Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Esa Kataja
|
0f15ae0bfc | ||
|
Esa Kataja
|
400b5d3833 | ||
|
Esa Kataja
|
1b3bbbbd7b |
@@ -1,9 +0,0 @@
|
||||
# The build needs the source and nothing else. storage/ holds the live database and audio, .env
|
||||
# holds the admin password, and pgdata is a leftover from the Postgres era that the build cannot
|
||||
# even read.
|
||||
.git
|
||||
.env
|
||||
storage/
|
||||
pgdata/
|
||||
levyraati
|
||||
levyraati26-go
|
||||
+3
-11
@@ -1,18 +1,10 @@
|
||||
# Copy to .env and edit.
|
||||
|
||||
# The first account. Only read when the database has no users: the app creates that account,
|
||||
# marks it admin, and ignores these afterwards. Everyone else joins by invite.
|
||||
ADMIN_EMAIL=
|
||||
# Copy to .env and edit. The admin password has no default.
|
||||
ADMIN_USER=admin
|
||||
ADMIN_PASSWORD=
|
||||
ADMIN_NAME=Ylläpito
|
||||
|
||||
# Set to false only for local development over plain HTTP.
|
||||
SECURE_COOKIES=true
|
||||
|
||||
# debug, info, warn or error. debug adds the per-request noise; failures are logged at error
|
||||
# regardless, with the same code the submitter is shown.
|
||||
LOG_LEVEL=info
|
||||
|
||||
# Public address of the site. Used to build pasteable invite links on the admin page.
|
||||
# Public address of the member site. Used to build pasteable invite links in the admin panel.
|
||||
# Unset falls back to a relative link, which is fine locally.
|
||||
PUBLIC_URL=https://levyraati.example.com
|
||||
|
||||
+3
-3
@@ -13,9 +13,9 @@ A person with an account. Every account is a member; there is no other kind.
|
||||
_Avoid_: user, käyttäjä, account
|
||||
|
||||
**Admin** — _ylläpitäjä_:
|
||||
A member who also operates the installation. The same account, the same session, one extra flag —
|
||||
so an admin submits and reviews like anyone else and does appear in lists of people.
|
||||
_Avoid_: superuser, role, admin account (there is no separate account)
|
||||
The operator of the installation. Not a member and not an account — a set of credentials on a
|
||||
separate surface. Never submits, reviews, or appears in any list of people.
|
||||
_Avoid_: admin user, superuser, role
|
||||
|
||||
**Invite** — _kutsu_ / **invite code** — _kutsukoodi_:
|
||||
A one-time code that permits one registration. Spent only by a registration that succeeds.
|
||||
|
||||
+2
-2
@@ -1,11 +1,11 @@
|
||||
FROM golang:1.27-alpine AS build
|
||||
FROM golang:1.26-alpine AS build
|
||||
# CalVer, injected at build so no file needs bumping by hand: docker build --build-arg VERSION=…
|
||||
ARG VERSION=dev
|
||||
WORKDIR /src
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati ./src
|
||||
RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati .
|
||||
|
||||
FROM alpine:3.24
|
||||
# yt-dlp rots against YouTube. Alpine's active branch tracks it closely (3.24 carries the current
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
# `make` is everything that has to pass before a commit. The rest are the workflows that were
|
||||
# otherwise copy-pasted out of README.md and docs/deployment.md.
|
||||
#
|
||||
# gofmt needs a wrapper because it reports offending files on stdout and still exits 0.
|
||||
.PHONY: check fmt vet test fix build run image db backup clean
|
||||
|
||||
# Overridable, so a target never bakes in one person's environment.
|
||||
BIN ?= levyraati26-go
|
||||
ADDR ?= 127.0.0.1:8080
|
||||
STORAGE ?= ./storage
|
||||
|
||||
check: fmt vet test
|
||||
|
||||
fmt:
|
||||
@out=$$(gofmt -l .); test -z "$$out" || { echo "not gofmt'd:"; echo "$$out"; exit 1; }
|
||||
|
||||
vet:
|
||||
go vet ./...
|
||||
|
||||
test:
|
||||
go test ./...
|
||||
|
||||
# Suggestions only. go fix rewrites files in place without -diff, and it is not always right —
|
||||
# read the hunks before applying any of them.
|
||||
fix:
|
||||
@go fix -diff ./... || true
|
||||
|
||||
# -o is required, not stylistic: the package lives in ./src, and without it `go build` would try to
|
||||
# write a binary named "src" over the directory.
|
||||
build:
|
||||
go build -o $(BIN) ./src
|
||||
|
||||
# Templates, static files and migrations are embedded, so seeing a change means rebuilding.
|
||||
# The admin credentials seed the first account on an empty database and are ignored after that.
|
||||
run: build
|
||||
ADMIN_EMAIL=$${ADMIN_EMAIL:[email protected]} \
|
||||
ADMIN_PASSWORD=$${ADMIN_PASSWORD:-dev} \
|
||||
SECURE_COOKIES=false STORAGE_DIR=$(STORAGE) ADDR=$(ADDR) ./$(BIN)
|
||||
|
||||
# A release image. VERSION comes from the tag, because that is the only way it reaches the binary
|
||||
# and /healthz must not claim a version that was never tagged. IMAGE names the registry and stays
|
||||
# out of this file: pass it in, or put it in the .env this reads nothing from.
|
||||
#
|
||||
# make image IMAGE=registry.example.com/owner/levyraati26-go
|
||||
image:
|
||||
@test -n "$(IMAGE)" || { echo "set IMAGE, e.g. make image IMAGE=registry.example.com/owner/levyraati26-go"; exit 1; }
|
||||
@v=$$(git describe --tags --exact-match 2>/dev/null) || { echo "HEAD is not tagged; tag the release first"; exit 1; }; \
|
||||
podman build --build-arg VERSION=$$v -t $(IMAGE):$$v -t $(IMAGE):latest . && \
|
||||
echo "built $(IMAGE):$$v — push with: podman push $(IMAGE):$$v"
|
||||
|
||||
# Operations against the running container, straight out of docs/deployment.md.
|
||||
db:
|
||||
docker compose exec app sqlite3 /storage/levyraati.db
|
||||
|
||||
# Copying the file while the app runs is not a backup: WAL keeps recent writes in a sidecar.
|
||||
backup:
|
||||
docker compose exec app sqlite3 /storage/levyraati.db ".backup '/storage/tmp/backup.db'"
|
||||
gzip -c $(STORAGE)/tmp/backup.db > backup-$$(date +%F).db.gz
|
||||
rm $(STORAGE)/tmp/backup.db
|
||||
@echo "wrote backup-$$(date +%F).db.gz"
|
||||
|
||||
clean:
|
||||
rm -f $(BIN)
|
||||
@@ -18,7 +18,6 @@ Invite-only, no public registration. Built for about ten friends.
|
||||
| [docs/decisions.md](docs/decisions.md) | Why it is that way. Append-only |
|
||||
| [docs/theme.md](docs/theme.md) | The visual language: tokens, type, and what differs from the theme handoff |
|
||||
| [docs/later.md](docs/later.md) | Deliberately not in v1, with the reasoning kept |
|
||||
| [docs/deployment.md](docs/deployment.md) | Running it on a server: the compose file, releases, upgrades, backups |
|
||||
|
||||
## Branches and releases
|
||||
|
||||
@@ -56,67 +55,60 @@ build stays `CGO_ENABLED=0`. No Node, no npm, no bundler.
|
||||
## Running it
|
||||
|
||||
```sh
|
||||
cp .env.example .env # then edit — set ADMIN_EMAIL and ADMIN_PASSWORD before the first start
|
||||
cp .env.example .env # then edit — ADMIN_PASSWORD has no default and the app won't start without it
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
Migrations apply themselves at startup, before the server accepts connections. On an empty database
|
||||
the first launch creates one account from `ADMIN_EMAIL` / `ADMIN_PASSWORD` and marks it admin; log
|
||||
in as that account and mint invites for everyone else. The two variables are read only while the
|
||||
`users` table is empty, so once that account exists they do nothing and can leave the environment.
|
||||
Migrations apply themselves at startup, before the server accepts connections. The first launch
|
||||
creates no users: log into the admin panel and mint an invite.
|
||||
|
||||
### Configuration
|
||||
|
||||
| Variable | Default | Notes |
|
||||
|---|---|---|
|
||||
| `DB_PATH` | `$STORAGE_DIR/levyraati.db` | The SQLite file. Created on first start |
|
||||
| `ADMIN_EMAIL` | — | Login address of the first account. Required on an empty database, ignored afterwards |
|
||||
| `ADMIN_PASSWORD` | — | Password for that account. Required on an empty database, ignored afterwards |
|
||||
| `ADMIN_NAME` | `Ylläpito` | Display name for that account |
|
||||
| `ADDR` | `:8080` | The only listener |
|
||||
| `ADMIN_USER` | `admin` | Admin panel username |
|
||||
| `ADMIN_PASSWORD` | — | **Required.** No default; the app refuses to start without it |
|
||||
| `ADDR` | `:8080` | Member-facing listener |
|
||||
| `ADMIN_ADDR` | `127.0.0.1:8081` | Admin listener. Keep it on loopback. Under Compose it binds `:8081` inside the container and is published only to the host's loopback |
|
||||
| `STORAGE_DIR` | `./storage` | Audio, avatars, in-flight conversions |
|
||||
| `SECURE_COOKIES` | `true` | Set `false` for local development over plain HTTP |
|
||||
| `LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error`. An unparseable value falls back to `info` |
|
||||
| `PUBLIC_URL` | — | Public address of the site, e.g. `https://levyraati.example.com`. Used to build invite links on the admin page; unset gives relative links |
|
||||
| `PUBLIC_URL` | — | Public address of the member site, e.g. `https://levyraati.example.com`. Used to build invite links in the admin panel; unset gives relative links |
|
||||
|
||||
### Local development
|
||||
|
||||
```sh
|
||||
export ADMIN_EMAIL=[email protected] ADMIN_PASSWORD=dev SECURE_COOKIES=false
|
||||
go run ./src
|
||||
export ADMIN_PASSWORD=dev SECURE_COOKIES=false
|
||||
go run .
