Move the package into src/
Thirty-seven entries in the root, most of them .go files. The assets had to come along: //go:embed cannot reach outside its own directory, so templates/, static/ and migrations/ live beside the code that embeds them, and testdata/ beside the test that reads it. storage/ stays put — runtime data, not source. go build now needs -o. Without it the output would be named after the package directory and collide with src/ itself.
This commit is contained in:
Esa Kataja
+200
@@ -0,0 +1,200 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
type adminInvite struct {
|
||||
ID int64
|
||||
Code string
|
||||
IsValid bool
|
||||
CreatedAt time.Time
|
||||
Link string
|
||||
}
|
||||
|
||||
type adminMember struct {
|
||||
ID int64
|
||||
Name string
|
||||
Email string
|
||||
Banned bool
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
type dashboard struct {
|
||||
Invites []adminInvite
|
||||
SpentCount int
|
||||
Members []adminMember
|
||||
Songs []adminSong
|
||||
OpenCount int
|
||||
}
|
||||
|
||||
func (a *app) adminDashboard(w http.ResponseWriter, r *http.Request) {
|
||||
var d dashboard
|
||||
|
||||
// Unused invites are the ones with a job to do; spent ones are counted, not listed. Truncating
|
||||
// a list silently reads as "that's all of them".
|
||||
if err := a.db.QueryRowContext(r.Context(),
|
||||
`select count(*) from invites where not is_valid`).Scan(&d.SpentCount); err != nil {
|
||||
adminError(w, "invites", err)
|
||||
return
|
||||
}
|
||||
rows, err := a.db.QueryContext(r.Context(),
|
||||
`select id, code, is_valid, created_at from invites where is_valid order by created_at desc`)
|
||||
if err != nil {
|
||||
adminError(w, "invites", err)
|
||||
return
|
||||
}
|
||||
for rows.Next() {
|
||||
var i adminInvite
|
||||
if err := rows.Scan(&i.ID, &i.Code, &i.IsValid, &i.CreatedAt); err != nil {
|
||||
adminError(w, "invites", err)
|
||||
return
|
||||
}
|
||||
i.Link = a.inviteLink(i.Code)
|
||||
d.Invites = append(d.Invites, i)
|
||||
}
|
||||
rows.Close()
|
||||
if err := rows.Err(); err != nil {
|
||||
adminError(w, "invites", err)
|
||||
return
|
||||
}
|
||||
|
||||
rows, err = a.db.QueryContext(r.Context(),
|
||||
`select id, name, email, banned, created_at from users order by created_at`)
|
||||
if err != nil {
|
||||
adminError(w, "users", err)
|
||||
return
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var m adminMember
|
||||
if err := rows.Scan(&m.ID, &m.Name, &m.Email, &m.Banned, &m.CreatedAt); err != nil {
|
||||
adminError(w, "users", err)
|
||||
return
|
||||
}
|
||||
d.Members = append(d.Members, m)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
adminError(w, "users", err)
|
||||
return
|
||||
}
|
||||
|
||||
if d.Songs, err = a.adminSongs(r.Context()); err != nil {
|
||||
adminError(w, "songs", err)
|
||||
return
|
||||
}
|
||||
if err := a.db.QueryRowContext(r.Context(),
|
||||
`select count(*) from reports where resolved_at is null`).Scan(&d.OpenCount); err != nil {
|
||||
adminError(w, "reports", err)
|
||||
return
|
||||
}
|
||||
|
||||
a.render(w, r, http.StatusOK, "admin.html", page{Title: "Ylläpito", Admin: true, Data: d})
|
||||
}
|
||||
|
||||
// 128 bits of entropy. The code is shown once on the dashboard and pasted to whoever is joining.
|
||||
func inviteCode() string {
|
||||
b := make([]byte, 16)
|
||||
rand.Read(b)
|
||||
return hex.EncodeToString(b)
|
||||
}
|
||||
|
||||
// The link is what actually gets sent to someone: the register form reads ?code= and prefills it,
|
||||
// so the recipient clicks and fills in their name. PUBLIC_URL unset falls back to a relative path,
|
||||
// which is enough locally.
|
||||
func (a *app) inviteLink(code string) string {
|
||||
return a.cfg.publicURL + "/register?code=" + url.QueryEscape(code)
|
||||
}
|
||||
|
||||
func (a *app) createInvite(w http.ResponseWriter, r *http.Request) {
|
||||
code := inviteCode()
|
||||
if _, err := a.db.ExecContext(r.Context(), `insert into invites (code) values ($1)`, code); err != nil {
|
||||
adminError(w, "invites", err)
|
||||
return
|
||||
}
|
||||
slog.Info("invite minted", "ctx", "invites")
|
||||
// The dashboard lists it as a clickable link immediately below, newest first, so the flash
|
||||
// doesn't repeat the URL as unclickable text.
|
||||
a.flash(w, "Uusi kutsulinkki luotu.")
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// Ban is a reversible toggle. It drops live sessions immediately — checking `banned` only at login
|
||||
// would leave a banned member browsing until their session expired.
|
||||
func (a *app) toggleBan(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.Error(w, "not found", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
// Banning drops every session for the target, so an admin doing it to themselves would be
|
||||
// locked out with nothing left that could unban them. The only route back is the database.
|
||||
if me := memberFrom(r.Context()); me != nil && me.ID == id {
|
||||
a.flash(w, "Et voi estää itseäsi.")
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
var banned bool
|
||||
err = a.db.QueryRowContext(r.Context(),
|
||||
`update users set banned = not banned where id = $1 returning banned`, id).Scan(&banned)
|
||||
if err != nil {
|
||||
adminError(w, "users", err)
|
||||
return
|
||||
}
|
||||
if banned {
|
||||
if _, err := a.db.ExecContext(r.Context(), `delete from sessions where user_id = $1`, id); err != nil {
|
||||
adminError(w, "users", err)
|
||||
return
|
||||
}
|
||||
a.flash(w, "Jäsen estetty.")
|
||||
} else {
|
||||
a.flash(w, "Esto poistettu.")
|
||||
}
|
||||
slog.Info("ban toggled", "ctx", "auth", "user", id, "banned", banned)
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// The admin reset is the only password recovery there is, so it also drops the member's sessions.
|
||||
func (a *app) resetPassword(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.Error(w, "not found", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
password := r.FormValue("password")
|
||||
if password == "" {
|
||||
a.flash(w, "Salasana on pakollinen.")
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
adminError(w, "auth", err)
|
||||
return
|
||||
}
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update users set password_hash = $2 where id = $1`, id, string(hash)); err != nil {
|
||||
adminError(w, "auth", err)
|
||||
return
|
||||
}
|
||||
if _, err := a.db.ExecContext(r.Context(), `delete from sessions where user_id = $1`, id); err != nil {
|
||||
adminError(w, "auth", err)
|
||||
return
|
||||
}
|
||||
slog.Info("password reset by admin", "ctx", "auth", "user", id)
|
||||
a.flash(w, "Salasana vaihdettu.")
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func adminError(w http.ResponseWriter, ctx string, err error) {
|
||||
slog.Error("admin", "ctx", ctx, "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
}
|
||||
+330
@@ -0,0 +1,330 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"database/sql"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
"modernc.org/sqlite"
|
||||
)
|
||||
|
||||
const (
|
||||
sessionCookie = "session"
|
||||
idleShort = 24 * time.Hour
|
||||
idleRemember = 30 * 24 * time.Hour
|
||||
// Skip the extending UPDATE unless the session has aged at least this much, so a sliding
|
||||
// session is not a write on every request.
|
||||
extendAfter = time.Minute
|
||||
)
|
||||
|
||||
type member struct {
|
||||
ID int64
|
||||
Name string
|
||||
Email string
|
||||
Avatar *string
|
||||
Banned bool
|
||||
IsAdmin bool
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
// Initials for the avatar circle: no default image on disk, no identicon generator.
|
||||
func (m *member) Initials() string {
|
||||
out, n := "", 0
|
||||
for _, f := range strings.Fields(m.Name) {
|
||||
out += strings.ToUpper(string([]rune(f)[0]))
|
||||
// ponytail: count runes taken, not bytes — "Ä" is 2 bytes and used to end the loop early.
|
||||
if n++; n == 2 {
|
||||
break
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
type ctxKey int
|
||||
|
||||
const memberKey ctxKey = 0
|
||||
|
||||
func memberFrom(ctx context.Context) *member {
|
||||
m, _ := ctx.Value(memberKey).(*member)
|
||||
return m
|
||||
}
|
||||
|
||||
func token() string {
|
||||
b := make([]byte, 32)
|
||||
rand.Read(b)
|
||||
return hex.EncodeToString(b)
|
||||
}
|
||||
|
||||
// A bearer header as well as the cookie, so something that isn't a browser can authenticate
|
||||
// without a second concept. SameSite=Lax still guards the cookie path, and a cross-origin page
|
||||
// cannot set Authorization without CORS, which is not enabled.
|
||||
func sessionToken(r *http.Request) string {
|
||||
if h := r.Header.Get("Authorization"); strings.HasPrefix(h, "Bearer ") {
|
||||
return strings.TrimPrefix(h, "Bearer ")
|
||||
}
|
||||
if c, err := r.Cookie(sessionCookie); err == nil {
|
||||
return c.Value
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func (a *app) startSession(ctx context.Context, userID int64, remember bool) (string, time.Time, error) {
|
||||
ttl := idleShort
|
||||
if remember {
|
||||
ttl = idleRemember
|
||||
}
|
||||
tok := token()
|
||||
expires := time.Now().Add(ttl)
|
||||
_, err := a.db.ExecContext(ctx,
|
||||
`insert into sessions (token, user_id, idle_ttl, expires_at) values ($1, $2, $3, $4)`,
|
||||
tok, userID, int64(ttl.Seconds()), expires)
|
||||
return tok, expires, err
|
||||
}
|
||||
|
||||
func (a *app) setSessionCookie(w http.ResponseWriter, tok string, expires time.Time) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: sessionCookie, Value: tok, Path: "/", Expires: expires,
|
||||
HttpOnly: true, Secure: a.cfg.secureCookies, SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
}
|
||||
|
||||
// session loads the member behind a token, extends the idle timeout, and treats a banned or
|
||||
// expired session as no session at all.
|
||||
func (a *app) session(w http.ResponseWriter, r *http.Request) *member {
|
||||
tok := sessionToken(r)
|
||||
if tok == "" {
|
||||
return nil
|
||||
}
|
||||
var (
|
||||
m member
|
||||
expires time.Time
|
||||
ttl time.Duration
|
||||
ttlSeconds int64
|
||||
)
|
||||
err := a.db.QueryRowContext(r.Context(), `
|
||||
select s.expires_at, s.idle_ttl,
|
||||
u.id, u.name, u.email, u.avatar, u.banned, u.is_admin, u.created_at
|
||||
from sessions s join users u on u.id = s.user_id
|
||||
where s.token = $1 and s.expires_at > datetime('now')`, tok).
|
||||
Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.IsAdmin, &m.CreatedAt)
|
||||
if err != nil {
|
||||
if !errors.Is(err, sql.ErrNoRows) {
|
||||
slog.Error("session lookup", "ctx", "auth", "error", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if m.Banned {
|
||||
// Banning deletes sessions, so this is belt and braces for a row that outlived one.
|
||||
a.db.ExecContext(r.Context(), `delete from sessions where user_id = $1`, m.ID)
|
||||
return nil
|
||||
}
|
||||
ttl = time.Duration(ttlSeconds) * time.Second
|
||||
if time.Until(expires) < ttl-extendAfter {
|
||||
newExpiry := time.Now().Add(ttl)
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update sessions set expires_at = $2 where token = $1`, tok, newExpiry); err == nil {
|
||||
a.setSessionCookie(w, tok, newExpiry)
|
||||
}
|
||||
}
|
||||
return &m
|
||||
}
|
||||
|
||||
func (a *app) withMember(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if m := a.session(w, r); m != nil {
|
||||
r = r.WithContext(context.WithValue(r.Context(), memberKey, m))
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
func (a *app) requireMember(next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
if memberFrom(r.Context()) == nil {
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
next(w, r)
|
||||
}
|
||||
}
|
||||
|
||||
// --- pages ---
|
||||
|
||||
type authForm struct {
|
||||
Name, Email, Code string
|
||||
Errors map[string]string
|
||||
}
|
||||
|
||||
func (a *app) loginPage(w http.ResponseWriter, r *http.Request) {
|
||||
a.render(w, r, http.StatusOK, "login.html", page{Title: "Kirjaudu", Narrow: true, Data: authForm{}})
|
||||
}
|
||||
|
||||
func (a *app) login(w http.ResponseWriter, r *http.Request) {
|
||||
email := strings.TrimSpace(strings.ToLower(r.FormValue("email")))
|
||||
form := authForm{Email: email, Errors: map[string]string{}}
|
||||
|
||||
if a.logins.locked(email) {
|
||||
form.Errors["form"] = "Liian monta yritystä. Yritä hetken kuluttua uudelleen."
|
||||
a.render(w, r, http.StatusTooManyRequests, "login.html", page{Title: "Kirjaudu", Narrow: true, Data: form})
|
||||
return
|
||||
}
|
||||
|
||||
var (
|
||||
id int64
|
||||
hash string
|
||||
banned bool
|
||||
)
|
||||
err := a.db.QueryRowContext(r.Context(),
|
||||
`select id, password_hash, banned from users where email = $1`, email).Scan(&id, &hash, &banned)
|
||||
if err != nil || bcrypt.CompareHashAndPassword([]byte(hash), []byte(r.FormValue("password"))) != nil {
|
||||
a.logins.fail(email)
|
||||
// One message for both cases: a distinct "no such account" tells anyone who asks which
|
||||
// addresses are members.
|
||||
form.Errors["form"] = "Sähköposti tai salasana ei täsmää."
|
||||
a.render(w, r, http.StatusUnauthorized, "login.html", page{Title: "Kirjaudu", Narrow: true, Data: form})
|
||||
return
|
||||
}
|
||||
if banned {
|
||||
form.Errors["form"] = "Tunnus on estetty."
|
||||
a.render(w, r, http.StatusForbidden, "login.html", page{Title: "Kirjaudu", Narrow: true, Data: form})
|
||||
return
|
||||
}
|
||||
|
||||
tok, expires, err := a.startSession(r.Context(), id, r.FormValue("remember") != "")
|
||||
if err != nil {
|
||||
slog.Error("start session", "ctx", "auth", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
a.logins.succeed(email)
|
||||
a.setSessionCookie(w, tok, expires)
|
||||
slog.Info("login", "ctx", "auth", "user", id)
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *app) logout(w http.ResponseWriter, r *http.Request) {
|
||||
if tok := sessionToken(r); tok != "" {
|
||||
a.db.ExecContext(r.Context(), `delete from sessions where token = $1`, tok)
|
||||
}
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: sessionCookie, Value: "", Path: "/", MaxAge: -1,
|
||||
HttpOnly: true, Secure: a.cfg.secureCookies, SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *app) registerPage(w http.ResponseWriter, r *http.Request) {
|
||||
a.render(w, r, http.StatusOK, "register.html",
|
||||
page{Title: "Liity", Narrow: true, Data: authForm{Code: r.URL.Query().Get("code")}})
|
||||
}
|
||||
|
||||
// register spends the invite only when the account is actually created: both statements are in one
|
||||
// transaction, so a failed signup leaves the code usable.
|
||||
func (a *app) register(w http.ResponseWriter, r *http.Request) {
|
||||
form := authForm{
|
||||
Name: strings.TrimSpace(r.FormValue("name")),
|
||||
Email: strings.TrimSpace(strings.ToLower(r.FormValue("email"))),
|
||||
Code: strings.TrimSpace(r.FormValue("code")),
|
||||
Errors: map[string]string{},
|
||||
}
|
||||
password := r.FormValue("password")
|
||||
|
||||
if form.Name == "" || len([]rune(form.Name)) > 50 {
|
||||
form.Errors["name"] = "Nimi on pakollinen, enintään 50 merkkiä."
|
||||
}
|
||||
if !strings.Contains(form.Email, "@") {
|
||||
form.Errors["email"] = "Tarkista sähköpostiosoite."
|
||||
}
|
||||
// ponytail: no length policy. Invite-only, ten friends, bcrypt, and the admin is the reset
|
||||
// path — a minimum buys nothing here and makes dev accounts tedious.
|
||||
if password == "" {
|
||||
form.Errors["password"] = "Salasana on pakollinen."
|
||||
}
|
||||
if form.Code == "" {
|
||||
form.Errors["code"] = "Kutsukoodi on pakollinen."
|
||||
}
|
||||
if len(form.Errors) > 0 {
|
||||
a.render(w, r, http.StatusUnprocessableEntity, "register.html", page{Title: "Liity", Narrow: true, Data: form})
|
||||
return
|
||||
}
|
||||
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
slog.Error("hash password", "ctx", "auth", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
tx, err := a.db.BeginTx(r.Context(), nil)
|
||||
if err != nil {
|
||||
slog.Error("begin", "ctx", "auth", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
defer tx.Rollback()
|
||||
|
||||
var inviteID int64
|
||||
err = tx.QueryRowContext(r.Context(),
|
||||
`update invites set is_valid = 0 where code = $1 and is_valid returning id`,
|
||||
form.Code).Scan(&inviteID)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
form.Errors["code"] = "Kutsukoodi ei kelpaa."
|
||||
a.render(w, r, http.StatusUnprocessableEntity, "register.html", page{Title: "Liity", Narrow: true, Data: form})
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("burn invite", "ctx", "invites", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
var userID int64
|
||||
err = tx.QueryRowContext(r.Context(),
|
||||
`insert into users (name, email, password_hash) values ($1, $2, $3) returning id`,
|
||||
form.Name, form.Email, string(hash)).Scan(&userID)
|
||||
if isUnique(err) {
|
||||
// Rolls back, so the invite is still valid.
|
||||
form.Errors["email"] = "Sähköpostiosoite on jo käytössä."
|
||||
a.render(w, r, http.StatusUnprocessableEntity, "register.html", page{Title: "Liity", Narrow: true, Data: form})
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("create user", "ctx", "auth", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if err := tx.Commit(); err != nil {
|
||||
slog.Error("commit registration", "ctx", "auth", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
slog.Info("registered", "ctx", "auth", "user", userID, "invite", inviteID)
|
||||
|
||||
tok, expires, err := a.startSession(r.Context(), userID, false)
|
||||
if err != nil {
|
||||
slog.Error("start session", "ctx", "auth", "error", err)
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
a.setSessionCookie(w, tok, expires)
|
||||
a.flash(w, "Tervetuloa mukaan!")
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// SQLITE_CONSTRAINT_UNIQUE and SQLITE_CONSTRAINT_PRIMARYKEY, spelled out rather than pulled in from
|
||||
// modernc.org/sqlite/lib — that package is the whole generated amalgamation, for two integers.
|
||||
const (
|
||||
sqliteConstraintUnique = 2067
|
||||
sqliteConstraintPrimaryKey = 1555
|
||||
)
|
||||
|
||||
func isUnique(err error) bool {
|
||||
var e *sqlite.Error
|
||||
return errors.As(err, &e) &&
|
||||
(e.Code() == sqliteConstraintUnique || e.Code() == sqliteConstraintPrimaryKey)
|
||||
}
|
||||
@@ -0,0 +1,305 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// A fresh database file per test, thrown away with the temp dir. No server to point at, so these
|
||||
// run everywhere rather than only where someone remembered to set an env var.
|
||||
func testApp(t *testing.T) *app {
|
||||
t.Helper()
|
||||
ctx := context.Background()
|
||||
db, err := openDB(filepath.Join(t.TempDir(), "test.db"))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Cleanup(func() { db.Close() })
|
||||
if err := migrate(ctx, db); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return &app{db: db}
|
||||
}
|
||||
|
||||
func post(t *testing.T, h http.Handler, path string, form url.Values) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
return postAs(t, h, path, form, "")
|
||||
}
|
||||
|
||||
// postAs is post with a session cookie, which is now the only way to reach an admin route.
|
||||
func postAs(t *testing.T, h http.Handler, path string, form url.Values, token string) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
r := httptest.NewRequest("POST", path, strings.NewReader(form.Encode()))
|
||||
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
if token != "" {
|
||||
r.AddCookie(&http.Cookie{Name: sessionCookie, Value: token})
|
||||
}
|
||||
w := httptest.NewRecorder()
|
||||
h.ServeHTTP(w, r)
|
||||
return w
|
||||
}
|
||||
|
||||
func (a *app) inviteValid(t *testing.T, code string) bool {
|
||||
t.Helper()
|
||||
var valid bool
|
||||
if err := a.db.QueryRowContext(context.Background(),
|
||||
`select is_valid from invites where code = $1`, code).Scan(&valid); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return valid
|
||||
}
|
||||
|
||||
// A failed registration must leave the code usable; a successful one must not.
|
||||
func TestInviteIsSpentOnlyBySuccess(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
mux := a.withMember(a.memberMux())
|
||||
|
||||
if _, err := a.db.ExecContext(ctx, `insert into invites (code) values ('kutsu1')`); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`insert into users (name, email, password_hash) values ('Esa', '[email protected]', 'x')`); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// Taken email — the insert fails after the invite has already been marked spent in the tx.
|
||||
w := post(t, mux, "/register", url.Values{
|
||||
"code": {"kutsu1"}, "name": {"Toinen"},
|
||||
"email": {"[email protected]"}, "password": {"salasana1"},
|
||||
})
|
||||
if w.Code != http.StatusUnprocessableEntity {
|
||||
t.Fatalf("duplicate email: status = %d, want 422", w.Code)
|
||||
}
|
||||
if !a.inviteValid(t, "kutsu1") {
|
||||
t.Fatal("failed registration spent the invite")
|
||||
}
|
||||
|
||||
// Missing password — rejected before the invite is touched at all.
|
||||
w = post(t, mux, "/register", url.Values{
|
||||
"code": {"kutsu1"}, "name": {"Toinen"}, "email": {"[email protected]"}, "password": {""},
|
||||
})
|
||||
if w.Code != http.StatusUnprocessableEntity {
|
||||
t.Fatalf("short password: status = %d, want 422", w.Code)
|
||||
}
|
||||
if !a.inviteValid(t, "kutsu1") {
|
||||
t.Fatal("rejected registration spent the invite")
|
||||
}
|
||||
|
||||
w = post(t, mux, "/register", url.Values{
|
||||
"code": {"kutsu1"}, "name": {"Toinen"}, "email": {"[email protected]"}, "password": {"salasana1"},
|
||||
})
|
||||
if w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("valid registration: status = %d, want 303", w.Code)
|
||||
}
|
||||
if a.inviteValid(t, "kutsu1") {
|
||||
t.Fatal("successful registration left the invite usable")
|
||||
}
|
||||
|
||||
// And it cannot be used twice.
|
||||
w = post(t, mux, "/register", url.Values{
|
||||
"code": {"kutsu1"}, "name": {"Kolmas"}, "email": {"[email protected]"}, "password": {"salasana1"},
|
||||
})
|
||||
if w.Code != http.StatusUnprocessableEntity {
|
||||
t.Fatalf("reused invite: status = %d, want 422", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// The limiter has its own unit test; this covers the wiring into the handler.
|
||||
func TestLoginHandlerRefusesAfterTooManyFailures(t *testing.T) {
|
||||
a := testApp(t)
|
||||
mux := a.withMember(a.memberMux())
|
||||
a.seedMember(t, "[email protected]")
|
||||
|
||||
bad := url.Values{"email": {"[email protected]"}, "password": {"väärin"}}
|
||||
for i := range loginMaxFailures {
|
||||
if w := post(t, mux, "/login", bad); w.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("attempt %d: status = %d, want 401", i+1, w.Code)
|
||||
}
|
||||
}
|
||||
if w := post(t, mux, "/login", bad); w.Code != http.StatusTooManyRequests {
|
||||
t.Fatalf("attempt %d: status = %d, want 429", loginMaxFailures+1, w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func (a *app) seedMember(t *testing.T, email string) int64 {
|
||||
t.Helper()
|
||||
var id int64
|
||||
err := a.db.QueryRowContext(context.Background(),
|
||||
`insert into users (name, email, password_hash) values ('Esa', $1, 'x') returning id`,
|
||||
email).Scan(&id)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return id
|
||||
}
|
||||
|
||||
// seedAdminMember returns an admin account and a live session token for it.
|
||||
func (a *app) seedAdminMember(t *testing.T, email string) (int64, string) {
|
||||
t.Helper()
|
||||
id := a.seedMember(t, email)
|
||||
if _, err := a.db.ExecContext(context.Background(),
|
||||
`update users set is_admin = 1 where id = $1`, id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
tok, _, err := a.startSession(context.Background(), id, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return id, tok
|
||||
}
|
||||
|
||||
func (a *app) sessionFor(t *testing.T, token string) *member {
|
||||
t.Helper()
|
||||
r := httptest.NewRequest("GET", "/", nil)
|
||||
r.AddCookie(&http.Cookie{Name: sessionCookie, Value: token})
|
||||
return a.session(httptest.NewRecorder(), r)
|
||||
}
|
||||
|
||||
func TestSessionIdleTimeout(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
id := a.seedMember(t, "[email protected]")
|
||||
|
||||
live, _, err := a.startSession(ctx, id, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if m := a.sessionFor(t, live); m == nil || m.ID != id {
|
||||
t.Fatal("fresh session did not resolve to its member")
|
||||
}
|
||||
|
||||
// Age it past the idle window: the timeout is what expiry means, so this is the whole rule.
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update sessions set expires_at = datetime('now', '-1 second') where token = $1`, live); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if m := a.sessionFor(t, live); m != nil {
|
||||
t.Fatal("expired session still resolved")
|
||||
}
|
||||
|
||||
// A session used inside the window slides forward.
|
||||
fresh, _, err := a.startSession(ctx, id, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update sessions set expires_at = datetime('now', '+1 hour') where token = $1`, fresh); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if m := a.sessionFor(t, fresh); m == nil {
|
||||
t.Fatal("session inside the window did not resolve")
|
||||
}
|
||||
var expires time.Time
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select expires_at from sessions where token = $1`, fresh).Scan(&expires); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if time.Until(expires) < 23*time.Hour {
|
||||
t.Fatalf("session was not extended: expires in %s", time.Until(expires))
|
||||
}
|
||||
}
|
||||
|
||||
func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
mux := a.withMember(a.memberMux())
|
||||
|
||||
if _, err := a.db.ExecContext(ctx, `insert into invites (code) values ('kutsu2')`); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
w := post(t, mux, "/register", url.Values{
|
||||
"code": {"kutsu2"}, "name": {"Esa"}, "email": {"[email protected]"}, "password": {"salasana1"},
|
||||
})
|
||||
if w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("registration: status = %d, want 303", w.Code)
|
||||
}
|
||||
var id int64
|
||||
if err := a.db.QueryRowContext(ctx, `select id from users where email = '[email protected]'`).Scan(&id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
_, adminTok := a.seedAdminMember(t, "[email protected]")
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("ban: status = %d, want 303", w.Code)
|
||||
}
|
||||
|
||||
var sessions int
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select count(*) from sessions where user_id = $1`, id).Scan(&sessions); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if sessions != 0 {
|
||||
t.Fatalf("banned member kept %d sessions", sessions)
|
||||
}
|
||||
|
||||
w = post(t, mux, "/login", url.Values{"email": {"[email protected]"}, "password": {"salasana1"}})
|
||||
if w.Code != http.StatusForbidden {
|
||||
t.Fatalf("banned login: status = %d, want 403", w.Code)
|
||||
}
|
||||
|
||||
// Reversible: unban, and the same credentials work again.
