/notification/notificationsget.go index b6f7cdd01..88220107e 100644 --- a/internal/api/client/notification/notificationsget.go +++ b/internal/api/client/notification/notificationsget.go @@ -19,34 +19,26 @@ package notification import ( + "fmt" "net/http" "strconv" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) // NotificationsGETHandler serves a list of notifications to the caller, with the desired query parameters func (m *Module) NotificationsGETHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "NotificationsGETHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - - authed, err := oauth.Authed(c, true, true, true, true) // we don't really need an app here but we want everything else + authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Errorf("error authing status faved by request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "not authed"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } @@ -55,8 +47,8 @@ func (m *Module) NotificationsGETHandler(c *gin.Context) { if limitString != "" { i, err := strconv.ParseInt(limitString, 10, 64) if err != nil { - l.Debugf("error parsing limit string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse limit query param"}) + err := fmt.Errorf("error parsing %s: %s", LimitKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } limit = int(i) @@ -76,8 +68,7 @@ func (m *Module) NotificationsGETHandler(c *gin.Context) { resp, errWithCode := m.processor.NotificationsGet(c.Request.Context(), authed, limit, maxID, sinceID) if errWithCode != nil { - l.Debugf("error processing notifications get: %s", errWithCode.Error()) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/search/searchget.go b/internal/api/client/search/searchget.go index f9cbba38a..8db49ebfd 100644 --- a/internal/api/client/search/searchget.go +++ b/internal/api/client/search/searchget.go @@ -19,14 +19,15 @@ package search import ( + "errors" "fmt" "net/http" "strconv" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" "github.com/superseriousbusiness/gotosocial/internal/api/model" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -52,50 +53,44 @@ import ( // type: array // items: // "$ref": "#/definitions/searchResult" -// '401': -// description: unauthorized // '400': // description: bad request +// '401': +// description: unauthorized +// '404': +// description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) SearchGETHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "SearchGETHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - - authed, err := oauth.Authed(c, true, true, true, true) // we don't really need an app here but we want everything else + authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Errorf("error authing search request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "not authed"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } - accountID := c.Query(AccountIDKey) - maxID := c.Query(MaxIDKey) - minID := c.Query(MinIDKey) - searchType := c.Query(TypeKey) - excludeUnreviewed := false excludeUnreviewedString := c.Query(ExcludeUnreviewedKey) if excludeUnreviewedString != "" { var err error excludeUnreviewed, err = strconv.ParseBool(excludeUnreviewedString) if err != nil { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("couldn't parse param %s: %s", excludeUnreviewedString, err)}) + err := fmt.Errorf("error parsing %s: %s", ExcludeUnreviewedKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } } query := c.Query(QueryKey) if query == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "query parameter q was empty"}) + err := errors.New("query parameter q was empty") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } @@ -105,18 +100,19 @@ func (m *Module) SearchGETHandler(c *gin.Context) { var err error resolve, err = strconv.ParseBool(resolveString) if err != nil { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("couldn't parse param %s: %s", resolveString, err)}) + err := fmt.Errorf("error parsing %s: %s", ResolveKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } } - limit := 20 + limit := 2 limitString := c.Query(LimitKey) if limitString != "" { i, err := strconv.ParseInt(limitString, 10, 64) if err != nil { - l.Debugf("error parsing limit string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse limit query param"}) + err := fmt.Errorf("error parsing %s: %s", LimitKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } limit = int(i) @@ -133,18 +129,12 @@ func (m *Module) SearchGETHandler(c *gin.Context) { if offsetString != "" { i, err := strconv.ParseInt(offsetString, 10, 64) if err != nil { - l.Debugf("error parsing offset string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse offset query param"}) + err := fmt.Errorf("error parsing %s: %s", OffsetKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } offset = int(i) } - if limit > 40 { - limit = 40 - } - if limit < 1 { - limit = 1 - } following := false followingString := c.Query(FollowingKey) @@ -152,16 +142,17 @@ func (m *Module) SearchGETHandler(c *gin.Context) { var err error following, err = strconv.ParseBool(followingString) if