|
||||
```
|
||||
|
||||
The package lives in `src/`, together with the `templates/`, `static/` and `migrations/` it embeds —
|
||||
`//go:embed` cannot reach outside its own directory, so the assets live beside the code that reads
|
||||
them. `storage/` stays at the root, since it is runtime data rather than source.
|
||||
|
||||
Requires Go 1.27+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
|
||||
Requires Go 1.25+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
|
||||
the database is a file under `./storage`, created on the first run.
|
||||
|
||||
Tests get a fresh database file in a temp directory each, so they need no setup and touch nothing.
|
||||
`make` is everything that has to pass before a commit — formatting, `go vet`, and the tests:
|
||||
Tests get a fresh database file in a temp directory each, so they need no setup and touch nothing:
|
||||
|
||||
```sh
|
||||
make # gofmt -l, go vet, go test
|
||||
make test # just the tests
|
||||
go test ./...
|
||||
```
|
||||
|
||||
Templates, stylesheet, and migrations are embedded with `embed.FS`, so a rebuild is needed to see
|
||||
template changes. `make run` is the loop.
|
||||
template changes. `go build && ./levyraati` is the loop.
|
||||
|
||||
## Admin page
|
||||
## Admin panel
|
||||
|
||||
An admin is **an ordinary member with `is_admin` set** — the same account, the same login, the same
|
||||
session cookie. Admins submit and review like anyone else; the flag adds a Ylläpito link to the nav
|
||||
and unlocks `/admin` on the normal listener. A signed-in member without the flag gets a 404 there.
|
||||
The admin is **not a user account**. It exists only as `ADMIN_USER` / `ADMIN_PASSWORD`, authenticates
|
||||
with HTTP Basic Auth, and is bound to loopback so it is not reachable from the internet. Reach it
|
||||
through an SSH tunnel:
|
||||
|
||||
From `/admin`: mint invites, reset member passwords, ban members, delete songs, read issue reports.
|
||||
```sh
|
||||
ssh -L 8081:127.0.0.1:8081 you@server
|
||||
# then open http://localhost:8081
|
||||
```
|
||||
|
||||
An admin cannot ban themselves, since banning drops every session for the target and nothing would
|
||||
be left to undo it.
|
||||
From there: mint invites, reset member passwords, ban members, delete songs, read issue reports.
|
||||
|
||||
**Lost the admin password?** There is no recovery endpoint and no recovery key. Reset the hash
|
||||
directly in the SQLite file, the same as for any locked-out member.
|
||||
**Lost the admin password?** Edit `.env` and `docker compose restart app`. There is no recovery
|
||||
endpoint and no recovery key — the credentials are the environment.
|
||||
|
||||
## Operations
|
||||
|
||||
@@ -163,23 +155,11 @@ docker compose exec app sqlite3 /storage/levyraati.db
|
||||
|
||||
## Layout
|
||||
|
||||
`src/` is the whole program: one flat `package main`, with the assets it embeds beside it, because
|
||||
`//go:embed` cannot reach outside its own directory. `templates/` and `static/` are those assets,
|
||||
`migrations/` holds numbered `.sql` files applied in order at startup, and `testdata/` holds the
|
||||
golden JSON files that guard the API contract, plus `ytdlp-noose.json` — a real `yt-dlp -J` dump of
|
||||
an ordinary upload, used to test metadata prefill against a video that has no `track`, `artist` or
|
||||
`album` at all.
|
||||
|
||||
The root keeps what is not source: `docs/`, the container and compose files, the `Makefile`, and
|
||||
`storage/` once the app has run.
|
||||
|
||||
| Command | Does |
|
||||
|---|---|
|
||||
| `make` | gofmt, `go vet`, `go test` — everything that must pass before a commit |
|
||||
| `make run` | Build and start on `127.0.0.1:8080` with development defaults |
|
||||
| `make fix` | Show `go fix` modernizer suggestions as a diff, without applying them |
|
||||
| `make image IMAGE=…` | Build a release image tagged from `git describe`; refuses an untagged HEAD |
|
||||
| `make db` / `make backup` | SQLite shell, and a WAL-safe snapshot, against the running container |
|
||||
Go source is flat at the repository root, one package. Beyond that: `templates/` and `static/` are
|
||||
embedded assets, `migrations/` holds numbered `.sql` files applied in order at startup, and
|
||||
`testdata/` holds the golden JSON files that guard the API contract, plus `ytdlp-noose.json` — a real
|
||||
`yt-dlp -J` dump of an ordinary upload, used to test metadata prefill against a video that has no
|
||||
`track`, `artist` or `album` at all.
|
||||
|
||||
## Notes
|
||||
|
||||
|
||||
@@ -135,13 +135,6 @@ func (a *app) toggleBan(w http.ResponseWriter, r *http.Request) {
|
||||
http.Error(w, "not found", http.StatusNotFound)
|
||||
return
|
||||
}
|
||||
// Banning drops every session for the target, so an admin doing it to themselves would be
|
||||
// locked out with nothing left that could unban them. The only route back is the database.
|
||||
if me := memberFrom(r.Context()); me != nil && me.ID == id {
|
||||
a.flash(w, "Et voi estää itseäsi.")
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
var banned bool
|
||||
err = a.db.QueryRowContext(r.Context(),
|
||||
`update users set banned = not banned where id = $1 returning banned`, id).Scan(&banned)
|
||||
@@ -30,17 +30,15 @@ type member struct {
|
||||
Email string
|
||||
Avatar *string
|
||||
Banned bool
|
||||
IsAdmin bool
|
||||
CreatedAt time.Time
|
||||
}
|
||||
|
||||
// Initials for the avatar circle: no default image on disk, no identicon generator.
|
||||
func (m *member) Initials() string {
|
||||
out, n := "", 0
|
||||
out := ""
|
||||
for _, f := range strings.Fields(m.Name) {
|
||||
out += strings.ToUpper(string([]rune(f)[0]))
|
||||
// ponytail: count runes taken, not bytes — "Ä" is 2 bytes and used to end the loop early.
|
||||
if n++; n == 2 {
|
||||
if len(out) == 2 {
|
||||
break
|
||||
}
|
||||
}
|
||||
@@ -110,10 +108,10 @@ func (a *app) session(w http.ResponseWriter, r *http.Request) *member {
|
||||
)
|
||||
err := a.db.QueryRowContext(r.Context(), `
|
||||
select s.expires_at, s.idle_ttl,
|
||||
u.id, u.name, u.email, u.avatar, u.banned, u.is_admin, u.created_at
|
||||
u.id, u.name, u.email, u.avatar, u.banned, u.created_at
|
||||
from sessions s join users u on u.id = s.user_id
|
||||
where s.token = $1 and s.expires_at > datetime('now')`, tok).
|
||||
Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.IsAdmin, &m.CreatedAt)
|
||||
Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.CreatedAt)
|
||||
if err != nil {
|
||||
if !errors.Is(err, sql.ErrNoRows) {
|
||||
slog.Error("session lookup", "ctx", "auth", "error", err)
|
||||
@@ -25,22 +25,13 @@ func testApp(t *testing.T) *app {
|
||||
if err := migrate(ctx, db); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return &app{db: db}
|
||||
return &app{cfg: config{adminUser: "admin", adminPass: "s3cret"}, db: db}
|
||||
}
|
||||
|
||||
func post(t *testing.T, h http.Handler, path string, form url.Values) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
return postAs(t, h, path, form, "")
|
||||
}
|
||||
|
||||
// postAs is post with a session cookie, which is now the only way to reach an admin route.
|
||||
func postAs(t *testing.T, h http.Handler, path string, form url.Values, token string) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
r := httptest.NewRequest("POST", path, strings.NewReader(form.Encode()))
|
||||
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
if token != "" {
|
||||
r.AddCookie(&http.Cookie{Name: sessionCookie, Value: token})
|
||||
}
|
||||
w := httptest.NewRecorder()
|
||||
h.ServeHTTP(w, r)
|
||||
return w
|
||||
@@ -141,21 +132,6 @@ func (a *app) seedMember(t *testing.T, email string) int64 {
|
||||
return id
|
||||
}
|
||||
|
||||
// seedAdminMember returns an admin account and a live session token for it.
|
||||
func (a *app) seedAdminMember(t *testing.T, email string) (int64, string) {
|
||||
t.Helper()
|
||||
id := a.seedMember(t, email)
|
||||
if _, err := a.db.ExecContext(context.Background(),
|
||||
`update users set is_admin = 1 where id = $1`, id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
tok, _, err := a.startSession(context.Background(), id, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return id, tok
|
||||
}
|
||||
|
||||
func (a *app) sessionFor(t *testing.T, token string) *member {
|
||||
t.Helper()
|
||||
r := httptest.NewRequest("GET", "/", nil)
|
||||
@@ -226,8 +202,8 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
_, adminTok := a.seedAdminMember(t, "[email protected]")
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
|
||||
adminMux := a.adminMux()
|
||||
if w := post(t, adminMux, fmt.Sprintf("/admin/users/%d/ban", id), nil); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("ban: status = %d, want 303", w.Code)
|
||||
}
|
||||
|
||||
@@ -246,7 +222,7 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
|
||||
}
|
||||
|
||||
// Reversible: unban, and the same credentials work again.