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("unban: status = %d, want 303", w.Code)
|
||||
}
|
||||
w = post(t, mux, "/login", url.Values{"email": {"[email protected]"}, "password": {"salasana1"}})
|
||||
if w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("login after unban: status = %d, want 303", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// Self-banning drops your own sessions, and only an admin could undo it. Refuse.
|
||||
func TestAdminCannotBanSelf(t *testing.T) {
|
||||
a := testApp(t)
|
||||
mux := a.withMember(a.memberMux())
|
||||
adminID, adminTok := a.seedAdminMember(t, "[email protected]")
|
||||
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", adminID), nil, adminTok); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("self-ban: status = %d, want 303", w.Code)
|
||||
}
|
||||
var banned bool
|
||||
if err := a.db.QueryRowContext(context.Background(),
|
||||
`select banned from users where id = $1`, adminID).Scan(&banned); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if banned {
|
||||
t.Fatal("admin banned themselves")
|
||||
}
|
||||
}
|
||||
|
||||
// A signed-in member who is not an admin must not be able to ban anyone.
|
||||
func TestMemberCannotReachAdminRoutes(t *testing.T) {
|
||||
a := testApp(t)
|
||||
mux := a.withMember(a.memberMux())
|
||||
victim := a.seedMember(t, "[email protected]")
|
||||
|
||||
plain := a.seedMember(t, "[email protected]")
|
||||
tok, _, err := a.startSession(context.Background(), plain, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", victim), nil, tok); w.Code != http.StatusNotFound {
|
||||
t.Fatalf("member ban: status = %d, want 404", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInitials(t *testing.T) {
|
||||
for name, want := range map[string]string{
|
||||
"Esa Kataja": "EK",
|
||||
"Ärväs Öhman": "ÄÖ", // multi-byte initials must not end the loop early
|
||||
"Åke": "Å",
|
||||
"": "",
|
||||
"a b c": "AB",
|
||||
} {
|
||||
if got := (&member{Name: name}).Initials(); got != want {
|
||||
t.Errorf("Initials(%q) = %q, want %q", name, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
+254
@@ -0,0 +1,254 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// LRCLIB is a community lyrics database with no API key. It is treated exactly like ffmpeg and
|
||||
// yt-dlp: an outside thing with a timeout, allowed to fail, never blocking anything.
|
||||
// A var rather than a const so tests can point it at a local server instead of the real service.
|
||||
var lrclibBase = "https://lrclib.net/api"
|
||||
|
||||
const (
|
||||
// Identifies the client and nothing else. No URL, no host, no version: this app is private,
|
||||
// and a third party's logs are not the place to learn where it lives.
|
||||
lrclibAgent = "levyraati"
|
||||
lyricsTimout = 10 * time.Second
|
||||
)
|
||||
|
||||
type lrclibResult struct {
|
||||
TrackName string `json:"trackName"`
|
||||
ArtistName string `json:"artistName"`
|
||||
Duration float64 `json:"duration"`
|
||||
Instrumental bool `json:"instrumental"`
|
||||
PlainLyrics string `json:"plainLyrics"`
|
||||
SyncedLyrics string `json:"syncedLyrics"`
|
||||
}
|
||||
|
||||
// best returns the synced version when there is one — timestamps are what make the scroll possible
|
||||
// later, and plain text is the fallback rather than the goal.
|
||||
func (r lrclibResult) best() string {
|
||||
if r.SyncedLyrics != "" {
|
||||
return r.SyncedLyrics
|
||||
}
|
||||
return r.PlainLyrics
|
||||
}
|
||||
|
||||
var lyricsClient = &http.Client{Timeout: lyricsTimout}
|
||||
|
||||
// LRC timestamps are stored, because the highlight needs them, and stripped for reading, because
|
||||
// nobody wants to read [00:11.74] at the start of every line.
|
||||
var lrcStamp = regexp.MustCompile(`^(\[\d{1,2}:\d{2}(?:[.:]\d{1,3})?\]\s*)+`)
|
||||
|
||||
// A line of synced lyrics: the seconds it starts at, and the words.
|
||||
type lyricLine struct {
|
||||
At float64
|
||||
Text string
|
||||
}
|
||||
|
||||
var lrcOne = regexp.MustCompile(`\[(\d{1,2}):(\d{2})(?:[.:](\d{1,3}))?\]`)
|
||||
|
||||
// parseLRC returns nil for plain text, which is the signal to scroll continuously instead of
|
||||
// highlighting: a line-by-line highlight on guessed timings makes every second of drift read as a
|
||||
// bug.
|
||||
func parseLRC(s string) []lyricLine {
|
||||
if !strings.HasPrefix(strings.TrimSpace(s), "[") {
|
||||
return nil
|
||||
}
|
||||
var out []lyricLine
|
||||
for raw := range strings.SplitSeq(s, "\n") {
|
||||
stamps := lrcOne.FindAllStringSubmatch(raw, -1)
|
||||
if len(stamps) == 0 {
|
||||
continue
|
||||
}
|
||||
text := strings.TrimSpace(lrcStamp.ReplaceAllString(raw, ""))
|
||||
// One line can carry several timestamps when a refrain repeats.
|
||||
for _, m := range stamps {
|
||||
min, _ := strconv.Atoi(m[1])
|
||||
sec, _ := strconv.Atoi(m[2])
|
||||
at := float64(min*60 + sec)
|
||||
if m[3] != "" {
|
||||
frac, _ := strconv.Atoi(m[3])
|
||||
switch len(m[3]) {
|
||||
case 1:
|
||||
at += float64(frac) / 10
|
||||
case 2:
|
||||
at += float64(frac) / 100
|
||||
default:
|
||||
at += float64(frac) / 1000
|
||||
}
|
||||
}
|
||||
out = append(out, lyricLine{At: at, Text: text})
|
||||
}
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool { return out[i].At < out[j].At })
|
||||
return out
|
||||
}
|
||||
|
||||
func stripLRC(s string) string {
|
||||
if !strings.HasPrefix(strings.TrimSpace(s), "[") {
|
||||
return s
|
||||
}
|
||||
lines := strings.Split(s, "\n")
|
||||
for i, line := range lines {
|
||||
lines[i] = strings.TrimRight(lrcStamp.ReplaceAllString(line, ""), " ")
|
||||
}
|
||||
return strings.Join(lines, "\n")
|
||||
}
|
||||
|
||||
func lrclibGet(ctx context.Context, path string, q url.Values) ([]byte, error) {
|
||||
ctx, cancel := context.WithTimeout(ctx, lyricsTimout)
|
||||
defer cancel()
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, "GET", lrclibBase+path+"?"+q.Encode(), nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.Header.Set("User-Agent", lrclibAgent)
|
||||
resp, err := lyricsClient.Do(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("lrclib %s: %s", path, resp.Status)
|
||||
}
|
||||
return io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||
}
|
||||
|
||||
// fetchLyrics tries the exact match first — artist, track and duration within LRCLIB's ±2 s — and
|
||||
// falls back to a search, which is what saves songs whose tags are close but not exact. Returns an
|
||||
// empty string when nothing matches, which is a normal outcome rather than an error.
|
||||
func fetchLyrics(ctx context.Context, title, artist string, seconds int) (string, error) {
|
||||
title, artist = strings.TrimSpace(title), strings.TrimSpace(artist)
|
||||
if title == "" {
|
||||
return "", nil // nothing to match on; the submitter has not named it yet
|
||||
}
|
||||
|
||||
if artist != "" && seconds > 0 {
|
||||
body, err := lrclibGet(ctx, "/get", url.Values{
|
||||
"track_name": {title},
|
||||
"artist_name": {artist},
|
||||
"duration": {fmt.Sprint(seconds)},
|
||||
})
|
||||
if err == nil {
|
||||
var res lrclibResult
|
||||
if json.Unmarshal(body, &res) == nil && !res.Instrumental {
|
||||
if l := res.best(); l != "" {
|
||||
return l, nil
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Looser: let LRCLIB do the matching on a free-text query.
|
||||
q := title
|
||||
if artist != "" {
|
||||
q = artist + " " + title
|
||||
}
|
||||
body, err := lrclibGet(ctx, "/search", url.Values{"q": {q}})
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
var results []lrclibResult
|
||||
if err := json.Unmarshal(body, &results); err != nil {
|
||||
return "", err
|
||||
}
|
||||
for _, res := range results {
|
||||
if res.Instrumental {
|
||||
continue
|
||||
}
|
||||
// A duration within 5 s is the strongest signal we have that it is the same recording.
|
||||
if seconds > 0 && res.Duration > 0 && abs(int(res.Duration)-seconds) > 5 {
|
||||
continue
|
||||
}
|
||||
if l := res.best(); l != "" {
|
||||
return l, nil
|
||||
}
|
||||
}
|
||||
return "", nil
|
||||
}
|
||||
|
||||
func abs(n int) int {
|
||||
if n < 0 {
|
||||
return -n
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
// --- the button on the waiting page ---
|
||||
|
||||
// Suggests lyrics for whatever title and artist are currently typed, and never overwrites what the
|
||||
// submitter has already put in the field — the response fills the textarea, and they can accept it,
|
||||
// edit it or clear it.
|
||||
func (a *app) suggestLyrics(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
title := clean(r.FormValue("title"), maxTitle)
|
||||
artist := clean(r.FormValue("artist"), maxArtist)
|
||||
if title == "" {
|
||||
title, artist = s.Title, s.Artist
|
||||
}
|
||||
|
||||
seconds := 0
|
||||
if meta, err := probe(r.Context(), s.TmpPath); err == nil {
|
||||
seconds = int(meta.Duration.Seconds())
|
||||
}
|
||||
|
||||
lyrics, err := fetchLyrics(r.Context(), title, artist, seconds)
|
||||
if err != nil {
|
||||
slog.Warn("lyrics lookup", "ctx", "submissions", "error", err, "submission", s.ID)
|
||||
}
|
||||
|
||||
// Keep whatever the submitter already typed: a suggestion never overwrites their own words.
|
||||
if existing := cleanLyrics(r.FormValue("lyrics")); existing != "" {
|
||||
lyrics = existing
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
data := map[string]any{
|
||||
"ID": s.ID, "Lyrics": lyrics, "Found": lyrics != "", "Searched": true,
|
||||
}
|
||||
if err := pages["submission.html"].ExecuteTemplate(w, "lyricsfield", data); err != nil {
|
||||
slog.Error("render lyrics field", "ctx", "submissions", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Called from the conversion worker: one automatic attempt, best effort, and only when the
|
||||
// submitter has not already pasted something.
|
||||
func (a *app) autoFetchLyrics(ctx context.Context, subID int64, title, artist string, seconds int) {
|
||||
if title == "" {
|
||||
return
|
||||
}
|
||||
lyrics, err := fetchLyrics(ctx, title, artist, seconds)
|
||||
if err != nil {
|
||||
slog.Warn("lyrics lookup", "ctx", "submissions", "error", err, "submission", subID)
|
||||
return
|
||||
}
|
||||
if lyrics == "" {
|
||||
return
|
||||
}
|
||||
res, err := a.db.ExecContext(ctx,
|
||||
`update submissions set lyrics = $2 where id = $1 and lyrics is null`,
|
||||
subID, cleanLyrics(lyrics))
|
||||
if err != nil {
|
||||
slog.Error("save lyrics", "ctx", "submissions", "error", err, "submission", subID)
|
||||
return
|
||||
}
|
||||
if affected(res) > 0 {
|
||||
slog.Info("lyrics found", "ctx", "submissions", "submission", subID)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// Line breaks are the content here — LRC timestamps are per line — so cleanLyrics must not do what
|
||||
// clean() does to a title.
|
||||
func TestCleanLyrics(t *testing.T) {
|
||||
got := cleanLyrics(" [00:11.74] Rivi yksi\r\n[00:13.99] Rivi\x07 kaksi\r\n\n")
|
||||
want := "[00:11.74] Rivi yksi\n[00:13.99] Rivi kaksi"
|
||||
if got != want {
|
||||
t.Fatalf("cleanLyrics gave %q, want %q", got, want)
|
||||
}
|
||||
if n := len([]rune(cleanLyrics(strings.Repeat("a", maxLyrics+500)))); n != maxLyrics {
|
||||
t.Fatalf("truncated to %d runes, want %d", n, maxLyrics)
|
||||
}
|
||||
}
|
||||
|
||||
// Plain text must parse to nil: that is the signal to scroll continuously rather than highlight
|
||||
// lines on timings nobody measured.
|
||||
func TestParseLRC(t *testing.T) {
|
||||
if got := parseLRC("Ihan tavallista tekstiä\ntoinen rivi"); got != nil {
|
||||
t.Fatalf("plain text parsed as synced: %v", got)
|
||||
}
|
||||
|
||||
lines := parseLRC("[00:11.74] Ensimmäinen\n[01:02] Toinen\n[00:05.5] Aikaisempi\nrivi ilman aikaa")
|
||||
if len(lines) != 3 {
|
||||
t.Fatalf("got %d lines, want 3 — untimed lines are dropped", len(lines))
|
||||
}
|
||||
// Sorted by time, whatever order the file had.
|
||||
if lines[0].At != 5.5 || lines[0].Text != "Aikaisempi" {
|
||||
t.Fatalf("first line is %+v, want 5.5s Aikaisempi", lines[0])
|
||||
}
|
||||
if lines[1].At != 11.74 || lines[2].At != 62 {
|
||||
t.Fatalf("timestamps parsed as %v and %v, want 11.74 and 62", lines[1].At, lines[2].At)
|
||||
}
|
||||
|
||||
// A refrain can carry several timestamps on one line, and each is its own occurrence.
|
||||
rep := parseLRC("[00:10.00][01:10.00] Kertosäe")
|
||||
if len(rep) != 2 || rep[0].At != 10 || rep[1].At != 70 {
|
||||
t.Fatalf("repeated stamps gave %+v, want two occurrences", rep)
|
||||
}
|
||||
}
|
||||
|
||||
// The lookup is a suggestion, so "nothing found" is a normal answer rather than an error, and a
|
||||
// synced hit always beats a plain one.
|
||||
func TestFetchLyrics(t *testing.T) {
|
||||
var lastPath string
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
lastPath = r.URL.Path
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
switch {
|
||||
case r.URL.Path == "/get" && r.URL.Query().Get("track_name") == "Paranoid":
|
||||
w.Write([]byte(`{"trackName":"Paranoid","artistName":"Black Sabbath","duration":168,
|
||||
"plainLyrics":"plain version","syncedLyrics":"[00:11.74] synced version"}`))
|
||||
case r.URL.Path == "/get":
|
||||
http.Error(w, `{"code":404}`, http.StatusNotFound)
|
||||
case r.URL.Path == "/search" && strings.Contains(r.URL.Query().Get("q"), "Soittorasia"):
|
||||
// An instrumental and a wrong-length take come first: both must be skipped.
|
||||
w.Write([]byte(`[{"trackName":"Soittorasia","duration":200,"instrumental":true,
|
||||
"plainLyrics":"","syncedLyrics":"[00:01.00] should be skipped"},
|
||||
{"trackName":"Soittorasia","duration":600,
|
||||
"plainLyrics":"wrong length take"},
|
||||
{"trackName":"Soittorasia","duration":201,
|
||||
"plainLyrics":"right one"}]`))
|
||||
default:
|
||||
w.Write([]byte(`[]`))
|
||||
}
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
old := lrclibBase
|
||||
lrclibBase = srv.URL
|
||||
defer func() { lrclibBase = old }()
|
||||
|
||||
ctx := context.Background()
|
||||
|
||||
got, err := fetchLyrics(ctx, "Paranoid", "Black Sabbath", 168)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got != "[00:11.74] synced version" {
|
||||
t.Fatalf("exact match returned %q, want the synced version", got)
|
||||
}
|
||||
|
||||
got, err = fetchLyrics(ctx, "Soittorasia", "Joku", 200)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got != "right one" {
|
||||
t.Fatalf("search fallback returned %q — instrumental and wrong-length takes must be skipped", got)
|
||||
}
|
||||
if lastPath != "/search" {
|
||||
t.Fatalf("last request was %s, want the search fallback", lastPath)
|
||||
}
|
||||
|
||||
// Nothing found is not an error: the submitter simply types their own.
|
||||
got, err = fetchLyrics(ctx, "Ei olemassa", "Kukaan", 100)
|
||||
if err != nil || got != "" {
|
||||
t.Fatalf("miss returned %q, %v — want empty and no error", got, err)
|
||||
}
|
||||
|
||||
// No title means nothing to match on, and no request at all.
|
||||
if got, err := fetchLyrics(ctx, "", "Artisti", 100); err != nil || got != "" {
|
||||
t.Fatalf("empty title returned %q, %v", got, err)
|
||||
}
|
||||
}
|
||||
+249
@@ -0,0 +1,249 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
_ "modernc.org/sqlite"
|
||||
)
|
||||
|
||||
// Set at build time with -ldflags "-X main.version=…". A local `go build` honestly says dev.
|
||||
var version = "dev"
|
||||
|
||||
type config struct {
|
||||
dbPath string
|
||||
// Only read when the database has no users at all: seedAdmin turns these into account number
|
||||
// one. Once that account exists they are dead weight and can leave the environment.
|
||||
adminEmail string
|
||||
adminName string
|
||||
adminPass string
|
||||
addr string
|
||||
storageDir string
|
||||
secureCookies bool
|
||||
// Public address of the site, so invite links are pasteable out of the admin page.
|
||||
publicURL string
|
||||
}
|
||||
|
||||
func loadConfig() config {
|
||||
c := config{
|
||||
adminEmail: os.Getenv("ADMIN_EMAIL"),
|
||||
adminName: env("ADMIN_NAME", "Ylläpito"),
|
||||
adminPass: os.Getenv("ADMIN_PASSWORD"),
|
||||
addr: env("ADDR", ":8080"),
|
||||
storageDir: env("STORAGE_DIR", "./storage"),
|
||||
secureCookies: env("SECURE_COOKIES", "true") != "false",
|
||||
publicURL: strings.TrimRight(os.Getenv("PUBLIC_URL"), "/"),
|
||||
}
|
||||
// The database lives beside the audio, so one volume is the whole backup.
|
||||
c.dbPath = env("DB_PATH", filepath.Join(c.storageDir, "levyraati.db"))
|
||||
return c
|
||||
}
|
||||
|
||||
func env(key, def string) string {
|
||||
if v := os.Getenv(key); v != "" {
|
||||
return v
|
||||
}
|
||||
return def
|
||||
}
|
||||
|
||||
func fatal(msg string, args ...any) {
|
||||
slog.Error(msg, args...)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
type app struct {
|
||||
cfg config
|
||||
db *sql.DB
|
||||
logins limiter // zero value is ready to use
|
||||
}
|
||||
|
||||
// openDB opens the file with the pragmas the schema assumes. foreign_keys is off by default in
|
||||
// SQLite, so without it every `on delete cascade` is decoration; WAL plus busy_timeout is what lets
|
||||
// a conversion goroutine write while a request reads; _txlock=immediate takes the write lock at
|
||||
// BEGIN rather than failing partway through a transaction that started out reading.
|
||||
//
|
||||
// _time_format and _timezone make Go write timestamps in exactly the shape datetime('now')
|
||||
// produces, so the two sources of a timestamp sort and compare against each other.
|
||||
func openDB(path string) (*sql.DB, error) {
|
||||
return sql.Open("sqlite", "file:"+path+"?"+strings.Join([]string{
|
||||
"_pragma=busy_timeout(5000)",
|
||||
"_pragma=journal_mode(WAL)",
|
||||
"_pragma=foreign_keys(1)",
|
||||
"_pragma=synchronous(NORMAL)",
|
||||
"_time_format=datetime",
|
||||
"_timezone=UTC",
|
||||
"_txlock=immediate",
|
||||
}, "&"))
|
||||
}
|
||||
|
||||
// database/sql splits the row count off into a second return value. Every caller here only asks
|
||||
// whether the statement matched anything, and a driver that could not report a count would already
|
||||
// have failed at Exec.
|
||||
func affected(res sql.Result) int64 {
|
||||
n, _ := res.RowsAffected()
|
||||
return n
|
||||
}
|
||||
|
||||
func main() {
|
||||
slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
|
||||
slog.Info("starting", "ctx", "startup", "version", version)
|
||||
cfg := loadConfig()
|
||||
|
||||
ctx := context.Background()
|
||||
// The storage directories come first: the database file lives in one of them.
|
||||
for _, dir := range []string{"audio", "tmp", "avatars"} {
|
||||
if err := os.MkdirAll(filepath.Join(cfg.storageDir, dir), 0o755); err != nil {
|
||||
fatal("storage dir", "error", err, "dir", dir)
|
||||
}
|
||||
}
|
||||
|
||||
db, err := openDB(cfg.dbPath)
|
||||
if err != nil {
|
||||
fatal("database open", "error", err)
|
||||
}
|
||||
defer db.Close()
|
||||
if err := db.PingContext(ctx); err != nil {
|
||||
fatal("database unreachable", "error", err, "path", cfg.dbPath)
|
||||
}
|
||||
|
||||
if err := migrate(ctx, db); err != nil {
|
||||
fatal("migrations", "error", err)
|
||||
}
|
||||
if err := sweep(ctx, db); err != nil {
|
||||
fatal("startup sweep", "error", err)
|
||||
}
|
||||
if err := seedAdmin(ctx, db, cfg); err != nil {
|
||||
fatal("seed admin", "error", err)
|
||||
}
|
||||
|
||||
a := &app{cfg: cfg, db: db}
|
||||
|
||||
slog.Info("listening", "ctx", "startup", "addr", cfg.addr)
|
||||
fatal("listener", "error", http.ListenAndServe(cfg.addr, a.withMember(a.memberMux())))
|
||||
}
|
||||
|
||||
// Registration needs an invite and invites are minted from the admin page, so a database with no
|
||||
// users has no way to grow one. seedAdmin breaks that circle exactly once: on an empty users table
|
||||
// it creates account number one from the environment and marks it admin. Every account after it
|
||||
// arrives through an invite like anyone else.
|
||||
//
|
||||
// ponytail: no promote-existing-user path and no password reset here. Re-running against a
|
||||
// populated database does nothing, which is what makes it safe to leave in the boot sequence.
|
||||
func seedAdmin(ctx context.Context, db *sql.DB, cfg config) error {
|
||||
var users int
|
||||
if err := db.QueryRowContext(ctx, `select count(*) from users`).Scan(&users); err != nil {
|
||||
return err
|
||||
}
|
||||
if users > 0 {
|
||||
return nil
|
||||
}
|
||||
if cfg.adminEmail == "" || cfg.adminPass == "" {
|
||||
// A site nobody can log into is worse than one that won't boot.
|
||||
fatal("empty database: set ADMIN_EMAIL and ADMIN_PASSWORD to create the first account")
|
||||
}
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(cfg.adminPass), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := db.ExecContext(ctx,
|
||||
`insert into users (name, email, password_hash, is_admin) values ($1, $2, $3, 1)`,
|
||||
cfg.adminName, strings.ToLower(cfg.adminEmail), string(hash)); err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Info("first admin created", "ctx", "startup", "email", cfg.adminEmail)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *app) memberMux() *http.ServeMux {
|
||||
mux := http.NewServeMux()
|
||||
mux.Handle("GET /static/", http.FileServerFS(assetFS))
|
||||
|
||||
mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||
if err := a.db.PingContext(r.Context()); err != nil {
|
||||
http.Error(w, "db down", http.StatusServiceUnavailable)
|
||||
return
|
||||
}
|
||||
// The version answers "what is actually running out there" without an SSH session.
|
||||
fmt.Fprintf(w, "ok %s\n", version)
|
||||
})
|
||||
|
||||
mux.HandleFunc("GET /login", a.loginPage)
|
||||
mux.HandleFunc("POST /login", a.login)
|
||||
mux.HandleFunc("GET /register", a.registerPage)
|
||||
mux.HandleFunc("POST /register", a.register)
|
||||
mux.HandleFunc("POST /logout", a.logout)
|
||||
|
||||
mux.HandleFunc("GET /{$}", a.requireMember(a.queuePage))
|
||||
mux.HandleFunc("GET /songs", a.requireMember(a.browsePage))
|
||||
mux.HandleFunc("GET /songs/{id}", a.requireMember(a.songPage))
|
||||
mux.HandleFunc("POST /songs/{id}", a.requireMember(a.editSong))
|
||||
mux.HandleFunc("POST /songs/{id}/delete", a.requireMember(a.deleteSong))
|
||||
mux.HandleFunc("POST /songs/{id}/lyrics", a.requireMember(a.editLyrics))
|
||||
mux.HandleFunc("GET /audio/{id}", a.requireMember(a.audio))
|
||||
mux.HandleFunc("GET /avatars/{id}", a.avatar) // public: avatars are not secret
|
||||
|
||||
mux.HandleFunc("GET /stats", a.requireMember(a.statsPage))
|
||||
mux.HandleFunc("GET /profile", a.requireMember(a.profilePage))
|
||||
mux.HandleFunc("GET /profile/{id}", a.requireMember(a.profilePage))
|
||||
mux.HandleFunc("POST /profile", a.requireMember(a.editProfile))
|
||||
|
||||
mux.HandleFunc("GET /report", a.requireMember(a.reportPage))
|
||||
mux.HandleFunc("POST /report", a.requireMember(a.createReport))
|
||||
|
||||
mux.HandleFunc("POST /songs/{id}/review", a.requireMember(a.createReview))
|
||||
mux.HandleFunc("POST /reviews/{id}", a.requireMember(a.editReview))
|
||||
mux.HandleFunc("POST /reviews/{id}/delete", a.requireMember(a.deleteReview))
|
||||
|
||||
mux.HandleFunc("GET /submit", a.requireMember(a.submitPage))
|
||||
mux.HandleFunc("POST /submit", a.requireMember(a.submit))
|
||||
mux.HandleFunc("GET /submit/{id}", a.requireMember(a.submissionPage))
|
||||
mux.HandleFunc("GET /submit/{id}/status", a.requireMember(a.submissionStatus))
|
||||
mux.HandleFunc("POST /submit/{id}", a.requireMember(a.saveSubmission))
|
||||
mux.HandleFunc("POST /submit/{id}/publish", a.requireMember(a.publish))
|
||||
mux.HandleFunc("POST /submit/{id}/lyrics", a.requireMember(a.suggestLyrics))
|
||||
mux.HandleFunc("POST /submit/{id}/retry", a.requireMember(a.retry))
|
||||
mux.HandleFunc("POST /submit/{id}/discard", a.requireMember(a.discard))
|
||||
|
||||
a.adminRoutes(mux)
|
||||
return mux
|
||||
}
|
||||
|
||||
// The admin pages sit on the same mux and the same session as everything else; only the guard
|
||||
// differs. There is no /admin/audio: requireAdmin members can reach GET /audio/{id} like anyone.
|
||||
func (a *app) adminRoutes(mux *http.ServeMux) {
|
||||
mux.HandleFunc("GET /admin", a.requireAdmin(a.adminDashboard))
|
||||
mux.HandleFunc("POST /admin/invites", a.requireAdmin(a.createInvite))
|
||||
mux.HandleFunc("POST /admin/users/{id}/ban", a.requireAdmin(a.toggleBan))
|
||||
mux.HandleFunc("POST /admin/users/{id}/password", a.requireAdmin(a.resetPassword))
|
||||
mux.HandleFunc("POST /admin/songs/{id}/delete", a.requireAdmin(a.adminDeleteSong))
|
||||
mux.HandleFunc("GET /admin/reports", a.requireAdmin(a.adminReports))
|
||||
mux.HandleFunc("POST /admin/reports/{id}/resolve", a.requireAdmin(a.resolveReport))
|
||||
}
|
||||
|
||||
// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
|
||||
// resolve reports without also being able to reset passwords.
|
||||
//
|
||||
// A signed-out visitor is sent to log in, the same as any member page. A signed-in member who is
|
||||
// not an admin gets 404 rather than 403: the admin pages are none of their business, and saying
|
||||
// "forbidden" confirms there is something there to be forbidden from.
|
||||
func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
m := memberFrom(r.Context())
|
||||
if m == nil {
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
if !m.IsAdmin {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
next(w, r)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// A plain member must not be able to tell that /admin exists, and a stranger must be sent to log in.
|
||||
func TestRequireAdmin(t *testing.T) {
|
||||
a := &app{}
|
||||
h := a.requireAdmin(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusTeapot)
|
||||
})
|
||||
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
as *member
|
||||
want int
|
||||
}{
|
||||
{name: "signed out", as: nil, want: http.StatusSeeOther},
|
||||
{name: "member", as: &member{ID: 1}, want: http.StatusNotFound},
|
||||
{name: "admin", as: &member{ID: 1, IsAdmin: true}, want: http.StatusTeapot},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
r := httptest.NewRequest("GET", "/admin", nil)
|
||||
if tc.as != nil {
|
||||
r = r.WithContext(context.WithValue(r.Context(), memberKey, tc.as))
|
||||
}
|
||||
w := httptest.NewRecorder()
|
||||
h(w, r)
|
||||
if w.Code != tc.want {
|
||||
t.Fatalf("status = %d, want %d", w.Code, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// The first account cannot arrive by invite, because minting an invite needs an admin.
|
||||
func TestSeedAdminOnlyOnEmptyDatabase(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
cfg := config{adminEmail: "[email protected]", adminName: "Ylläpito", adminPass: "salasana1"}
|
||||
|
||||
if err := seedAdmin(ctx, a.db, cfg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var name, email string
|
||||
var isAdmin bool
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select name, email, is_admin from users`).Scan(&name, &email, &isAdmin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !isAdmin || name != "Ylläpito" {
|
||||
t.Fatalf("seeded %q is_admin=%v, want Ylläpito admin", name, isAdmin)
|
||||
}
|
||||
// Login is by lowercased email, so the seed must not smuggle in a capital.
|
||||
if email != "[email protected]" {
|
||||
t.Fatalf("email = %q, want lowercased", email)
|
||||
}
|
||||
|
||||
// Re-running on a populated database must not add a second account or reset the first.
|
||||
cfg.adminEmail = "[email protected]"
|
||||
if err := seedAdmin(ctx, a.db, cfg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var n int
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from users`).Scan(&n); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if n != 1 {
|
||||
t.Fatalf("users = %d, want 1", n)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMigrateIsIdempotent(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
a := testApp(t) // already migrated once
|
||||
|
||||
if err := migrate(ctx, a.db); err != nil {
|
||||
t.Fatalf("second migrate: %v", err)
|
||||
}
|
||||
if err := sweep(ctx, a.db); err != nil {
|
||||
t.Fatalf("sweep: %v", err)
|
||||
}
|
||||
|
||||
var n int
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if n != 2 {
|
||||
t.Fatalf("applied migrations = %d, want 2", n)
|
||||
}
|
||||
}
|
||||
+241
@@ -0,0 +1,241 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/url"
|
||||
"os/exec"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Everything here shells out with exec.CommandContext and an argument list — never a shell string.
|
||||
|
||||
type probeResult struct {
|
||||
Title string
|
||||
Artist string
|
||||
Duration time.Duration
|
||||
}
|
||||
|
||||
type ffprobeOutput struct {
|
||||
Format struct {
|
||||
Duration string `json:"duration"`
|
||||
Tags map[string]string `json:"tags"`
|
||||
} `json:"format"`
|
||||
Streams []struct {
|
||||
CodecType string `json:"codec_type"`
|
||||
Tags map[string]string `json:"tags"`
|
||||
} `json:"streams"`
|
||||
}
|
||||
|
||||
// probe reads duration and whatever title/artist tags the container carries. Tag keys vary in case
|
||||
// by container (title, TITLE, Title), so the map is lowercased before anything is read from it.
|
||||
func probe(ctx context.Context, path string) (probeResult, error) {
|
||||
ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
|
||||
defer cancel()
|
||||
|
||||
out, err := exec.CommandContext(ctx, "ffprobe",
|
||||
"-v", "quiet", "-print_format", "json", "-show_format", "-show_streams", path).Output()
|
||||
if err != nil {
|
||||
return probeResult{}, err
|
||||
}
|
||||
var parsed ffprobeOutput
|
||||
if err := json.Unmarshal(out, &parsed); err != nil {
|
||||
return probeResult{}, err
|
||||
}
|
||||
|
||||
tags := map[string]string{}
|
||||
for _, stream := range parsed.Streams {
|
||||
if stream.CodecType != "audio" {
|
||||
continue
|
||||
}
|
||||
for k, v := range stream.Tags {
|
||||
tags[strings.ToLower(k)] = v
|
||||
}
|
||||
}
|
||||
// Container tags win over stream tags when both exist.