err != nil { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("couldn't parse param %s: %s", followingString, err)}) + err := fmt.Errorf("error parsing %s: %s", FollowingKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } } searchQuery := &model.SearchQuery{ - AccountID: accountID, - MaxID: maxID, - MinID: minID, - Type: searchType, + AccountID: c.Query(AccountIDKey), + MaxID: c.Query(MaxIDKey), + MinID: c.Query(MinIDKey), + Type: c.Query(TypeKey), ExcludeUnreviewed: excludeUnreviewed, Query: query, Resolve: resolve, @@ -172,8 +163,7 @@ func (m *Module) SearchGETHandler(c *gin.Context) { results, errWithCode := m.processor.SearchGet(c.Request.Context(), authed, searchQuery) if errWithCode != nil { - l.Debugf("error searching: %s", errWithCode.Error()) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusboost.go b/internal/api/client/status/statusboost.go index 25b2cf0e7..0642ad92e 100644 --- a/internal/api/client/status/statusboost.go +++ b/internal/api/client/status/statusboost.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -66,37 +67,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusBoostPOSTHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "StatusBoostPOSTHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debug("not authed so can't boost status") - c.JSON(http.StatusUnauthorized, gin.H{"error": "not authorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } apiStatus, errWithCode := m.processor.StatusBoost(c.Request.Context(), authed, targetStatusID) if errWithCode != nil { - l.Debugf("error processing status boost: %s", errWithCode.Error()) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusboost_test.go b/internal/api/client/status/statusboost_test.go index 42693d9e0..e33b582e8 100644 --- a/internal/api/client/status/statusboost_test.go +++ b/internal/api/client/status/statusboost_test.go @@ -134,13 +134,13 @@ func (suite *StatusBoostTestSuite) TestPostUnboostable() { suite.statusModule.StatusBoostPOSTHandler(ctx) // check response - suite.EqualValues(http.StatusForbidden, recorder.Code) // we 403 unboostable statuses + suite.Equal(http.StatusForbidden, recorder.Code) // we 403 unboostable statuses result := recorder.Result() defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) assert.NoError(suite.T(), err) - assert.Equal(suite.T(), `{"error":"forbidden"}`, string(b)) + assert.Equal(suite.T(), `{"error":"Forbidden"}`, string(b)) } // try to boost a status that's not visible to the user @@ -177,13 +177,7 @@ func (suite *StatusBoostTestSuite) TestPostNotVisible() { suite.statusModule.StatusBoostPOSTHandler(ctx) // check response - suite.EqualValues(http.StatusNotFound, recorder.Code) // we 404 statuses that aren't visible - - result := recorder.Result() - defer result.Body.Close() - b, err := ioutil.ReadAll(result.Body) - assert.NoError(suite.T(), err) - assert.Equal(suite.T(), `{"error":"404 not found"}`, string(b)) + suite.Equal(http.StatusNotFound, recorder.Code) // we 404 statuses that aren't visible } func TestStatusBoostTestSuite(t *testing.T) { diff --git a/internal/api/client/status/statusboostedby.go b/internal/api/client/status/statusboostedby.go index bd2578a12..382b38f7b 100644 --- a/internal/api/client/status/statusboostedby.go +++ b/internal/api/client/status/statusboostedby.go @@ -23,6 +23,7 @@ import ( "github.com/gin-gonic/gin" "github.com/sirupsen/logrus" + "github.com/superseriousbusiness/gotosocial/internal/api" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -84,10 +85,9 @@ func (m *Module) StatusBoostedByGETHandler(c *gin.Context) { return } - apiAccounts, err := m.processor.StatusBoostedBy(c.Request.Context(), authed, targetStatusID) - if err != nil { - l.Debugf("error processing status boosted by request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) + apiAccounts, errWithCode := m.processor.StatusBoostedBy(c.Request.Context(), authed, targetStatusID) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statuscontext.go b/internal/api/client/status/statuscontext.go index 32a0a89ba..0daefaec1 100644 --- a/internal/api/client/status/statuscontext.go +++ b/internal/api/client/status/statuscontext.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -65,37 +66,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusContextGETHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "StatusContextGETHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Errorf("error authing status context request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "not authed"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } statusContext, errWithCode := m.processor.StatusGetContext(c.Request.Context(), authed, targetStatusID) if errWithCode != nil { - l.Debugf("error getting status context: %s", errWithCode.Error()) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statuscreate.go b/internal/api/client/status/statuscreate.go index 2813efb90..dce6f1296 100644 --- a/internal/api/client/status/statuscreate.go +++ b/internal/api/client/status/statuscreate.go @@ -23,12 +23,11 @@ import ( "fmt" "net/http" - "github.com/sirupsen/logrus" - "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" "github.com/superseriousbusiness/gotosocial/internal/api/model" "github.com/superseriousbusiness/gotosocial/internal/config" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" "github.com/superseriousbusiness/gotosocial/internal/validate" ) @@ -61,58 +60,44 @@ import ( // description: "The newly created status." // schema: // "$ref": "#/definitions/status" -// '401': -// description: unauthorized // '400': // description: bad request +// '401': +// description: unauthorized +// '403': +// description: forbidden // '404': // description: not found +// '406': +// description: not acceptable // '500': -// description: internal error +// description: internal server error func (m *Module) StatusCreatePOSTHandler(c *gin.Context) { - l := logrus.WithField("func", "statusCreatePOSTHandler") authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("couldn't auth: %s", err) - c.JSON(http.StatusForbidden, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } - // First check this user/account is permitted to post new statuses. - // There's no point continuing otherwise. - if authed.User.Disabled || !authed.User.Approved || !authed.Account.SuspendedAt.IsZero() { - l.Debugf("couldn't auth: %s", err) - c.JSON(http.StatusForbidden, gin.H{"error": "account is disabled, not yet approved, or suspended"}) - return - } - - // extract the status create form from the request context - l.Debugf("parsing request form: %s", c.Request.Form) form := &model.AdvancedStatusCreateForm{} - if err := c.ShouldBind(form); err != nil || form == nil { - l.Debugf("could not parse form from request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "missing one or more required form values"}) + if err := c.ShouldBind(form); err != nil { + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - l.Debugf("handling status request form: %+v", form) - // Give the fields on the request form a first pass to make sure the request is superficially valid. - l.Tracef("validating form %+v", form) if err := validateCreateStatus(form); err != nil { - l.Debugf("error validating form: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - apiStatus, err := m.processor.StatusCreate(c.Request.Context(), authed, form) - if err != nil { - l.Debugf("error processing status create: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) + apiStatus, errWithCode := m.processor.StatusCreate(c.Request.Context(), authed, form) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } @@ -120,7 +105,6 @@ func (m *Module) StatusCreatePOSTHandler(c *gin.Context) { } func validateCreateStatus(form *model.AdvancedStatusCreateForm) error { - // validate that, structurally, we have a valid status/post if form.Status == "" && form.MediaIDs == nil && form.Poll == nil { return errors.New("no status, media, or poll provided") } @@ -135,19 +119,16 @@ func validateCreateStatus(form *model.AdvancedStatusCreateForm) error { maxPollChars := config.GetStatusesPollOptionMaxChars() maxCwChars := config.GetStatusesCWMaxChars() - // validate status if form.Status != "" { if len(form.Status) > maxChars { return fmt.Errorf("status too long, %d characters provided but limit is %d", len(form.Status), maxChars) } } - // validate media attachments if len(form.MediaIDs) > maxMediaFiles { return fmt.Errorf("too many media files attached to status, %d attached but limit is %d", len(form.MediaIDs), maxMediaFiles) } - // validate poll if form.Poll != nil { if form.Poll.Options == nil { return errors.New("poll with no options") @@ -162,14 +143,12 @@ func validateCreateStatus(form *model.AdvancedStatusCreateForm) error { } } - // validate spoiler text/cw if form.SpoilerText != "" { if len(form.SpoilerText) > maxCwChars { return fmt.Errorf("content-warning/spoilertext too long, %d characters provided but limit is %d", len(form.SpoilerText), maxCwChars) } } - // validate post language if form.Language != "" { if err := validate.Language(form.Language); err != nil { return err diff --git a/internal/api/client/status/statuscreate_test.go b/internal/api/client/status/statuscreate_test.go index a1df25547..61d0a5ee4 100644 --- a/internal/api/client/status/statuscreate_test.go +++ b/internal/api/client/status/statuscreate_test.go @@ -256,7 +256,7 @@ func (suite *StatusCreateTestSuite) TestReplyToNonexistentStatus() { defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) suite.NoError(err) - suite.Equal(`{"error":"bad request"}`, string(b)) + suite.Equal(`{"error":"Bad Request: status with id 3759e7ef-8ee1-4c0c-86f6-8b70b9ad3d50 not replyable because it doesn't exist"}`, string(b)) } // Post a reply to the status of a local user that allows replies. diff --git a/internal/api/client/status/statusdelete.go b/internal/api/client/status/statusdelete.go index 2b6a235f7..f9adccb57 100644 --- a/internal/api/client/status/statusdelete.go +++ b/internal/api/client/status/statusdelete.