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
|
||||
if w := post(t, adminMux, fmt.Sprintf("/admin/users/%d/ban", id), nil); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("unban: status = %d, want 303", w.Code)
|
||||
}
|
||||
w = post(t, mux, "/login", url.Values{"email": {"[email protected]"}, "password": {"salasana1"}})
|
||||
@@ -254,52 +230,3 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
|
||||
t.Fatalf("login after unban: status = %d, want 303", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// Self-banning drops your own sessions, and only an admin could undo it. Refuse.
|
||||
func TestAdminCannotBanSelf(t *testing.T) {
|
||||
a := testApp(t)
|
||||
mux := a.withMember(a.memberMux())
|
||||
adminID, adminTok := a.seedAdminMember(t, "[email protected]")
|
||||
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", adminID), nil, adminTok); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("self-ban: status = %d, want 303", w.Code)
|
||||
}
|
||||
var banned bool
|
||||
if err := a.db.QueryRowContext(context.Background(),
|
||||
`select banned from users where id = $1`, adminID).Scan(&banned); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if banned {
|
||||
t.Fatal("admin banned themselves")
|
||||
}
|
||||
}
|
||||
|
||||
// A signed-in member who is not an admin must not be able to ban anyone.
|
||||
func TestMemberCannotReachAdminRoutes(t *testing.T) {
|
||||
a := testApp(t)
|
||||
mux := a.withMember(a.memberMux())
|
||||
victim := a.seedMember(t, "[email protected]")
|
||||
|
||||
plain := a.seedMember(t, "[email protected]")
|
||||
tok, _, err := a.startSession(context.Background(), plain, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", victim), nil, tok); w.Code != http.StatusNotFound {
|
||||
t.Fatalf("member ban: status = %d, want 404", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInitials(t *testing.T) {
|
||||
for name, want := range map[string]string{
|
||||
"Esa Kataja": "EK",
|
||||
"Ärväs Öhman": "ÄÖ", // multi-byte initials must not end the loop early
|
||||
"Åke": "Å",
|
||||
"": "",
|
||||
"a b c": "AB",
|
||||
} {
|
||||
if got := (&member{Name: name}).Initials(); got != want {
|
||||
t.Errorf("Initials(%q) = %q, want %q", name, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
+6
-5
@@ -5,17 +5,18 @@ services:
|
||||
args:
|
||||
VERSION: ${VERSION:-dev}
|
||||
environment:
|
||||
# Only used to create the first account on an empty database; inert after that.
|
||||
ADMIN_EMAIL: ${ADMIN_EMAIL:-}
|
||||
ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
|
||||
ADMIN_NAME: ${ADMIN_NAME:-Ylläpito}
|
||||
ADMIN_USER: ${ADMIN_USER:-admin}
|
||||
ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
|
||||
ADDR: ":8080"
|
||||
# Inside the container the admin listener must bind the container's own interface; it is not
|
||||
# published below, so it stays unreachable from outside without a tunnel or the proxy.
|
||||
ADMIN_ADDR: ":8081"
|
||||
SECURE_COOKIES: ${SECURE_COOKIES:-true}
|
||||
LOG_LEVEL: ${LOG_LEVEL:-info}
|
||||
PUBLIC_URL: ${PUBLIC_URL:-}
|
||||
# The SQLite file sits in here beside the audio, so this one mount is the whole backup.
|
||||
volumes:
|
||||
- ./storage:/storage
|
||||
ports:
|
||||
- "8080:8080"
|
||||
- "8081:8081"
|
||||
restart: unless-stopped
|
||||
|
||||
+8
-14
@@ -33,21 +33,15 @@ and `storage` was test data, so **the schema has no legacy to respect.**
|
||||
retention `DELETE`, a table and a filtered page — ~150 lines to avoid `docker compose logs`. If
|
||||
in-app visibility is ever wanted, build an *audit* view of domain events instead; those are
|
||||
queries over tables that already exist.
|
||||
8. **The admin is a member with `is_admin` set.** ~~The admin is not a user.~~ *Reversed.* The
|
||||
original call — env credentials, Basic Auth, its own loopback listener — bought network isolation
|
||||
at the price of a second port to tunnel and proxy, and a second credential in the password
|
||||
manager. Basic Auth also sat outside the `SameSite` protection the member cookie already had, and
|
||||
left admin actions with no actor to log. One boolean column reuses the session, the login rate
|
||||
limiter, the ban-drops-sessions path and CSRF protection that all existed anyway. The costs the
|
||||
original entry named are real but small here: seeding is `seedAdmin` on an empty database, and
|
||||
the only lockout rule is that an admin cannot ban themselves. Banning a *second* admin is allowed
|
||||
— with one admin per installation there is no last-admin case to protect.
|
||||
9. **No moderator tier.** A four-level role enum was considered and dropped: nothing in the admin
|
||||
surface distinguishes a superadmin from an admin, and moderator is a second column on the day
|
||||
somebody needs to resolve reports without also being able to reset passwords.
|
||||
8. **The admin is not a user.** Env credentials, Basic Auth, its own loopback listener. This deletes
|
||||
the `role` column, first-launch seeding, admin sessions, the "cannot ban the last admin" rules,
|
||||
and every "exclude the admin" clause that would otherwise appear in user and stats queries.
|
||||
9. **Same process, two listeners** — not a second binary. A management binary would need its own
|
||||
deploy and would race the startup migrations. Two listeners give the network isolation, which was
|
||||
the only real benefit.
|
||||
10. **The admin recovery endpoint is dropped.** The old app had a key-gated credential reset with a
|
||||
`qwerty123` default in `docker-compose.yml`. There is no route, no key and no default: an admin
|
||||
who loses their password is reset from the database, the same as any locked-out member.
|
||||
`qwerty123` default in `docker-compose.yml`. The password is an env var now, so recovery is
|
||||
editing it and restarting. No route, no key, no default.
|
||||
11. **Conversion runs in the background; nothing enters `songs` until it succeeds and the submitter
|
||||
confirms.** Costs a `submissions` table, buys a `songs` table where every row is a real song and
|
||||
no query filters on readiness.
|
||||
|
||||
@@ -1,275 +0,0 @@
|
||||
# Deployment
|
||||
|
||||
How Levyraati gets onto a server and how it is changed once it is there. Configuration variables are
|
||||
tabulated in the [README](../README.md#configuration); this file is the procedures.
|
||||
|
||||
The whole deployment is **one container and one directory**. There is no database server, no
|
||||
migration step to run by hand, and no build on the target machine.
|
||||
|
||||
---
|
||||
|
||||
## The server's compose file
|
||||
|
||||
The `docker-compose.yml` in the repository root **builds from source** — that is the development
|
||||
one, and it is what you want on a machine that has the code checked out. A server has no source, so
|
||||
it runs a published image instead. Keep this second file on the server; it is not in the repository
|
||||
because it describes one particular deployment rather than the app.
|
||||
|
||||
```yaml
|
||||
services:
|
||||
app:
|
||||
# Registry included. Pin a release tag, never :latest — a restart must not quietly change the
|
||||
# running version. Kept in .env so this file carries no host of yours.
|
||||
image: ${IMAGE:?set IMAGE in .env}
|
||||
environment:
|
||||
# Only read while the users table is empty: they create the first account and are ignored
|
||||
# from then on. Safe to remove once that account exists.
|
||||
ADMIN_EMAIL: ${ADMIN_EMAIL:-}
|
||||
ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
|
||||
ADMIN_NAME: ${ADMIN_NAME:-Ylläpito}
|
||||
ADDR: ":8080"
|
||||
SECURE_COOKIES: ${SECURE_COOKIES:-true}
|
||||
PUBLIC_URL: ${PUBLIC_URL:-}
|
||||
# The SQLite file sits in here beside the audio, so this one mount is the whole backup.
|
||||
volumes:
|
||||
- ./storage:/storage
|
||||
ports:
|
||||
- "8080:8080"
|
||||
restart: unless-stopped
|
||||
```
|
||||
|
||||
Two differences from the development file, and the reason for each:
|
||||
|
||||
| | Development | Server |
|
||||
|---|---|---|
|
||||
| Source of the binary | `build:` from the checkout | `image:` pulled from the registry |
|
||||
| Version | `VERSION` build arg, `dev` by default | baked into the tagged image |
|
||||
|
||||
There is one port. `/admin` rides the member listener behind the same session cookie as everything
|
||||
else, so there is nothing extra to publish, tunnel or firewall.
|
||||
|
||||
Alongside it, a `.env` — same variables as [.env.example](../.env.example), plus the image:
|
||||
|
||||
```sh
|
||||
IMAGE=registry.example.com/owner/levyraati26-go:2026.08.02-1
|
||||
ADMIN_EMAIL=… # first start only
|
||||
ADMIN_PASSWORD=… # first start only
|
||||
SECURE_COOKIES=true
|
||||
PUBLIC_URL=https://levyraati.example.com
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## What the server needs
|
||||
|
||||
- Docker with the Compose plugin, or Podman with `podman-compose`.
|
||||
- Credentials for the registry holding the image (`docker login <registry>`), unless it is public.
|
||||
- A reverse proxy terminating TLS in front of port 8080. Cookies are `Secure`, so the members' site
|
||||
over plain HTTP will not keep anyone logged in.
|
||||
- Outbound network access: yt-dlp reaches YouTube, and the lyrics lookup reaches LRCLIB. Neither is
|
||||
fatal to lose — submissions fail with a visible message and lyrics stay empty.
|
||||
|
||||
Nothing else. No Go toolchain, no ffmpeg on the host — those live in the image.
|
||||
|
||||
---
|
||||
|
||||
## Building and publishing a release
|
||||
|
||||
Done from a checkout, not on the server. The version reaches the binary only through the build arg,
|
||||
so it must match the tag or `/healthz` will lie about what is deployed:
|
||||
|
||||
```sh
|
||||
git switch main && git merge dev
|
||||
git tag 2026.08.02-1
|
||||
podman build --build-arg VERSION=2026.08.02-1 \
|
||||
-t registry.example.com/owner/levyraati26-go:2026.08.02-1 \
|
||||
-t registry.example.com/owner/levyraati26-go:latest .
|
||||
podman push registry.example.com/owner/levyraati26-go:2026.08.02-1
|
||||
podman push registry.example.com/owner/levyraati26-go:latest
|
||||
```
|
||||
|
||||
Check before pushing that the tag took: `podman run --rm -p 8099:8080 -e ADMIN_PASSWORD=x IMAGE`
|
||||
then `curl localhost:8099/healthz` should answer `ok 2026.08.02-1`, not `ok dev`.
|
||||
|
||||
---
|
||||
|
||||
## First deployment
|
||||
|
||||
Two files go on the server — the compose file above and `.env`. **Not** a git clone; the source is
|
||||
not needed to run this.
|
||||
|
||||
```sh
|
||||
mkdir -p /srv/levyraati && cd /srv/levyraati
|
||||
# put docker-compose.yml and .env here
|
||||
chmod 600 .env # it holds the only admin credential there is
|
||||
docker compose pull
|
||||
docker compose up -d
|
||||
docker compose logs -f app # watch the migrations apply
|
||||
```
|
||||
|
||||
The first start creates `./storage` with `audio/`, `avatars/`, `tmp/` and `levyraati.db`, applies
|
||||
every migration, and only then accepts connections. It creates **no users** — nobody can register
|
||||
until you mint an invite.