|
||||
for k, v := range parsed.Format.Tags {
|
||||
tags[strings.ToLower(k)] = v
|
||||
}
|
||||
|
||||
var res probeResult
|
||||
res.Title = clean(tags["title"], 100)
|
||||
res.Artist = clean(firstOf(tags, "artist", "album_artist"), 100)
|
||||
if secs, err := strconv.ParseFloat(parsed.Format.Duration, 64); err == nil {
|
||||
res.Duration = time.Duration(secs * float64(time.Second))
|
||||
}
|
||||
return res, nil
|
||||
}
|
||||
|
||||
func firstOf(m map[string]string, keys ...string) string {
|
||||
for _, k := range keys {
|
||||
if v := strings.TrimSpace(m[k]); v != "" {
|
||||
return v
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// Tag text is attacker-controlled and arrives inside an uploaded file. html/template escapes on
|
||||
// render, but a title with an embedded newline wrecks every list layout it appears in.
|
||||
func clean(s string, max int) string {
|
||||
s = strings.Map(func(r rune) rune {
|
||||
if r == '\n' || r == '\r' || r == '\t' {
|
||||
return ' '
|
||||
}
|
||||
if r < 0x20 || r == 0x7f {
|
||||
return -1
|
||||
}
|
||||
return r
|
||||
}, s)
|
||||
s = strings.TrimSpace(strings.Join(strings.Fields(s), " "))
|
||||
if r := []rune(s); len(r) > max {
|
||||
s = strings.TrimSpace(string(r[:max]))
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
const maxLyrics = 20000
|
||||
|
||||
// Lyrics are the one field where line breaks carry meaning — LRC timestamps are per line — so they
|
||||
// survive, and only the other control characters go.
|
||||
func cleanLyrics(s string) string {
|
||||
s = strings.ReplaceAll(s, "\r\n", "\n")
|
||||
s = strings.ReplaceAll(s, "\r", "\n")
|
||||
s = strings.Map(func(r rune) rune {
|
||||
if r == '\n' || r == '\t' {
|
||||
return r
|
||||
}
|
||||
if r < 0x20 || r == 0x7f {
|
||||
return -1
|
||||
}
|
||||
return r
|
||||
}, s)
|
||||
s = strings.TrimSpace(s)
|
||||
if r := []rune(s); len(r) > maxLyrics {
|
||||
s = strings.TrimSpace(string(r[:maxLyrics]))
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// Hosts yt-dlp is allowed to see. Validated before the URL goes anywhere near a subprocess
|
||||
// argument list — and it never goes through a shell.
|
||||
var allowedHosts = map[string]bool{
|
||||
"youtube.com": true, "www.youtube.com": true, "m.youtube.com": true,
|
||||
"youtu.be": true, "www.youtu.be": true, "music.youtube.com": true,
|
||||
}
|
||||
|
||||
func allowedYouTubeURL(raw string) (string, bool) {
|
||||
u, err := url.Parse(strings.TrimSpace(raw))
|
||||
if err != nil || (u.Scheme != "http" && u.Scheme != "https") {
|
||||
return "", false
|
||||
}
|
||||
if !allowedHosts[strings.ToLower(u.Hostname())] {
|
||||
return "", false
|
||||
}
|
||||
return u.String(), true
|
||||
}
|
||||
|
||||
type ytOutput struct {
|
||||
Title string `json:"title"`
|
||||
Track string `json:"track"`
|
||||
Artist string `json:"artist"`
|
||||
Creator string `json:"creator"`
|
||||
Uploader string `json:"uploader"`
|
||||
Duration float64 `json:"duration"`
|
||||
}
|
||||
|
||||
// youtubeMeta asks yt-dlp for metadata only — no download. A 1–3 s network call, so the handler
|
||||
// gives it 15 s and renders blank fields on timeout rather than failing the submission.
|
||||
func youtubeMeta(ctx context.Context, url string) (probeResult, error) {
|
||||
ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
|
||||
defer cancel()
|
||||
|
||||
out, err := exec.CommandContext(ctx, "yt-dlp", "-J", "--no-playlist", "--no-warnings", url).Output()
|
||||
if err != nil {
|
||||
return probeResult{}, err
|
||||
}
|
||||
return parseYouTubeMeta(out)
|
||||
}
|
||||
|
||||
// track/artist exist only for Topic channels, YouTube Music entries and videos with a "Music in
|
||||
// this video" panel. An ordinary upload gives a title and an uploader and nothing else — and if a
|
||||
// field resolves to empty it stays empty, because a blank field prompts the submitter while a
|
||||
// plausible "Unknown" does not.
|
||||
func parseYouTubeMeta(jsonBytes []byte) (probeResult, error) {
|
||||
var y ytOutput
|
||||
if err := json.Unmarshal(jsonBytes, &y); err != nil {
|
||||
return probeResult{}, err
|
||||
}
|
||||
title := y.Track
|
||||
if title == "" {
|
||||
title = y.Title
|
||||
}
|
||||
artist := firstOf(map[string]string{
|
||||
"artist": y.Artist, "creator": y.Creator, "uploader": y.Uploader,
|
||||
}, "artist", "creator", "uploader")
|
||||
return probeResult{
|
||||
Title: clean(title, 100),
|
||||
Artist: clean(artist, 100),
|
||||
Duration: time.Duration(y.Duration * float64(time.Second)),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// download fetches the best audio-only stream. The extension is whatever YouTube served, so the
|
||||
// caller globs for it — ffmpeg does not care which container it gets.
|
||||
func downloadYouTube(ctx context.Context, url, outTemplate string) (string, error) {
|
||||
ctx, cancel := context.WithTimeout(ctx, 10*time.Minute)
|
||||
defer cancel()
|
||||
|
||||
cmd := exec.CommandContext(ctx, "yt-dlp",
|
||||
"-f", "bestaudio", "--no-playlist", "--max-filesize", "100M",
|
||||
"--no-warnings", "-o", outTemplate, url)
|
||||
var stderr strings.Builder
|
||||
cmd.Stderr = &stderr
|
||||
if err := cmd.Run(); err != nil {
|
||||
return tail(stderr.String(), 400), err
|
||||
}
|
||||
return "", nil
|
||||
}
|
||||
|
||||
// toAvatarJPEG normalises any image ffmpeg understands into a 256px square JPEG. The re-encode is
|
||||
// the validation and the size cap in one — webp and avif included, which stdlib image cannot read.
|
||||
func toAvatarJPEG(ctx context.Context, in, out string) error {
|
||||
ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
|
||||
defer cancel()
|
||||
|
||||
return exec.CommandContext(ctx, "ffmpeg", "-nostdin", "-y", "-i", in,
|
||||
"-vf", "scale=256:256:force_original_aspect_ratio=increase,crop=256:256",
|
||||
"-frames:v", "1", "-q:v", "3", out).Run()
|
||||
}
|
||||
|
||||
// convertToOpus is also the validation: if ffmpeg produced an Opus stream, the upload was audio.
|
||||
// No container sniffing, no magic-byte library. Returns the stderr tail on failure, which is worth
|
||||
// showing — "Invalid data found when processing input" beats "submission failed".
|
||||
func convertToOpus(ctx context.Context, in, out string) (string, error) {
|
||||
ctx, cancel := context.WithTimeout(ctx, 15*time.Minute)
|
||||
defer cancel()
|
||||
|
||||
cmd := exec.CommandContext(ctx, "ffmpeg", "-nostdin", "-y",
|
||||
"-i", in, "-c:a", "libopus", "-b:a", "96k", "-ac", "2", "-vn", out)
|
||||
var stderr strings.Builder
|
||||
cmd.Stderr = &stderr
|
||||
if err := cmd.Run(); err != nil {
|
||||
return tail(stderr.String(), 400), err
|
||||
}
|
||||
return "", nil
|
||||
}
|
||||
|
||||
func tail(s string, n int) string {
|
||||
s = strings.TrimSpace(s)
|
||||
lines := strings.Split(s, "\n")
|
||||
if len(lines) > 3 {
|
||||
lines = lines[len(lines)-3:]
|
||||
}
|
||||
s = strings.TrimSpace(strings.Join(lines, " "))
|
||||
if r := []rune(s); len(r) > n {
|
||||
s = string(r[len(r)-n:])
|
||||
}
|
||||
return s
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"os"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestAllowedYouTubeURL(t *testing.T) {
|
||||
for _, ok := range []string{
|
||||
"https://www.youtube.com/watch?v=XnfMBo4IQ-g",
|
||||
"https://youtu.be/XnfMBo4IQ-g",
|
||||
"https://music.youtube.com/watch?v=XnfMBo4IQ-g",
|
||||
"http://m.youtube.com/watch?v=XnfMBo4IQ-g",
|
||||
} {
|
||||
if _, allowed := allowedYouTubeURL(ok); !allowed {
|
||||
t.Errorf("%q was rejected", ok)
|
||||
}
|
||||
}
|
||||
for _, bad := range []string{
|
||||
"",
|
||||
"not a url",
|
||||
"file:///etc/passwd",
|
||||
"https://evil.example.com/watch?v=x",
|
||||
// The allowlist is on the host, so a lookalike path or userinfo must not pass.
|
||||
"https://evil.example.com/www.youtube.com/watch?v=x",
|
||||
"https://youtube.com.evil.example.com/watch?v=x",
|
||||
"https://[email protected]/",
|
||||
"-oExecuteMe",
|
||||
} {
|
||||
if _, allowed := allowedYouTubeURL(bad); allowed {
|
||||
t.Errorf("%q was allowed", bad)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A real dump of an ordinary upload: no track, no artist, no creator, no album — just a title with
|
||||
// double spaces and an uploader. This is why prefill must never invent an "Unknown".
|
||||
func TestYouTubeMetaFromOrdinaryUpload(t *testing.T) {
|
||||
raw, err := os.ReadFile("testdata/ytdlp-noose.json")
|
||||
if err != nil {
|
||||
t.Skipf("fixture missing: %v", err)
|
||||
}
|
||||
meta, err := parseYouTubeMeta(raw)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if meta.Title != "Sentenced Noose" {
|
||||
t.Errorf("title = %q, want the cleaned video title", meta.Title)
|
||||
}
|
||||
if meta.Artist != "Heikki Rokkonen" {
|
||||
t.Errorf("artist = %q, want the uploader as the last fallback", meta.Artist)
|
||||
}
|
||||
if meta.Duration != 245*time.Second {
|
||||
t.Errorf("duration = %v, want 4m5s", meta.Duration)
|
||||
}
|
||||
}
|
||||
|
||||
func TestYouTubeMetaPrefersMusicFields(t *testing.T) {
|
||||
meta, err := parseYouTubeMeta([]byte(`{
|
||||
"title": "Sentenced - Noose (Official Video)",
|
||||
"track": "Noose", "artist": "Sentenced", "creator": "ignored",
|
||||
"uploader": "SentencedVEVO", "duration": 245.0}`))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if meta.Title != "Noose" || meta.Artist != "Sentenced" {
|
||||
t.Errorf("got %q by %q, want the track/artist fields to win", meta.Title, meta.Artist)
|
||||
}
|
||||
}
|
||||
|
||||
// Empty stays empty: a blank field prompts the submitter, a plausible "Unknown" does not.
|
||||
func TestYouTubeMetaLeavesBlanksBlank(t *testing.T) {
|
||||
meta, err := parseYouTubeMeta([]byte(`{"duration": 10.0}`))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if meta.Title != "" || meta.Artist != "" {
|
||||
t.Errorf("got %q by %q, want both empty", meta.Title, meta.Artist)
|
||||
}
|
||||
}
|
||||
+118
@@ -0,0 +1,118 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"embed"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"sort"
|
||||
)
|
||||
|
||||
//go:embed migrations/*.sql
|
||||
var migrationFS embed.FS
|
||||
|
||||
// migrate applies every migrations/*.sql not yet recorded, in filename order, each in its own
|
||||
// transaction. Applied names are the record — a file that changes after it ran is not re-applied.
|
||||
func migrate(ctx context.Context, db *sql.DB) error {
|
||||
_, err := db.ExecContext(ctx, `create table if not exists schema_migrations (
|
||||
name text primary key,
|
||||
applied_at timestamp not null default (datetime('now'))
|
||||
)`)
|
||||
if err != nil {
|
||||
return fmt.Errorf("create schema_migrations: %w", err)
|
||||
}
|
||||
|
||||
applied := map[string]bool{}
|
||||
rows, err := db.QueryContext(ctx, `select name from schema_migrations`)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read schema_migrations: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
var name string
|
||||
if err := rows.Scan(&name); err != nil {
|
||||
return err
|
||||
}
|
||||
applied[name] = true
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return err
|
||||
}
|
||||
rows.Close()
|
||||
|
||||
entries, err := migrationFS.ReadDir("migrations")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
names := make([]string, 0, len(entries))
|
||||
for _, e := range entries {
|
||||
names = append(names, e.Name())
|
||||
}
|
||||
sort.Strings(names)
|
||||
|
||||
for _, name := range names {
|
||||
if applied[name] {
|
||||
continue
|
||||
}
|
||||
sql, err := migrationFS.ReadFile("migrations/" + name)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
tx, err := db.BeginTx(ctx, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
|
||||
tx.Rollback()
|
||||
return fmt.Errorf("migration %s: %w", name, err)
|
||||
}
|
||||
if _, err := tx.ExecContext(ctx, `insert into schema_migrations (name) values ($1)`, name); err != nil {
|
||||
tx.Rollback()
|
||||
return err
|
||||
}
|
||||
if err := tx.Commit(); err != nil {
|
||||
return fmt.Errorf("migration %s: %w", name, err)
|
||||
}
|
||||
slog.Info("migration applied", "ctx", "startup", "name", name)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// sweep runs the startup cleanup from docs/spec.md §4.6. An in-process conversion goroutine dies
|
||||
// with the process, so without this those rows say "converting" forever.
|
||||
func sweep(ctx context.Context, db *sql.DB) error {
|
||||
res, err := db.ExecContext(ctx, `update submissions
|
||||
set status = 'failed', status_msg = 'interrupted by restart'
|
||||
where status in ('queued', 'downloading', 'converting')`)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if n := affected(res); n > 0 {
|
||||
slog.Warn("submissions interrupted by restart", "ctx", "startup", "count", n)
|
||||
}
|
||||
|
||||
// ponytail: temp files of swept submissions are unlinked with the row in step 3, once the
|
||||
// pipeline exists and there is something to unlink.
|
||||
if _, err := db.ExecContext(ctx,
|
||||
`delete from submissions where created_at < datetime('now', '-7 days')`); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := db.ExecContext(ctx,
|
||||
`delete from sessions where expires_at < datetime('now')`); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var failed int
|
||||
err = db.QueryRowContext(ctx,
|
||||
`select count(*) from submissions where status = 'failed'`).Scan(&failed)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if failed > 0 {
|
||||
// A failed submission is invisible to everyone but its submitter, so a broken pipeline
|
||||
// has no other way of announcing itself.
|
||||
slog.Warn("failed submissions present", "ctx", "startup", "count", failed)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
-- Timestamps are declared `timestamp` and hold UTC 'YYYY-MM-DD HH:MM:SS': the declared type is what
|
||||
-- makes the driver hand them back as time.Time, and a fixed-width UTC string is what makes
|
||||
-- `order by created_at` and `expires_at > datetime('now')` mean what they say.
|
||||
|
||||
create table users (
|
||||
id integer primary key autoincrement,
|
||||
name text not null,
|
||||
email text not null unique,
|
||||
password_hash text not null,
|
||||
avatar text,
|
||||
banned integer not null default 0,
|
||||
created_at timestamp not null default (datetime('now'))
|
||||
);
|
||||
|
||||
create table sessions (
|
||||
token text primary key,
|
||||
user_id integer not null references users (id) on delete cascade,
|
||||
idle_ttl integer not null, -- seconds; SQLite has no interval type
|
||||
expires_at timestamp not null,
|
||||
created_at timestamp not null default (datetime('now'))
|
||||
);
|
||||
|
||||
create index sessions_user on sessions (user_id);
|
||||
|
||||
create table invites (
|
||||
id integer primary key autoincrement,
|
||||
code text not null unique,
|
||||
is_valid integer not null default 1,
|
||||
created_at timestamp not null default (datetime('now'))
|
||||
);
|
||||
|
||||
create table songs (
|
||||
id integer primary key autoincrement,
|
||||
title text not null,
|
||||
artist text not null,
|
||||
genre text not null,
|
||||
description text,
|
||||
-- LRC or plain text, told apart by whether the first line starts with '['. Not covered by the
|
||||
-- lock: nobody reviewed the lyrics.
|
||||
lyrics text,
|
||||
audio_file text not null,
|
||||
duration_seconds integer not null,
|
||||
source_url text,
|
||||
submitted_by integer not null references users (id),
|
||||
created_at timestamp not null default (datetime('now'))
|
||||
);
|
||||
|
||||
create index songs_created_at on songs (created_at desc);
|
||||
|
||||
create table submissions (
|
||||
id integer primary key autoincrement,
|
||||
user_id integer not null references users (id) on delete cascade,
|
||||
status text not null default 'queued',
|
||||
status_msg text,
|
||||
source_url text,
|
||||
tmp_path text,
|
||||
title text,
|
||||
artist text,
|
||||
genre text,
|
||||
description text,
|
||||
lyrics text,
|
||||
created_at timestamp not null default (datetime('now')),
|
||||
constraint submissions_status check (
|
||||
status in ('queued', 'downloading', 'converting', 'ready', 'failed')
|
||||
)
|
||||
);
|
||||
|
||||
-- The submission quota (5 per rolling 24h, failures excluded) reads this.
|
||||
create index submissions_user_created on submissions (user_id, created_at desc);
|
||||
|
||||
create table reviews (
|
||||
id integer primary key autoincrement,
|
||||
song_id integer not null references songs (id) on delete cascade,
|
||||
reviewer_id integer not null references users (id),
|
||||
score integer not null check (score between 1 and 100),
|
||||
text text not null,
|
||||
created_at timestamp not null default (datetime('now')),
|
||||
updated_at timestamp not null default (datetime('now')),
|
||||
unique (song_id, reviewer_id)
|
||||
);
|
||||
|
||||
create index reviews_song on reviews (song_id);
|
||||
|
||||
-- The queue asks "songs this member has not reviewed" — that lookup is by reviewer.
|
||||
create index reviews_reviewer_song on reviews (reviewer_id, song_id);
|
||||
|
||||
create table reports (
|
||||
id integer primary key autoincrement,
|
||||
user_id integer not null references users (id) on delete cascade,
|
||||
body text not null,
|
||||
page text,
|
||||
user_agent text,
|
||||
resolved_at timestamp,
|
||||
created_at timestamp not null default (datetime('now'))
|
||||
);
|
||||
@@ -0,0 +1,8 @@
|
||||
-- The admin became an ordinary account with a flag, so the separate Basic Auth listener could go.
|
||||
-- Same integer-as-boolean convention as `banned` above it.
|
||||
alter table users add column is_admin integer not null default 0;
|
||||
|
||||
-- An existing database already has its admin sitting in row one: the person who was handed the
|
||||
-- first invite from the old panel. A fresh database has no rows, so this is a no-op there and
|
||||
-- seedAdmin creates the account from the environment instead.
|
||||
update users set is_admin = 1 where id = (select min(id) from users);
|
||||
+232
@@ -0,0 +1,232 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
const maxAvatarBytes = 5 << 20
|
||||
|
||||
type profileStats struct {
|
||||
SongsSubmitted int
|
||||
ReviewsWritten int
|
||||
AverageGiven *float64
|
||||
AverageReceived *float64
|
||||
}
|
||||
|
||||
type profileView struct {
|
||||
ID int64
|
||||
Name string
|
||||
Email string // only filled for your own profile
|
||||
Avatar *string
|
||||
CreatedAt time.Time
|
||||
Own bool
|
||||
Stats profileStats
|
||||
Songs []*songSummary
|
||||
Errors map[string]string
|
||||
}
|
||||
|
||||
func (p *profileView) Initials() string { m := member{Name: p.Name}; return m.Initials() }
|
||||
|
||||
func (a *app) avatarPath(userID int64) string {
|
||||
return filepath.Join(a.cfg.storageDir, "avatars", strconv.FormatInt(userID, 10)+".jpg")
|
||||
}
|
||||
|
||||
// Counts and history-wide averages only. A member's per-song opinions stay on the song pages —
|
||||
// per-song opinion is gated, whole-history aggregate is public.
|
||||
func (a *app) profile(ctx context.Context, viewerID, userID int64) (*profileView, error) {
|
||||
var p profileView
|
||||
err := a.db.QueryRowContext(ctx, `
|
||||
select u.id, u.name, u.email, u.avatar, u.created_at,
|
||||
(select count(*) from songs s where s.submitted_by = u.id),
|
||||
(select count(*) from reviews r where r.reviewer_id = u.id),
|
||||
(select avg(r.score) from reviews r where r.reviewer_id = u.id),
|
||||
(select avg(r.score) from reviews r
|
||||
join songs s on s.id = r.song_id where s.submitted_by = u.id)
|
||||
from users u where u.id = $1`, userID).
|
||||
Scan(&p.ID, &p.Name, &p.Email, &p.Avatar, &p.CreatedAt,
|
||||
&p.Stats.SongsSubmitted, &p.Stats.ReviewsWritten,
|
||||
&p.Stats.AverageGiven, &p.Stats.AverageReceived)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
p.Own = viewerID == userID
|
||||
if !p.Own {
|
||||
p.Email = ""
|
||||
}
|
||||
|
||||
// Their songs, with the viewer's own reveal rule applied to each average.
|
||||
rows, err := a.db.QueryContext(ctx, `select`+songColumns+`
|
||||
from songs s join users u on u.id = s.submitted_by
|
||||
where s.submitted_by = $2
|
||||
order by s.created_at desc`, viewerID, userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
p.Songs, err = scanSongs(rows)
|
||||
return &p, err
|
||||
}
|
||||
|
||||
func (a *app) profilePage(w http.ResponseWriter, r *http.Request) {
|
||||
me := memberFrom(r.Context())
|
||||
id := me.ID
|
||||
if raw := r.PathValue("id"); raw != "" {
|
||||
parsed, err := strconv.ParseInt(raw, 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
id = parsed
|
||||
}
|
||||
p, err := a.profile(r.Context(), me.ID, id)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("profile", "ctx", "auth", "error", err, "user", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "profile.html", page{Title: p.Name, Data: p})
|
||||
}
|
||||
|
||||
// Editing your own profile: name, email, password, avatar. Changing the password requires the
|
||||
// current one and drops your other sessions.
|
||||
func (a *app) editProfile(w http.ResponseWriter, r *http.Request) {
|
||||
me := memberFrom(r.Context())
|
||||
|
||||
if err := r.ParseMultipartForm(maxAvatarBytes); err != nil && !errors.Is(err, http.ErrNotMultipart) {
|
||||
a.flash(w, "Kuva on liian suuri. Enintään 5 MB.")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
name := clean(r.FormValue("name"), 50)
|
||||
email := strings.TrimSpace(strings.ToLower(r.FormValue("email")))
|
||||
if name == "" || !strings.Contains(email, "@") {
|
||||
a.flash(w, "Tarkista nimi ja sähköpostiosoite.")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update users set name = $2, email = $3 where id = $1`, me.ID, name, email); isUnique(err) {
|
||||
a.flash(w, "Sähköpostiosoite on jo käytössä.")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("edit profile", "ctx", "auth", "error", err, "user", me.ID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
if newPassword := r.FormValue("new_password"); newPassword != "" {
|
||||
if !a.changePassword(w, r, me.ID, r.FormValue("current_password"), newPassword) {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
if file, _, err := r.FormFile("avatar"); err == nil {
|
||||
defer file.Close()
|
||||
if err := a.saveAvatar(r, me.ID, file); err != nil {
|
||||
slog.Error("avatar", "ctx", "auth", "error", err, "user", me.ID)
|
||||
a.flash(w, "Kuvaa ei voitu käsitellä. Onko se varmasti kuva?")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
a.flash(w, "Tiedot tallennettu.")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *app) changePassword(w http.ResponseWriter, r *http.Request, userID int64, current, next string) bool {
|
||||
var hash string
|
||||
if err := a.db.QueryRowContext(r.Context(),
|
||||
`select password_hash from users where id = $1`, userID).Scan(&hash); err != nil {
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return false
|
||||
}
|
||||
if bcrypt.CompareHashAndPassword([]byte(hash), []byte(current)) != nil {
|
||||
a.flash(w, "Nykyinen salasana ei täsmää.")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
return false
|
||||
}
|
||||
newHash, err := bcrypt.GenerateFromPassword([]byte(next), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return false
|
||||
}
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update users set password_hash = $2 where id = $1`, userID, string(newHash)); err != nil {
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return false
|
||||
}
|
||||
// Every other session dies; this browser keeps its own.
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`delete from sessions where user_id = $1 and token <> $2`, userID, sessionToken(r)); err != nil {
|
||||
slog.Error("drop sessions", "ctx", "auth", "error", err, "user", userID)
|
||||
}
|
||||
slog.Info("password changed", "ctx", "auth", "user", userID)
|
||||
return true
|
||||
}
|
||||
|
||||
// The re-encode through ffmpeg is the validation, the same trick as audio: it handles webp and
|
||||
// avif (stdlib image does not), and it caps what ends up on disk.
|
||||
func (a *app) saveAvatar(r *http.Request, userID int64, file io.Reader) error {
|
||||
tmp := filepath.Join(a.cfg.storageDir, "tmp", "avatar-"+strconv.FormatInt(userID, 10))
|
||||
dst, err := os.Create(tmp)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
_, err = io.Copy(dst, io.LimitReader(file, maxAvatarBytes))
|
||||
dst.Close()
|
||||
if err != nil {
|
||||
os.Remove(tmp)
|
||||
return err
|
||||
}
|
||||
defer os.Remove(tmp)
|
||||
|
||||
out := a.avatarPath(userID)
|
||||
if err := toAvatarJPEG(r.Context(), tmp, out); err != nil {
|
||||
return err
|
||||
}
|
||||
_, err = a.db.ExecContext(r.Context(),
|
||||
`update users set avatar = $2 where id = $1`, userID, filepath.Base(out))
|
||||
return err
|
||||
}
|
||||
|
||||
// Avatars are public: they are not secret, and gating them buys nothing.
|
||||
func (a *app) avatar(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
f, err := os.Open(a.avatarPath(id))
|
||||
if err != nil {
|
||||
// No upload: the template renders initials instead, and a client sees avatar_url null.
