oficina / meet Public

auth: use ui's error-page partial, note Begin's own origin check

errors.html now renders rastrillo's error-page partial instead of
hand-rolled markup; a comment above sameAnswer notes Begin's own
same-origin 403, unreachable behind csrf.Protect but worth knowing.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Paul Campbell pushed by paul@keymail.dev 1 month ago 4f6d7ca46e6708502cfb628f67ffed5a65990b98 parent 595d6ae

3 files changed, +10 −4

internal/meet/auth.go +4 −0
internal/meet/templates/errors.html +1 −3
internal/meettest/signin_test.go +5 −1

diff --git a/internal/meet/auth.go b/internal/meet/auth.go

index fd824d4..cf80a13 100644

--- a/internal/meet/auth.go

+++ b/internal/meet/auth.go

@@ -69,6 +69,10 @@ func (a *app) mayRequestLink(w http.ResponseWriter, r *http.Request, address str

return a.cfg.allow.allows(address)

}

+// rastrillo's own Begin also same-origin-checks the request and

+// answers a bare 403 on failure — unreachable behind csrf.Protect

+// here, but a second gate worth knowing runs underneath this one.

+//

// sameAnswer rewrites rastrillo's own refusal redirects to the sent

// location. It hooks WriteHeader because http.Redirect sets Location

// and then calls WriteHeader, so the Location is visible in time.

diff --git a/internal/meet/templates/errors.html b/internal/meet/templates/errors.html

index 011d936..5c0345d 100644

--- a/internal/meet/templates/errors.html

+++ b/internal/meet/templates/errors.html

@@ -1,6 +1,4 @@

{{define "title"}}Something went wrong{{end}}

-{{template "page-header" dict "Title" (printf "%d" .Status)}}

-<p>That did not work.{{if .Ref}} Reference {{.Ref}}.{{end}}</p>

-<p><a href="/">Back to meetings</a></p>

+{{template "error-page" dict "Status" .Status "Ref" .Ref}}

diff --git a/internal/meettest/signin_test.go b/internal/meettest/signin_test.go

index 7d2b131..6cd38a5 100644

--- a/internal/meettest/signin_test.go

+++ b/internal/meettest/signin_test.go

@@ -46,9 +46,13 @@ func TestNonMemberSessionSeesWelcomeNotTheList(t *testing.T) {

if dest := c.signIn("anyone@example.com"); dest != "/welcome" {

t.Fatalf("non-member landed on %s, want /welcome", dest)

}

- if rec := c.get("/"); rec.Code != http.StatusNotFound {

+ rec := c.get("/")

+ if rec.Code != http.StatusNotFound {

t.Fatalf("non-member GET /: %d, want 404", rec.Code)

}

+ if !strings.Contains(rec.Body.String(), "rst-error") {

+ t.Fatal("404 does not render the error-page partial")

+ }

if rec := c.get("/welcome"); !strings.Contains(rec.Body.String(), "anyone@example.com") {

t.Fatal("welcome page does not name the address")

}