|
||||
|
||||
Confirm it is alive, and that the version is the one you meant to deploy:
|
||||
|
||||
```sh
|
||||
curl -s localhost:8080/healthz # -> ok 2026.08.02-1
|
||||
```
|
||||
|
||||
### Reverse proxy
|
||||
|
||||
Proxy your public hostname to `127.0.0.1:8080`. Two things matter beyond the defaults:
|
||||
|
||||
- **Upload size.** Submissions are capped at 50 MB by the app; a proxy with a 1 MB default body
|
||||
limit rejects them first, and the error is not the app's clear one. Raise it past 50 MB
|
||||
(`client_max_body_size 64m` in nginx, `MaxRequestBodySize` in Caddy).
|
||||
- **Response buffering off**, or at least generous timeouts, for `/audio/{id}` — it serves Range
|
||||
requests so the player can seek.
|
||||
|
||||
### Admin access
|
||||
|
||||
Log in as your own account and open `/admin`. Nothing to tunnel, nothing extra to proxy: the page is
|
||||
part of the site and is gated on the `is_admin` flag on your user row. A signed-in member without the
|
||||
flag gets a 404 there, so the page does not advertise itself.
|
||||
|
||||
TLS at the proxy is what makes the invite *Kopioi* button work — the clipboard API needs a secure
|
||||
context, and `https://` is one. Over plain HTTP on a real hostname the button will not fire.
|
||||
|
||||
From the page: mint invites, reset passwords, ban members, delete songs, read feedback.
|
||||
|
||||
**First start.** On an empty database the app creates one account from `ADMIN_EMAIL` /
|
||||
`ADMIN_PASSWORD` and marks it admin. Once it exists those variables do nothing; drop them from
|
||||
`.env` if you would rather not keep a password there.
|
||||
|
||||
**Lost the admin password?** There is no recovery endpoint and no recovery key. Set a new bcrypt
|
||||
hash directly in the SQLite file — re-running the app with `ADMIN_PASSWORD` will not help, because
|
||||
seeding only fires on an empty `users` table.
|
||||
|
||||
---
|
||||
|
||||
## Upgrading
|
||||
|
||||
```sh
|
||||
cd /srv/levyraati
|
||||
# back up first — see below; it takes a second and this is exactly when you want it
|
||||
$EDITOR .env # point IMAGE at the new tag
|
||||
docker compose pull
|
||||
docker compose up -d
|
||||
curl -s localhost:8080/healthz # confirm the new version is answering
|
||||
```
|
||||
|
||||
Migrations run at startup, inside the new container, before it serves. There is no separate step.
|
||||
|
||||
**Expect a few seconds of downtime.** One container, one SQLite file, no rolling deploy — and a
|
||||
restart deliberately fails every in-flight submission. Deploy when nobody is mid-review.
|
||||
|
||||
### Rolling back
|
||||
|
||||
Point `IMAGE` at the previous tag and `docker compose up -d`. **Only safe if the release you are
|
||||
leaving added no migration** — migrations are forward-only and the old binary will not understand a
|
||||
schema it has never seen. Check `migrations/` between the two tags first; if one landed, restore the
|
||||
backup taken before the upgrade instead.
|
||||
|
||||
### What a restart does to work in progress
|
||||
|
||||
Conversions run as goroutines inside the process, so a restart kills them. This is handled, not
|
||||
ignored: the startup sweep marks every submission still `queued`, `downloading` or `converting` as
|
||||
`failed` with "interrupted by restart", so nothing is stuck saying "converting" forever. The
|
||||
submitter sees the failure and can retry a URL submission or re-upload a file. Published songs and
|
||||
reviews are untouched.
|
||||
|
||||
---
|
||||
|
||||
## Backups
|
||||
|
||||
`./storage` holds everything — audio, avatars, and `levyraati.db`.
|
||||
|
||||
**Do not just copy the database file while the app is running.** WAL mode means recent writes live
|
||||
in `levyraati.db-wal`, and a bare copy can miss them or catch a torn state. Ask SQLite for a
|
||||
consistent snapshot instead — it is safe against a live, writing database:
|
||||
|
||||
```sh
|
||||
cd /srv/levyraati
|
||||
docker compose exec app sqlite3 /storage/levyraati.db ".backup '/storage/tmp/backup.db'"
|
||||
gzip -c storage/tmp/backup.db > /backups/levyraati-$(date +%F).db.gz
|
||||
rm storage/tmp/backup.db
|
||||
tar czf /backups/levyraati-audio-$(date +%F).tar.gz -C storage audio avatars
|
||||
```
|
||||
|
||||
`storage/tmp/` is in-flight conversions and is safe to skip; it is cleared at startup anyway.
|
||||
|
||||
A daily cron of those four lines is a complete backup strategy for this app.
|
||||
|
||||
### Restoring
|
||||
|
||||
```sh
|
||||
docker compose down
|
||||
gunzip -c /backups/levyraati-2026-08-02.db.gz > storage/levyraati.db
|
||||
rm -f storage/levyraati.db-wal storage/levyraati.db-shm # stale sidecars of the old file
|
||||
tar xzf /backups/levyraati-audio-2026-08-02.tar.gz -C storage
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
Deleting the `-wal` and `-shm` files matters: left behind, they belong to the database you just
|
||||
replaced, and SQLite will try to apply them to the restored one.
|
||||
|
||||
Audio and rows are backed up separately but must be restored together — a song row whose `.ogg` is
|
||||
missing gives a broken player, and an orphan `.ogg` is invisible to everyone.
|
||||
|
||||
---
|
||||
|
||||
## Operations
|
||||
|
||||
### Logs
|
||||
|
||||
```sh
|
||||
docker compose logs -f app
|
||||
```
|
||||
|
||||
JSON to stdout, nothing else. Every line carries a `ctx` field (`startup`, `auth`, `songs`,
|
||||
`submissions`, `invites`, `reports`) to filter on.
|
||||
|
||||
Two startup warnings are worth reading rather than skipping: `submissions interrupted by restart`
|
||||
says the sweep cleaned up after a restart, and `failed submissions present` is often the first sign
|
||||
that yt-dlp has gone stale.
|
||||
|
||||
### yt-dlp goes stale
|
||||
|
||||
yt-dlp rots against YouTube — routine maintenance, not an incident. It comes from Alpine's community
|
||||
repository in the image, so **the fix is a rebuild**, which means publishing a new image rather than
|
||||
anything on the server. Rebuild monthly. Failures show the yt-dlp error to the submitter, so members
|
||||
usually notice before you read a log.
|
||||
|
||||
### Database shell
|
||||
|
||||
```sh
|
||||
docker compose exec app sqlite3 /storage/levyraati.db
|
||||
```
|
||||
|
||||
Writes here are unaudited and unvalidated — the schema holds the constraints, but the app's rules
|
||||
(the review window, the reveal rule, the lock) are in Go. Prefer the admin panel.
|
||||
|
||||
### Disk
|
||||
|
||||
Audio is Opus at 96 kbps: roughly 2–3 MB per song, so a hundred songs is a few hundred megabytes.
|
||||
`storage/tmp/` briefly holds a 50 MB upload plus its converted copy per in-flight submission,
|
||||
bounded by the two conversion slots.
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
| Symptom | Cause |
|
||||
|---|---|
|
||||
| Container exits immediately on a first start | `ADMIN_EMAIL` or `ADMIN_PASSWORD` unset on an empty database. The log says so; a site nobody can log into is worse than one that will not boot |
|
||||
| `set IMAGE in .env` | Compose has no image to run; `IMAGE` is required and unset |
|
||||
| `/healthz` says `ok dev` | The image was built without `--build-arg VERSION`, so what is deployed cannot be identified |
|
||||
| Login never sticks | Plain HTTP with `SECURE_COOKIES=true`. Terminate TLS, or set it `false` for a local test |
|
||||
| Uploads fail near 50 MB | The reverse proxy's body limit, not the app's |
|
||||
| Invite links are relative | `PUBLIC_URL` unset |
|
||||
| Everything 500s after a restore | `-wal`/`-shm` sidecars from the replaced database were left in place |
|
||||
| Submissions all fail at download | yt-dlp is stale, or YouTube is refusing this server's IP; rebuild and publish the image first. `docker compose logs app \| grep '"stage":"download"'` shows yt-dlp's own stderr under `detail` |
|
||||
| A submitter reports a *virhekoodi* | `docker compose logs app \| grep <code>` — one line, with the stage, the submission id, the URL and the tool's stderr |
|
||||
| `/admin` returns 404 while logged in | That account has no `is_admin`. Set it in the database; nothing in the UI grants it |
|
||||
| Setting `ADMIN_PASSWORD` again changes nothing | Seeding only fires on an empty `users` table. Reset the hash in the database instead |
|
||||
+36
-39
@@ -4,8 +4,7 @@ What the app does. This file and the code must never disagree; when behaviour ch
|
||||
with it. Terms are defined in [CONTEXT.md](../CONTEXT.md), decisions and their reasons in
|
||||
[decisions.md](./decisions.md), and anything explicitly not in v1 in [later.md](./later.md).
|
||||
|
||||
Stack and configuration are in the [README](../README.md); running it on a server is in
|
||||
[deployment.md](./deployment.md).
|
||||
Stack, configuration, and operations are in the [README](../README.md).
|
||||
|
||||
---
|
||||
|
||||
@@ -364,58 +363,56 @@ template renders a circle with the member's initials, in CSS. No default image o
|
||||
|
||||
## 6. Admin
|
||||
|
||||
**An admin is a member with `is_admin` set.** One boolean column on `users`, no role enum. They
|
||||
submit and review like anyone else and appear in every list and leaderboard, so no query has to
|
||||
exclude them. The admin UI is Finnish, like everything else.
|
||||
**The admin is not a user.** They never submit, never review, and never see the member-facing site.
|
||||
No `role` column, no admin row, no admin session, no admin login page, no first-launch seeding — and
|
||||
no query anywhere has to exclude the admin from a list, a leaderboard, or an aggregate. The admin UI
|
||||
is Finnish, like everything else.
|
||||
|
||||
```go
|
||||
// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
|
||||
// resolve reports without also being able to reset passwords.
|
||||
func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
m := memberFrom(r.Context())
|
||||
if m == nil {
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
// ponytail: Basic Auth, no admin session, no admin row. Ceiling: one admin, no logout
|
||||
// (close the browser). Add a cookie session if a second admin ever needs one.