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
defer f.Close()
|
||||
info, err := f.Stat()
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "image/jpeg")
|
||||
w.Header().Set("Cache-Control", "public, max-age=300")
|
||||
http.ServeContent(w, r, "avatar.jpg", info.ModTime(), f)
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"sync"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Login attempts are limited per email address, which is the thing under attack — and the only key
|
||||
// available without parsing X-Forwarded-For and maintaining a trusted-proxy list.
|
||||
//
|
||||
// ponytail: in memory, dies with the process. A restart clearing the counters is not an attack an
|
||||
// attacker can mount. A shared store is the upgrade if this ever runs as more than one process.
|
||||
const (
|
||||
loginMaxFailures = 10
|
||||
loginWindow = 15 * time.Minute
|
||||
loginLockout = 15 * time.Minute
|
||||
)
|
||||
|
||||
type attempts struct {
|
||||
count int
|
||||
first time.Time
|
||||
until time.Time // zero unless locked
|
||||
}
|
||||
|
||||
type limiter struct {
|
||||
mu sync.Mutex
|
||||
by map[string]*attempts
|
||||
}
|
||||
|
||||
// locked reports whether the key is currently refused. It does not count as an attempt.
|
||||
func (l *limiter) locked(key string) bool {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
a := l.by[key]
|
||||
return a != nil && time.Now().Before(a.until)
|
||||
}
|
||||
|
||||
func (l *limiter) fail(key string) {
|
||||
now := time.Now()
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
if l.by == nil {
|
||||
l.by = map[string]*attempts{}
|
||||
}
|
||||
l.sweep(now)
|
||||
|
||||
a := l.by[key]
|
||||
if a == nil || now.Sub(a.first) > loginWindow {
|
||||
l.by[key] = &attempts{count: 1, first: now}
|
||||
return
|
||||
}
|
||||
a.count++
|
||||
if a.count >= loginMaxFailures {
|
||||
a.until = now.Add(loginLockout)
|
||||
}
|
||||
}
|
||||
|
||||
// A correct password clears the record: the limit is on guessing, not on the account. Locking the
|
||||
// account itself would let anyone lock its owner out by trying.
|
||||
func (l *limiter) succeed(key string) {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
delete(l.by, key)
|
||||
}
|
||||
|
||||
// Called under the lock, on failures only — there is nothing to grow the map otherwise.
|
||||
func (l *limiter) sweep(now time.Time) {
|
||||
for k, a := range l.by {
|
||||
if now.Sub(a.first) > loginWindow && now.After(a.until) {
|
||||
delete(l.by, k)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestLoginRateLimit(t *testing.T) {
|
||||
var l limiter
|
||||
|
||||
for i := range loginMaxFailures - 1 {
|
||||
l.fail("[email protected]")
|
||||
if l.locked("[email protected]") {
|
||||
t.Fatalf("locked after %d failures, limit is %d", i+1, loginMaxFailures)
|
||||
}
|
||||
}
|
||||
l.fail("[email protected]")
|
||||
if !l.locked("[email protected]") {
|
||||
t.Fatalf("not locked after %d failures", loginMaxFailures)
|
||||
}
|
||||
|
||||
// The limit is per email: locking one address must not lock anyone else out.
|
||||
if l.locked("[email protected]") {
|
||||
t.Fatal("a different address was locked too")
|
||||
}
|
||||
|
||||
// A correct password clears it, so a member who mistypes nine times and then gets it right
|
||||
// starts from zero.
|
||||
l.succeed("[email protected]")
|
||||
if l.locked("[email protected]") {
|
||||
t.Fatal("still locked after a successful login")
|
||||
}
|
||||
|
||||
// Failures older than the window don't accumulate.
|
||||
for range loginMaxFailures - 1 {
|
||||
l.fail("[email protected]")
|
||||
}
|
||||
l.by["[email protected]"].first = time.Now().Add(-loginWindow - time.Minute)
|
||||
l.fail("[email protected]")
|
||||
if l.locked("[email protected]") {
|
||||
t.Fatal("failures outside the window were counted")
|
||||
}
|
||||
}
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"embed"
|
||||
"html/template"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"time"
|
||||
)
|
||||
|
||||
//go:embed templates static
|
||||
var assetFS embed.FS
|
||||
|
||||
var funcs = template.FuncMap{
|
||||
"fidate": func(t time.Time) string { return t.Local().Format("2.1.2006 15:04") },
|
||||
// Date without the clock: the minute a song was published is noise.
|
||||
"fiday": func(t time.Time) string { return t.Local().Format("2.1.2006") },
|
||||
// Lyrics as they are meant to be read: LRC timestamps belong to the player, not the reader.
|
||||
"lyricstext": stripLRC,
|
||||
"score": func(f *float64) string { return strconv.FormatFloat(*f, 'f', 1, 64) },
|
||||
"value": func(f float64) string { return strconv.FormatFloat(f, 'f', 1, 64) },
|
||||
// Lets one board partial be called with a title and a list, instead of two near-identical
|
||||
// partials per leaderboard.
|
||||
"dict": func(pairs ...any) map[string]any {
|
||||
m := map[string]any{}
|
||||
for i := 0; i+1 < len(pairs); i += 2 {
|
||||
m[pairs[i].(string)] = pairs[i+1]
|
||||
}
|
||||
return m
|
||||
},
|
||||
}
|
||||
|
||||
// Each page is parsed with the layout into its own set, so two pages may both define "content".
|
||||
var pages = map[string]*template.Template{}
|
||||
|
||||
func init() {
|
||||
entries, err := assetFS.ReadDir("templates")
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
for _, e := range entries {
|
||||
if e.Name() == "layout.html" {
|
||||
continue
|
||||
}
|
||||
if e.IsDir() {
|
||||
continue
|
||||
}
|
||||
pages[e.Name()] = template.Must(template.New("layout.html").Funcs(funcs).
|
||||
ParseFS(assetFS, "templates/layout.html", "templates/partials/*.html", "templates/"+e.Name()))
|
||||
}
|
||||
}
|
||||
|
||||
// page is everything the layout needs, plus whatever the page itself wants in Data.
|
||||
type page struct {
|
||||
Title string
|
||||
Member *member
|
||||
Admin bool
|
||||
Flash string
|
||||
Path string
|
||||
Narrow bool // auth pages are a 420px column
|
||||
Queued int // songs still owed a review, shown in the nav
|
||||
Version string
|
||||
Data any
|
||||
}
|
||||
|
||||
func (a *app) render(w http.ResponseWriter, r *http.Request, status int, name string, p page) {
|
||||
t, ok := pages[name]
|
||||
if !ok {
|
||||
slog.Error("unknown template", "name", name)
|
||||
http.Error(w, "template", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
p.Member = memberFrom(r.Context())
|
||||
p.Path = r.URL.Path
|
||||
p.Version = version
|
||||
if p.Member != nil {
|
||||
// The queue is a worklist, so its size belongs in the nav.
|
||||
a.db.QueryRowContext(r.Context(), `
|
||||
select count(*) from songs s
|
||||
where s.submitted_by <> $1
|
||||
and not exists (select 1 from reviews r
|
||||
where r.song_id = s.id and r.reviewer_id = $1)`,
|
||||
p.Member.ID).Scan(&p.Queued)
|
||||
}
|
||||
p.Flash = a.takeFlash(w, r)
|
||||
|
||||
// Render to memory first: a template that fails halfway must not leave a half-written 200.
|
||||
var buf bytes.Buffer
|
||||
if err := t.ExecuteTemplate(&buf, "layout.html", p); err != nil {
|
||||
slog.Error("render", "name", name, "error", err)
|
||||
http.Error(w, "template", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
w.WriteHeader(status)
|
||||
buf.WriteTo(w)
|
||||
}
|
||||
|
||||
// Toasts are a cookie rendered server-side and cleared on read — no JS, no session storage.
|
||||
func (a *app) flash(w http.ResponseWriter, msg string) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: "flash", Value: url.QueryEscape(msg), Path: "/",
|
||||
HttpOnly: true, Secure: a.cfg.secureCookies, SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
}
|
||||
|
||||
func (a *app) takeFlash(w http.ResponseWriter, r *http.Request) string {
|
||||
c, err := r.Cookie("flash")
|
||||
if err != nil || c.Value == "" {
|
||||
return ""
|
||||
}
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: "flash", Value: "", Path: "/", MaxAge: -1,
|
||||
HttpOnly: true, Secure: a.cfg.secureCookies, SameSite: http.SameSiteLaxMode,
|
||||
})
|
||||
msg, err := url.QueryUnescape(c.Value)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return msg
|
||||
}
|
||||
+192
@@ -0,0 +1,192 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
const maxReportBody = 2000
|
||||
|
||||
type report struct {
|
||||
ID int64
|
||||
Body string
|
||||
Page string
|
||||
UserAgent string
|
||||
Reporter string
|
||||
ResolvedAt *time.Time
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
func (r *report) Open() bool { return r.ResolvedAt == nil }
|
||||
|
||||
type reportPage struct {
|
||||
From string
|
||||
Mine []*report
|
||||
}
|
||||
|
||||
// Free text and nothing else. No category, no priority, no severity — with ten users a sentence and
|
||||
// a page URL beat a taxonomy nobody fills in honestly.
|
||||
func (a *app) reportPage(w http.ResponseWriter, r *http.Request) {
|
||||
mine, err := a.myReports(r.Context(), memberFrom(r.Context()).ID)
|
||||
if err != nil {
|
||||
slog.Error("list reports", "ctx", "reports", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
from := r.URL.Query().Get("from")
|
||||
if !strings.HasPrefix(from, "/") {
|
||||
from = "/" // never redirect off-site on the strength of a query parameter
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "report.html",
|
||||
page{Title: "Palaute", Data: reportPage{From: from, Mine: mine}})
|
||||
}
|
||||
|
||||
// Seeing your own past reports is what stops the same bug arriving four times.
|
||||
func (a *app) myReports(ctx context.Context, userID int64) ([]*report, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select id, body, coalesce(page, ''), resolved_at, created_at
|
||||
from reports where user_id = $1 order by created_at desc`, userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []*report
|
||||
for rows.Next() {
|
||||
var rep report
|
||||
if err := rows.Scan(&rep.ID, &rep.Body, &rep.Page, &rep.ResolvedAt, &rep.CreatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, &rep)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
func (a *app) createReport(w http.ResponseWriter, r *http.Request) {
|
||||
me := memberFrom(r.Context())
|
||||
body := clean(r.FormValue("body"), maxReportBody)
|
||||
from := r.FormValue("from")
|
||||
if !strings.HasPrefix(from, "/") {
|
||||
from = "/"
|
||||
}
|
||||
if body == "" {
|
||||
a.flash(w, "Kirjoita muutama sana siitä, mikä meni pieleen.")
|
||||
http.Redirect(w, r, "/report?from="+from, http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
// "Only on my phone" is the most common bug report and this answers it without asking.
|
||||
_, err := a.db.ExecContext(r.Context(), `
|
||||
insert into reports (user_id, body, page, user_agent) values ($1, $2, nullif($3, ''), $4)`,
|
||||
me.ID, body, from, clean(r.Header.Get("User-Agent"), 300))
|
||||
if err != nil {
|
||||
slog.Error("create report", "ctx", "reports", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
slog.Info("report filed", "ctx", "reports", "user", me.ID)
|
||||
a.flash(w, "Kiitos! Palaute on perillä.")
|
||||
http.Redirect(w, r, from, http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// --- admin ---
|
||||
|
||||
func (a *app) adminReports(w http.ResponseWriter, r *http.Request) {
|
||||
rows, err := a.db.QueryContext(r.Context(), `
|
||||
select rep.id, rep.body, coalesce(rep.page, ''), coalesce(rep.user_agent, ''),
|
||||
u.name, rep.resolved_at, rep.created_at
|
||||
from reports rep join users u on u.id = rep.user_id
|
||||
order by rep.resolved_at nulls first, rep.created_at desc`)
|
||||
if err != nil {
|
||||
adminError(w, "reports", err)
|
||||
return
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []*report
|
||||
for rows.Next() {
|
||||
var rep report
|
||||
if err := rows.Scan(&rep.ID, &rep.Body, &rep.Page, &rep.UserAgent, &rep.Reporter,
|
||||
&rep.ResolvedAt, &rep.CreatedAt); err != nil {
|
||||
adminError(w, "reports", err)
|
||||
return
|
||||
}
|
||||
out = append(out, &rep)
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
adminError(w, "reports", err)
|
||||
return
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "admin_reports.html",
|
||||
page{Title: "Palautteet", Admin: true, Data: out})
|
||||
}
|
||||
|
||||
// A nullable timestamp rather than a status enum: smaller, and it tells you *when*.
|
||||
func (a *app) resolveReport(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update reports set resolved_at = case when resolved_at is null then datetime('now') end
|
||||
where id = $1`,
|
||||
id); err != nil {
|
||||
adminError(w, "reports", err)
|
||||
return
|
||||
}
|
||||
http.Redirect(w, r, "/admin/reports", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// The admin deletes a song unconditionally — a separate route from the submitter's, rather than one
|
||||
// route with a branch. The row and the file go together here too.
|
||||
func (a *app) adminDeleteSong(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
res, err := a.db.ExecContext(r.Context(), `delete from songs where id = $1`, id)
|
||||
if err != nil {
|
||||
adminError(w, "songs", err)
|
||||
return
|
||||
}
|
||||
if affected(res) > 0 {
|
||||
removeFile(a.audioPath(id))
|
||||
slog.Info("song deleted by admin", "ctx", "songs", "song", id)
|
||||
a.flash(w, "Kappale poistettu.")
|
||||
}
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
type adminSong struct {
|
||||
ID int64
|
||||
Title string
|
||||
Artist string
|
||||
Submitter string
|
||||
Reviews int
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
func (a *app) adminSongs(ctx context.Context) ([]adminSong, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select s.id, s.title, s.artist, u.name,
|
||||
(select count(*) from reviews r where r.song_id = s.id), s.created_at
|
||||
from songs s join users u on u.id = s.submitted_by
|
||||
order by s.created_at desc`)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []adminSong
|
||||
for rows.Next() {
|
||||
var s adminSong
|
||||
if err := rows.Scan(&s.ID, &s.Title, &s.Artist, &s.Submitter, &s.Reviews, &s.CreatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, s)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
+203
@@ -0,0 +1,203 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
editWindow = 30 * time.Minute
|
||||
maxReview = 5000
|
||||
)
|
||||
|
||||
// The same window as a SQLite date modifier, for the two statements that enforce it. SQLite has no
|
||||
// interval type to bind, so the unit travels in the string.
|
||||
var editWindowAgo = fmt.Sprintf("-%d seconds", int(editWindow.Seconds()))
|
||||
|
||||
type review struct {
|
||||
ID int64
|
||||
SongID int64
|
||||
ReviewerID int64
|
||||
Reviewer string
|
||||
Score int
|
||||
Text string
|
||||
CreatedAt time.Time
|
||||
UpdatedAt time.Time
|
||||
Own bool
|
||||
}
|
||||
|
||||
// The window is measured from updated_at, so an edit extends it. It gates deletion as well as
|
||||
// editing: for 30 minutes a review is yours to change or withdraw, after that it is on the record.
|
||||
func (r *review) EditableUntil() time.Time { return r.UpdatedAt.Add(editWindow) }
|
||||
func (r *review) CanEdit() bool { return r.Own && time.Now().Before(r.EditableUntil()) }
|
||||
|
||||
func (r *review) Initials() string {
|
||||
m := member{Name: r.Reviewer}
|
||||
return m.Initials()
|
||||
}
|
||||
|
||||
func (a *app) reviewsFor(ctx context.Context, songID, viewerID int64) ([]*review, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select r.id, r.song_id, r.reviewer_id, u.name, r.score, r.text, r.created_at, r.updated_at,
|
||||
r.reviewer_id = $2
|
||||
from reviews r join users u on u.id = r.reviewer_id
|
||||
where r.song_id = $1
|
||||
order by r.created_at`, songID, viewerID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []*review
|
||||
for rows.Next() {
|
||||
var v review
|
||||
if err := rows.Scan(&v.ID, &v.SongID, &v.ReviewerID, &v.Reviewer, &v.Score, &v.Text,
|
||||
&v.CreatedAt, &v.UpdatedAt, &v.Own); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, &v)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
func (a *app) viewerReview(ctx context.Context, songID, viewerID int64) (*review, error) {
|
||||
var v review
|
||||
err := a.db.QueryRowContext(ctx, `
|
||||
select r.id, r.song_id, r.reviewer_id, u.name, r.score, r.text, r.created_at, r.updated_at, true
|
||||
from reviews r join users u on u.id = r.reviewer_id
|
||||
where r.song_id = $1 and r.reviewer_id = $2`, songID, viewerID).
|
||||
Scan(&v.ID, &v.SongID, &v.ReviewerID, &v.Reviewer, &v.Score, &v.Text,
|
||||
&v.CreatedAt, &v.UpdatedAt, &v.Own)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, nil
|
||||
}
|
||||
return &v, err
|
||||
}
|
||||
|
||||
func reviewInput(r *http.Request) (int, string, string) {
|
||||
score, _ := strconv.Atoi(r.FormValue("score"))
|
||||
text := clean(r.FormValue("text"), maxReview)
|
||||
switch {
|
||||
case score < 1 || score > 100:
|
||||
return 0, "", "Pisteiden tulee olla 1–100."
|
||||
case text == "":
|
||||
return 0, "", "Kirjoita muutama sana."
|
||||
}
|
||||
return score, text, ""
|
||||
}
|
||||
|
||||
func (a *app) createReview(w http.ResponseWriter, r *http.Request) {
|
||||
songID, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
me := memberFrom(r.Context())
|
||||
score, text, problem := reviewInput(r)
|
||||
if problem != "" {
|
||||
a.flash(w, problem)
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", songID), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
// You cannot review your own song, and the unique constraint is what stops a second review —
|
||||
// no read-then-write race to lose.
|
||||
var submitter int64
|
||||
err = a.db.QueryRowContext(r.Context(), `select submitted_by from songs where id = $1`, songID).Scan(&submitter)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("load song", "ctx", "reviews", "error", err, "song", songID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if submitter == me.ID {
|
||||
http.Error(w, "omaa kappaletta ei voi arvostella", http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
|
||||
_, err = a.db.ExecContext(r.Context(),
|
||||
`insert into reviews (song_id, reviewer_id, score, text) values ($1, $2, $3, $4)`,
|
||||
songID, me.ID, score, text)
|
||||
if isUnique(err) {
|
||||
a.flash(w, "Olet jo arvostellut tämän kappaleen.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", songID), http.StatusSeeOther)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("create review", "ctx", "reviews", "error", err, "song", songID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
slog.Info("review written", "ctx", "reviews", "song", songID, "user", me.ID)
|
||||
a.flash(w, "Arvostelu tallennettu. Nyt näet muidenkin arvostelut.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", songID), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// Both edit and delete are gated by the same window, in the same WHERE clause — the database
|
||||
// decides, so there is no clock-check in Go to get subtly wrong.
|
||||
func (a *app) editReview(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
score, text, problem := reviewInput(r)
|
||||
if problem != "" {
|
||||
a.flash(w, problem)
|
||||
http.Redirect(w, r, r.FormValue("from"), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
var songID int64
|
||||
err = a.db.QueryRowContext(r.Context(), `
|
||||
update reviews set score = $3, text = $4, updated_at = datetime('now')
|
||||
where id = $1 and reviewer_id = $2 and updated_at > datetime('now', $5)
|
||||
returning song_id`,
|
||||
id, memberFrom(r.Context()).ID, score, text, editWindowAgo).Scan(&songID)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
a.flash(w, "Muokkausaika on umpeutunut.")
|
||||
http.Redirect(w, r, r.FormValue("from"), http.StatusSeeOther)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("edit review", "ctx", "reviews", "error", err, "review", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
a.flash(w, "Arvostelu päivitetty.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", songID), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// Deleting the last review unlocks the song for its submitter again — locked is a live state, and
|
||||
// the 30-minute window is what keeps that from being a rug-pull months later.
|
||||
func (a *app) deleteReview(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
var songID int64
|
||||
err = a.db.QueryRowContext(r.Context(), `
|
||||
delete from reviews
|
||||
where id = $1 and reviewer_id = $2 and updated_at > datetime('now', $3)
|
||||
returning song_id`,
|
||||
id, memberFrom(r.Context()).ID, editWindowAgo).Scan(&songID)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
a.flash(w, "Muokkausaika on umpeutunut.")
|
||||
http.Redirect(w, r, r.FormValue("from"), http.StatusSeeOther)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("delete review", "ctx", "reviews", "error", err, "review", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
slog.Info("review deleted", "ctx", "reviews", "review", id, "song", songID)
|
||||
a.flash(w, "Arvostelu poistettu.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", songID), http.StatusSeeOther)
|
||||
}
|
||||
+375
@@ -0,0 +1,375 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"os"
|
||||
"strconv"
|
||||
"time"
|
||||
)
|
||||
|
||||
const pageSize = 20
|
||||
|
||||
type songSummary struct {
|
||||
ID int64
|
||||
Title string
|
||||
Artist string
|
||||
Genre string
|
||||
Duration int
|
||||
CreatedAt time.Time
|
||||
Submitter string
|
||||
SubmitterID int64
|
||||
ReviewCount int
|
||||
// Nil unless the viewer has revealed the song. The reveal rule is applied in the query, not
|
||||
// in the template — a hidden average is never sent.
|
||||
Average *float64
|
||||
Own bool
|
||||
Reviewed bool
|
||||
}
|
||||
|
||||
func (s *songSummary) GenreLabel() string { return genreLabel(s.Genre) }
|
||||
func (s *songSummary) Revealed() bool { return s.Own || s.Reviewed }
|
||||
|
||||
func (s *songSummary) Length() string {
|
||||
return fmt.Sprintf("%d:%02d", s.Duration/60, s.Duration%60)
|
||||
}
|
||||
|
||||
type songList struct {
|
||||
Items []*songSummary
|
||||
Cursor int64 // the cursor this page was fetched with; 0 means the first page
|
||||
NextCursor int64 // 0 when there is no next page
|
||||
Queue bool
|
||||
}
|
||||
|
||||
// The select list is identical for both lists, so the reveal rule cannot drift between them.
|
||||
const songColumns = `
|
||||
s.id, s.title, s.artist, s.genre, s.duration_seconds, s.created_at, u.id, u.name,
|
||||
(select count(*) from reviews r where r.song_id = s.id),
|
||||
case when s.submitted_by = $1
|
||||
or exists (select 1 from reviews r where r.song_id = s.id and r.reviewer_id = $1)
|
||||
then (select avg(r.score) from reviews r where r.song_id = s.id)
|
||||
end,
|
||||
s.submitted_by = $1,
|
||||
exists (select 1 from reviews r where r.song_id = s.id and r.reviewer_id = $1)`
|
||||
|
||||
func scanSongs(rows *sql.Rows) ([]*songSummary, error) {
|
||||
defer rows.Close()
|
||||
var out []*songSummary
|
||||
for rows.Next() {
|
||||
var s songSummary
|
||||
if err := rows.Scan(&s.ID, &s.Title, &s.Artist, &s.Genre, &s.Duration, &s.CreatedAt,
|
||||
&s.SubmitterID, &s.Submitter, &s.ReviewCount, &s.Average, &s.Own, &s.Reviewed); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, &s)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// The queue is a worklist: songs you can still review, oldest first, and never your own — you can
|
||||
// never act on those, so they would sit at the front forever.
|
||||
func (a *app) queue(ctx context.Context, viewerID, cursor int64) (*songList, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `select`+songColumns+`
|
||||
from songs s join users u on u.id = s.submitted_by
|
||||
where s.submitted_by <> $1
|
||||
and not exists (select 1 from reviews r where r.song_id = s.id and r.reviewer_id = $1)
|
||||
and ($2 = 0 or s.id > $2)
|
||||
order by s.created_at, s.id
|
||||
limit $3`, viewerID, cursor, pageSize+1)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items, err := scanSongs(rows)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return paginate(items, cursor, true), nil
|
||||
}
|
||||
|
||||
// Everything, newest first. This is where a song lives once it has left the queue.
|
||||
func (a *app) browse(ctx context.Context, viewerID, cursor int64) (*songList, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `select`+songColumns+`
|
||||
from songs s join users u on u.id = s.submitted_by
|
||||
where ($2 = 0 or s.id < $2)
|
||||
order by s.created_at desc, s.id desc
|
||||
limit $3`, viewerID, cursor, pageSize+1)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items, err := scanSongs(rows)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return paginate(items, cursor, false), nil
|
||||
}
|
||||
|
||||
// One row over the page size is fetched so "is there more" needs no second count query.
|
||||
func paginate(items []*songSummary, cursor int64, isQueue bool) *songList {
|
||||
l := &songList{Items: items, Cursor: cursor, Queue: isQueue}
|
||||
if len(items) > pageSize {
|
||||
l.Items = items[:pageSize]
|
||||
l.NextCursor = l.Items[pageSize-1].ID
|
||||
}
|
||||
return l
|
||||
}
|
||||
|
||||
func cursorOf(r *http.Request) int64 {
|
||||
n, _ := strconv.ParseInt(r.URL.Query().Get("cursor"), 10, 64)
|
||||
return n
|
||||
}
|
||||
|
||||
func (a *app) queuePage(w http.ResponseWriter, r *http.Request) {
|
||||
list, err := a.queue(r.Context(), memberFrom(r.Context()).ID, cursorOf(r))
|
||||
if err != nil {
|
||||
slog.Error("queue", "ctx", "songs", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "queue.html", page{Title: "Jono", Data: list})
|
||||
}
|
||||
|
||||
func (a *app) browsePage(w http.ResponseWriter, r *http.Request) {
|
||||
list, err := a.browse(r.Context(), memberFrom(r.Context()).ID, cursorOf(r))
|
||||
if err != nil {
|
||||
slog.Error("browse", "ctx", "songs", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "songs.html", page{Title: "Kappaleet", Data: list})
|
||||
}
|
||||
|
||||
// --- detail ---
|
||||
|
||||
type songDetail struct {
|
||||
songSummary
|
||||
Description string
|
||||
Lyrics string
|
||||
SourceURL *string
|
||||
Reviews []*review // nil when the reveal rule is withholding them
|
||||
ViewerReview *review
|
||||
CanReview bool
|
||||
CanEdit bool // submitter, and the song is unlocked
|
||||
NextInQueue int64 // 0 when the queue is empty — keeps the loop moving after a review
|
||||
Genres []genre
|
||||
}
|
||||
|
||||
func (s *songDetail) Locked() bool { return s.ReviewCount > 0 }
|
||||
|
||||
// Synced lyrics get a line-by-line highlight; plain text scrolls continuously instead, because a
|
||||
// highlight on guessed timings makes every second of drift look like a bug.
|
||||
func (s *songDetail) LyricLines() []lyricLine { return parseLRC(s.Lyrics) }
|
||||
|
||||
func (a *app) song(ctx context.Context, viewerID, songID int64) (*songDetail, error) {
|
||||
var d songDetail
|
||||
err := a.db.QueryRowContext(ctx, `select`+songColumns+`,
|
||||
coalesce(s.description, ''), coalesce(s.lyrics, ''), s.source_url
|
||||
from songs s join users u on u.id = s.submitted_by
|
||||
where s.id = $2`, viewerID, songID).
|
||||
Scan(&d.ID, &d.Title, &d.Artist, &d.Genre, &d.Duration, &d.CreatedAt,
|
||||
&d.SubmitterID, &d.Submitter, &d.ReviewCount, &d.Average, &d.Own, &d.Reviewed,
|
||||
&d.Description, &d.Lyrics, &d.SourceURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
d.Genres = genres
|
||||
d.CanReview = !d.Own && !d.Reviewed
|
||||
d.CanEdit = d.Own && d.ReviewCount == 0
|
||||
|
||||
if d.Reviewed {
|
||||
d.ViewerReview, err = a.viewerReview(ctx, songID, viewerID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
// The query only runs when the song is revealed: hidden reviews are never fetched, let alone
|
||||
// sent and hidden with CSS.
|
||||
if d.Revealed() {
|
||||
d.Reviews, err = a.reviewsFor(ctx, songID, viewerID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if !d.CanReview {
|
||||
d.NextInQueue, err = a.nextInQueue(ctx, viewerID, songID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
return &d, nil
|
||||
}
|
||||
|
||||
// The oldest song the viewer still owes a review on. Offered right after they finish one, so
|
||||
// draining the queue never means navigating back to it.
|
||||
func (a *app) nextInQueue(ctx context.Context, viewerID, exceptID int64) (int64, error) {
|
||||
var id int64
|
||||
err := a.db.QueryRowContext(ctx, `
|
||||
select s.id from songs s
|
||||
where s.submitted_by <> $1 and s.id <> $2
|
||||
and not exists (select 1 from reviews r where r.song_id = s.id and r.reviewer_id = $1)
|
||||
order by s.created_at, s.id
|
||||
limit 1`, viewerID, exceptID).Scan(&id)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return 0, nil
|
||||
}
|
||||
return id, err
|
||||
}
|
||||
|
||||
func (a *app) songPage(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
d, err := a.song(r.Context(), memberFrom(r.Context()).ID, id)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("song", "ctx", "songs", "error", err, "song", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "song.html", page{Title: d.Title, Data: d})
|
||||
}
|
||||
|
||||
// Lyrics are not covered by the lock: it freezes what the song claims to be, and nobody reviewed
|
||||
// the lyrics. So this checks the submitter and nothing else, which also lets someone paste them for
|
||||
// an old song a year later.
|
||||
func (a *app) editLyrics(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
res, err := a.db.ExecContext(r.Context(),
|
||||
`update songs set lyrics = nullif($3, '') where id = $1 and submitted_by = $2`,
|
||||
id, memberFrom(r.Context()).ID, cleanLyrics(r.FormValue("lyrics")))
|
||||
if err != nil {
|
||||
slog.Error("edit lyrics", "ctx", "songs", "error", err, "song", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if affected(res) == 0 {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
a.flash(w, "Sanoitukset tallennettu.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// --- edit and delete ---
|
||||
|
||||
// The submitter may change the four text fields while the song is unlocked. Once people have
|
||||
// reviewed it, the thing they reviewed stops changing under them.
|
||||
func (a *app) editSong(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
genre := r.FormValue("genre")
|
||||
if !validGenre(genre) {
|
||||
http.Error(w, "tuntematon genre", http.StatusUnprocessableEntity)
|
||||
return
|
||||
}
|
||||
title, artist := clean(r.FormValue("title"), maxTitle), clean(r.FormValue("artist"), maxArtist)
|
||||
if title == "" || artist == "" {
|
||||
a.flash(w, "Nimi ja esittäjä ovat pakollisia.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
res, err := a.db.ExecContext(r.Context(), `
|
||||
update songs set title = $3, artist = $4, genre = $5, description = nullif($6, '')
|
||||
where id = $1 and submitted_by = $2
|
||||
and not exists (select 1 from reviews r where r.song_id = songs.id)`,
|
||||
id, memberFrom(r.Context()).ID, title, artist, genre,
|
||||
clean(r.FormValue("description"), maxDescription))
|
||||
if err != nil {
|
||||
slog.Error("edit song", "ctx", "songs", "error", err, "song", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if affected(res) == 0 {
|
||||
a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi muokata.")
|
||||
} else {
|
||||
a.flash(w, "Tiedot tallennettu.")
|
||||
}
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// The row and the file go together, always.
|
||||
func (a *app) deleteSong(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
res, err := a.db.ExecContext(r.Context(), `
|
||||
delete from songs where id = $1 and submitted_by = $2
|
||||
and not exists (select 1 from reviews r where r.song_id = songs.id)`,
|
||||
id, memberFrom(r.Context()).ID)
|
||||
if err != nil {
|
||||
slog.Error("delete song", "ctx", "songs", "error", err, "song", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if affected(res) == 0 {
|
||||
a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi poistaa.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
removeFile(a.audioPath(id))
|
||||
slog.Info("song deleted", "ctx", "songs", "song", id)
|
||||
a.flash(w, "Kappale poistettu.")
|
||||
http.Redirect(w, r, "/songs", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// A missing file is fine — the row is gone either way — but anything else is worth knowing about.
|
||||
func removeFile(path string) {
|
||||
if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
|
||||
slog.Error("remove file", "ctx", "songs", "error", err, "path", path)
|
||||
}
|
||||
}
|
||||
|
||||
// --- audio ---
|
||||
|
||||
// Auth-gated, Range-capable, and not under /api because it serves bytes rather than JSON.
|
||||
// Parsing the id as an integer is the traversal check.