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -65,43 +66,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusDELETEHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "StatusDELETEHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debug("not authed so can't delete status") - c.JSON(http.StatusUnauthorized, gin.H{"error": "not authorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - apiStatus, err := m.processor.StatusDelete(c.Request.Context(), authed, targetStatusID) - if err != nil { - l.Debugf("error processing status delete: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) - return - } - - // the status was already gone/never existed - if apiStatus == nil { - c.JSON(http.StatusNotFound, gin.H{"error": "Record not found"}) + apiStatus, errWithCode := m.processor.StatusDelete(c.Request.Context(), authed, targetStatusID) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusfave.go b/internal/api/client/status/statusfave.go index 81f70da83..29f74316a 100644 --- a/internal/api/client/status/statusfave.go +++ b/internal/api/client/status/statusfave.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -62,37 +63,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusFavePOSTHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "StatusFavePOSTHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debug("not authed so can't fave status") - c.JSON(http.StatusUnauthorized, gin.H{"error": "not authorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - apiStatus, err := m.processor.StatusFave(c.Request.Context(), authed, targetStatusID) - if err != nil { - l.Debugf("error processing status fave: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) + apiStatus, errWithCode := m.processor.StatusFave(c.Request.Context(), authed, targetStatusID) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusfave_test.go b/internal/api/client/status/statusfave_test.go index 144296ebd..5b10ba9b3 100644 --- a/internal/api/client/status/statusfave_test.go +++ b/internal/api/client/status/statusfave_test.go @@ -118,13 +118,13 @@ func (suite *StatusFaveTestSuite) TestPostUnfaveable() { suite.statusModule.StatusFavePOSTHandler(ctx) // check response - suite.EqualValues(http.StatusBadRequest, recorder.Code) + suite.EqualValues(http.StatusForbidden, recorder.Code) result := recorder.Result() defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) assert.NoError(suite.T(), err) - assert.Equal(suite.T(), `{"error":"bad request"}`, string(b)) + assert.Equal(suite.T(), `{"error":"Forbidden"}`, string(b)) } func TestStatusFaveTestSuite(t *testing.T) { diff --git a/internal/api/client/status/statusfavedby.go b/internal/api/client/status/statusfavedby.go index 3e3a18136..579df6432 100644 --- a/internal/api/client/status/statusfavedby.go +++ b/internal/api/client/status/statusfavedby.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -63,37 +64,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusFavedByGETHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "statusGETHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - - authed, err := oauth.Authed(c, true, true, true, true) // we don't really need an app here but we want everything else + authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Errorf("error authing status faved by request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "not authed"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - apiAccounts, err := m.processor.StatusFavedBy(c.Request.Context(), authed, targetStatusID) - if err != nil { - l.Debugf("error processing status faved by request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) + apiAccounts, errWithCode := m.processor.StatusFavedBy(c.Request.Context(), authed, targetStatusID) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusget.go b/internal/api/client/status/statusget.go index 0730bcdda..9a8b406dc 100644 --- a/internal/api/client/status/statusget.go +++ b/internal/api/client/status/statusget.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -54,45 +55,40 @@ import ( // description: "The requested created status." // schema: // "$ref": "#/definitions/status" -// '401': -// description: unauthorized // '400': // description: bad request +// '401': +// description: unauthorized +// '403': +// description: forbidden // '404': // description: not found +// '406': +// description: not acceptable // '500': -// description: internal error +// description: internal server error func (m *Module) StatusGETHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "statusGETHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - - authed, err := oauth.Authed(c, false, false, false, false) + authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Errorf("error authing status faved by request: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "not authed"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - apiStatus, err := m.processor.StatusGet(c.Request.Context(), authed, targetStatusID) - if err != nil { - l.Debugf("error processing status get: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) + apiStatus, errWithCode := m.processor.StatusGet(c.Request.Context(), authed, targetStatusID) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusunboost.go b/internal/api/client/status/statusunboost.go index 7d6052500..b3e921bb7 100644 --- a/internal/api/client/status/statusunboost.go +++ b/internal/api/client/status/statusunboost.