|
||||
func requireAdmin(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
u, p, ok := r.BasicAuth()
|
||||
if !ok || subtle.ConstantTimeCompare([]byte(u), []byte(adminUser)) != 1 ||
|
||||
subtle.ConstantTimeCompare([]byte(p), []byte(adminPass)) != 1 {
|
||||
w.Header().Set("WWW-Authenticate", `Basic realm="levyraati admin"`)
|
||||
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
if !m.IsAdmin {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
next(w, r)
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
```
|
||||
|
||||
A signed-in member who is not an admin gets **404, not 403**: the admin pages are none of their
|
||||
business, and "forbidden" confirms there is something to be forbidden from. Everything else — the
|
||||
session cookie, `SameSite` CSRF protection, the login rate limiter, ban-drops-sessions — is reused
|
||||
rather than reimplemented, which is the whole point of the flag.
|
||||
No bcrypt here: hashing protects *stored* passwords against a database leak, and this one lives in
|
||||
the env file already. The constant-time compare is the part that
|
||||
matters. **Fatal at startup if `ADMIN_PASSWORD` is unset** — an admin panel that silently opens is
|
||||
worse than one that will not boot.
|
||||
|
||||
```go
|
||||
// One listener. /admin is a route on the member mux, gated per-route.
|
||||
log.Fatal(http.ListenAndServe(":8080", a.withMember(a.memberMux())))
|
||||
// ponytail: two listeners, one process. Admin is loopback-only — reach it over an SSH tunnel
|
||||
// or the reverse proxy. A separate binary would need its own deploy and would race the
|
||||
// startup migrations; it buys nothing else.
|
||||
go func() { log.Fatal(http.ListenAndServe("127.0.0.1:8081", requireAdmin(adminMux))) }()
|
||||
log.Fatal(http.ListenAndServe(":8080", memberMux))
|
||||
```
|
||||
|
||||
**Bootstrap:** registration needs an invite and invites are minted from `/admin`, so an empty
|
||||
database cannot grow a first user on its own. `seedAdmin` breaks the circle exactly once — on an
|
||||
empty `users` table it creates account number one from `ADMIN_EMAIL` / `ADMIN_PASSWORD` and sets
|
||||
`is_admin`. Against a populated database it does nothing, which is what makes it safe to leave in
|
||||
the boot sequence. **Fatal at startup if those are unset on an empty database** — a site nobody can
|
||||
log into is worse than one that will not boot.
|
||||
**Bootstrap:** the admin logs in with the env credentials and mints the first invite. That is the
|
||||
entire first-launch story. Losing the password is an edit to `.env` and a restart.
|
||||
|
||||
**Routes:** `GET /admin` dashboard, `POST /admin/invites`, `POST /admin/users/{id}/password`,
|
||||
`POST /admin/users/{id}/ban`, `POST /admin/songs/{id}/delete`, `GET /admin/reports`,
|
||||
`POST /admin/reports/{id}/resolve`. There is no `/admin/audio/{id}`: an admin is a member, so
|
||||
`GET /audio/{id}` already works for them.
|
||||
**Routes** (all on the loopback listener): `GET /admin` dashboard, `POST /admin/invites`,
|
||||
`POST /admin/users/{id}/password`, `POST /admin/users/{id}/ban`, `POST /admin/songs/{id}/delete`,
|
||||
`GET /admin/reports`, `POST /admin/reports/{id}/resolve`, and `GET /admin/audio/{id}` — moderating a
|
||||
complaint means listening to the song, and a separate audio route avoids branching auth inside the
|
||||
member handler.
|
||||
|
||||
**Ban** is a reversible toggle. It refuses login and deletes the member's sessions immediately.
|
||||
Their songs and reviews stay, keep counting in the stats, and keep their name on them: a ban ends
|
||||
participation, it does not rewrite history. An admin cannot ban *themselves* — the sessions would go
|
||||
with it and nothing would be left to undo it.
|
||||
participation, it does not rewrite history.
|
||||
|
||||
**The admin surface has no API.** No client but a browser, so JSON would be contract surface with no
|
||||
consumer.
|
||||
**The admin surface has no API.** Basic Auth on loopback with no client but a browser — JSON would
|
||||
be contract surface with no consumer.
|
||||
|
||||
---
|
||||
|
||||
@@ -733,7 +730,7 @@ panel, so the admin surface comes first — before a single member can exist.
|
||||
|
||||
1. **Skeleton** — `main.go`, embedded migrations at startup, `database/sql`, slog, Docker Compose,
|
||||
the two listeners.
|
||||
2. **Admin, invites, auth** — seed the first admin, mint an invite, register, log in, sessions, ban.
|
||||
2. **Admin, invites, auth** — Basic Auth listener, mint an invite, register, log in, sessions, ban.
|
||||
3. **Submission pipeline, upload path only** — submit, convert, waiting page, publish. No yt-dlp yet,
|
||||
so the hard parts (worker, publish transaction, restart recovery) are proven without a network
|
||||
dependency.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
module git.kessinen.com/kessinen/levyraati26-go
|
||||
|
||||
go 1.27.0
|
||||
go 1.25.0
|
||||
|
||||
require (
|
||||
golang.org/x/crypto v0.32.0
|
||||
|
||||
@@ -67,7 +67,7 @@ func parseLRC(s string) []lyricLine {
|
||||
return nil
|
||||
}
|
||||
var out []lyricLine
|
||||
for raw := range strings.SplitSeq(s, "\n") {
|
||||
for _, raw := range strings.Split(s, "\n") {
|
||||
stamps := lrcOne.FindAllStringSubmatch(raw, -1)
|
||||
if len(stamps) == 0 {
|
||||
continue
|
||||
+51
-88
@@ -2,6 +2,7 @@ package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/subtle"
|
||||
"database/sql"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
@@ -10,7 +11,6 @@ import (
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
_ "modernc.org/sqlite"
|
||||
)
|
||||
|
||||
@@ -18,31 +18,34 @@ import (
|
||||
var version = "dev"
|
||||
|
||||
type config struct {
|
||||
dbPath string
|
||||
// Only read when the database has no users at all: seedAdmin turns these into account number
|
||||
// one. Once that account exists they are dead weight and can leave the environment.
|
||||
adminEmail string
|
||||
adminName string
|
||||
dbPath string
|
||||
adminUser string
|
||||
adminPass string
|
||||
addr string
|
||||
adminAddr string
|
||||
storageDir string
|
||||
secureCookies bool
|
||||
// Public address of the site, so invite links are pasteable out of the admin page.
|
||||
// Public address of the member site, so admin-side invite links are pasteable. The admin
|
||||
// listener's own Host is a tunnel, not the site, so it cannot be derived.
|
||||
publicURL string
|
||||
}
|
||||
|
||||
func loadConfig() config {
|
||||
c := config{
|
||||
adminEmail: os.Getenv("ADMIN_EMAIL"),
|
||||
adminName: env("ADMIN_NAME", "Ylläpito"),
|
||||
adminUser: env("ADMIN_USER", "admin"),
|
||||
adminPass: os.Getenv("ADMIN_PASSWORD"),
|
||||
addr: env("ADDR", ":8080"),
|
||||
adminAddr: env("ADMIN_ADDR", "127.0.0.1:8081"),
|
||||
storageDir: env("STORAGE_DIR", "./storage"),
|
||||
secureCookies: env("SECURE_COOKIES", "true") != "false",
|
||||
publicURL: strings.TrimRight(os.Getenv("PUBLIC_URL"), "/"),
|
||||
}
|
||||
// The database lives beside the audio, so one volume is the whole backup.
|
||||
c.dbPath = env("DB_PATH", filepath.Join(c.storageDir, "levyraati.db"))
|
||||
// An admin panel that silently opens is worse than one that won't boot.
|
||||
if c.adminPass == "" {
|
||||
fatal("ADMIN_PASSWORD is not set")
|
||||
}
|
||||
return c
|
||||
}
|
||||
|
||||
@@ -91,23 +94,8 @@ func affected(res sql.Result) int64 {
|
||||
return n
|
||||
}
|
||||
|
||||
// LOG_LEVEL is debug, info, warn or error. slog parses those itself, so an unreadable value falls
|
||||
// back to info rather than refusing to boot over a logging setting.
|
||||
func logLevel() slog.Level {
|
||||
var l slog.Level
|
||||
if err := l.UnmarshalText([]byte(env("LOG_LEVEL", "info"))); err != nil {
|
||||
return slog.LevelInfo
|
||||
}
|
||||
return l
|
||||
}
|
||||
|
||||
func main() {
|
||||
// AddSource puts file:line on every record, so a log line found by its error code leads
|
||||
// straight to the branch that wrote it.
|
||||
slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
|
||||
AddSource: true,
|
||||
Level: logLevel(),
|
||||
})))
|
||||
slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
|
||||
slog.Info("starting", "ctx", "startup", "version", version)
|
||||
cfg := loadConfig()
|
||||
|
||||
@@ -134,48 +122,22 @@ func main() {
|
||||
if err := sweep(ctx, db); err != nil {
|
||||
fatal("startup sweep", "error", err)
|
||||
}
|
||||
if err := seedAdmin(ctx, db, cfg); err != nil {
|
||||
fatal("seed admin", "error", err)
|
||||
}
|
||||
|
||||
a := &app{cfg: cfg, db: db}
|
||||
|
||||
// ponytail: two listeners, one process. Admin is loopback-only — reach it over an SSH tunnel
|
||||
// or the reverse proxy. A separate binary would need its own deploy and would race the
|
||||
// startup migrations; it buys nothing else.
|
||||
go func() {
|
||||
slog.Info("admin listening", "ctx", "startup", "addr", cfg.adminAddr)
|
||||
err := http.ListenAndServe(cfg.adminAddr, a.requireAdmin(a.adminMux()))
|
||||
fatal("admin listener", "error", err)
|
||||
}()
|
||||
|
||||
slog.Info("listening", "ctx", "startup", "addr", cfg.addr)
|
||||
fatal("listener", "error", http.ListenAndServe(cfg.addr, a.withMember(a.memberMux())))
|
||||
}
|
||||
|
||||
// Registration needs an invite and invites are minted from the admin page, so a database with no
|
||||
// users has no way to grow one. seedAdmin breaks that circle exactly once: on an empty users table
|
||||
// it creates account number one from the environment and marks it admin. Every account after it
|
||||
// arrives through an invite like anyone else.