|
||||
func (a *app) audio(w http.ResponseWriter, r *http.Request) {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
var name string
|
||||
err = a.db.QueryRowContext(r.Context(), `select audio_file from songs where id = $1`, id).Scan(&name)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
} else if err != nil {
|
||||
slog.Error("audio lookup", "ctx", "songs", "error", err, "song", id)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
f, err := os.Open(a.audioPath(id))
|
||||
if err != nil {
|
||||
slog.Error("audio open", "ctx", "songs", "error", err, "song", id)
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
defer f.Close()
|
||||
info, err := f.Stat()
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "audio/ogg")
|
||||
// ServeContent handles 206, 416 and If-Range correctly, which hand-rolled Range parsing does not.
|
||||
http.ServeContent(w, r, name, info.ModTime(), f)
|
||||
}
|
||||
@@ -0,0 +1,232 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func (a *app) seedSong(t *testing.T, submitter int64, title string) int64 {
|
||||
t.Helper()
|
||||
var id int64
|
||||
err := a.db.QueryRowContext(context.Background(), `
|
||||
insert into songs (title, artist, genre, audio_file, duration_seconds, submitted_by)
|
||||
values ($1, 'Testiartisti', 'Metal', 'x.ogg', 120, $2) returning id`,
|
||||
title, submitter).Scan(&id)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return id
|
||||
}
|
||||
|
||||
func (a *app) seedReview(t *testing.T, songID, reviewerID int64, score int) int64 {
|
||||
t.Helper()
|
||||
var id int64
|
||||
err := a.db.QueryRowContext(context.Background(), `
|
||||
insert into reviews (song_id, reviewer_id, score, text)
|
||||
values ($1, $2, $3, 'sanat') returning id`, songID, reviewerID, score).Scan(&id)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return id
|
||||
}
|
||||
|
||||
// A member who hasn't reviewed a song must not receive other reviews *in the result set*, and must
|
||||
// not receive the average either — not merely fail to render them.
|
||||
func TestRevealRuleWithholdsReviewsAndAverage(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
aino := a.seedMember(t, "[email protected]")
|
||||
bertta := a.seedMember(t, "[email protected]")
|
||||
cecilia := a.seedMember(t, "[email protected]")
|
||||
|
||||
songID := a.seedSong(t, aino, "Testikappale")
|
||||
a.seedReview(t, songID, bertta, 88)
|
||||
|
||||
// Cecilia has not reviewed it.
|
||||
d, err := a.song(ctx, cecilia, songID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if d.Revealed() {
|
||||
t.Fatal("song is revealed to a member who has not reviewed it")
|
||||
}
|
||||
if d.Reviews != nil {
|
||||
t.Fatalf("withheld reviews were still fetched: %d of them", len(d.Reviews))
|
||||
}
|
||||
if d.Average != nil {
|
||||
t.Fatalf("withheld average was still sent: %v", *d.Average)
|
||||
}
|
||||
if d.ReviewCount != 1 {
|
||||
t.Fatalf("review count = %d, want 1 — the count is not secret", d.ReviewCount)
|
||||
}
|
||||
|
||||
// Writing her own review unlocks both.
|
||||
a.seedReview(t, songID, cecilia, 60)
|
||||
d, err = a.song(ctx, cecilia, songID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !d.Revealed() || len(d.Reviews) != 2 {
|
||||
t.Fatalf("after reviewing: revealed = %v, reviews = %d, want true and 2",
|
||||
d.Revealed(), len(d.Reviews))
|
||||
}
|
||||
if d.Average == nil || *d.Average != 74 {
|
||||
t.Fatalf("average = %v, want 74", d.Average)
|
||||
}
|
||||
|
||||
// The submitter sees everything without reviewing — they cannot review their own song.
|
||||
d, err = a.song(ctx, aino, songID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !d.Revealed() || len(d.Reviews) != 2 || d.Average == nil {
|
||||
t.Fatal("the submitter cannot see the reviews of their own song")
|
||||
}
|
||||
if d.CanReview {
|
||||
t.Fatal("the submitter is offered a review form for their own song")
|
||||
}
|
||||
|
||||
// And the same rule holds in the list query, which is a different SQL path.
|
||||
list, err := a.browse(ctx, cecilia, 0)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(list.Items) != 1 || list.Items[0].Average == nil {
|
||||
t.Fatal("browse withheld the average from someone who has reviewed the song")
|
||||
}
|
||||
list, err = a.browse(ctx, a.seedMember(t, "[email protected]"), 0)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if list.Items[0].Average != nil {
|
||||
t.Fatal("browse leaked the average to someone who has not reviewed the song")
|
||||
}
|
||||
}
|
||||
|
||||
// The queue excludes your own songs and anything you have already reviewed, oldest first.
|
||||
func TestQueueContents(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
aino := a.seedMember(t, "[email protected]")
|
||||
bertta := a.seedMember(t, "[email protected]")
|
||||
|
||||
own := a.seedSong(t, aino, "Oma kappale")
|
||||
reviewed := a.seedSong(t, bertta, "Jo arvosteltu")
|
||||
fresh := a.seedSong(t, bertta, "Arvostelematon")
|
||||
a.seedReview(t, reviewed, aino, 50)
|
||||
|
||||
list, err := a.queue(ctx, aino, 0)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(list.Items) != 1 {
|
||||
var titles []string
|
||||
for _, s := range list.Items {
|
||||
titles = append(titles, s.Title)
|
||||
}
|
||||
t.Fatalf("queue = %v, want just the unreviewed song", titles)
|
||||
}
|
||||
if list.Items[0].ID != fresh {
|
||||
t.Fatalf("queue holds song %d, want %d", list.Items[0].ID, fresh)
|
||||
}
|
||||
_ = own
|
||||
|
||||
// Oldest first: a second unreviewed song comes after the first.
|
||||
older := a.seedSong(t, bertta, "Vanhempi")
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update songs set created_at = datetime('now', '-2 days') where id = $1`, older); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
list, err = a.queue(ctx, aino, 0)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if list.Items[0].ID != older {
|
||||
t.Fatal("queue is not oldest first")
|
||||
}
|
||||
}
|
||||
|
||||
// Locked is a live state: deleting the only review makes the song editable again.
|
||||
func TestSongUnlocksWhenTheLastReviewGoes(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
aino := a.seedMember(t, "[email protected]")
|
||||
bertta := a.seedMember(t, "[email protected]")
|
||||
songID := a.seedSong(t, aino, "Testikappale")
|
||||
|
||||
d, _ := a.song(ctx, aino, songID)
|
||||
if !d.CanEdit {
|
||||
t.Fatal("a song with no reviews is not editable by its submitter")
|
||||
}
|
||||
|
||||
reviewID := a.seedReview(t, songID, bertta, 88)
|
||||
d, _ = a.song(ctx, aino, songID)
|
||||
if d.CanEdit {
|
||||
t.Fatal("a reviewed song is still editable")
|
||||
}
|
||||
|
||||
if _, err := a.db.ExecContext(ctx, `delete from reviews where id = $1`, reviewID); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
d, _ = a.song(ctx, aino, songID)
|
||||
if !d.CanEdit {
|
||||
t.Fatal("song did not unlock after its only review was deleted")
|
||||
}
|
||||
}
|
||||
|
||||
// The window is measured from updated_at, so an edit extends it — and it gates delete too.
|
||||
func TestEditWindow(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
aino := a.seedMember(t, "[email protected]")
|
||||
bertta := a.seedMember(t, "[email protected]")
|
||||
songID := a.seedSong(t, aino, "Testikappale")
|
||||
reviewID := a.seedReview(t, songID, bertta, 88)
|
||||
|
||||
v, err := a.viewerReview(ctx, songID, bertta)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !v.CanEdit() {
|
||||
t.Fatal("a fresh review is not editable")
|
||||
}
|
||||
|
||||
// Just inside the window.
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update reviews set updated_at = datetime('now', '-29 minutes') where id = $1`,
|
||||
reviewID); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
v, _ = a.viewerReview(ctx, songID, bertta)
|
||||
if !v.CanEdit() {
|
||||
t.Fatal("a 29-minute-old review is not editable")
|
||||
}
|
||||
|
||||
// Past it.
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update reviews set updated_at = datetime('now', '-31 minutes') where id = $1`,
|
||||
reviewID); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
v, _ = a.viewerReview(ctx, songID, bertta)
|
||||
if v.CanEdit() {
|
||||
t.Fatal("a 31-minute-old review is still editable")
|
||||
}
|
||||
|
||||
// The database is the authority, not the Go clock: the update and the delete both refuse.
|
||||
var n int64
|
||||
err = a.db.QueryRowContext(ctx, `
|
||||
update reviews set score = 1, updated_at = datetime('now')
|
||||
where id = $1 and reviewer_id = $2 and updated_at > datetime('now', $3)
|
||||
returning id`, reviewID, bertta, editWindowAgo).Scan(&n)
|
||||
if err == nil {
|
||||
t.Fatal("an expired review was edited")
|
||||
}
|
||||
err = a.db.QueryRowContext(ctx, `
|
||||
delete from reviews
|
||||
where id = $1 and reviewer_id = $2 and updated_at > datetime('now', $3)
|
||||
returning id`, reviewID, bertta, editWindowAgo).Scan(&n)
|
||||
if err == nil {
|
||||
t.Fatal("an expired review was deleted")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
||||
<!-- Created with Inkscape (http://www.inkscape.org/) -->
|
||||
|
||||
<svg
|
||||
version="1.1"
|
||||
id="svg1"
|
||||
width="1024"
|
||||
height="1024"
|
||||
viewBox="0 0 1024 1024"
|
||||
xmlns:xlink="http://www.w3.org/1999/xlink"
|
||||
xmlns="http://www.w3.org/2000/svg"
|
||||
xmlns:svg="http://www.w3.org/2000/svg">
|
||||
<defs
|
||||
id="defs1">
|
||||
<linearGradient
|
||||
id="linearGradient1">
|
||||
<stop
|
||||
style="stop-color:#131313;stop-opacity:1;"
|
||||
offset="0"
|
||||
id="stop1" />
|
||||
<stop
|
||||
style="stop-color:#1e1e1e;stop-opacity:1;"
|
||||
offset="1"
|
||||
id="stop2" />
|
||||
</linearGradient>
|
||||
<linearGradient
|
||||
xlink:href="#linearGradient1"
|
||||
id="linearGradient2"
|
||||
x1="-126.14488"
|
||||
y1="1023.127"
|
||||
x2="-1038.4041"
|
||||
y2="94.281311"
|
||||
gradientUnits="userSpaceOnUse" />
|
||||
</defs>
|
||||
<g
|
||||
id="g1"
|
||||
transform="translate(1112.6069,-41.466324)">
|
||||
<rect
|
||||
style="font-variation-settings:'wght' 400;opacity:1;fill:url(#linearGradient2);stroke:none;stroke-width:1.50385"
|
||||
id="rect1"
|
||||
width="1024"
|
||||
height="1024"
|
||||
x="-1112.6069"
|
||||
y="41.466324" />
|
||||
<path
|
||||
style="fill:#a96832;fill-opacity:1"
|
||||
d="m -256.32286,859.80613 c -0.5587,-1.0439 -5.998,-14.34542 -12.0874,-29.55893 -6.0894,-15.21351 -12.6981,-31.36028 -14.6861,-35.88171 -1.9879,-4.52143 -6.2446,-15.32745 -9.4591,-24.01338 -9.8775,-26.68952 -17.0559,-44.11196 -19.469,-47.25279 -1.2676,-1.65 -6.3824,-7.275 -11.3661,-12.5 -4.9837,-5.225 -9.2794,-10.4 -9.546,-11.5 -0.2667,-1.1 -1.0926,-9.875 -1.8354,-19.5 l -1.3507,-17.5 -8.7081,-21 c -19.3876,-46.75383 -39.6764,-97.57184 -39.2382,-98.28098 0.2562,-0.41453 9.0751,-6.5959 19.5975,-13.73636 10.5224,-7.14046 25.298,-17.36069 32.8348,-22.71161 7.5367,-5.35093 16.5609,-11.49239 20.0538,-13.64769 l 6.3507,-3.91873 -0.138,-14.35231 c -0.088,-9.11047 0.4034,-17.17033 1.3445,-22.06808 1.2363,-6.43377 1.4019,-16.5691 0.9969,-61 -0.2672,-29.30633 -0.7305,-55.53424 -1.0295,-58.28424 -0.6352,-5.84093 9.315,3.05716 -80.2267,-71.74374 l -20.3514,-17.00104 -159.3986,-0.43563 c -93.9669,-0.2568 -159.3986,-0.0666 -159.3986,0.46325 0,0.79387 14.1728,39.5009 32.3012,88.21716 l 6.14,16.5 -0.4706,20 c -0.5906,25.10141 -0.61,106.08069 -0.035,147 0.2396,17.05 -0.058,42.25 -0.6606,56 -0.6029,13.75 -1.4093,49.4125 -1.7922,79.25 l -0.696,54.25 h 34.4369 34.4369 l 17.6574,-12.25 c 9.7116,-6.7375 23.2724,-16.075 30.1351,-20.75 l 12.4776,-8.5 0.045,-28 0.045,-28 23.7399,-10.46084 c 13.0569,-5.75347 28.8714,-12.84696 35.1432,-15.76332 6.2719,-2.91637 11.4981,-5.18399 11.6139,-5.03916 0.1159,0.14483 1.3683,3.86332 2.7832,8.26332 1.415,4.4 8.1816,25.1 15.0368,46 11.4894,35.02826 12.867,38.58653 17.6148,45.5 2.8328,4.125 7.6915,11.24468 10.797,15.8215 l 5.6464,8.3215 0.8322,11.6785 c 2.1376,29.99811 3.0902,34.82716 12.5368,63.55422 l 8.8379,26.87572 5.9488,2.32255 c 3.2719,1.27739 12.0239,4.62345 19.4489,7.43567 7.425,2.81223 18.4886,7.11051 24.5858,9.55174 6.0972,2.44123 11.7197,4.4386 12.4945,4.4386 2.6086,0 23.1976,8.18948 27.9673,11.12431 2.5995,1.59952 12.5398,5.78582 22.0894,9.30289 9.5496,3.51707 23.888,8.84253 31.863,11.83435 14.6625,5.50065 16.6188,5.6317 14.1107,0.94526 z m -303.1107,-418.51779 v -57.34908 l -23.4418,-17.91997 c -12.893,-9.85598 -23.468,-18.20969 -23.5,-18.56379 -0.032,-0.3541 34.315,-0.53781 76.3268,-0.40824 l 76.3849,0.23557 7.3651,5.99943 c 4.0507,3.29968 10.74,8.39168 14.865,11.31555 4.125,2.92387 9.2498,6.8043 11.3884,8.62319 l 3.8884,3.30707 -0.1932,29.78562 c -0.1063,16.3821 -0.4246,30.68563 -0.7073,31.78563 -0.2828,1.1 -4.6655,5.22906 -9.7393,9.17568 -5.0739,3.94663 -12.9359,10.38223 -17.4712,14.30134 l -8.246,7.12566 -37.2099,10.49833 c -20.4655,5.77409 -43.2849,12.21526 -50.7099,14.31371 -7.425,2.09845 -14.7375,4.10967 -16.25,4.46938 l -2.75,0.654 z m 45.446,417.1983 c 0.2839,-0.28388 1.4247,-7.59187 2.5351,-16.23998 1.8573,-14.46552 2.0189,-21.36257 2.0189,-86.18559 0,-40.49991 -0.3784,-70.46175 -0.89,-70.46175 -0.4894,0 -6.9019,4.40065 -14.25,9.77923 -11.1102,8.13247 -58.8721,42.62513 -78.1649,56.44912 l -5.2033,3.72836 -111.246,0.27164 c -61.1854,0.14941 -111.246,0.21437 -111.246,0.14437 10e-5,-0.07 4.1627,-3.4641 9.2502,-7.54242 11.3961,-9.13555 33.5431,-26.93368 35.3917,-28.44206 1.1443,-0.93375 1.3221,-39.12151 1.1104,-238.5 l -0.2521,-237.38824 -79.75,-0.25599 c -65.2629,-0.20948 -79.75,-0.0177 -79.75,1.05568 0,0.72141 1.6361,5.33661 3.6358,10.25598 1.9997,4.91938 6.4668,16.14433 9.9269,24.94433 3.4601,8.8 10.0502,25.225 14.6447,36.5 l 8.3537,20.5 -0.1377,207.42507 -0.1377,207.42508 -18.8328,19.343 -18.8327,19.34299 0.206,33.73193 c 0.1133,18.55256 0.1987,34.00382 0.1899,34.33613 -0.02,0.73234 430.6972,0.51582 431.4299,-0.21688 z"
|
||||
id="path1" />
|
||||
</g>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 4.7 KiB |
Binary file not shown.
Vendored
+1
File diff suppressed because one or more lines are too long
@@ -0,0 +1,135 @@
|
||||
// Lyrics that follow the audio. Two behaviours, because the two kinds of lyrics deserve different
|
||||
// treatment: real LRC timestamps get a line highlight, guessed timings get a continuous scroll and
|
||||
// a nudge knob. Progressive enhancement — without this file the lyrics are still readable text.
|
||||
(function () {
|
||||
'use strict'
|
||||
|
||||
const quiet = window.matchMedia('(prefers-reduced-motion: reduce)').matches
|
||||
|
||||
// The audio element belonging to the same strip, falling back to the only one on the page.
|
||||
const audioFor = (box) => {
|
||||
const scope = box.closest('.strip') || box.closest('section') || document
|
||||
return scope.querySelector('audio') || document.querySelector('audio')
|
||||
}
|
||||
|
||||
// --- synced: highlight the line that is playing ---
|
||||
|
||||
function enhanceSynced(box) {
|
||||
const audio = audioFor(box)
|
||||
if (!audio) return
|
||||
const lines = [...box.querySelectorAll('.lline')]
|
||||
if (!lines.length) return
|
||||
const times = lines.map((l) => Number(l.dataset.t))
|
||||
let current = -1
|
||||
|
||||
// Following is what moves the box. Timestamps are somebody else's guess at where a line
|
||||
// starts, so when they are off, the scrolling is the part that fights you — the highlight can
|
||||
// stay. Remembered per song.
|
||||
const follow = box.parentElement.querySelector('.follow input')
|
||||
const key = 'lyricsfollow:' + box.dataset.song
|
||||
if (follow && localStorage.getItem(key) === 'off') follow.checked = false
|
||||
if (follow) {
|
||||
follow.addEventListener('change', () => {
|
||||
localStorage.setItem(key, follow.checked ? 'on' : 'off')
|
||||
})
|
||||
}
|
||||
|
||||
// Scrolling the box by hand turns following off: reading somewhere else is a clear statement
|
||||
// that you do not want to be dragged back.
|
||||
let selfScroll = false
|
||||
box.addEventListener('scroll', () => {
|
||||
if (selfScroll || !follow || !follow.checked) return
|
||||
follow.checked = false
|
||||
localStorage.setItem(key, 'off')
|
||||
})
|
||||
|
||||
const show = (i) => {
|
||||
if (i === current) return
|
||||
if (lines[current]) lines[current].classList.remove('on')
|
||||
current = i
|
||||
const line = lines[i]
|
||||
if (!line) return
|
||||
line.classList.add('on')
|
||||
if (follow && !follow.checked) return
|
||||
// Measured against the box itself. offsetTop is relative to the nearest positioned ancestor,
|
||||
// which is not this box, so using it scrolls to a position from a different coordinate space.
|
||||
const boxRect = box.getBoundingClientRect()
|
||||
const lineRect = line.getBoundingClientRect()
|
||||
const target = box.scrollTop + (lineRect.top - boxRect.top)
|
||||
- box.clientHeight / 2 + lineRect.height / 2
|
||||
selfScroll = true
|
||||
box.scrollTo({ top: target, behavior: quiet ? 'auto' : 'smooth' })
|
||||
// Long enough for the smooth scroll to finish, so our own movement is not mistaken for the
|
||||
// reader's.
|
||||
setTimeout(() => { selfScroll = false }, 700)
|
||||
}
|
||||
|
||||
audio.addEventListener('timeupdate', () => {
|
||||
const t = audio.currentTime
|
||||
let i = current
|
||||
// Usually one step forward; a seek walks from wherever it lands.
|
||||
if (i < 0 || times[i] > t) i = 0
|
||||
while (i + 1 < times.length && times[i + 1] <= t) i++
|
||||
if (times[i] <= t) show(i)
|
||||
})
|
||||
|
||||
audio.addEventListener('seeked', () => {
|
||||
current = -1
|
||||
})
|
||||
|
||||
// Clicking a line seeks to it: the lyrics become a way to navigate the song.
|
||||
lines.forEach((line, i) => {
|
||||
line.addEventListener('click', () => {
|
||||
audio.currentTime = times[i]
|
||||
if (audio.paused) audio.play()
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
// --- plain: scroll the block in step with the audio ---
|
||||
|
||||
function enhancePlain(box) {
|
||||
const audio = audioFor(box)
|
||||
const inner = box.querySelector('.lscroll')
|
||||
if (!audio || !inner) return
|
||||
|
||||
const nudge = box.parentElement.querySelector('.nudge input')
|
||||
const readout = box.parentElement.querySelector('.nudge output')
|
||||
const key = 'lyricsoffset:' + box.dataset.song
|
||||
let offset = Number(localStorage.getItem(key) || 0)
|
||||
if (nudge) {
|
||||
nudge.value = offset
|
||||
readout.value = offset + ' s'
|
||||
}
|
||||
|
||||
const duration = () => Number(audio.duration) || Number(box.dataset.duration) || 0
|
||||
|
||||
// Position is a pure function of time, so a seek needs no bookkeeping and drift cannot
|
||||
// accumulate the way it would with a timer.
|
||||
const place = () => {
|
||||
const total = duration()
|
||||
const travel = inner.scrollHeight - box.clientHeight
|
||||
if (total <= 0 || travel <= 0) return
|
||||
const at = (audio.currentTime + offset) / total
|
||||
box.scrollTop = Math.max(0, Math.min(travel, at * travel))
|
||||
}
|
||||
|
||||
audio.addEventListener('timeupdate', place)
|
||||
audio.addEventListener('seeked', place)
|
||||
audio.addEventListener('loadedmetadata', place)
|
||||
|
||||
if (nudge) {
|
||||
nudge.addEventListener('input', () => {
|
||||
offset = Number(nudge.value)
|
||||
readout.value = (offset > 0 ? '+' : '') + offset + ' s'
|
||||
localStorage.setItem(key, offset)
|
||||
place()
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
document.addEventListener('DOMContentLoaded', () => {
|
||||
document.querySelectorAll('.lyricsbox.synced').forEach(enhanceSynced)
|
||||
document.querySelectorAll('.lyricsbox.plain').forEach(enhancePlain)
|
||||
})
|
||||
})()
|
||||
@@ -0,0 +1,143 @@
|
||||
// Progressive enhancement: the page ships <audio controls>. If this script runs, it takes the
|
||||
// controls off and drives the same element itself — playback, buffering, seeking and Range
|
||||
// requests are untouched, because the element never changes.
|
||||
(function () {
|
||||
'use strict'
|
||||
|
||||
const fmt = (s) => {
|
||||
if (!isFinite(s)) return '–:––'
|
||||
const m = Math.floor(s / 60)
|
||||
return m + ':' + String(Math.floor(s % 60)).padStart(2, '0')
|
||||
}
|
||||
|
||||
const SEGMENTS = 18
|
||||
const quiet = window.matchMedia('(prefers-reduced-motion: reduce)').matches
|
||||
|
||||
function enhance(wrap) {
|
||||
const audio = wrap.querySelector('audio')
|
||||
if (!audio) return
|
||||
audio.removeAttribute('controls')
|
||||
|
||||
const total = Number(wrap.dataset.duration) || 0
|
||||
wrap.insertAdjacentHTML('beforeend', `
|
||||
<div class="transport">
|
||||
<button type="button" class="tp-play" aria-label="Toista">
|
||||
<span class="tp-icon" aria-hidden="true"></span>
|
||||
</button>
|
||||
<div class="tp-mid">
|
||||
<input type="range" class="tp-seek" min="0" max="${total || 100}" step="0.1" value="0"
|
||||
aria-label="Kelaus">
|
||||
<div class="meter" aria-hidden="true">
|
||||
<div class="meter-row"><span class="lbl">L</span><span class="segs"></span></div>
|
||||
<div class="meter-row"><span class="lbl">R</span><span class="segs"></span></div>
|
||||
</div>
|
||||
</div>
|
||||
<span class="tp-time"><b>0:00</b> / ${fmt(total)}</span>
|
||||
</div>`)
|
||||
|
||||
const play = wrap.querySelector('.tp-play')
|
||||
const seek = wrap.querySelector('.tp-seek')
|
||||
const time = wrap.querySelector('.tp-time b')
|
||||
const rows = wrap.querySelectorAll('.meter .segs')
|
||||
for (const row of rows) {
|
||||
row.innerHTML = '<span class="seg"></span>'.repeat(SEGMENTS)
|
||||
}
|
||||
const segs = [...rows].map((r) => [...r.children])
|
||||
|
||||
// --- transport ---
|
||||
|
||||
play.addEventListener('click', () => (audio.paused ? audio.play() : audio.pause()))
|
||||
|
||||
const setPlaying = (playing) => {
|
||||
wrap.classList.toggle('playing', playing)
|
||||
play.setAttribute('aria-label', playing ? 'Tauko' : 'Toista')
|
||||
}
|
||||
audio.addEventListener('play', () => { setPlaying(true); startMeter() })
|
||||
audio.addEventListener('pause', () => setPlaying(false))
|
||||
audio.addEventListener('ended', () => setPlaying(false))
|
||||
|
||||
audio.addEventListener('loadedmetadata', () => {
|
||||
if (isFinite(audio.duration)) {
|
||||
seek.max = audio.duration
|
||||
wrap.querySelector('.tp-time').lastChild.textContent = ' / ' + fmt(audio.duration)
|
||||
}
|
||||
})
|
||||
|
||||
let scrubbing = false
|
||||
seek.addEventListener('input', () => {
|
||||
scrubbing = true
|
||||
time.textContent = fmt(Number(seek.value))
|
||||
})
|
||||
seek.addEventListener('change', () => {
|
||||
audio.currentTime = Number(seek.value)
|
||||
scrubbing = false
|
||||
})
|
||||
|
||||
audio.addEventListener('timeupdate', () => {
|
||||
if (scrubbing) return
|
||||
seek.value = audio.currentTime
|
||||
time.textContent = fmt(audio.currentTime)
|
||||
seek.style.setProperty('--pct', (audio.currentTime / (Number(seek.max) || 1)) * 100 + '%')
|
||||
})
|
||||
|
||||
// --- meter ---
|
||||
//
|
||||
// A real analyser, not a decorative loop: it is dark until the audio actually plays, and it
|
||||
// stops the moment playback does. The AudioContext can only start from a gesture, so it is
|
||||
// created on first play. MediaElementSource reroutes the audio, so the graph must reach the
|
||||
// destination or the sound stops.
|
||||
|
||||
let ctx, analysers, raf
|
||||
function startMeter() {
|
||||
if (quiet || raf) return
|
||||
if (!ctx) {
|
||||
try {
|
||||
ctx = new (window.AudioContext || window.webkitAudioContext)()
|
||||
const src = ctx.createMediaElementSource(audio)
|
||||
const split = ctx.createChannelSplitter(2)
|
||||
analysers = [ctx.createAnalyser(), ctx.createAnalyser()]
|
||||
analysers.forEach((a, i) => {
|
||||
a.fftSize = 256
|
||||
split.connect(a, i)
|
||||
})
|
||||
src.connect(split)
|
||||
src.connect(ctx.destination)
|
||||
} catch (e) {
|
||||
return // no Web Audio: the transport still works, the meter simply never lights
|
||||
}
|
||||
}
|
||||
ctx.resume()
|
||||
const buf = new Uint8Array(analysers[0].fftSize)
|
||||
const held = [0, 0]
|
||||
|
||||
const draw = () => {
|
||||
if (audio.paused) {
|
||||
segs.forEach((row) => row.forEach((s) => (s.className = 'seg')))
|
||||
raf = null
|
||||
return
|
||||
}
|
||||
analysers.forEach((a, ch) => {
|
||||
a.getByteTimeDomainData(buf)
|
||||
let peak = 0
|
||||
for (let i = 0; i < buf.length; i++) {
|
||||
const v = Math.abs(buf[i] - 128) / 128
|
||||
if (v > peak) peak = v
|
||||
}
|
||||
// Fall slower than it rises, the way a real meter behaves.
|
||||
held[ch] = peak > held[ch] ? peak : held[ch] * 0.88
|
||||
const lit = Math.round(held[ch] * SEGMENTS)
|
||||
segs[ch].forEach((s, i) => {
|
||||
s.className = 'seg' +
|
||||
(i < lit ? ' on' + (i >= SEGMENTS - 3 ? ' peak' : i >= SEGMENTS - 7 ? ' hot' : '') : '')
|
||||
})
|
||||
})
|
||||
raf = requestAnimationFrame(draw)
|
||||
}
|
||||
raf = requestAnimationFrame(draw)
|
||||
}
|
||||
}
|
||||
|
||||
document.addEventListener('DOMContentLoaded', () => {
|
||||
document.querySelectorAll('.playerwrap').forEach(enhance)
|
||||
})
|
||||
})()
|
||||
File diff suppressed because it is too large
Load Diff
+164
@@ -0,0 +1,164 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
// A song needs this many reviews to qualify for any ranking: with ten members it means a third of
|
||||
// the club has weighed in, which is a real threshold rather than a formality.
|
||||
const minReviews = 3
|
||||
|
||||
type songStat struct {
|
||||
ID int64
|
||||
Title string
|
||||
Artist string
|
||||
Value float64
|
||||
ReviewCount int
|
||||
Min int // the spread, which is what "divisive" actually means
|
||||
Max int
|
||||
}
|
||||
|
||||
// Percentages for the bars, so the templates hold no arithmetic.