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -63,37 +64,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusUnboostPOSTHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "StatusUnboostPOSTHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debug("not authed so can't unboost status") - c.JSON(http.StatusUnauthorized, gin.H{"error": "not authorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } apiStatus, errWithCode := m.processor.StatusUnboost(c.Request.Context(), authed, targetStatusID) if errWithCode != nil { - l.Debugf("error processing status unboost: %s", errWithCode.Error()) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/status/statusunfave.go b/internal/api/client/status/statusunfave.go index 5c5c7e701..19f217160 100644 --- a/internal/api/client/status/statusunfave.go +++ b/internal/api/client/status/statusunfave.go @@ -19,11 +19,12 @@ package status import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -62,37 +63,32 @@ import ( // description: forbidden // '404': // description: not found +// '406': +// description: not acceptable +// '500': +// description: internal server error func (m *Module) StatusUnfavePOSTHandler(c *gin.Context) { - l := logrus.WithFields(logrus.Fields{ - "func": "StatusUnfavePOSTHandler", - "request_uri": c.Request.RequestURI, - "user_agent": c.Request.UserAgent(), - "origin_ip": c.ClientIP(), - }) - l.Debugf("entering function") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debug("not authed so can't unfave status") - c.JSON(http.StatusUnauthorized, gin.H{"error": "not authorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } targetStatusID := c.Param(IDKey) if targetStatusID == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": "no status id provided"}) + err := errors.New("no status id specified") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } - apiStatus, err := m.processor.StatusUnfave(c.Request.Context(), authed, targetStatusID) - if err != nil { - l.Debugf("error processing status unfave: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "bad request"}) + apiStatus, errWithCode := m.processor.StatusUnfave(c.Request.Context(), authed, targetStatusID) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/streaming/stream.go b/internal/api/client/streaming/stream.go index c01bf2216..2c18e4e41 100644 --- a/internal/api/client/streaming/stream.go +++ b/internal/api/client/streaming/stream.go @@ -2,14 +2,24 @@ package streaming import ( "fmt" - "github.com/sirupsen/logrus" "net/http" "time" + "github.com/sirupsen/logrus" + "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" + "github.com/gin-gonic/gin" "github.com/gorilla/websocket" ) +var wsUpgrader = websocket.Upgrader{ + ReadBufferSize: 1024, + WriteBufferSize: 1024, + // we expect cors requests (via eg., pinafore.social) so be lenient + CheckOrigin: func(r *http.Request) bool { return true }, +} + // StreamGETHandler swagger:operation GET /api/v1/streaming streamGet // // Initiate a websocket connection for live streaming of statuses and notifications. @@ -108,79 +118,78 @@ import ( // '400': // description: bad request func (m *Module) StreamGETHandler(c *gin.Context) { - l := logrus.WithField("func", "StreamGETHandler") - streamType := c.Query(StreamQueryKey) if streamType == "" { - c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("no stream type provided under query key %s", StreamQueryKey)}) + err := fmt.Errorf("no stream type provided under query key %s", StreamQueryKey) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } accessToken := c.Query(AccessTokenQueryKey) if accessToken == "" { - c.JSON(http.StatusUnauthorized, gin.H{"error": fmt.Sprintf("no access token provided under query key %s", AccessTokenQueryKey)}) + err := fmt.Errorf("no access token provided under query key %s", AccessTokenQueryKey) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } - // make sure a valid token has been provided and obtain the associated account - account, err := m.processor.AuthorizeStreamingRequest(c.Request.Context(), accessToken) - if err != nil { - c.JSON(http.StatusUnauthorized, gin.H{"error": "could not authorize with given token"}) - return - } - - // prepare to upgrade the connection to a websocket connection - upgrader := websocket.Upgrader{ - ReadBufferSize: 1024, - WriteBufferSize: 1024, - CheckOrigin: func(r *http.Request) bool { - // we fully expect cors requests (via something like pinafore.social) so we should be lenient here - return true - }, - } - - // do the actual upgrade here - conn, err := upgrader.Upgrade(c.Writer, c.Request, nil) - if err != nil { - l.Infof("error upgrading websocket connection: %s", err) - return - } - defer conn.Close() // whatever happens, when we leave this function we want to close the websocket connection - - // inform the processor that we have a new connection and want a s for it - s, errWithCode := m.processor.OpenStreamForAccount(c.Request.Context(), account, streamType) + account, errWithCode := m.processor.AuthorizeStreamingRequest(c.Request.Context(), accessToken) if errWithCode != nil { - c.JSON(errWithCode.Code(), errWithCode.Safe()) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } - defer close(s.Hangup) // closing stream.Hangup indicates that we've finished with the connection (the client has gone), so we want to do this on exiting this handler - // spawn a new ticker for pinging the connection periodically - t := time.NewTicker(30 * time.Second) + stream, errWithCode := m.processor.OpenStreamForAccount(c.Request.Context(), account, streamType) + if errWithCode != nil { + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) + return + } - // we want to stay in the sendloop as long as possible while the client is connected -- the only thing that should break the loop is if the client leaves or something else goes wrong -sendLoop: + l := logrus.WithFields(logrus.Fields{ + "account": account.Username, + "path": BasePath, + "streamID": stream.ID, + "streamType": streamType, + }) + + wsConn, err := wsUpgrader.Upgrade(c.Writer, c.Request, nil) + if err != nil { + // If the upgrade fails, then Upgrade replies to the client with an HTTP error response. + // Because websocket issues are a pretty common source of headaches, we should also log + // this at Error to make this plenty visible and help admins out a bit. + l.Errorf("error upgrading websocket connection: %s", err) + close(stream.Hangup) + return + } + + defer func() { + // cleanup + wsConn.Close() + close(stream.Hangup) + }() + + streamTicker := time.NewTicker(30 * time.Second) + + // We want to stay in the loop as long as possible while the client is connected. + // The only thing that should break the loop is if the client leaves or the connection becomes unhealthy. + // + // If the loop does break, we expect the client to reattempt connection, so it's cheap to leave + try again +wsLoop: for { select { - case m := <-s.Messages: - // we've got a streaming message!! + case m := <-stream.Messages: l.Trace("received message from stream") - if err := conn.WriteJSON(m); err != nil { - l.Debugf("error writing json to websocket connection: %s", err) - // if something is wrong we want to bail and drop the connection -- the client will create a new one - break sendLoop + if err := wsConn.WriteJSON(m); err != nil { + l.Debugf("error writing json to websocket connection; breaking off: %s", err) + break wsLoop } l.Trace("wrote message into websocket connection") - case <-t.C: + case <-streamTicker.C: l.Trace("received TICK from ticker") - if err := conn.WriteMessage(websocket.PingMessage, []byte(": ping")); err != nil { - l.Debugf("error writing ping to websocket connection: %s", err) - // if something is wrong we want to bail and drop the connection -- the client will create a new one - break sendLoop + if err := wsConn.WriteMessage(websocket.PingMessage, []byte(": ping")); err != nil { + l.Debugf("error writing ping to websocket connection; breaking off: %s", err) + break wsLoop } l.Trace("wrote ping message into websocket connection") } } - - l.Trace("leaving StreamGETHandler") } diff --git a/internal/api/client/timeline/home.go b/internal/api/client/timeline/home.go index 47bc2943e..db712e4d2 100644 --- a/internal/api/client/timeline/home.go +++ b/internal/api/client/timeline/home.go @@ -19,13 +19,13 @@ package timeline import ( + "fmt" "net/http" "strconv" - "github.com/sirupsen/logrus" - "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -105,17 +105,14 @@ import ( // '400': // description: bad request func (m *Module) HomeTimelineGETHandler(c *gin.Context) { - l := logrus.WithField("func", "HomeTimelineGETHandler") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("error authing: %s", err) - c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } @@ -142,8 +139,8 @@ func (m *Module) HomeTimelineGETHandler(c *gin.Context) { if limitString != "" { i, err := strconv.ParseInt(limitString, 10, 64) if err != nil { - l.Debugf("error parsing limit string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse limit query param"}) + err := fmt.Errorf("error parsing %s: %s", LimitKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } limit = int(i) @@ -154,8 +151,8 @@ func (m *Module) HomeTimelineGETHandler(c *gin.Context) { if localString != "" { i, err := strconv.ParseBool(localString) if err != nil { - l.Debugf("error parsing local string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse local query param"}) + err := fmt.Errorf("error parsing %s: %s", LocalKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } local = i @@ -163,8 +160,7 @@ func (m *Module) HomeTimelineGETHandler(c *gin.Context) { resp, errWithCode := m.processor.HomeTimelineGet(c.Request.Context(), authed, maxID, sinceID, minID, limit, local) if errWithCode != nil { - l.Debugf("error from processor HomeTimelineGet: %s", errWithCode) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/timeline/public.go b/internal/api/client/timeline/public.go index 06da6e947..0cea856c9 100644 --- a/internal/api/client/timeline/public.go +++ b/internal/api/client/timeline/public.go @@ -19,13 +19,13 @@ package timeline import ( + "fmt" "net/http" "strconv" - "github.com/sirupsen/logrus" - "github.com/gin-gonic/gin" "github.com/superseriousbusiness/gotosocial/internal/api" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -105,17 +105,14 @@ import ( // '400': // description: bad request func (m *Module) PublicTimelineGETHandler(c *gin.Context) { - l := logrus.WithField("func", "PublicTimelineGETHandler") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("error authing: %s", err) - c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } @@ -142,8 +139,8 @@ func (m *Module) PublicTimelineGETHandler(c *gin.Context) { if limitString != "" { i, err := strconv.ParseInt(limitString, 10, 64) if err != nil { - l.Debugf("error parsing limit string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse limit query param"}) + err := fmt.Errorf("error parsing %s: %s", LimitKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } limit = int(i) @@ -154,8 +151,8 @@ func (m *Module) PublicTimelineGETHandler(c *gin.Context) { if localString != "" { i, err := strconv.ParseBool(localString) if err != nil { - l.Debugf("error parsing local string: %s", err) - c.JSON(http.StatusBadRequest, gin.H{"error": "couldn't parse local query param"}) + err := fmt.Errorf("error parsing %s: %s", LocalKey, err) + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } local = i @@ -163,8 +160,7 @@ func (m *Module) PublicTimelineGETHandler(c *gin.Context) { resp, errWithCode := m.processor.PublicTimelineGet(c.Request.Context(), authed, maxID, sinceID, minID, limit, local) if errWithCode != nil { - l.Debugf("error from processor PublicTimelineGet: %s", errWithCode) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/user/passwordchange.go b/internal/api/client/user/passwordchange.go index 15b082c1d..7676f5b85 100644 --- a/internal/api/client/user/passwordchange.go +++ b/internal/api/client/user/passwordchange.go @@ -19,12 +19,13 @@ package user import ( + "errors" "net/http" "github.com/gin-gonic/gin" - "github.com/sirupsen/logrus" "github.com/superseriousbusiness/gotosocial/internal/api" "github.com/superseriousbusiness/gotosocial/internal/api/model" + "github.com/superseriousbusiness/gotosocial/internal/gtserror" "github.com/superseriousbusiness/gotosocial/internal/oauth" ) @@ -54,48 +55,48 @@ import ( // responses: // '200': // description: Change successful +// '400': +// description: bad request // '401': // description: unauthorized // '403': // description: forbidden -// '400': -// description: bad request +// '406': +// description: not acceptable // '500': -// description: "internal error" +// description: internal error func (m *Module) PasswordChangePOSTHandler(c *gin.Context) { - l := logrus.WithField("func", "PasswordChangePOSTHandler") - authed, err := oauth.Authed(c, true, true, true, true) if err != nil { - l.Debugf("error authing: %s", err) - c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"}) + api.ErrorHandler(c, gtserror.NewErrorUnauthorized(err, err.Error()), m.processor.InstanceGet) return } if _, err := api.NegotiateAccept(c, api.JSONAcceptHeaders...); err != nil { - c.JSON(http.StatusNotAcceptable, gin.H{"error": err.Error()}) - return - } - - // First check this user/account is active. - if authed.User.Disabled || !authed.User.Approved || !authed.Account.SuspendedAt.IsZero() { - l.Debugf("couldn't auth: %s", err) - c.JSON(http.StatusForbidden, gin.H{"error": "account is disabled, not yet approved, or suspended"}) + api.ErrorHandler(c, gtserror.NewErrorNotAcceptable(err, err.Error()), m.processor.InstanceGet) return } form := &model.PasswordChangeRequest{} - if err := c.ShouldBind(form); err != nil || form == nil || form.NewPassword == "" || form.OldPassword == "" { - if err != nil { - l.Debugf("could not parse form from request: %s", err) - } - c.JSON(http.StatusBadRequest, gin.H{"error": "missing one or more required form values"}) + if err := c.ShouldBind(form); err != nil { + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) + return + } + + if form.OldPassword == "" { + err := errors.New("password change request missing field old_password") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) + return + } + + if form.NewPassword == "" { + err := errors.New("password change request missing field new_password") + api.ErrorHandler(c, gtserror.NewErrorBadRequest(err, err.Error()), m.processor.InstanceGet) return } if errWithCode := m.processor.UserChangePassword(c.Request.Context(), authed, form); errWithCode != nil { - l.Debugf("error changing user password: %s", errWithCode.Error()) - c.JSON(errWithCode.Code(), gin.H{"error": errWithCode.Safe()}) + api.ErrorHandler(c, errWithCode, m.processor.InstanceGet) return } diff --git a/internal/api/client/user/passwordchange_test.go b/internal/api/client/user/passwordchange_test.go index 23a234116..11df161e2 100644 --- a/internal/api/client/user/passwordchange_test.go +++ b/internal/api/client/user/passwordchange_test.go @@ -49,7 +49,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordChangePOST() { ctx.Set(oauth.SessionAuthorizedToken, oauthToken) ctx.Set(oauth.SessionAuthorizedUser, suite.testUsers["local_account_1"]) ctx.Set(oauth.SessionAuthorizedAccount, suite.testAccounts["local_account_1"]) - ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080/%s", user.PasswordChangePath), nil) + ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080%s", user.PasswordChangePath), nil) ctx.Request.Header.Set("accept", "application/json") ctx.Request.Form = url.Values{ "old_password": {"password"}, @@ -83,7 +83,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordMissingOldPassword() { ctx.Set(oauth.SessionAuthorizedToken, oauthToken) ctx.Set(oauth.SessionAuthorizedUser, suite.testUsers["local_account_1"]) ctx.Set(oauth.SessionAuthorizedAccount, suite.testAccounts["local_account_1"]) - ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080/%s", user.PasswordChangePath), nil) + ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080%s", user.PasswordChangePath), nil) ctx.Request.Header.Set("accept", "application/json") ctx.Request.Form = url.Values{ "new_password": {"peepeepoopoopassword"}, @@ -97,7 +97,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordMissingOldPassword() { defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) suite.NoError(err) - suite.Equal(`{"error":"missing one or more required form values"}`, string(b)) + suite.Equal(`{"error":"Bad Request: password change request missing field old_password"}`, string(b)) } func (suite *PasswordChangeTestSuite) TestPasswordIncorrectOldPassword() { @@ -110,7 +110,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordIncorrectOldPassword() { ctx.Set(oauth.SessionAuthorizedToken, oauthToken) ctx.Set(oauth.SessionAuthorizedUser, suite.testUsers["local_account_1"]) ctx.Set(oauth.SessionAuthorizedAccount, suite.testAccounts["local_account_1"]) - ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080/%s", user.PasswordChangePath), nil) + ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080%s", user.PasswordChangePath), nil) ctx.Request.Header.Set("accept", "application/json") ctx.Request.Form = url.Values{ "old_password": {"notright"}, @@ -125,7 +125,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordIncorrectOldPassword() { defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) suite.NoError(err) - suite.Equal(`{"error":"bad request: old password did not match"}`, string(b)) + suite.Equal(`{"error":"Bad Request: old password did not match"}`, string(b)) } func (suite *PasswordChangeTestSuite) TestPasswordWeakNewPassword() { @@ -138,7 +138,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordWeakNewPassword() { ctx.Set(oauth.SessionAuthorizedToken, oauthToken) ctx.Set(oauth.SessionAuthorizedUser, suite.testUsers["local_account_1"]) ctx.Set(oauth.SessionAuthorizedAccount, suite.testAccounts["local_account_1"]) - ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080/%s", user.PasswordChangePath), nil) + ctx.Request = httptest.NewRequest(http.MethodPost, fmt.Sprintf("http://localhost:8080%s", user.PasswordChangePath), nil) ctx.Request.Header.Set("accept", "application/json") ctx.Request.Form = url.Values{ "old_password": {"password"}, @@ -153,7 +153,7 @@ func (suite *PasswordChangeTestSuite) TestPasswordWeakNewPassword() { defer result.Body.Close() b, err := ioutil.ReadAll(result.Body) suite.NoError(err) - suite.Equal(`{"error":"bad request: password is 94% strength, try including more special characters, using uppercase letters, using numbers or using a longer password"}`, string(b)) + suite.Equal(`{"error":"Bad Request: password is 94% strength, try including more special characters, using uppercase letters, using numbers or using a longer password"}`, string(b)) } func TestPasswordChangeTestSuite(t *testing.T) { diff --git a/internal/api/client/user/user_test.go b/internal/api/client/user/user_test.go index 6e9c46525..b158ec161 100644 --- a/internal/api/client/user/user_test.go +++ b/internal/api/client/user/user_test.go @@ -56,8 +56,8 @@ type UserStandardTestSuite struct { } func (suite *UserStandardTestSuite) SetupTest() { - testrig.InitTestLog() testrig.InitTestConfig() + testrig.InitTestLog() fedWorker := concurrency.NewWorkerPool[messages.FromFederator](-1, -1) clientWorker := concurrency.NewWorkerPool[messages.FromClientAPI](-1, -1) suite.testTokens = testrig.NewTestTokens() diff --git a/internal/api/errorhandling.go b/internal/api/errorhandling.go new file mode 100644 index 000000000..57659f83c --- /dev/null +++ b/internal/api/errorhandling.go @@ -0,0 +1,127 @@ +/* + GoToSocial + Copyright (C) 2021-2022 GoToSocial Authors admin@gotosocial.org + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see+ GoToSocial only serves Public statuses via the web. + If you reached this page by clicking on a status link, + it's possible that the status is not Public, has been + deleted by the author, you don't have permission to see + it, or it just doesn't exist at all. +
++ If you believe this 404 was an error, you can contact + the instance admin. +
{{.error}}