|
||||
//
|
||||
// ponytail: no promote-existing-user path and no password reset here. Re-running against a
|
||||
// populated database does nothing, which is what makes it safe to leave in the boot sequence.
|
||||
func seedAdmin(ctx context.Context, db *sql.DB, cfg config) error {
|
||||
var users int
|
||||
if err := db.QueryRowContext(ctx, `select count(*) from users`).Scan(&users); err != nil {
|
||||
return err
|
||||
}
|
||||
if users > 0 {
|
||||
return nil
|
||||
}
|
||||
if cfg.adminEmail == "" || cfg.adminPass == "" {
|
||||
// A site nobody can log into is worse than one that won't boot.
|
||||
fatal("empty database: set ADMIN_EMAIL and ADMIN_PASSWORD to create the first account")
|
||||
}
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(cfg.adminPass), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := db.ExecContext(ctx,
|
||||
`insert into users (name, email, password_hash, is_admin) values ($1, $2, $3, 1)`,
|
||||
cfg.adminName, strings.ToLower(cfg.adminEmail), string(hash)); err != nil {
|
||||
return err
|
||||
}
|
||||
slog.Info("first admin created", "ctx", "startup", "email", cfg.adminEmail)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *app) memberMux() *http.ServeMux {
|
||||
mux := http.NewServeMux()
|
||||
mux.Handle("GET /static/", http.FileServerFS(assetFS))
|
||||
@@ -225,40 +187,41 @@ func (a *app) memberMux() *http.ServeMux {
|
||||
mux.HandleFunc("POST /submit/{id}/lyrics", a.requireMember(a.suggestLyrics))
|
||||
mux.HandleFunc("POST /submit/{id}/retry", a.requireMember(a.retry))
|
||||
mux.HandleFunc("POST /submit/{id}/discard", a.requireMember(a.discard))
|
||||
|
||||
a.adminRoutes(mux)
|
||||
return mux
|
||||
}
|
||||
|
||||
// The admin pages sit on the same mux and the same session as everything else; only the guard
|
||||
// differs. There is no /admin/audio: requireAdmin members can reach GET /audio/{id} like anyone.
|
||||
func (a *app) adminRoutes(mux *http.ServeMux) {
|
||||
mux.HandleFunc("GET /admin", a.requireAdmin(a.adminDashboard))
|
||||
mux.HandleFunc("POST /admin/invites", a.requireAdmin(a.createInvite))
|
||||
mux.HandleFunc("POST /admin/users/{id}/ban", a.requireAdmin(a.toggleBan))
|
||||
mux.HandleFunc("POST /admin/users/{id}/password", a.requireAdmin(a.resetPassword))
|
||||
mux.HandleFunc("POST /admin/songs/{id}/delete", a.requireAdmin(a.adminDeleteSong))
|
||||
mux.HandleFunc("GET /admin/reports", a.requireAdmin(a.adminReports))
|
||||
mux.HandleFunc("POST /admin/reports/{id}/resolve", a.requireAdmin(a.resolveReport))
|
||||
func (a *app) adminMux() *http.ServeMux {
|
||||
mux := http.NewServeMux()
|
||||
mux.Handle("GET /static/", http.FileServerFS(assetFS))
|
||||
mux.HandleFunc("GET /admin", a.adminDashboard)
|
||||
mux.HandleFunc("POST /admin/invites", a.createInvite)
|
||||
mux.HandleFunc("POST /admin/users/{id}/ban", a.toggleBan)
|
||||
mux.HandleFunc("POST /admin/users/{id}/password", a.resetPassword)
|
||||
mux.HandleFunc("POST /admin/songs/{id}/delete", a.adminDeleteSong)
|
||||
mux.HandleFunc("GET /admin/reports", a.adminReports)
|
||||
mux.HandleFunc("POST /admin/reports/{id}/resolve", a.resolveReport)
|
||||
mux.HandleFunc("GET /admin/audio/{id}", a.adminAudio)
|
||||
mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, "/admin", http.StatusSeeOther)
|
||||
})
|
||||
return mux
|
||||
}
|
||||
|
||||
// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
|
||||
// resolve reports without also being able to reset passwords.
|
||||
// ponytail: Basic Auth, no admin session, no admin row. Ceiling: one admin, no logout
|
||||
// (close the browser). Add a cookie session if a second admin ever needs one.
|
||||
//
|
||||
// A signed-out visitor is sent to log in, the same as any member page. A signed-in member who is
|
||||
// not an admin gets 404 rather than 403: the admin pages are none of their business, and saying
|
||||
// "forbidden" confirms there is something there to be forbidden from.
|
||||
func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
m := memberFrom(r.Context())
|
||||
if m == nil {
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
// No bcrypt: hashing protects stored passwords against a database leak, and this one lives in the
|
||||
// env file already. The constant-time compare is the part that matters.
|
||||
func (a *app) requireAdmin(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
u, p, ok := r.BasicAuth()
|
||||
userOK := subtle.ConstantTimeCompare([]byte(u), []byte(a.cfg.adminUser)) == 1
|
||||
passOK := subtle.ConstantTimeCompare([]byte(p), []byte(a.cfg.adminPass)) == 1
|
||||
if !ok || !userOK || !passOK {
|
||||
w.Header().Set("WWW-Authenticate", `Basic realm="levyraati admin"`)
|
||||
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
if !m.IsAdmin {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
next(w, r)
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestRequireAdmin(t *testing.T) {
|
||||
a := &app{cfg: config{adminUser: "admin", adminPass: "s3cret"}}
|
||||
h := a.requireAdmin(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusTeapot)
|
||||
}))
|
||||
|
||||
for _, tc := range []struct {
|
||||
name, user, pass string
|
||||
auth bool
|
||||
want int
|
||||
}{
|
||||
{name: "no credentials", want: http.StatusUnauthorized},
|
||||
{name: "wrong password", user: "admin", pass: "hunter2", auth: true, want: http.StatusUnauthorized},
|
||||
{name: "wrong user", user: "root", pass: "s3cret", auth: true, want: http.StatusUnauthorized},
|
||||
{name: "correct", user: "admin", pass: "s3cret", auth: true, want: http.StatusTeapot},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
r := httptest.NewRequest("GET", "/admin", nil)
|
||||
if tc.auth {
|
||||
r.SetBasicAuth(tc.user, tc.pass)
|
||||
}
|
||||
w := httptest.NewRecorder()
|
||||
h.ServeHTTP(w, r)
|
||||
if w.Code != tc.want {
|
||||
t.Fatalf("status = %d, want %d", w.Code, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestMigrateIsIdempotent(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
a := testApp(t) // already migrated once
|
||||
|
||||
if err := migrate(ctx, a.db); err != nil {
|
||||
t.Fatalf("second migrate: %v", err)
|
||||
}
|
||||
if err := sweep(ctx, a.db); err != nil {
|
||||
t.Fatalf("sweep: %v", err)
|
||||
}
|
||||
|
||||
var n int
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if n != 1 {
|
||||
t.Fatalf("applied migrations = %d, want 1", n)
|
||||
}
|
||||
}
|
||||
@@ -132,13 +132,6 @@ func (a *app) editProfile(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
if newPassword := r.FormValue("new_password"); newPassword != "" {
|
||||
// A typo here would lock them out of an account they can still reach right now, and the
|
||||
// only way back is an admin reset.
|
||||
if newPassword != r.FormValue("new_password_repeat") {
|
||||
a.flash(w, "Uudet salasanat eivät täsmää.")
|
||||
http.Redirect(w, r, "/profile", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
if !a.changePassword(w, r, me.ID, r.FormValue("current_password"), newPassword) {
|
||||
return
|
||||
}
|
||||
@@ -190,3 +190,9 @@ func (a *app) adminSongs(ctx context.Context) ([]adminSong, error) {
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// Moderating a complaint means listening to the song, so the admin surface has its own audio route
|
||||
// rather than branching auth inside the member handler.
|
||||
func (a *app) adminAudio(w http.ResponseWriter, r *http.Request) {
|
||||
a.audio(w, r)
|
||||
}
|
||||
@@ -295,7 +295,7 @@ func (a *app) editSong(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
if affected(res) == 0 {
|
||||
a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi muokata.")
|
||||
a.flash(w, "Kappaletta ei voi enää muokata — sitä on jo arvosteltu.")
|
||||
} else {
|
||||
a.flash(w, "Tiedot tallennettu.")
|
||||
}
|
||||
@@ -319,7 +319,7 @@ func (a *app) deleteSong(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
if affected(res) == 0 {
|
||||
a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi poistaa.")
|
||||
a.flash(w, "Kappaletta ei voi enää poistaa — sitä on jo arvosteltu.")
|
||||
http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
@@ -1,95 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// A plain member must not be able to tell that /admin exists, and a stranger must be sent to log in.
|
||||
func TestRequireAdmin(t *testing.T) {
|
||||
a := &app{}
|
||||
h := a.requireAdmin(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusTeapot)
|
||||
})
|
||||
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
as *member
|
||||
want int
|
||||
}{
|
||||
{name: "signed out", as: nil, want: http.StatusSeeOther},
|
||||
{name: "member", as: &member{ID: 1}, want: http.StatusNotFound},
|
||||
{name: "admin", as: &member{ID: 1, IsAdmin: true}, want: http.StatusTeapot},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
r := httptest.NewRequest("GET", "/admin", nil)
|
||||
if tc.as != nil {
|
||||
r = r.WithContext(context.WithValue(r.Context(), memberKey, tc.as))
|
||||
}
|
||||
w := httptest.NewRecorder()
|
||||
h(w, r)
|
||||
if w.Code != tc.want {
|
||||
t.Fatalf("status = %d, want %d", w.Code, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// The first account cannot arrive by invite, because minting an invite needs an admin.
|
||||
func TestSeedAdminOnlyOnEmptyDatabase(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
cfg := config{adminEmail: "[email protected]", adminName: "Ylläpito", adminPass: "salasana1"}
|
||||
|
||||
if err := seedAdmin(ctx, a.db, cfg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var name, email string
|
||||
var isAdmin bool
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select name, email, is_admin from users`).Scan(&name, &email, &isAdmin); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !isAdmin || name != "Ylläpito" {
|
||||
t.Fatalf("seeded %q is_admin=%v, want Ylläpito admin", name, isAdmin)
|
||||
}
|
||||
// Login is by lowercased email, so the seed must not smuggle in a capital.