|
||||
func (s songStat) Pct() float64 { return s.Value }
|
||||
func (s songStat) MinPct() float64 { return float64(s.Min) }
|
||||
func (s songStat) SpanPct() float64 {
|
||||
if s.Max <= s.Min {
|
||||
return 1
|
||||
}
|
||||
return float64(s.Max - s.Min)
|
||||
}
|
||||
|
||||
type userStat struct {
|
||||
ID int64
|
||||
Name string
|
||||
Value float64
|
||||
Count int
|
||||
Avatar *string
|
||||
}
|
||||
|
||||
func (u *userStat) Initials() string { m := member{Name: u.Name}; return m.Initials() }
|
||||
|
||||
type stats struct {
|
||||
MinReviews int
|
||||
|
||||
TopSongs []songStat
|
||||
BottomSongs []songStat
|
||||
MostDivisive []songStat
|
||||
MostUnified []songStat
|
||||
MostReviewed []songStat
|
||||
|
||||
Harshest []userStat
|
||||
MostGenerous []userStat
|
||||
MostActive []userStat
|
||||
MostProlific []userStat
|
||||
}
|
||||
|
||||
// SQLite has no stddev aggregate. This is the population formula written out; max() absorbs the
|
||||
// tiny negative that floating-point cancellation produces when every score is identical, which
|
||||
// would otherwise make sqrt() return null and fail the scan.
|
||||
const stddevPop = `sqrt(max(0.0, avg(r.score * r.score) - avg(r.score) * avg(r.score)))`
|
||||
|
||||
// Every leaderboard is ordered and limited in SQL, and every one carries a deterministic tie-break:
|
||||
// ties are common in a ten-person club, and without one the database may return a different ten
|
||||
// each time, so the page visibly reshuffles between reloads for no reason.
|
||||
func (a *app) songLeaderboard(ctx context.Context, valueExpr, direction string) ([]songStat, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select s.id, s.title, s.artist, cast(`+valueExpr+` as real) as value,
|
||||
count(r.id) as reviews, min(r.score), max(r.score)
|
||||
from songs s join reviews r on r.song_id = s.id
|
||||
group by s.id
|
||||
having count(r.id) >= $1
|
||||
order by value `+direction+`, reviews desc, s.id asc
|
||||
limit 10`, minReviews)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []songStat
|
||||
for rows.Next() {
|
||||
var s songStat
|
||||
if err := rows.Scan(&s.ID, &s.Title, &s.Artist, &s.Value, &s.ReviewCount,
|
||||
&s.Min, &s.Max); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, s)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// Reviewer boards need a minimum too, or one enthusiastic 100 makes someone the most generous
|
||||
// member in the club forever.
|
||||
func (a *app) reviewerLeaderboard(ctx context.Context, valueExpr, direction string) ([]userStat, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select u.id, u.name, u.avatar, cast(`+valueExpr+` as real) as value, count(r.id) as n
|
||||
from users u join reviews r on r.reviewer_id = u.id
|
||||
group by u.id
|
||||
having count(r.id) >= $1
|
||||
order by value `+direction+`, n desc, u.id asc
|
||||
limit 10`, minReviews)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []userStat
|
||||
for rows.Next() {
|
||||
var u userStat
|
||||
if err := rows.Scan(&u.ID, &u.Name, &u.Avatar, &u.Value, &u.Count); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, u)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
func (a *app) mostProlific(ctx context.Context) ([]userStat, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select u.id, u.name, u.avatar, cast(count(s.id) as real), count(s.id)
|
||||
from users u join songs s on s.submitted_by = u.id
|
||||
group by u.id
|
||||
order by count(s.id) desc, u.id asc
|
||||
limit 10`)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []userStat
|
||||
for rows.Next() {
|
||||
var u userStat
|
||||
if err := rows.Scan(&u.ID, &u.Name, &u.Avatar, &u.Value, &u.Count); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, u)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// The reveal rule does not apply here: leaderboards are always public. That is the whole point of
|
||||
// /stats being a page you walk to deliberately.
|
||||
func (a *app) statsPage(w http.ResponseWriter, r *http.Request) {
|
||||
ctx := r.Context()
|
||||
s := stats{MinReviews: minReviews}
|
||||
|
||||
var err error
|
||||
for _, load := range []func() error{
|
||||
func() (err error) { s.TopSongs, err = a.songLeaderboard(ctx, "avg(r.score)", "desc"); return },
|
||||
func() (err error) { s.BottomSongs, err = a.songLeaderboard(ctx, "avg(r.score)", "asc"); return },
|
||||
func() (err error) { s.MostDivisive, err = a.songLeaderboard(ctx, stddevPop, "desc"); return },
|
||||
func() (err error) { s.MostUnified, err = a.songLeaderboard(ctx, stddevPop, "asc"); return },
|
||||
func() (err error) { s.MostReviewed, err = a.songLeaderboard(ctx, "count(r.id)", "desc"); return },
|
||||
func() (err error) { s.Harshest, err = a.reviewerLeaderboard(ctx, "avg(r.score)", "asc"); return },
|
||||
func() (err error) { s.MostGenerous, err = a.reviewerLeaderboard(ctx, "avg(r.score)", "desc"); return },
|
||||
func() (err error) { s.MostActive, err = a.reviewerLeaderboard(ctx, "count(r.id)", "desc"); return },
|
||||
func() (err error) { s.MostProlific, err = a.mostProlific(ctx); return },
|
||||
} {
|
||||
if err = load(); err != nil {
|
||||
slog.Error("stats", "ctx", "songs", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
a.render(w, r, http.StatusOK, "stats.html", page{Title: "Tilastot", Data: s})
|
||||
}
|
||||
@@ -0,0 +1,120 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// A song qualifies only at minReviews, and the order is decided in SQL — with a tie-break, so the
|
||||
// same ten come back in the same order every time.
|
||||
func TestLeaderboardThresholdAndOrder(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
submitter := a.seedMember(t, "[email protected]")
|
||||
var reviewers []int64
|
||||
for _, e := range []string{"[email protected]", "[email protected]", "[email protected]"} {
|
||||
reviewers = append(reviewers, a.seedMember(t, e))
|
||||
}
|
||||
|
||||
loved := a.seedSong(t, submitter, "Rakastettu")
|
||||
hated := a.seedSong(t, submitter, "Vihattu")
|
||||
ignored := a.seedSong(t, submitter, "Kahdesti arvosteltu")
|
||||
|
||||
for _, r := range reviewers {
|
||||
a.seedReview(t, loved, r, 90)
|
||||
a.seedReview(t, hated, r, 20)
|
||||
}
|
||||
// One short of the threshold.
|
||||
a.seedReview(t, ignored, reviewers[0], 100)
|
||||
a.seedReview(t, ignored, reviewers[1], 100)
|
||||
|
||||
top, err := a.songLeaderboard(ctx, "avg(r.score)", "desc")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(top) != 2 {
|
||||
t.Fatalf("top has %d entries, want 2 — the third song is below %d reviews", len(top), minReviews)
|
||||
}
|
||||
if top[0].ID != loved || top[1].ID != hated {
|
||||
t.Fatalf("top order is %d, %d — want %d first", top[0].ID, top[1].ID, loved)
|
||||
}
|
||||
if top[0].Value != 90 || top[0].ReviewCount != 3 {
|
||||
t.Fatalf("top entry = %v with %d reviews, want 90 and 3", top[0].Value, top[0].ReviewCount)
|
||||
}
|
||||
|
||||
bottom, err := a.songLeaderboard(ctx, "avg(r.score)", "asc")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if bottom[0].ID != hated {
|
||||
t.Fatalf("bottom starts with %d, want %d", bottom[0].ID, hated)
|
||||
}
|
||||
|
||||
// Identical scores everywhere means stddev 0, so unified beats divisive on the same data.
|
||||
unified, err := a.songLeaderboard(ctx, stddevPop, "asc")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if unified[0].Value != 0 {
|
||||
t.Fatalf("most unified has stddev %v, want 0", unified[0].Value)
|
||||
}
|
||||
|
||||
// Ties are the common case in a ten-person club: the same query must return the same order.
|
||||
first, _ := a.songLeaderboard(ctx, "count(r.id)", "desc")
|
||||
second, _ := a.songLeaderboard(ctx, "count(r.id)", "desc")
|
||||
for i := range first {
|
||||
if first[i].ID != second[i].ID {
|
||||
t.Fatal("a tied leaderboard reshuffles between calls — the tie-break is missing")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Profiles are counts and history-wide averages. They never carry per-song opinions.
|
||||
func TestProfileStats(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
aino := a.seedMember(t, "[email protected]")
|
||||
bertta := a.seedMember(t, "[email protected]")
|
||||
|
||||
song := a.seedSong(t, aino, "Testikappale")
|
||||
a.seedReview(t, song, bertta, 80)
|
||||
other := a.seedSong(t, bertta, "Berttan kappale")
|
||||
a.seedReview(t, other, aino, 40)
|
||||
|
||||
p, err := a.profile(ctx, bertta, aino)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if p.Stats.SongsSubmitted != 1 || p.Stats.ReviewsWritten != 1 {
|
||||
t.Fatalf("counts = %d songs, %d reviews; want 1 and 1",
|
||||
p.Stats.SongsSubmitted, p.Stats.ReviewsWritten)
|
||||
}
|
||||
if p.Stats.AverageGiven == nil || *p.Stats.AverageGiven != 40 {
|
||||
t.Fatalf("average given = %v, want 40", p.Stats.AverageGiven)
|
||||
}
|
||||
if p.Stats.AverageReceived == nil || *p.Stats.AverageReceived != 80 {
|
||||
t.Fatalf("average received = %v, want 80", p.Stats.AverageReceived)
|
||||
}
|
||||
// Viewing someone else's profile does not expose their email.
|
||||
if p.Email != "" {
|
||||
t.Fatalf("another member's email leaked: %q", p.Email)
|
||||
}
|
||||
// Their songs still obey the viewer's own reveal rule. Bertta reviewed this one, so she sees
|
||||
// its average here.
|
||||
if len(p.Songs) != 1 {
|
||||
t.Fatalf("profile lists %d songs, want 1", len(p.Songs))
|
||||
}
|
||||
if p.Songs[0].Average == nil {
|
||||
t.Fatal("a reviewer cannot see the average of a song they reviewed")
|
||||
}
|
||||
|
||||
// A third member who has reviewed nothing must not learn it from the profile page.
|
||||
cecilia := a.seedMember(t, "[email protected]")
|
||||
p, err = a.profile(ctx, cecilia, aino)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if p.Songs[0].Average != nil {
|
||||
t.Fatal("profile leaked a song average to someone who has not reviewed it")
|
||||
}
|
||||
}
|
||||
+656
@@ -0,0 +1,656 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
maxUploadBytes = 50 << 20
|
||||
maxDuration = 15 * time.Minute
|
||||
maxPerDay = 5
|
||||
maxTitle = 100
|
||||
maxArtist = 100
|
||||
maxDescription = 2000
|
||||
quotaWindowText = "24 tunnin"
|
||||
)
|
||||
|
||||
// Fixed list, validated app-side. Not a table: it never changes without a code change anyway.
|
||||
//
|
||||
// The stored value is the English code and the Finnish label is display only — the same split the
|
||||
// statuses use, so rewording a genre never touches a song row.
|
||||
type genre struct {
|
||||
Code string
|
||||
Label string
|
||||
}
|
||||
|
||||
var genres = []genre{
|
||||
{"Rock", "Rock"},
|
||||
{"Metal", "Metal"},
|
||||
{"Punk", "Punk"},
|
||||
{"Blues", "Blues"},
|
||||
{"Jazz", "Jazz"},
|
||||
{"Electronic", "Elektroninen"},
|
||||
{"Hip Hop", "Hip hop"},
|
||||
{"Pop", "Pop"},
|
||||
{"Folk / Country", "Folk / Country"},
|
||||
{"Classical", "Klassinen"},
|
||||
{"Soundtrack", "Elokuvamusiikki"},
|
||||
{"Experimental", "Kokeellinen"},
|
||||
{"Finnish", "Kotimainen"},
|
||||
{"Just Plain Weird", "Ihan outoa"},
|
||||
{"Other", "Muu"},
|
||||
}
|
||||
|
||||
func validGenre(code string) bool {
|
||||
return genreLabel(code) != ""
|
||||
}
|
||||
|
||||
func genreLabel(code string) string {
|
||||
for _, g := range genres {
|
||||
if g.Code == code {
|
||||
return g.Label
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// ponytail: in-process goroutines, 2 at a time. A real queue is the upgrade if this ever needs to
|
||||
// survive a restart mid-conversion or run on another box. Unbounded goroutines shelling out to
|
||||
// ffmpeg is how one enthusiastic evening fork-bombs a small VPS.
|
||||
var slots = make(chan struct{}, 2)
|
||||
|
||||
// The nullable metadata columns are read with coalesce and held as plain strings: templates
|
||||
// indirect pointers when printing, so a nil *string would render as "<nil>" inside a form field.
|
||||
type submission struct {
|
||||
ID int64
|
||||
UserID int64
|
||||
Status string
|
||||
StatusMsg *string
|
||||
SourceURL *string
|
||||
TmpPath string
|
||||
Title string
|
||||
Artist string
|
||||
Genre string
|
||||
Description string
|
||||
Lyrics string
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
func (s *submission) Ready() bool { return s.Status == "ready" }
|
||||
func (s *submission) Failed() bool { return s.Status == "failed" }
|
||||
func (s *submission) Done() bool { return s.Ready() || s.Failed() }
|
||||
|
||||
// Every status ships with its Finnish label, so the strings never leave Go.
|
||||
func (s *submission) Label() string {
|
||||
switch s.Status {
|
||||
case "queued":
|
||||
return "Jonossa…"
|
||||
case "downloading":
|
||||
return "Ladataan…"
|
||||
case "converting":
|
||||
return "Muunnetaan…"
|
||||
case "ready":
|
||||
return "Valmis julkaistavaksi"
|
||||
case "failed":
|
||||
return "Epäonnistui"
|
||||
}
|
||||
return s.Status
|
||||
}
|
||||
|
||||
func (s *submission) Genres() []genre { return genres }
|
||||
|
||||
// Only URL submissions can retry: an upload's temp file is gone, so that case offers re-upload.
|
||||
func (s *submission) CanRetry() bool { return s.Failed() && s.SourceURL != nil }
|
||||
|
||||
// The chosen genre's Finnish label, for pages that show it rather than offer it.
|
||||
func (s *submission) GenreLabel() string { return genreLabel(s.Genre) }
|
||||
|
||||
func (a *app) tmpPath(id int64, ext string) string {
|
||||
return filepath.Join(a.cfg.storageDir, "tmp", strconv.FormatInt(id, 10)+ext)
|
||||
}
|
||||
|
||||
func (a *app) audioPath(songID int64) string {
|
||||
return filepath.Join(a.cfg.storageDir, "audio", strconv.FormatInt(songID, 10)+".ogg")
|
||||
}
|
||||
|
||||
// --- submit ---
|
||||
|
||||
// The submit page also lists your own submissions still in flight, so one is reachable by
|
||||
// something other than its URL.
|
||||
func (a *app) submitPage(w http.ResponseWriter, r *http.Request) {
|
||||
a.submitError(w, r, http.StatusOK, "")
|
||||
}
|
||||
|
||||
func (a *app) submitError(w http.ResponseWriter, r *http.Request, status int, msg string) {
|
||||
subs, err := a.mySubmissions(r.Context(), memberFrom(r.Context()).ID)
|
||||
if err != nil {
|
||||
slog.Error("list submissions", "ctx", "submissions", "error", err)
|
||||
}
|
||||
a.render(w, r, status, "submit.html",
|
||||
page{Title: "Lähetä kappale", Data: map[string]any{"Error": msg, "Submissions": subs}})
|
||||
}
|
||||
|
||||
// Five submissions per rolling 24 hours. Failed ones never count: no audio, no submission, and
|
||||
// yt-dlp breaking is not the submitter's fault. Published songs do count, so the row being gone
|
||||
// from `submissions` is why this also looks at `songs`.
|
||||
func (a *app) overQuota(ctx context.Context, userID int64) (bool, error) {
|
||||
var n int
|
||||
err := a.db.QueryRowContext(ctx, `
|
||||
select (select count(*) from submissions
|
||||
where user_id = $1 and status <> 'failed'
|
||||
and created_at > datetime('now', '-24 hours'))
|
||||
+ (select count(*) from songs
|
||||
where submitted_by = $1 and created_at > datetime('now', '-24 hours'))`,
|
||||
userID).Scan(&n)
|
||||
return n >= maxPerDay, err
|
||||
}
|
||||
|
||||
func (a *app) submit(w http.ResponseWriter, r *http.Request) {
|
||||
m := memberFrom(r.Context())
|
||||
|
||||
over, err := a.overQuota(r.Context(), m.ID)
|
||||
if err != nil {
|
||||
slog.Error("quota", "ctx", "submissions", "error", err)
|
||||
a.submitError(w, r, http.StatusInternalServerError, "Jokin meni pieleen.")
|
||||
return
|
||||
}
|
||||
if over {
|
||||
a.submitError(w, r, http.StatusTooManyRequests,
|
||||
fmt.Sprintf("Olet lähettänyt jo %d kappaletta viimeisen %s aikana. Yritä huomenna.",
|
||||
maxPerDay, quotaWindowText))
|
||||
return
|
||||
}
|
||||
|
||||
// A YouTube song is not a different kind of song — it just has an extra download step and a
|
||||
// source_url. Both paths converge on the same worker.
|
||||
if raw := r.FormValue("url"); strings.TrimSpace(raw) != "" {
|
||||
a.submitURL(w, r, m.ID, raw)
|
||||
return
|
||||
}
|
||||
|
||||
r.Body = http.MaxBytesReader(w, r.Body, maxUploadBytes)
|
||||
file, header, err := r.FormFile("audio")
|
||||
if errors.Is(err, http.ErrMissingFile) {
|
||||
// Neither field filled. HTML cannot express "one of these two", so the server says it.
|
||||
a.submitError(w, r, http.StatusUnprocessableEntity,
|
||||
"Valitse äänitiedosto tai anna YouTube-linkki.")
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
a.submitError(w, r, http.StatusRequestEntityTooLarge,
|
||||
"Tiedostoa ei voitu lukea. Enintään 50 MB.")
|
||||
return
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
var subID int64
|
||||
err = a.db.QueryRowContext(r.Context(),
|
||||
`insert into submissions (user_id, status) values ($1, 'queued') returning id`,
|
||||
m.ID).Scan(&subID)
|
||||
if err != nil {
|
||||
slog.Error("create submission", "ctx", "submissions", "error", err)
|
||||
a.submitError(w, r, http.StatusInternalServerError, "Jokin meni pieleen.")
|
||||
return
|
||||
}
|
||||
|
||||
// The row exists before the file does, so nothing on disk is ever unaccounted for.
|
||||
src := a.tmpPath(subID, filepath.Ext(header.Filename))
|
||||
dst, err := os.Create(src)
|
||||
if err == nil {
|
||||
_, err = io.Copy(dst, file)
|
||||
dst.Close()
|
||||
}
|
||||
if err != nil {
|
||||
slog.Error("save upload", "ctx", "submissions", "error", err, "submission", subID)
|
||||
a.discardSubmission(r.Context(), subID, src)
|
||||
a.submitError(w, r, http.StatusRequestEntityTooLarge,
|
||||
"Tiedostoa ei voitu tallentaa. Enintään 50 MB.")
|
||||
return
|
||||
}
|
||||
|
||||
// Metadata is read synchronously: arriving later, it would land in a form the submitter is
|
||||
// already typing into and race their keystrokes.
|
||||
meta, err := probe(r.Context(), src)
|
||||
if err != nil {
|
||||
a.discardSubmission(r.Context(), subID, src)
|
||||
a.submitError(w, r, http.StatusUnprocessableEntity,
|
||||
"Tiedostosta ei löytynyt ääntä. Onko se varmasti äänitiedosto?")
|
||||
return
|
||||
}
|
||||
if meta.Duration > maxDuration {
|
||||
a.discardSubmission(r.Context(), subID, src)
|
||||
a.submitError(w, r, http.StatusUnprocessableEntity,
|
||||
"Kappale on yli 15 minuuttia pitkä.")
|
||||
return
|
||||
}
|
||||
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update submissions set tmp_path = $2, title = nullif($3, ''), artist = nullif($4, '')
|
||||
where id = $1`, subID, src, meta.Title, meta.Artist); err != nil {
|
||||
slog.Error("save metadata", "ctx", "submissions", "error", err, "submission", subID)
|
||||
}
|
||||
|
||||
slog.Info("submission received", "ctx", "submissions", "submission", subID, "user", m.ID)
|
||||
go a.process(subID, "", src)
|
||||
http.Redirect(w, r, fmt.Sprintf("/submit/%d", subID), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *app) submitURL(w http.ResponseWriter, r *http.Request, userID int64, raw string) {
|
||||
// The allowlist is checked before yt-dlp is invoked at all.
|
||||
link, ok := allowedYouTubeURL(raw)
|
||||
if !ok {
|
||||
a.submitError(w, r, http.StatusUnprocessableEntity,
|
||||
"Vain YouTube-linkit kelpaavat (youtube.com, youtu.be, music.youtube.com).")
|
||||
return
|
||||
}
|
||||
|
||||
// Metadata first, so an over-long track is refused before a byte is downloaded. A timeout is
|
||||
// not fatal: blank fields are a fine outcome, since the submitter fills them in anyway.
|
||||
meta, err := youtubeMeta(r.Context(), link)
|
||||
if err != nil {
|
||||
slog.Warn("yt-dlp metadata", "ctx", "submissions", "error", err)
|
||||
}
|
||||
if meta.Duration > maxDuration {
|
||||
a.submitError(w, r, http.StatusUnprocessableEntity, "Kappale on yli 15 minuuttia pitkä.")
|
||||
return
|
||||
}
|
||||
|
||||
var subID int64
|
||||
err = a.db.QueryRowContext(r.Context(), `
|
||||
insert into submissions (user_id, status, source_url, title, artist)
|
||||
values ($1, 'queued', $2, nullif($3, ''), nullif($4, '')) returning id`,
|
||||
userID, link, meta.Title, meta.Artist).Scan(&subID)
|
||||
if err != nil {
|
||||
slog.Error("create submission", "ctx", "submissions", "error", err)
|
||||
a.submitError(w, r, http.StatusInternalServerError, "Jokin meni pieleen.")
|
||||
return
|
||||
}
|
||||
|
||||
slog.Info("url submission received", "ctx", "submissions", "submission", subID, "user", userID)
|
||||
go a.process(subID, link, "")
|
||||
http.Redirect(w, r, fmt.Sprintf("/submit/%d", subID), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// Retry re-queues a failed URL submission with the typed title and introduction intact. An upload
|
||||
// cannot retry — its temp file is gone — so that case offers re-upload instead.
|
||||
func (a *app) retry(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
if !s.CanRetry() {
|
||||
http.Error(w, "ei uudelleenyritettävissä", http.StatusConflict)
|
||||
return
|
||||
}
|
||||
if _, err := a.db.ExecContext(r.Context(),
|
||||
`update submissions set status = 'queued', status_msg = null where id = $1`, s.ID); err != nil {
|
||||
slog.Error("retry", "ctx", "submissions", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
slog.Info("submission retried", "ctx", "submissions", "submission", s.ID)
|
||||
go a.process(s.ID, *s.SourceURL, "")
|
||||
http.Redirect(w, r, fmt.Sprintf("/submit/%d", s.ID), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (a *app) discardSubmission(ctx context.Context, subID int64, path string) {
|
||||
if path != "" {
|
||||
os.Remove(path)
|
||||
}
|
||||
if _, err := a.db.ExecContext(ctx, `delete from submissions where id = $1`, subID); err != nil {
|
||||
slog.Error("discard submission", "ctx", "submissions", "error", err, "submission", subID)
|
||||
}
|
||||
}
|
||||
|
||||
// --- convert ---
|
||||
|
||||
// process is the whole background half of the pipeline: download when the source is a URL, then
|
||||
// convert. Everything past the two slots waits in `queued`.
|
||||
func (a *app) process(subID int64, sourceURL, src string) {
|
||||
slots <- struct{}{}
|
||||
defer func() { <-slots }()
|
||||
|
||||
// Detached from the request: the submitter's browser is long gone by now.
|
||||
ctx := context.Background()
|
||||
|
||||
if sourceURL != "" {
|
||||
a.setStatus(ctx, subID, "downloading", "")
|
||||
msg, err := downloadYouTube(ctx, sourceURL, a.tmpPath(subID, ".%(ext)s"))
|
||||
if err != nil {
|
||||
if msg == "" {
|
||||
msg = err.Error()
|
||||
}
|
||||
a.setStatus(ctx, subID, "failed", msg)
|
||||
slog.Warn("download failed", "ctx", "submissions", "submission", subID, "error", err)
|
||||
return
|
||||
}
|
||||
// yt-dlp names the file after whatever container YouTube served.
|
||||
matches, _ := filepath.Glob(a.tmpPath(subID, ".*"))
|
||||
for _, m := range matches {
|
||||
if filepath.Ext(m) != ".ogg" {
|
||||
src = m
|
||||
break
|
||||
}
|
||||
}
|
||||
if src == "" {
|
||||
a.setStatus(ctx, subID, "failed", "lataus ei tuottanut tiedostoa")
|
||||
return
|
||||
}
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update submissions set tmp_path = $2 where id = $1`, subID, src); err != nil {
|
||||
slog.Error("save tmp path", "ctx", "submissions", "error", err, "submission", subID)
|
||||
}
|
||||
}
|
||||
|
||||
a.setStatus(ctx, subID, "converting", "")
|
||||
|
||||
out := a.tmpPath(subID, ".ogg")
|
||||
msg, err := convertToOpus(ctx, src, out)
|
||||
if err != nil {
|
||||
os.Remove(out)
|
||||
if msg == "" {
|
||||
msg = err.Error()
|
||||
}
|
||||
a.setStatus(ctx, subID, "failed", msg)
|
||||
slog.Warn("conversion failed", "ctx", "submissions", "submission", subID, "error", err)
|
||||
return
|
||||
}
|
||||
// The original is discarded as soon as the Opus exists.
|
||||
os.Remove(src)
|
||||
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update submissions set status = 'ready', status_msg = null, tmp_path = $2 where id = $1`,
|
||||
subID, out); err != nil {
|
||||
slog.Error("mark ready", "ctx", "submissions", "error", err, "submission", subID)
|
||||
return
|
||||
}
|
||||
slog.Info("conversion ready", "ctx", "submissions", "submission", subID)
|
||||
|
||||
// One automatic lyrics attempt, after the audio is safe. It runs on whatever metadata exists,
|
||||
// so it covers well-tagged music; the Hae sanoitukset button on the waiting page is what
|
||||
// covers everything else, once the submitter has fixed the title and artist.
|
||||
var title, artist string
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select coalesce(title, ''), coalesce(artist, '') from submissions where id = $1`,
|
||||
subID).Scan(&title, &artist); err != nil {
|
||||
return
|
||||
}
|
||||
seconds := 0
|
||||
if meta, err := probe(ctx, out); err == nil {
|
||||
seconds = int(meta.Duration.Seconds())
|
||||
}
|
||||
a.autoFetchLyrics(ctx, subID, title, artist, seconds)
|
||||
}
|
||||
|
||||
func (a *app) setStatus(ctx context.Context, subID int64, status, msg string) {
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update submissions set status = $2, status_msg = nullif($3, '') where id = $1`,
|
||||
subID, status, msg); err != nil {
|
||||
slog.Error("set status", "ctx", "submissions", "error", err, "submission", subID)
|
||||
}
|
||||
}
|
||||
|
||||
// --- the waiting page ---
|
||||
|
||||
// Submitter-only: a submission is invisible to everyone else, including a failed one.
|
||||
func (a *app) loadSubmission(w http.ResponseWriter, r *http.Request) *submission {
|
||||
id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
|
||||
if err != nil {
|
||||
http.NotFound(w, r)
|
||||
return nil
|
||||
}
|
||||
var s submission
|
||||
err = a.db.QueryRowContext(r.Context(), `
|
||||
select id, user_id, status, status_msg, source_url, coalesce(tmp_path, ''),
|
||||
coalesce(title, ''), coalesce(artist, ''), coalesce(genre, ''),
|
||||
coalesce(description, ''), coalesce(lyrics, ''), created_at
|
||||
from submissions where id = $1`, id).
|
||||
Scan(&s.ID, &s.UserID, &s.Status, &s.StatusMsg, &s.SourceURL, &s.TmpPath,
|
||||
&s.Title, &s.Artist, &s.Genre, &s.Description, &s.Lyrics, &s.CreatedAt)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
http.NotFound(w, r)
|
||||
return nil
|
||||
} else if err != nil {
|
||||
slog.Error("load submission", "ctx", "submissions", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return nil
|
||||
}
|
||||
if s.UserID != memberFrom(r.Context()).ID {
|
||||
http.NotFound(w, r)
|
||||
return nil
|
||||
}
|
||||
return &s
|
||||
}
|
||||
|
||||
func (a *app) submissionPage(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
a.render(w, r, http.StatusOK, "submission.html", page{Title: "Lähetys", Data: s})
|
||||
}
|
||||
|
||||
// The same partial the page includes on first paint, returned alone for the HTMX poll — so the
|
||||
// markup exists once and arrives already populated. HTMX stops polling when the fragment drops
|
||||
// hx-trigger, which it does on a terminal status.
|
||||
func (a *app) submissionStatus(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
if err := pages["submission.html"].ExecuteTemplate(w, "submission-status", s); err != nil {
|
||||
slog.Error("render status", "ctx", "submissions", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Metadata is editable while the conversion runs — that is the point of the waiting page. There is
|
||||
// no save button: HTMX posts here after a pause in typing, and pressing Julkaise posts the same
|
||||
// fields to publish, so a browser without JS loses nothing.
|
||||
func (a *app) saveMetadata(ctx context.Context, subID int64, r *http.Request) error {
|
||||
// r.Form is only populated once the body has been parsed, and the check below reads it.
|
||||
if err := r.ParseForm(); err != nil {
|
||||
return err
|
||||
}
|
||||
genre := r.FormValue("genre")
|
||||
if genre != "" && !validGenre(genre) {
|
||||
return fmt.Errorf("unknown genre %q", genre)
|
||||
}
|
||||
// A field the request does not carry keeps its stored value. Without this, any post that omits
|
||||
// a field silently clears it — which is exactly how a publish request wiped lyrics that the
|
||||
// worker had just fetched.
|
||||
has := func(field string) bool { _, ok := r.Form[field]; return ok }
|
||||
|
||||
_, err := a.db.ExecContext(ctx, `
|
||||
update submissions set
|
||||
title = case when $2 then nullif($3, '') else title end,
|
||||
artist = case when $4 then nullif($5, '') else artist end,
|
||||
genre = case when $6 then nullif($7, '') else genre end,
|
||||
description = case when $8 then nullif($9, '') else description end,
|
||||
lyrics = case when $10 then nullif($11, '') else lyrics end
|
||||
where id = $1`,
|
||||
subID,
|
||||
has("title"), clean(r.FormValue("title"), maxTitle),
|
||||
has("artist"), clean(r.FormValue("artist"), maxArtist),
|
||||
has("genre"), genre,
|
||||
has("description"), clean(r.FormValue("description"), maxDescription),
|
||||
// Line breaks are the whole point of lyrics, so they survive rather than being cleaned away.
|
||||
has("lyrics"), cleanLyrics(r.FormValue("lyrics")))
|
||||
return err
|
||||
}
|
||||
|
||||
func (a *app) saveSubmission(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
if err := a.saveMetadata(r.Context(), s.ID, r); err != nil {
|
||||
slog.Error("save submission", "ctx", "submissions", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusUnprocessableEntity)
|
||||
return
|
||||
}
|
||||
// The autosave answers with the "saved at" line and nothing else; a plain POST (no JS) goes
|
||||
// back to the page.
|
||||
if r.Header.Get("HX-Request") == "" {
|
||||
http.Redirect(w, r, fmt.Sprintf("/submit/%d", s.ID), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
if err := pages["submission.html"].ExecuteTemplate(w, "saved",
|
||||
time.Now().Local().Format("15.04")); err != nil {
|
||||
slog.Error("render saved", "ctx", "submissions", "error", err)
|
||||
}
|
||||
}
|
||||
|
||||
// --- publish ---
|
||||
|
||||
func (a *app) publish(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
if !s.Ready() {
|
||||
http.Error(w, "ei vielä valmis", http.StatusConflict)
|
||||
return
|
||||
}
|
||||
|
||||
// Julkaise submits the metadata form, so the last keystrokes arrive with it — the autosave is
|
||||
// a convenience, not the only path.
|
||||
if r.FormValue("title") != "" || r.FormValue("artist") != "" || r.FormValue("genre") != "" {
|
||||
if err := a.saveMetadata(r.Context(), s.ID, r); err != nil {
|
||||
slog.Error("save before publish", "ctx", "submissions", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusUnprocessableEntity)
|
||||
return
|
||||
}
|
||||
if s = a.loadSubmission(w, r); s == nil {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Title, artist and genre are required here rather than at submit: the form is meant to be
|
||||
// filled while the conversion runs, and prefill can legitimately produce nothing.
|
||||
title, artist, genre := clean(s.Title, maxTitle), clean(s.Artist, maxArtist), s.Genre
|
||||
if title == "" || artist == "" || !validGenre(genre) {
|
||||
a.flash(w, "Täytä nimi, esittäjä ja genre ennen julkaisua.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/submit/%d", s.ID), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
src := s.TmpPath
|
||||
meta, err := probe(r.Context(), src)
|
||||
if err != nil {
|
||||
slog.Error("probe before publish", "ctx", "submissions", "error", err, "submission", s.ID)
|
||||
a.flash(w, "Äänitiedostoa ei löytynyt. Lähetä kappale uudelleen.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/submit/%d", s.ID), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
|
||||
tx, err := a.db.BeginTx(r.Context(), nil)
|
||||
if err != nil {
|
||||
slog.Error("begin publish", "ctx", "submissions", "error", err)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
defer tx.Rollback()
|
||||
|
||||
var songID int64
|
||||
err = tx.QueryRowContext(r.Context(), `
|
||||
insert into songs (title, artist, genre, description, lyrics, audio_file, duration_seconds,
|
||||
source_url, submitted_by)
|
||||
values ($1, $2, $3, $4, $5, '', $6, $7, $8) returning id`,
|
||||
title, artist, genre, nilIfEmpty(clean(s.Description, maxDescription)),
|
||||
nilIfEmpty(cleanLyrics(s.Lyrics)),
|
||||
int(meta.Duration.Seconds()), s.SourceURL, s.UserID).Scan(&songID)
|
||||
if err != nil {
|
||||
slog.Error("insert song", "ctx", "songs", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
// The rename is inside the transaction: if the file move fails, the song row never existed.
|
||||
// A crash between rename and commit leaves an orphan .ogg — the startup sweep gets it.
|
||||
dst := a.audioPath(songID)
|
||||
if err := os.Rename(src, dst); err != nil {
|
||||
slog.Error("move audio", "ctx", "songs", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if _, err := tx.ExecContext(r.Context(),
|
||||
`update songs set audio_file = $2 where id = $1`,
|
||||
songID, filepath.Base(dst)); err != nil {
|
||||
os.Rename(dst, src)
|
||||
slog.Error("set audio file", "ctx", "songs", "error", err, "song", songID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if _, err := tx.ExecContext(r.Context(), `delete from submissions where id = $1`, s.ID); err != nil {
|
||||
os.Rename(dst, src)
|
||||
slog.Error("delete submission", "ctx", "submissions", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if err := tx.Commit(); err != nil {
|
||||
os.Rename(dst, src)
|
||||
slog.Error("commit publish", "ctx", "songs", "error", err, "submission", s.ID)
|
||||
http.Error(w, "virhe", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
slog.Info("song published", "ctx", "songs", "song", songID, "user", s.UserID)
|
||||
a.flash(w, "Kappale julkaistu.")
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// A failed submission is denied in every sense that matters: invisible to everyone but its
|
||||
// submitter and never in `songs`. Discard removes the row and its temp file.
|
||||
func (a *app) discard(w http.ResponseWriter, r *http.Request) {
|
||||
s := a.loadSubmission(w, r)
|
||||
if s == nil {
|
||||
return
|
||||
}
|
||||
a.discardSubmission(r.Context(), s.ID, s.TmpPath)
|
||||
os.Remove(a.tmpPath(s.ID, ".ogg"))
|
||||
a.flash(w, "Lähetys poistettu.")
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func nilIfEmpty(s string) *string {
|
||||
if strings.TrimSpace(s) == "" {
|
||||
return nil
|
||||
}
|
||||
return &s
|
||||
}
|
||||
|
||||
// Own in-flight submissions, for the home page — otherwise a submission is only reachable by URL.
|
||||
func (a *app) mySubmissions(ctx context.Context, userID int64) ([]*submission, error) {
|
||||
rows, err := a.db.QueryContext(ctx, `
|
||||
select id, user_id, status, status_msg, source_url, coalesce(tmp_path, ''),
|
||||
coalesce(title, ''), coalesce(artist, ''), coalesce(genre, ''),
|
||||
coalesce(description, ''), created_at
|
||||
from submissions where user_id = $1 order by created_at desc`, userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
var out []*submission
|
||||
for rows.Next() {
|
||||
var s submission
|
||||
if err := rows.Scan(&s.ID, &s.UserID, &s.Status, &s.StatusMsg, &s.SourceURL, &s.TmpPath,
|
||||
&s.Title, &s.Artist, &s.Genre, &s.Description, &s.CreatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, &s)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -0,0 +1,222 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestClean(t *testing.T) {
|
||||
for _, tc := range []struct{ in, want string }{
|
||||
{"Testikappale", "Testikappale"},
|
||||
{" padded ", "padded"},
|
||||
{"line\nbreak", "line break"},
|
||||
{"tab\tsep", "tab sep"},
|
||||
{"bell\x07null\x00", "bellnull"},
|
||||
{"a b c", "a b c"},
|
||||
} {
|
||||
if got := clean(tc.in, 100); got != tc.want {
|
||||
t.Errorf("clean(%q) = %q, want %q", tc.in, got, tc.want)
|
||||
}
|
||||
}
|
||||
// Truncation counts runes, not bytes: a 100-ä title is 100 characters, not 50.
|
||||
long := ""
|
||||
for range 150 {
|
||||
long += "ä"
|
||||
}
|
||||
if got := []rune(clean(long, 100)); len(got) != 100 {
|
||||
t.Errorf("truncated to %d runes, want 100", len(got))
|
||||
}
|
||||
}
|
||||
|
||||
func makeAudio(t *testing.T, path string) {
|
||||
t.Helper()
|
||||
if _, err := exec.LookPath("ffmpeg"); err != nil {
|
||||
t.Skip("ffmpeg not on PATH")
|
||||
}
|
||||
cmd := exec.Command("ffmpeg", "-nostdin", "-y", "-f", "lavfi",
|
||||
"-i", "sine=frequency=440:duration=1", "-c:a", "libopus", path)
|
||||
if out, err := cmd.CombinedOutput(); err != nil {
|
||||
t.Fatalf("ffmpeg: %v\n%s", err, out)
|
||||
}
|
||||
}
|
||||
|
||||
func (a *app) readySubmission(t *testing.T, userID int64) *submission {
|
||||
t.Helper()
|
||||
var id int64
|
||||
err := a.db.QueryRowContext(context.Background(), `
|
||||
insert into submissions (user_id, status, title, artist, genre)
|
||||
values ($1, 'ready', 'Testikappale', 'Testiartisti', 'Metal') returning id`,
|
||||
userID).Scan(&id)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
path := a.tmpPath(id, ".ogg")
|
||||
makeAudio(t, path)
|
||||
if _, err := a.db.ExecContext(context.Background(),
|
||||
`update submissions set tmp_path = $2 where id = $1`, id, path); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return &submission{ID: id, UserID: userID, Status: "ready", TmpPath: path}
|
||||
}
|
||||
|
||||
// A song row and its .ogg appear together, or neither does.
|
||||
func TestPublishIsAllOrNothing(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
a.cfg.storageDir = t.TempDir()
|
||||
audioDir := filepath.Join(a.cfg.storageDir, "audio")
|
||||
for _, d := range []string{"audio", "tmp"} {
|
||||
if err := os.MkdirAll(filepath.Join(a.cfg.storageDir, d), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
id := a.seedMember(t, "[email protected]")
|
||||
sub := a.readySubmission(t, id)
|
||||
|
||||
// Make the move impossible, the same way a full or read-only disk would.
|
||||
if err := os.Chmod(audioDir, 0o500); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Cleanup(func() { os.Chmod(audioDir, 0o755) })
|
||||
|
||||
r := httptest.NewRequest("POST", fmt.Sprintf("/submit/%d/publish", sub.ID), nil)
|
||||
r.SetPathValue("id", fmt.Sprint(sub.ID))
|
||||
r = r.WithContext(context.WithValue(ctx, memberKey, &member{ID: id}))
|
||||
w := httptest.NewRecorder()
|
||||
a.publish(w, r)
|
||||
|
||||
if w.Code != http.StatusInternalServerError {
|
||||
t.Fatalf("publish with an unwritable audio dir: status = %d, want 500", w.Code)
|
||||
}
|
||||
var songs, submissions int
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from songs`).Scan(&songs); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if songs != 0 {
|
||||
t.Fatalf("orphan song row: %d rows with no audio file", songs)
|
||||
}
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from submissions`).Scan(&submissions); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if submissions != 1 {
|
||||
t.Fatalf("submission rows = %d, want 1 — a failed publish must leave it recoverable", submissions)
|
||||
}
|
||||
if _, err := os.Stat(sub.TmpPath); err != nil {
|
||||
t.Fatalf("converted audio was lost: %v", err)
|
||||
}
|
||||
|
||||
// With the directory writable again, the same submission publishes.
|
||||
os.Chmod(audioDir, 0o755)
|
||||
w = httptest.NewRecorder()
|
||||
a.publish(w, r)
|
||||
if w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("publish: status = %d, want 303", w.Code)
|
||||
}
|
||||
var songID int64
|
||||
if err := a.db.QueryRowContext(ctx, `select id from songs`).Scan(&songID); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := os.Stat(a.audioPath(songID)); err != nil {
|
||||
t.Fatalf("published song has no audio file: %v", err)
|
||||
}
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from submissions`).Scan(&submissions); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if submissions != 0 {
|
||||
t.Fatalf("submission survived publish: %d rows", submissions)
|
||||
}
|
||||
}
|
||||
|
||||
// Five per rolling 24 hours, counting published songs, never counting failures.
|
||||
func TestSubmissionQuota(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
id := a.seedMember(t, "[email protected]")
|
||||
|
||||
check := func(want bool, why string) {
|
||||
t.Helper()
|
||||
over, err := a.overQuota(ctx, id)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if over != want {
|
||||
t.Fatalf("%s: overQuota = %v, want %v", why, over, want)
|
||||
}
|
||||
}
|
||||
|
||||
check(false, "no submissions")
|
||||
|
||||
for range 4 {
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`insert into submissions (user_id, status) values ($1, 'ready')`, id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
check(false, "four in flight")
|
||||
|
||||
// Failures never count — yt-dlp rot and bad files are not the submitter's fault.
|
||||
for range 10 {
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`insert into submissions (user_id, status) values ($1, 'failed')`, id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
check(false, "failures do not count")
|
||||
|
||||
// A published song still occupies a slot, even though its submission row is gone.
|
||||
if _, err := a.db.ExecContext(ctx, `
|
||||
insert into songs (title, artist, genre, audio_file, duration_seconds, submitted_by)
|
||||
values ('T', 'A', 'Metal', '1.ogg', 60, $1)`, id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
check(true, "four in flight plus one published")
|
||||
|
||||
// Yesterday's submissions are outside the window.
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update submissions set created_at = datetime('now', '-25 hours') where user_id = $1`,
|
||||
id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
check(false, "older than 24 hours")
|
||||
}
|
||||
|
||||
// A submission left mid-conversion by a restart must not say "converting" forever.
|
||||
func TestRestartRecovery(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
id := a.seedMember(t, "[email protected]")
|
||||
|
||||
for _, status := range []string{"queued", "downloading", "converting"} {
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`insert into submissions (user_id, status) values ($1, $2)`, id, status); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
if err := sweep(ctx, a.db); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
var stuck int
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select count(*) from submissions where status <> 'failed'`).Scan(&stuck); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if stuck != 0 {
|
||||
t.Fatalf("%d submissions survived the sweep still in flight", stuck)
|
||||
}
|
||||
var msg string
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select status_msg from submissions limit 1`).Scan(&msg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if msg == "" {
|
||||
t.Fatal("swept submission carries no explanation")
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,118 @@
|
||||
{{define "content"}}
|
||||
<h1>Ylläpito</h1>
|
||||
<p><a href="/admin/reports">Palautteet</a>{{if .Data.OpenCount}} <span class="badge pending">{{.Data.OpenCount}} avointa</span>{{end}}</p>
|
||||
|
||||
<section class="adminsection">
|
||||
<header>
|
||||
<h2>Kutsut</h2>
|
||||
<form method="post" action="/admin/invites"><button type="submit">Luo kutsukoodi</button></form>
|
||||
</header>
|
||||
<div class="body">
|
||||
<table>
|
||||
<thead><tr><th>Kutsulinkki</th><th>Tila</th><th>Luotu</th></tr></thead>
|
||||
<tbody>
|
||||
{{range .Data.Invites}}
|
||||
<tr>
|
||||
<!-- Not a link: an invite is something to send, never to follow. A click used to open the
|
||||
join form in the admin's own browser, which is never what was wanted. -->
|
||||
<td class="invitecell">
|
||||
<code>{{.Link}}</code>
|
||||
<button type="button" class="ghost" onclick="copyInvite(this)">Kopioi</button>
|
||||
</td>
|
||||
<td class="nowrap"><span class="dot on"></span> käyttämätön</td>
|
||||
<td>{{fidate .CreatedAt}}</td>
|
||||
</tr>
|
||||
{{else}}
|
||||
<tr><td colspan="3" class="muted">Ei käyttämättömiä kutsuja.</td></tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
<p class="muted small">Lähetä linkki kaverille. Koodi on valmiiksi täytettynä.
|
||||
Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
|
||||
{{.Data.SpentCount}}{{end}}.</p>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section class="adminsection">
|
||||
<header><h2>Jäsenet</h2></header>
|
||||
<div class="body">
|
||||
<table>
|
||||
<thead><tr><th>Nimi</th><th>Sähköposti</th><th>Liittyi</th><th>Toiminnot</th></tr></thead>
|
||||
<tbody>
|
||||
{{range .Data.Members}}
|
||||
<tr{{if .Banned}} class="banned"{{end}}>
|
||||
<td>{{.Name}}{{if .Banned}} <span class="badge pending">estetty</span>{{end}}</td>
|
||||
<td>{{.Email}}</td>
|
||||
<td>{{fidate .CreatedAt}}</td>
|
||||
<td class="actions">
|
||||
<form method="post" action="/admin/users/{{.ID}}/ban">
|
||||
<button type="submit" class="ghost">{{if .Banned}}Poista esto{{else}}Estä{{end}}</button>
|
||||
</form>
|
||||
<form method="post" action="/admin/users/{{.ID}}/password">
|
||||
<input type="password" name="password" placeholder="uusi salasana" required>
|
||||
<button type="submit" class="ghost">Vaihda salasana</button>
|
||||
</form>
|
||||
</td>
|
||||
</tr>
|
||||
{{else}}
|
||||
<tr><td colspan="4" class="muted">Ei jäseniä. Luo kutsukoodi ja lähetä se jollekulle.</td></tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section class="adminsection">
|
||||
<header><h2>Kappaleet</h2></header>
|
||||
<div class="body">
|
||||
<table>
|
||||
<thead><tr><th>Kappale</th><th>Lähettäjä</th><th>Arvostelut</th><th>Julkaistu</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
{{range .Data.Songs}}
|
||||
<tr>
|
||||
<td>{{.Title}} <span class="muted">— {{.Artist}}</span></td>
|
||||
<td>{{.Submitter}}</td>
|
||||
<td>{{.Reviews}}</td>
|
||||
<td class="nowrap">{{fidate .CreatedAt}}</td>
|
||||
<td class="actions">
|
||||
<a href="/audio/{{.ID}}">Kuuntele</a>
|
||||
<form method="post" action="/admin/songs/{{.ID}}/delete"
|
||||
onsubmit="return confirm('Poistetaanko kappale ja kaikki sen arvostelut?')">
|
||||
<button type="submit" class="ghost danger">Poista</button>
|
||||
</form>
|
||||
</td>
|
||||
</tr>
|
||||
{{else}}
|
||||
<tr><td colspan="5" class="muted">Ei kappaleita.</td></tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<script>
|
||||
// The clipboard API needs a secure context. Over the documented SSH tunnel the origin is
|
||||
// localhost, which qualifies; reached any other way it is missing, so selecting the text is the
|
||||
// fallback — the admin presses Ctrl+C instead of being left with a button that does nothing.
|
||||
function copyInvite(button) {
|
||||
const link = button.previousElementSibling;
|
||||
const done = () => {
|
||||
button.textContent = 'Kopioitu';
|
||||
setTimeout(() => { button.textContent = 'Kopioi'; }, 1500);
|
||||
};
|
||||
if (navigator.clipboard) {
|
||||
navigator.clipboard.writeText(link.textContent).then(done, () => selectText(link));
|
||||
} else {
|
||||
selectText(link);
|
||||
}
|
||||
}
|
||||
|
||||
function selectText(el) {
|
||||
const range = document.createRange();
|
||||
range.selectNodeContents(el);
|
||||
const sel = window.getSelection();
|
||||
sel.removeAllRanges();
|
||||
sel.addRange(range);
|
||||
}
|
||||
</script>
|
||||
{{end}}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{define "content"}}
|
||||
<h1>Palautteet</h1>
|
||||
<p><a href="/admin">← Ylläpito</a></p>
|
||||
|
||||
{{range .Data}}
|
||||
<article class="review{{if .Open}} own{{end}}">
|
||||
<header>
|
||||
<span class="badge {{if .Open}}pending{{else}}reviewed{{end}}">{{if .Open}}avoin{{else}}käsitelty{{end}}</span>
|
||||
<span class="who">{{.Reporter}}</span>
|
||||
<span class="meta">{{fidate .CreatedAt}}{{if .Page}} · {{.Page}}{{end}}</span>
|
||||
</header>
|
||||
<p>{{.Body}}</p>
|
||||
<p class="meta break">{{.UserAgent}}</p>
|
||||
{{if .Open}}
|
||||
<form method="post" action="/admin/reports/{{.ID}}/resolve">
|
||||
<button type="submit" class="ghost">Merkitse käsitellyksi</button>
|
||||
</form>
|
||||
{{end}}
|
||||
</article>
|
||||
{{else}}
|
||||
<p class="empty">Ei palautteita.</p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
@@ -0,0 +1,82 @@
|
||||
<!doctype html>
|
||||
<html lang="fi">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>{{.Title}} — Levyraati</title>
|
||||
<link rel="icon" href="/static/favicon.svg" type="image/svg+xml">
|
||||
<link rel="preload" href="/static/fonts/oswald.woff2" as="font" type="font/woff2" crossorigin>
|
||||
<link rel="stylesheet" href="/static/style.css">
|
||||
<script src="/static/htmx.min.js" defer></script>
|
||||
<script src="/static/player.js" defer></script>
|
||||
<script src="/static/lyrics.js" defer></script>
|
||||
</head>
|
||||
<body>
|
||||
<header class="topbar">
|
||||
<div class="topbar-inner">
|
||||
<a class="brand" href="/">Levyraati{{if .Admin}} <span class="badge admin">ylläpito</span>{{end}}</a>
|
||||
|
||||
{{if .Member}}
|
||||
<nav class="navlinks">
|
||||
<a href="/" {{if eq .Path "/"}}aria-current="page"{{end}}>Jono{{if .Queued}} <span class="count">{{.Queued}}</span>{{end}}</a>
|
||||
<a href="/songs" {{if eq .Path "/songs"}}aria-current="page"{{end}}>Kappaleet</a>
|
||||
<a href="/submit" {{if eq .Path "/submit"}}aria-current="page"{{end}}>Lähetä</a>
|
||||
<a href="/stats" {{if eq .Path "/stats"}}aria-current="page"{{end}}>Tilastot</a>
|
||||
<!-- An admin is a member first: the same nav, with one link the others do not get. -->
|
||||
{{if .Member.IsAdmin}}<a href="/admin" {{if .Admin}}aria-current="page"{{end}}>Ylläpito</a>{{end}}
|
||||
</nav>
|
||||
<div class="userblock">
|
||||
<span class="lines">
|
||||
<span class="name">{{.Member.Name}}</span>
|
||||
<span class="email">{{.Member.Email}}</span>
|
||||
</span>
|
||||
<a href="/profile" title="{{.Member.Name}}">
|
||||
{{if .Member.Avatar}}<img class="avatar" src="/avatars/{{.Member.ID}}" alt="Oma profiili">
|
||||
{{else}}<span class="avatar">{{.Member.Initials}}</span>{{end}}
|
||||
</a>
|
||||
<form method="post" action="/logout"><button class="link">Kirjaudu ulos</button></form>
|
||||
|
||||
<!-- <details> is the mobile panel: no JS, and Esc/click-away come free. -->
|
||||
<details class="mobilenav">
|
||||
<summary aria-label="Valikko">☰</summary>
|
||||
<div class="panel">
|
||||
<a href="/">Jono{{if .Queued}} <span class="count">{{.Queued}}</span>{{end}}</a>
|
||||
<a href="/songs">Kappaleet</a>
|
||||
<a href="/submit">Lähetä</a>
|
||||
<a href="/stats">Tilastot</a>
|
||||
{{if .Member.IsAdmin}}<a href="/admin">Ylläpito</a>{{end}}
|
||||
<a href="/profile">Oma profiili</a>
|
||||
<form method="post" action="/logout"><button type="submit">Kirjaudu ulos</button></form>
|
||||
</div>
|
||||
</details>
|
||||
</div>
|
||||
{{else}}
|
||||
<span></span>
|
||||
<nav class="navlinks"><a href="/login">Kirjaudu</a></nav>
|
||||
{{end}}
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<main {{if .Narrow}}class="narrow"{{end}}>{{template "content" .}}</main>
|
||||
|
||||
<footer class="sitefooter">
|
||||
{{if .Member}}
|
||||
<!-- The server already knows where they were, so the path travels in the link — no JS. -->
|
||||
<a href="/report?from={{.Path}}">Anna palautetta</a> ·
|
||||
{{end}}
|
||||
<span class="slogan">We know good music, baby!</span>
|
||||
<span class="copyright">© Kessinen</span>
|
||||
<span class="version" title="Käytössä oleva versio">v{{.Version}}</span>
|
||||
</footer>
|
||||
|
||||
{{with .Flash}}
|
||||
<div class="toasts">
|
||||
<div class="toast" role="status">
|
||||
<p>{{.}}</p>
|
||||
<button class="dismiss" aria-label="Sulje"
|
||||
onclick="this.closest('.toast').remove()">×</button>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,23 @@
|
||||
{{define "content"}}
|
||||
<h1>Kirjaudu</h1>
|
||||
<!-- The app's own slogan, three decades old. A mark, not interface copy, so it stays English. -->
|
||||
<p class="slogan hero">We know good music, baby!</p>
|
||||
|
||||
{{with .Data.Errors.form}}<p class="error">{{.}}</p>{{end}}
|
||||
|
||||
<form method="post" action="/login" class="stack">
|
||||
<label>Sähköposti
|
||||
<input type="email" name="email" value="{{.Data.Email}}" required autofocus autocomplete="email">
|
||||
</label>
|
||||
<label>Salasana
|
||||
<input type="password" name="password" required autocomplete="current-password">
|
||||
</label>
|
||||
<label class="row">
|
||||
<input type="checkbox" name="remember" value="1"> Pysy kirjautuneena 30 päivää
|
||||
</label>
|
||||
<button type="submit">Kirjaudu</button>
|
||||
</form>
|
||||
|
||||
<p class="muted">Levyraati on kutsuvierasklubi. Kutsukoodilla pääset mukaan
|
||||
<a href="/register">tästä</a>.</p>
|
||||
{{end}}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{/* Two shapes, because timed lyrics and guessed lyrics deserve different treatment.
|
||||
Synced: one element per line with its own timestamp, highlighted as it comes.