|
||||
if email != "[email protected]" {
|
||||
t.Fatalf("email = %q, want lowercased", email)
|
||||
}
|
||||
|
||||
// Re-running on a populated database must not add a second account or reset the first.
|
||||
cfg.adminEmail = "[email protected]"
|
||||
if err := seedAdmin(ctx, a.db, cfg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var n int
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from users`).Scan(&n); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if n != 1 {
|
||||
t.Fatalf("users = %d, want 1", n)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMigrateIsIdempotent(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
a := testApp(t) // already migrated once
|
||||
|
||||
if err := migrate(ctx, a.db); err != nil {
|
||||
t.Fatalf("second migrate: %v", err)
|
||||
}
|
||||
if err := sweep(ctx, a.db); err != nil {
|
||||
t.Fatalf("sweep: %v", err)
|
||||
}
|
||||
|
||||
var n int
|
||||
if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if n != 2 {
|
||||
t.Fatalf("applied migrations = %d, want 2", n)
|
||||
}
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
-- The admin became an ordinary account with a flag, so the separate Basic Auth listener could go.
|
||||
-- Same integer-as-boolean convention as `banned` above it.
|
||||
alter table users add column is_admin integer not null default 0;
|
||||
|
||||
-- An existing database already has its admin sitting in row one: the person who was handed the
|
||||
-- first invite from the old panel. A fresh database has no rows, so this is a no-op there and
|
||||
-- seedAdmin creates the account from the environment instead.
|
||||
update users set is_admin = 1 where id = (select min(id) from users);
|
||||
@@ -1,62 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
// The repeat field is the only guard against a typo in something nobody can read back: the account
|
||||
// is reachable right now, and a mistyped new password makes it reachable only through an admin.
|
||||
func TestPasswordChangeNeedsMatchingRepeat(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
mux := a.withMember(a.memberMux())
|
||||
|
||||
id := a.seedMember(t, "[email protected]")
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte("vanha1"), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update users set password_hash = $2 where id = $1`, id, string(hash)); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
tok, _, err := a.startSession(ctx, id, false)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
form := func(repeat string) url.Values {
|
||||
return url.Values{
|
||||
"name": {"Esa"}, "email": {"[email protected]"},
|
||||
"current_password": {"vanha1"},
|
||||
"new_password": {"uusi1"}, "new_password_repeat": {repeat},
|
||||
}
|
||||
}
|
||||
current := func() string {
|
||||
var h string
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select password_hash from users where id = $1`, id).Scan(&h); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return h
|
||||
}
|
||||
|
||||
if w := postAs(t, mux, "/profile", form("uusi2"), tok); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("mismatch: status = %d, want 303", w.Code)
|
||||
}
|
||||
if bcrypt.CompareHashAndPassword([]byte(current()), []byte("vanha1")) != nil {
|
||||
t.Fatal("a mismatched repeat still changed the password")
|
||||
}
|
||||
|
||||
if w := postAs(t, mux, "/profile", form("uusi1"), tok); w.Code != http.StatusSeeOther {
|
||||
t.Fatalf("match: status = %d, want 303", w.Code)
|
||||
}
|
||||
if bcrypt.CompareHashAndPassword([]byte(current()), []byte("uusi1")) != nil {
|
||||
t.Fatal("a matching repeat did not change the password")
|
||||
}
|
||||
}
|
||||
|
Before Width: | Height: | Size: 4.7 KiB After Width: | Height: | Size: 4.7 KiB |
+13
-34
@@ -2,9 +2,7 @@ package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"database/sql"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
@@ -328,11 +326,13 @@ func (a *app) process(subID int64, sourceURL, src string) {
|
||||
|
||||
if sourceURL != "" {
|
||||
a.setStatus(ctx, subID, "downloading", "")
|
||||
detail, err := downloadYouTube(ctx, sourceURL, a.tmpPath(subID, ".%(ext)s"))
|
||||
msg, err := downloadYouTube(ctx, sourceURL, a.tmpPath(subID, ".%(ext)s"))
|
||||
if err != nil {
|
||||
a.fail(ctx, subID, "download",
|
||||
"Kappaleen lataaminen ei onnistunut. Yritä myöhemmin uudelleen.",
|
||||
detail, err, "url", sourceURL)
|
||||
if msg == "" {
|
||||
msg = err.Error()
|
||||
}
|
||||
a.setStatus(ctx, subID, "failed", msg)
|
||||
slog.Warn("download failed", "ctx", "submissions", "submission", subID, "error", err)
|
||||
return
|
||||
}
|
||||
// yt-dlp names the file after whatever container YouTube served.
|
||||
@@ -344,9 +344,7 @@ func (a *app) process(subID int64, sourceURL, src string) {
|
||||
}
|
||||
}
|
||||
if src == "" {
|
||||
a.fail(ctx, subID, "download",
|
||||
"Kappaleen lataaminen ei onnistunut. Yritä myöhemmin uudelleen.",
|
||||
"yt-dlp exited cleanly but produced no file", nil, "url", sourceURL)
|
||||
a.setStatus(ctx, subID, "failed", "lataus ei tuottanut tiedostoa")
|
||||
return
|
||||
}
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
@@ -358,12 +356,14 @@ func (a *app) process(subID int64, sourceURL, src string) {
|
||||
a.setStatus(ctx, subID, "converting", "")
|
||||
|
||||
out := a.tmpPath(subID, ".ogg")
|
||||
detail, err := convertToOpus(ctx, src, out)
|
||||
msg, err := convertToOpus(ctx, src, out)
|
||||
if err != nil {
|
||||
os.Remove(out)
|
||||
a.fail(ctx, subID, "convert",
|
||||
"Tiedostoa ei voitu muuntaa. Onko se varmasti äänitiedosto?",
|
||||
detail, err)
|
||||
if msg == "" {
|
||||
msg = err.Error()
|
||||
}
|
||||
a.setStatus(ctx, subID, "failed", msg)
|
||||
slog.Warn("conversion failed", "ctx", "submissions", "submission", subID, "error", err)
|
||||
return
|
||||
}
|
||||
// The original is discarded as soon as the Opus exists.
|
||||
@@ -393,27 +393,6 @@ func (a *app) process(subID int64, sourceURL, src string) {
|
||||
a.autoFetchLyrics(ctx, subID, title, artist, seconds)
|
||||
}
|
||||
|
||||
// Short enough to read out over chat, long enough not to collide in a log worth grepping.
|
||||
func traceID() string {
|
||||
b := make([]byte, 4)
|
||||
rand.Read(b)
|
||||
return hex.EncodeToString(b)
|
||||
}
|
||||
|
||||
// fail is the only way a submission is marked failed. The submitter gets a sentence they can act
|
||||
// on plus a code; the log line gets that same code and everything that identifies the cause —
|
||||
// including the tool's own stderr, which used to go to the submitter and nowhere else. A download
|
||||
// that died on an HTTP 403 left "error: exit status 1" in the log and nothing else.
|
||||
func (a *app) fail(ctx context.Context, subID int64, stage, userMsg, detail string, err error, extra ...any) {
|
||||
code := traceID()
|
||||
args := []any{
|
||||
"ctx", "submissions", "code", code, "stage", stage, "submission", subID,
|
||||
"detail", detail, "error", err,
|
||||
}
|
||||
slog.Error("submission failed", append(args, extra...)...)
|
||||
a.setStatus(ctx, subID, "failed", fmt.Sprintf("%s (virhekoodi %s)", userMsg, code))
|
||||
}
|
||||
|
||||
func (a *app) setStatus(ctx context.Context, subID int64, status, msg string) {
|
||||
if _, err := a.db.ExecContext(ctx,
|
||||
`update submissions set status = $2, status_msg = nullif($3, '') where id = $1`,
|
||||
@@ -8,8 +8,6 @@ import (
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@@ -222,37 +220,3 @@ func TestRestartRecovery(t *testing.T) {
|
||||
t.Fatal("swept submission carries no explanation")
|
||||
}
|
||||
}
|
||||
|
||||
// The submitter must get a code they can quote, and must not get yt-dlp's stderr. The code is the
|
||||
// only thing tying their screenshot to the log line that says what actually broke.
|
||||
func TestFailGivesTraceableCodeNotToolOutput(t *testing.T) {
|
||||
a := testApp(t)
|
||||
ctx := context.Background()
|
||||
uid := a.seedMember(t, "[email protected]")
|
||||
|
||||
var subID int64
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`insert into submissions (user_id, status) values ($1, 'downloading') returning id`,
|
||||
uid).Scan(&subID); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
const secret = "HTTP Error 403: Forbidden"
|
||||
a.fail(ctx, subID, "download", "Kappaleen lataaminen ei onnistunut.", secret,
|
||||
fmt.Errorf("exit status 1"), "url", "https://youtu.be/x")
|
||||
|
||||
var status, msg string
|
||||
if err := a.db.QueryRowContext(ctx,
|
||||
`select status, status_msg from submissions where id = $1`, subID).Scan(&status, &msg); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if status != "failed" {
|
||||
t.Fatalf("status = %q, want failed", status)
|
||||
}
|
||||
if strings.Contains(msg, secret) {
|
||||
t.Fatalf("tool stderr leaked to the submitter: %q", msg)
|
||||
}
|
||||
if !regexp.MustCompile(`\(virhekoodi [0-9a-f]{8}\)$`).MatchString(msg) {
|
||||
t.Fatalf("no traceable code in %q", msg)
|
||||
}
|
||||
}
|
||||
@@ -27,8 +27,8 @@
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
<p class="muted small">Lähetä linkki kaverille. Koodi on valmiiksi täytettynä.