|
||||
Plain: one block that scrolls continuously, with a nudge knob, because a highlight on evenly
|
||||
guessed timings turns guaranteed drift into what looks like a bug. */}}
|
||||
{{define "lyricsview"}}
|
||||
<span class="cap">Sanoitukset</span>
|
||||
{{$lines := .LyricLines}}
|
||||
{{if $lines}}
|
||||
<div class="lyricsbox synced" data-song="{{.ID}}">
|
||||
{{range $lines}}<p class="lline" data-t="{{.At}}">{{if .Text}}{{.Text}}{{else}} {{end}}</p>{{end}}
|
||||
</div>
|
||||
<label class="follow">
|
||||
<input type="checkbox" checked> Seuraa kappaletta
|
||||
<span class="muted small">(sivu ei vieri)</span>
|
||||
</label>
|
||||
{{else}}
|
||||
<div class="lyricsbox plain" data-duration="{{.Duration}}" data-song="{{.ID}}">
|
||||
<div class="lscroll">{{lyricstext .Lyrics}}</div>
|
||||
</div>
|
||||
<label class="nudge">
|
||||
Ajoitus
|
||||
<input type="range" min="-10" max="10" step="0.5" value="0" aria-label="Ajoituksen siirto sekunteina">
|
||||
<output>0 s</output>
|
||||
</label>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
{{define "player"}}
|
||||
<!-- Ships with native controls; player.js removes them and drives the same element. No JS means
|
||||
the browser's own player, which is plain but complete. -->
|
||||
<div class="playerwrap" data-duration="{{.Duration}}">
|
||||
<audio controls preload="none" src="/audio/{{.ID}}" class="player"></audio>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "songcard"}}
|
||||
<a class="songcard{{if and (not .Own) (not .Reviewed)}} unreviewed{{end}}" href="/songs/{{.ID}}">
|
||||
{{if .Average}}<span class="scorebadge">{{score .Average}}</span>
|
||||
{{else if .ReviewCount}}<span class="scorebadge sealed" title="Muiden pisteet paljastuvat kun tallennat omasi"></span>{{end}}
|
||||
<span class="title">{{.Title}}</span>
|
||||
<span class="artist">{{.Artist}}</span>
|
||||
<span class="meta">
|
||||
<span class="badge genre">{{.GenreLabel}}</span>
|
||||
<span>{{.Length}}</span>
|
||||
<span>{{.Submitter}}</span>
|
||||
{{if .Own}}<span class="badge admin">oma</span>
|
||||
{{else if .Reviewed}}<span class="badge reviewed">arvosteltu</span>
|
||||
{{else}}<span class="badge pending">arvostelematta</span>{{end}}
|
||||
{{if .ReviewCount}}<span>{{.ReviewCount}} arvostelua</span>{{end}}
|
||||
</span>
|
||||
</a>
|
||||
{{end}}
|
||||
|
||||
{{define "fader"}}
|
||||
<!-- A native range input turned vertical: keyboard, form submission and the value all stay free. -->
|
||||
<div class="fader">
|
||||
<span class="ticks" aria-hidden="true">
|
||||
<span>100</span><span>75</span><span>50</span><span>25</span><span>1</span>
|
||||
</span>
|
||||
<input type="range" name="score" min="1" max="100" value="{{.}}"
|
||||
aria-label="Pisteet 1–100"
|
||||
oninput="this.closest('.fader').querySelector('output').value = this.value">
|
||||
<output class="readout">{{.}}</output>
|
||||
</div>
|
||||
{{end}}
|
||||
@@ -0,0 +1,67 @@
|
||||
{{define "content"}}
|
||||
{{$p := .Data}}
|
||||
<div class="profilehead">
|
||||
{{if $p.Avatar}}
|
||||
<img class="avatar big" src="/avatars/{{$p.ID}}" alt="">
|
||||
{{else}}
|
||||
<span class="avatar big">{{$p.Initials}}</span>
|
||||
{{end}}
|
||||
<div>
|
||||
<h1>{{$p.Name}}</h1>
|
||||
<p class="muted">Liittyi {{fidate $p.CreatedAt}}{{if $p.Email}} · {{$p.Email}}{{end}}</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="statgrid">
|
||||
<div class="statcard"><span class="statvalue">{{$p.Stats.SongsSubmitted}}</span><span class="muted small">kappaletta</span></div>
|
||||
<div class="statcard"><span class="statvalue">{{$p.Stats.ReviewsWritten}}</span><span class="muted small">arvostelua</span></div>
|
||||
|
||||
<!-- The one comparison that says something about a person, in the same language as the review
|
||||
form: what they give versus what they get. -->
|
||||
<div class="statcard wide">
|
||||
<div class="channels compare">
|
||||
{{if $p.Stats.AverageGiven}}
|
||||
<div class="chan" style="--v: {{score $p.Stats.AverageGiven}}">
|
||||
<span class="chan-track"><span class="chan-cap"></span></span>
|
||||
<span class="chan-score">{{score $p.Stats.AverageGiven}}</span>
|
||||
<span class="chan-who">antanut</span>
|
||||
</div>
|
||||
{{end}}
|
||||
{{if $p.Stats.AverageReceived}}
|
||||
<div class="chan own" style="--v: {{score $p.Stats.AverageReceived}}">
|
||||
<span class="chan-track"><span class="chan-cap"></span></span>
|
||||
<span class="chan-score">{{score $p.Stats.AverageReceived}}</span>
|
||||
<span class="chan-who">saanut</span>
|
||||
</div>
|
||||
{{end}}
|
||||
{{if and (not $p.Stats.AverageGiven) (not $p.Stats.AverageReceived)}}
|
||||
<p class="muted small">Ei vielä pisteitä kumpaankaan suuntaan.</p>
|
||||
{{end}}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{{if $p.Own}}
|
||||
<details class="editbox">
|
||||
<summary>Muokkaa tietoja</summary>
|
||||
<form method="post" action="/profile" enctype="multipart/form-data" class="stack">
|
||||
<label>Nimi <input name="name" value="{{$p.Name}}" maxlength="50" required></label>
|
||||
<label>Sähköposti <input type="email" name="email" value="{{$p.Email}}" required></label>
|
||||
<label>Kuva <input type="file" name="avatar" accept="image/*"></label>
|
||||
<label>Nykyinen salasana <input type="password" name="current_password" autocomplete="current-password"></label>
|
||||
<label>Uusi salasana <input type="password" name="new_password" autocomplete="new-password"></label>
|
||||
<button type="submit">Tallenna</button>
|
||||
</form>
|
||||
<p class="muted small">Salasanan vaihto vaatii nykyisen salasanan ja kirjaa ulos muut laitteesi.</p>
|
||||
</details>
|
||||
{{end}}
|
||||
|
||||
<section>
|
||||
<h2>Kappaleet</h2>
|
||||
{{if $p.Songs}}
|
||||
<div class="songgrid">{{range $p.Songs}}{{template "songcard" .}}{{end}}</div>
|
||||
{{else}}
|
||||
<p class="muted">Ei vielä yhtään kappaletta.</p>
|
||||
{{end}}
|
||||
</section>
|
||||
{{end}}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{define "content"}}
|
||||
<h1>Jono</h1>
|
||||
|
||||
{{if .Data.Items}}
|
||||
<p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Muiden pisteet paljastuvat
|
||||
kun tallennat omasi.</p>
|
||||
<div class="songgrid">
|
||||
{{range .Data.Items}}{{template "songcard" .}}{{end}}
|
||||
</div>
|
||||
<p class="pager">
|
||||
{{if .Data.Cursor}}<a href="/">← Alkuun</a>{{end}}
|
||||
{{with .Data.NextCursor}}<a href="/?cursor={{.}}">Lisää →</a>{{end}}
|
||||
</p>
|
||||
{{else}}
|
||||
<p class="empty">Kaikki kuunneltu.</p>
|
||||
<p>Olet arvostellut kaiken, mitä muut ovat lähettäneet.
|
||||
<a href="/submit">Lähetä kappale</a> tai lue <a href="/songs">mitä muut sanoivat</a>.</p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{define "content"}}
|
||||
<h1>Liity</h1>
|
||||
|
||||
<form method="post" action="/register" class="stack">
|
||||
<label>Kutsukoodi
|
||||
<input name="code" value="{{.Data.Code}}" required>
|
||||
{{with .Data.Errors.code}}<span class="error">{{.}}</span>{{end}}
|
||||
</label>
|
||||
<label>Nimi
|
||||
<input name="name" value="{{.Data.Name}}" required maxlength="50">
|
||||
{{with .Data.Errors.name}}<span class="error">{{.}}</span>{{end}}
|
||||
</label>
|
||||
<label>Sähköposti
|
||||
<input type="email" name="email" value="{{.Data.Email}}" required autocomplete="email">
|
||||
{{with .Data.Errors.email}}<span class="error">{{.}}</span>{{end}}
|
||||
</label>
|
||||
<label>Salasana
|
||||
<input type="password" name="password" required autocomplete="new-password">
|
||||
{{with .Data.Errors.password}}<span class="error">{{.}}</span>{{end}}
|
||||
</label>
|
||||
<button type="submit">Liity</button>
|
||||
</form>
|
||||
|
||||
<p class="muted">Sähköpostiosoite on kirjautumistunnuksesi. Levyraati ei lähetä sähköpostia.</p>
|
||||
{{end}}
|
||||
@@ -0,0 +1,29 @@
|
||||
{{define "content"}}
|
||||
<h1>Palaute</h1>
|
||||
<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Yksi virke riittää.</p>
|
||||
|
||||
<form method="post" action="/report" class="stack">
|
||||
<input type="hidden" name="from" value="{{.Data.From}}">
|
||||
<label>Palaute
|
||||
<textarea name="body" rows="6" maxlength="2000" required autofocus
|
||||
placeholder="Esim. soittimeen kaipaisi kelausta."></textarea>
|
||||
</label>
|
||||
<button type="submit">Lähetä palaute</button>
|
||||
</form>
|
||||
<p class="muted small">Lähetämme mukaan sivun, jolla olit ({{.Data.From}}), sekä selaimen tiedot.</p>
|
||||
|
||||
{{with .Data.Mine}}
|
||||
<section>
|
||||
<h2>Omat palautteet</h2>
|
||||
{{range .}}
|
||||
<article class="review{{if .Open}} own{{end}}">
|
||||
<header>
|
||||
<span class="badge {{if .Open}}pending{{else}}reviewed{{end}}">{{if .Open}}avoin{{else}}käsitelty{{end}}</span>
|
||||
<span class="meta">{{fidate .CreatedAt}}{{if .Page}} · {{.Page}}{{end}}</span>
|
||||
</header>
|
||||
<p>{{.Body}}</p>
|
||||
</article>
|
||||
{{end}}
|
||||
</section>
|
||||
{{end}}
|
||||
{{end}}
|
||||
@@ -0,0 +1,180 @@
|
||||
{{define "content"}}
|
||||
{{$s := .Data}}
|
||||
<h1>{{$s.Title}}</h1>
|
||||
<p class="by">{{$s.Artist}}</p>
|
||||
|
||||
<!-- Four different kinds of fact, so four labelled cells rather than one run of text. "Oma
|
||||
kappale" belongs here as the submitter, not as a badge: it is a fact about you. -->
|
||||
<dl class="spec">
|
||||
<div><dt>Genre</dt><dd>{{$s.GenreLabel}}</dd></div>
|
||||
<div><dt>Kesto</dt><dd>{{$s.Length}}</dd></div>
|
||||
<div><dt>Lähetti</dt>
|
||||
<dd>{{if $s.Own}}sinä{{else}}<a href="/profile/{{$s.SubmitterID}}">{{$s.Submitter}}</a>{{end}}</dd>
|
||||
</div>
|
||||
<div><dt>Julkaistu</dt><dd>{{fiday $s.CreatedAt}}</dd></div>
|
||||
</dl>
|
||||
|
||||
{{if $s.CanEdit}}
|
||||
<details class="editbox">
|
||||
<summary>Muokkaa tietoja</summary>
|
||||
<form method="post" action="/songs/{{$s.ID}}" class="stack">
|
||||
<label>Nimi <input name="title" value="{{$s.Title}}" maxlength="100" required></label>
|
||||
<label>Esittäjä <input name="artist" value="{{$s.Artist}}" maxlength="100" required></label>
|
||||
<label>Genre
|
||||
<select name="genre" required>
|
||||
{{$current := $s.Genre}}
|
||||
{{range $s.Genres}}
|
||||
<option value="{{.Code}}" {{if eq .Code $current}}selected{{end}}>{{.Label}}</option>
|
||||
{{end}}
|
||||
</select>
|
||||
</label>
|
||||
<label>Esittely <textarea name="description" rows="4" maxlength="2000">{{$s.Description}}</textarea></label>
|
||||
<button type="submit">Tallenna</button>
|
||||
</form>
|
||||
<form method="post" action="/songs/{{$s.ID}}/delete"
|
||||
onsubmit="return confirm('Poistetaanko kappale lopullisesti?')">
|
||||
<button type="submit" class="ghost danger">Poista kappale</button>
|
||||
</form>
|
||||
<p class="muted small">Muokkaus ja poisto ovat mahdollisia vain ennen ensimmäistä arvostelua.</p>
|
||||
</details>
|
||||
{{else if $s.Own}}
|
||||
<p class="muted small">Kappaletta on jo arvosteltu, joten tietoja ei voi enää muuttaa.</p>
|
||||
{{end}}
|
||||
|
||||
{{if $s.CanReview}}
|
||||
<!-- The channel strip: the fader is the score, the panel beside it is everything else you do
|
||||
while the track plays. -->
|
||||
<form method="post" action="/songs/{{$s.ID}}/review" class="strip">
|
||||
{{template "fader" 50}}
|
||||
<div class="deck">
|
||||
{{template "player" $s}}
|
||||
{{with $s.Description}}<p class="intro">{{.}}</p>{{end}}
|
||||
|
||||
<!-- Two panes when the song has lyrics: read on the left, write on the right, so following
|
||||
the words costs no scrolling. Without lyrics the pane is absent, not empty. -->
|
||||
<div class="panes{{if not $s.Lyrics}} solo{{end}}">
|
||||
{{if $s.Lyrics}}
|
||||
<div class="lyricspane">{{template "lyricsview" $s}}</div>
|
||||
{{end}}
|
||||
<div class="writepane">
|
||||
<label class="grow">Arvostelu
|
||||
<textarea name="text" maxlength="5000" required placeholder="Mitä kuulit?"></textarea>
|
||||
</label>
|
||||
<div class="deckfoot">
|
||||
<button type="submit">Tallenna arvostelu</button>
|
||||
<span class="muted small">Muiden pisteet paljastuvat kun tallennat omasi. Voit muokata
|
||||
tai poistaa arvostelusi 30 minuutin ajan.</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
{{else}}
|
||||
{{template "player" $s}}
|
||||
{{with $s.Description}}<p class="intro">{{.}}</p>{{end}}
|
||||
{{end}}
|
||||
|
||||
{{/* New tab: leaving the page mid-review would lose whatever is already typed in the form. */}}
|
||||
{{with $s.SourceURL}}<p class="muted small"><a href="{{.}}" target="_blank" rel="noreferrer">Kuuntele YouTubessa</a></p>{{end}}
|
||||
|
||||
{{if and (not $s.CanReview) (or $s.Lyrics $s.Own)}}
|
||||
<!-- Only when the review strip is not already showing them: while reviewing, the lyrics live in
|
||||
the left pane. This panel is for reading afterwards and for the submitter's edits. -->
|
||||
<details class="lyrics">
|
||||
<summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">(ei vielä lisätty)</span>{{end}}</summary>
|
||||
{{if $s.Lyrics}}<pre class="lyricstext">{{lyricstext $s.Lyrics}}</pre>{{end}}
|
||||
{{if $s.Own}}
|
||||
<form method="post" action="/songs/{{$s.ID}}/lyrics" class="stack">
|
||||
<label>Muokkaa sanoituksia
|
||||
<textarea name="lyrics" rows="10" maxlength="20000"
|
||||
placeholder="Liitä sanoitukset tähän.">{{$s.Lyrics}}</textarea>
|
||||
</label>
|
||||
<button type="submit">Tallenna sanoitukset</button>
|
||||
</form>
|
||||
<p class="muted small">Sanoituksia voi muokata vielä arvostelujenkin jälkeen.</p>
|
||||
{{end}}
|
||||
</details>
|
||||
{{end}}
|
||||
|
||||
{{if $s.ViewerReview}}
|
||||
<section>
|
||||
<h2>Oma arvostelusi</h2>
|
||||
{{with $s.ViewerReview}}
|
||||
{{if .CanEdit}}
|
||||
<form method="post" action="/reviews/{{.ID}}" class="strip">
|
||||
<input type="hidden" name="from" value="/songs/{{$s.ID}}">
|
||||
{{template "fader" .Score}}
|
||||
<div class="deck">
|
||||
<label class="grow">Arvostelu
|
||||
<textarea name="text" rows="6" maxlength="5000" required>{{.Text}}</textarea>
|
||||
</label>
|
||||
<div class="deckfoot">
|
||||
<button type="submit">Päivitä</button>
|
||||
<span class="muted small">Muokkausaika päättyy {{fidate .EditableUntil}}.</span>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
<form method="post" action="/reviews/{{.ID}}/delete"
|
||||
onsubmit="return confirm('Poistetaanko arvostelu?')">
|
||||
<input type="hidden" name="from" value="/songs/{{$s.ID}}">
|
||||
<button type="submit" class="ghost danger">Poista arvostelu</button>
|
||||
</form>
|
||||
{{else}}
|
||||
<p class="score">{{.Score}}</p>
|
||||
<p class="reviewtext">{{.Text}}</p>
|
||||
<p class="muted small">Muokkausaika on päättynyt.</p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
</section>
|
||||
{{end}}
|
||||
|
||||
<section>
|
||||
<h2>Arvostelut{{if $s.ReviewCount}} ({{$s.ReviewCount}}){{end}}</h2>
|
||||
|
||||
{{if $s.Revealed}}
|
||||
{{if $s.Reviews}}
|
||||
<!-- One channel per reviewer: the spread across the row is what "divisive" looks like. -->
|
||||
<div class="channels">
|
||||
{{range $i, $r := $s.Reviews}}
|
||||
<div class="chan{{if $r.Own}} own{{end}}" style="--v: {{$r.Score}}; --i: {{$i}}">
|
||||
<span class="chan-track"><span class="chan-cap"></span></span>
|
||||
<span class="chan-score">{{$r.Score}}</span>
|
||||
<span class="chan-who" title="{{$r.Reviewer}}">{{$r.Initials}}</span>
|
||||
</div>
|
||||
{{end}}
|
||||
{{if $s.Average}}
|
||||
<div class="chan avg" style="--v: {{score $s.Average}}">
|
||||
<span class="chan-track"><span class="chan-cap"></span></span>
|
||||
<span class="chan-score">{{score $s.Average}}</span>
|
||||
<span class="chan-who">ka.</span>
|
||||
</div>
|
||||
{{end}}
|
||||
</div>
|
||||
|
||||
{{range $s.Reviews}}
|
||||
<article class="review{{if .Own}} own{{end}}">
|
||||
<header>
|
||||
<span class="avatar small">{{.Initials}}</span>
|
||||
<span class="who">{{.Reviewer}}</span>
|
||||
<span class="score">{{.Score}}</span>
|
||||
<span class="meta">{{fidate .CreatedAt}}</span>
|
||||
</header>
|
||||
<p>{{.Text}}</p>
|
||||
</article>
|
||||
{{end}}
|
||||
{{else}}
|
||||
<p class="muted">Kukaan ei ole vielä arvostellut tätä kappaletta.</p>
|
||||
{{end}}
|
||||
{{else}}
|
||||
<p class="sealed-note">
|
||||
<span class="sealed" aria-hidden="true"></span>
|
||||
Muiden pisteet paljastuvat kun tallennat omasi.
|
||||
{{if $s.ReviewCount}}Arvosteluja on {{$s.ReviewCount}}.{{end}}
|
||||
</p>
|
||||
{{end}}
|
||||
</section>
|
||||
|
||||
{{if $s.NextInQueue}}
|
||||
<p class="nextup"><a href="/songs/{{$s.NextInQueue}}">Seuraava jonossa →</a></p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{define "content"}}
|
||||
<h1>Kappaleet</h1>
|
||||
|
||||
{{if .Data.Items}}
|
||||
<div class="songgrid">
|
||||
{{range .Data.Items}}{{template "songcard" .}}{{end}}
|
||||
</div>
|
||||
<p class="pager">
|
||||
{{if .Data.Cursor}}<a href="/songs">← Uusimmat</a>{{end}}
|
||||
{{with .Data.NextCursor}}<a href="/songs?cursor={{.}}">Vanhempia →</a>{{end}}
|
||||
</p>
|
||||
{{else}}
|
||||
<p class="empty">Yhtään kappaletta ei ole vielä julkaistu.</p>
|
||||
<p><a href="/submit">Lähetä ensimmäinen</a>.</p>
|
||||
{{end}}
|
||||
{{end}}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{define "songboard"}}
|
||||
<section class="board">
|
||||
<h2>{{.Title}}</h2>
|
||||
{{if .Items}}
|
||||
<ol class="board-list">
|
||||
{{range .Items}}
|
||||
<li>
|
||||
<a href="/songs/{{.ID}}">{{.Title}}</a>
|
||||
<span class="muted small">{{.Artist}}</span>
|
||||
<span class="value">{{if $.Count}}{{.ReviewCount}}{{else}}{{value .Value}}{{end}}</span>
|
||||
{{if not $.Count}}<span class="muted small">{{.ReviewCount}} arv.</span>{{end}}
|
||||
{{if $.Spread}}
|
||||
<!-- Where the scores actually landed: a range says more than a deviation. -->
|
||||
<span class="bar range" title="{{.Min}}–{{.Max}}">
|
||||
<span class="fill" style="left: {{.MinPct}}%; width: {{.SpanPct}}%"></span>
|
||||
</span>
|
||||
{{else if not $.Count}}
|
||||
<span class="bar"><span class="fill" style="width: {{.Pct}}%"></span></span>
|
||||
{{end}}
|
||||
</li>
|
||||
{{end}}
|
||||
</ol>
|
||||
{{else}}
|
||||
<p class="muted small">Ei vielä tarpeeksi arvosteluja.</p>
|
||||
{{end}}
|
||||
</section>
|
||||
{{end}}
|
||||
|
||||
{{define "userboard"}}
|
||||
<section class="board">
|
||||
<h2>{{.Title}}</h2>
|
||||
{{if .Items}}
|
||||
<ol class="board-list">
|
||||
{{range .Items}}
|
||||
<li>
|
||||
<a href="/profile/{{.ID}}">{{.Name}}</a>
|
||||
<span class="value">{{if $.Count}}{{.Count}}{{else}}{{value .Value}}{{end}}</span>
|
||||
{{if not $.Count}}<span class="muted small">{{.Count}} kpl</span>{{end}}
|
||||
{{if not $.Count}}<span class="bar"><span class="fill" style="width: {{value .Value}}%"></span></span>{{end}}
|
||||
</li>
|
||||
{{end}}
|
||||
</ol>
|
||||
{{else}}
|
||||
<p class="muted small">Ei vielä tarpeeksi arvosteluja.</p>
|
||||
{{end}}
|
||||
</section>
|
||||
{{end}}
|
||||
|
||||
{{define "content"}}
|
||||
<h1>Tilastot</h1>
|
||||
<p class="muted">Kappale pääsee listoille kun sillä on vähintään {{.Data.MinReviews}} arvostelua.
|
||||
Tilastot näkyvät kaikille.</p>
|
||||
|
||||
<div class="boards">
|
||||
{{template "songboard" dict "Title" "Parhaat" "Items" .Data.TopSongs}}
|
||||
{{template "songboard" dict "Title" "Heikoimmat" "Items" .Data.BottomSongs}}
|
||||
{{template "songboard" dict "Title" "Riitaisimmat" "Items" .Data.MostDivisive "Spread" true}}
|
||||
{{template "songboard" dict "Title" "Yksimielisimmät" "Items" .Data.MostUnified "Spread" true}}
|
||||
{{template "songboard" dict "Title" "Eniten arvosteltu" "Items" .Data.MostReviewed "Count" true}}
|
||||
{{template "userboard" dict "Title" "Ankarin arvostelija" "Items" .Data.Harshest}}
|
||||
{{template "userboard" dict "Title" "Anteliain" "Items" .Data.MostGenerous}}
|
||||
{{template "userboard" dict "Title" "Ahkerin arvostelija" "Items" .Data.MostActive "Count" true}}
|
||||
{{template "userboard" dict "Title" "Ahkerin lähettäjä" "Items" .Data.MostProlific "Count" true}}
|
||||
</div>
|
||||
{{end}}
|
||||
@@ -0,0 +1,91 @@
|
||||
{{define "submission-status"}}
|
||||
<div class="status{{if .Failed}} failed{{end}}" {{if not .Done}}hx-get="/submit/{{.ID}}/status" hx-trigger="every 2s" hx-swap="outerHTML"{{end}}>
|
||||
<ol class="segments" aria-label="Lähetyksen tila">
|
||||
<li class="{{if .Done}}done{{else}}now{{end}}">Lähetetty</li>
|
||||
<li class="{{if .Done}}done{{else if eq .Status "converting"}}now{{else if eq .Status "downloading"}}now{{end}}">
|
||||
{{if eq .Status "downloading"}}Ladataan{{else}}Muunnetaan{{end}}</li>
|
||||
<li class="{{if .Ready}}done{{else if .Failed}}failed{{end}}">{{if .Failed}}Epäonnistui{{else}}Valmis{{end}}</li>
|
||||
</ol>
|
||||
<p class="{{if .Failed}}error{{end}}"><strong>{{.Label}}</strong></p>
|
||||
{{if .Failed}}
|
||||
{{with .StatusMsg}}<p class="muted small">{{.}}</p>{{end}}
|
||||
<div class="actions">
|
||||
{{if .CanRetry}}
|
||||
<form method="post" action="/submit/{{.ID}}/retry">
|
||||
<button type="submit">Yritä uudelleen</button>
|
||||
</form>
|
||||
{{end}}
|
||||
<form method="post" action="/submit/{{.ID}}/discard">
|
||||
<button type="submit" class="danger">Poista lähetys</button>
|
||||
</form>
|
||||
</div>
|
||||
{{if not .CanRetry}}<p class="muted small">Lataa tiedosto uudelleen, jos haluat yrittää toisen kerran.</p>{{end}}
|
||||
{{else}}
|
||||
<!-- Outside the form and attached to it with form=, so one button both submits the metadata
|
||||
and publishes. Disabled until the audio has finished converting. -->
|
||||
<button type="submit" form="meta" {{if not .Ready}}disabled{{end}}>Julkaise</button>
|
||||
{{if not .Ready}}<p class="muted small">Julkaise aukeaa kun lähetys on valmis.</p>{{end}}
|
||||
{{end}}
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "saved"}}<span id="saved" class="saved">{{if .}}Tallennettu {{.}}{{end}}</span>{{end}}
|
||||
|
||||
<!-- Included by the page and returned alone by the suggestion button, so the markup exists once.
|
||||
hx-include sends the current title and artist, which is the whole point: the lookup uses what
|
||||
the submitter just fixed, not what the tags claimed. -->
|
||||
{{define "lyricsfield"}}
|
||||
<div id="lyricsfield">
|
||||
<label>Sanoitukset <span class="muted small">(vapaaehtoinen)</span>
|
||||
<textarea name="lyrics" rows="8" maxlength="20000"
|
||||
placeholder="Liitä sanoitukset tähän tai hae ne alta.">{{.Lyrics}}</textarea>
|
||||
</label>
|
||||
<div class="lyricsbar">
|
||||
<button type="button" class="ghost"
|
||||
hx-post="/submit/{{.ID}}/lyrics"
|
||||
hx-include="[name='title'], [name='artist']"
|
||||
hx-target="#lyricsfield" hx-swap="outerHTML">Hae sanoitukset</button>
|
||||
{{if .Found}}<span class="muted small">Löytyi. Tarkista teksti.</span>{{end}}
|
||||
{{if .Searched}}{{if not .Found}}
|
||||
<span class="muted small">Ei löytynyt. Tarkista nimi ja esittäjä tai liitä sanoitukset itse.</span>
|
||||
{{end}}{{end}}
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "content"}}
|
||||
<h1>Lähetys</h1>
|
||||
|
||||
{{if .Data.Failed}}{{template "submission-status" .Data}}{{end}}
|
||||
|
||||
{{if not .Data.Failed}}
|
||||
<form id="meta" method="post" action="/submit/{{.Data.ID}}/publish" class="stack"
|
||||
hx-post="/submit/{{.Data.ID}}" hx-trigger="input changed delay:1.2s, change"
|
||||
hx-target="#saved" hx-swap="outerHTML">
|
||||
<label>Kappaleen nimi
|
||||
<input name="title" value="{{.Data.Title}}" maxlength="100" required>
|
||||
</label>
|
||||
<label>Esittäjä
|
||||
<input name="artist" value="{{.Data.Artist}}" maxlength="100" required>
|
||||
</label>
|
||||
<label>Genre
|
||||
<select name="genre" required>
|
||||
<option value="">— valitse —</option>
|
||||
{{$current := .Data.Genre}}
|
||||
{{range .Data.Genres}}
|
||||
<option value="{{.Code}}" {{if eq .Code $current}}selected{{end}}>{{.Label}}</option>
|
||||
{{end}}
|
||||
</select>
|
||||
</label>
|
||||
<label>Esittely <span class="muted small">(vapaaehtoinen)</span>
|
||||
<textarea name="description" rows="5" maxlength="2000">{{.Data.Description}}</textarea>
|
||||
</label>
|
||||
{{template "lyricsfield" dict "ID" .Data.ID "Lyrics" .Data.Lyrics}}
|
||||
{{template "saved" ""}}
|
||||
</form>
|
||||
|
||||
<p class="muted">Nimi, esittäjä ja genre tarvitaan ennen julkaisua.</p>
|
||||
|
||||
{{template "submission-status" .Data}}
|
||||
{{end}}
|
||||
{{end}}
|
||||
@@ -0,0 +1,68 @@
|
||||
{{define "content"}}
|
||||
<h1>Lähetä kappale</h1>
|
||||
|
||||
{{with .Data.Error}}<p class="error">{{.}}</p>{{end}}
|
||||
|
||||
<form method="post" action="/submit" enctype="multipart/form-data" class="stack">
|
||||
<label class="dropzone" id="dropzone" for="audio">
|
||||
<input type="file" id="audio" name="audio" accept="audio/*">
|
||||
<span class="dz-title">Raahaa äänitiedosto tähän</span>
|
||||
<span class="muted small">tai valitse napsauttamalla</span>
|
||||
<span class="filename" id="filename"></span>
|
||||
</label>
|
||||
<p class="or">tai</p>
|
||||
<label>YouTube-linkki
|
||||
<input type="url" name="url" placeholder="https://www.youtube.com/watch?v=…">
|
||||
</label>
|
||||
<button type="submit">Lähetä</button>
|
||||
</form>
|
||||
|
||||
{{with .Data.Submissions}}
|
||||
<section>
|
||||
<h2>Omat lähetykset</h2>
|
||||
<table>
|
||||
<thead><tr><th>Kappale</th><th>Tila</th><th>Lähetetty</th></tr></thead>
|
||||
<tbody>
|
||||
{{range .}}
|
||||
<tr>
|
||||
<td><a href="/submit/{{.ID}}">{{if .Title}}{{.Title}}{{else}}(nimetön){{end}}</a></td>
|
||||
<td>{{.Label}}</td>
|
||||
<td class="nowrap">{{fidate .CreatedAt}}</td>
|
||||
</tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
{{end}}
|
||||
|
||||
<p class="muted">Enintään 50 MB ja 15 minuuttia.</p>
|
||||
|
||||
<script>
|
||||
// The native control can't be relabelled or styled, so it is hidden behind this one — which
|
||||
// still is the input, so keyboard focus and form submission work untouched.
|
||||
(function () {
|
||||
const zone = document.getElementById('dropzone')
|
||||
const input = document.getElementById('audio')
|
||||
const name = document.getElementById('filename')
|
||||
|
||||
const show = () => {
|
||||
name.textContent = input.files.length ? input.files[0].name : ''
|
||||
zone.classList.toggle('has-file', input.files.length > 0)
|
||||
}
|
||||
input.addEventListener('change', show)
|
||||
|
||||
for (const type of ['dragenter', 'dragover']) {
|
||||
zone.addEventListener(type, e => { e.preventDefault(); zone.classList.add('over') })
|
||||
}
|
||||
for (const type of ['dragleave', 'dragend', 'drop']) {
|
||||
zone.addEventListener(type, e => { e.preventDefault(); zone.classList.remove('over') })
|
||||
}
|
||||
zone.addEventListener('drop', e => {
|
||||
if (e.dataTransfer.files.length) {
|
||||
input.files = e.dataTransfer.files
|
||||
show()
|
||||
}
|
||||
})
|
||||
})()
|
||||
</script>
|
||||
{{end}}
|
||||
Vendored
+1
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user