|
||||
Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
|
||||
<p class="muted small">Lähetä linkki kaverille — se avaa liittymislomakkeen koodi valmiiksi
|
||||
täytettynä. Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
|
||||
{{.Data.SpentCount}}{{end}}.</p>
|
||||
</div>
|
||||
</section>
|
||||
@@ -75,7 +75,7 @@
|
||||
<td>{{.Reviews}}</td>
|
||||
<td class="nowrap">{{fidate .CreatedAt}}</td>
|
||||
<td class="actions">
|
||||
<a href="/audio/{{.ID}}">Kuuntele</a>
|
||||
<a href="/admin/audio/{{.ID}}">Kuuntele</a>
|
||||
<form method="post" action="/admin/songs/{{.ID}}/delete"
|
||||
onsubmit="return confirm('Poistetaanko kappale ja kaikki sen arvostelut?')">
|
||||
<button type="submit" class="ghost danger">Poista</button>
|
||||
@@ -16,14 +16,15 @@
|
||||
<div class="topbar-inner">
|
||||
<a class="brand" href="/">Levyraati{{if .Admin}} <span class="badge admin">ylläpito</span>{{end}}</a>
|
||||
|
||||
{{if .Member}}
|
||||
{{if .Admin}}
|
||||
<nav class="navlinks"><a href="/admin" aria-current="page">Ylläpito</a></nav>
|
||||
<span></span>
|
||||
{{else if .Member}}
|
||||
<nav class="navlinks">
|
||||
<a href="/" {{if eq .Path "/"}}aria-current="page"{{end}}>Jono{{if .Queued}} <span class="count">{{.Queued}}</span>{{end}}</a>
|
||||
<a href="/songs" {{if eq .Path "/songs"}}aria-current="page"{{end}}>Kappaleet</a>
|
||||
<a href="/submit" {{if eq .Path "/submit"}}aria-current="page"{{end}}>Lähetä</a>
|
||||
<a href="/stats" {{if eq .Path "/stats"}}aria-current="page"{{end}}>Tilastot</a>
|
||||
<!-- An admin is a member first: the same nav, with one link the others do not get. -->
|
||||
{{if .Member.IsAdmin}}<a href="/admin" {{if .Admin}}aria-current="page"{{end}}>Ylläpito</a>{{end}}
|
||||
</nav>
|
||||
<div class="userblock">
|
||||
<span class="lines">
|
||||
@@ -44,7 +45,6 @@
|
||||
<a href="/songs">Kappaleet</a>
|
||||
<a href="/submit">Lähetä</a>
|
||||
<a href="/stats">Tilastot</a>
|
||||
{{if .Member.IsAdmin}}<a href="/admin">Ylläpito</a>{{end}}
|
||||
<a href="/profile">Oma profiili</a>
|
||||
<form method="post" action="/logout"><button type="submit">Kirjaudu ulos</button></form>
|
||||
</div>
|
||||
@@ -62,7 +62,7 @@
|
||||
<footer class="sitefooter">
|
||||
{{if .Member}}
|
||||
<!-- The server already knows where they were, so the path travels in the link — no JS. -->
|
||||
<a href="/report?from={{.Path}}">Anna palautetta</a> ·
|
||||
<a href="/report?from={{.Path}}">Ongelmia? Ideoita? Palautetta?</a> ·
|
||||
{{end}}
|
||||
<span class="slogan">We know good music, baby!</span>
|
||||
<span class="copyright">© Kessinen</span>
|
||||
@@ -11,7 +11,7 @@
|
||||
</div>
|
||||
<label class="follow">
|
||||
<input type="checkbox" checked> Seuraa kappaletta
|
||||
<span class="muted small">(sivu ei vieri)</span>
|
||||
<span class="muted small">— korostus jatkuu, sivu ei vieri</span>
|
||||
</label>
|
||||
{{else}}
|
||||
<div class="lyricsbox plain" data-duration="{{.Duration}}" data-song="{{.ID}}">
|
||||
@@ -36,7 +36,7 @@
|
||||
{{define "songcard"}}
|
||||
<a class="songcard{{if and (not .Own) (not .Reviewed)}} unreviewed{{end}}" href="/songs/{{.ID}}">
|
||||
{{if .Average}}<span class="scorebadge">{{score .Average}}</span>
|
||||
{{else if .ReviewCount}}<span class="scorebadge sealed" title="Muiden pisteet paljastuvat kun tallennat omasi"></span>{{end}}
|
||||
{{else if .ReviewCount}}<span class="scorebadge sealed" title="Pisteet paljastuvat kun arvostelet"></span>{{end}}
|
||||
<span class="title">{{.Title}}</span>
|
||||
<span class="artist">{{.Artist}}</span>
|
||||
<span class="meta">
|
||||
@@ -50,8 +50,6 @@
|
||||
<label>Kuva <input type="file" name="avatar" accept="image/*"></label>
|
||||
<label>Nykyinen salasana <input type="password" name="current_password" autocomplete="current-password"></label>
|
||||
<label>Uusi salasana <input type="password" name="new_password" autocomplete="new-password"></label>
|
||||
<!-- Neither field can be read back, and the new password has never been typed before. -->
|
||||
<label>Toista uusi salasana <input type="password" name="new_password_repeat" autocomplete="new-password"></label>
|
||||
<button type="submit">Tallenna</button>
|
||||
</form>
|
||||
<p class="muted small">Salasanan vaihto vaatii nykyisen salasanan ja kirjaa ulos muut laitteesi.</p>
|
||||
@@ -2,8 +2,8 @@
|
||||
<h1>Jono</h1>
|
||||
|
||||
{{if .Data.Items}}
|
||||
<p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Muiden pisteet paljastuvat
|
||||
kun tallennat omasi.</p>
|
||||
<p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Pisteet paljastuvat kun
|
||||
olet kirjoittanut oman arvostelusi.</p>
|
||||
<div class="songgrid">
|
||||
{{range .Data.Items}}{{template "songcard" .}}{{end}}
|
||||
</div>
|
||||
@@ -1,6 +1,7 @@
|
||||
{{define "content"}}
|
||||
<h1>Palaute</h1>
|
||||
<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Yksi virke riittää.</p>
|
||||
<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Ei kategorioita eikä
|
||||
prioriteetteja — yksi virke riittää.</p>
|
||||
|
||||
<form method="post" action="/report" class="stack">
|
||||
<input type="hidden" name="from" value="{{.Data.From}}">
|
||||
@@ -81,7 +81,7 @@
|
||||
<!-- Only when the review strip is not already showing them: while reviewing, the lyrics live in
|
||||
the left pane. This panel is for reading afterwards and for the submitter's edits. -->
|
||||
<details class="lyrics">
|
||||
<summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">(ei vielä lisätty)</span>{{end}}</summary>
|
||||
<summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">— ei vielä lisätty</span>{{end}}</summary>
|
||||
{{if $s.Lyrics}}<pre class="lyricstext">{{lyricstext $s.Lyrics}}</pre>{{end}}
|
||||
{{if $s.Own}}
|
||||
<form method="post" action="/songs/{{$s.ID}}/lyrics" class="stack">
|
||||
@@ -168,7 +168,7 @@
|
||||
{{else}}
|
||||
<p class="sealed-note">
|
||||
<span class="sealed" aria-hidden="true"></span>
|
||||
Muiden pisteet paljastuvat kun tallennat omasi.
|
||||
Muiden pisteet ja arvostelut paljastuvat kun kirjoitat omasi.
|
||||
{{if $s.ReviewCount}}Arvosteluja on {{$s.ReviewCount}}.{{end}}
|
||||
</p>
|
||||
{{end}}
|
||||
@@ -49,7 +49,7 @@
|
||||
{{define "content"}}
|
||||
<h1>Tilastot</h1>
|
||||
<p class="muted">Kappale pääsee listoille kun sillä on vähintään {{.Data.MinReviews}} arvostelua.
|
||||
Tilastot näkyvät kaikille.</p>
|
||||
Tilastot näkyvät kaikille — täällä pisteitä ei piiloteta.</p>
|
||||
|
||||
<div class="boards">
|
||||
{{template "songboard" dict "Title" "Parhaat" "Items" .Data.TopSongs}}
|
||||
@@ -24,7 +24,7 @@
|
||||
<!-- Outside the form and attached to it with form=, so one button both submits the metadata
|
||||
and publishes. Disabled until the audio has finished converting. -->
|
||||
<button type="submit" form="meta" {{if not .Ready}}disabled{{end}}>Julkaise</button>
|
||||
{{if not .Ready}}<p class="muted small">Julkaise aukeaa kun lähetys on valmis.</p>{{end}}
|
||||
{{if not .Ready}}<p class="muted small">Julkaise aukeaa kun muunnos on valmis.</p>{{end}}
|
||||
{{end}}
|
||||
</div>
|
||||
{{end}}
|
||||
@@ -45,7 +45,7 @@
|
||||
hx-post="/submit/{{.ID}}/lyrics"
|
||||
hx-include="[name='title'], [name='artist']"
|
||||
hx-target="#lyricsfield" hx-swap="outerHTML">Hae sanoitukset</button>
|
||||
{{if .Found}}<span class="muted small">Löytyi. Tarkista teksti.</span>{{end}}
|
||||
{{if .Found}}<span class="muted small">Löytyi — tarkista ja muokkaa tarvittaessa.</span>{{end}}
|
||||
{{if .Searched}}{{if not .Found}}
|
||||
<span class="muted small">Ei löytynyt. Tarkista nimi ja esittäjä tai liitä sanoitukset itse.</span>
|
||||
{{end}}{{end}}
|
||||
@@ -84,7 +84,8 @@
|
||||
{{template "saved" ""}}
|
||||
</form>
|
||||
|
||||
<p class="muted">Nimi, esittäjä ja genre tarvitaan ennen julkaisua.</p>
|
||||
<p class="muted">Tiedot tallentuvat itsestään kirjoittaessasi. Nimi, esittäjä ja genre tarvitaan
|
||||
ennen julkaisua.</p>
|
||||
|
||||
{{template "submission-status" .Data}}
|
||||
{{end}}
|
||||
@@ -32,10 +32,13 @@
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
<p class="muted small">Valmis lähetys odottaa Julkaise-painallusta — vasta se tuo kappaleen
|
||||
muiden nähtäville.</p>
|
||||
</section>
|
||||
{{end}}
|
||||
|
||||
<p class="muted">Enintään 50 MB ja 15 minuuttia.</p>
|
||||
<p class="muted">Enintään 50 MB ja 15 minuuttia. Tiedosto muunnetaan Opus-muotoon, ja pääset
|
||||
kirjoittamaan esittelyn odotellessa. Kappale julkaistaan vasta kun painat Julkaise.</p>
|
||||
|
||||
<script>
|
||||
// The native control can't be relabelled or styled, so it is hidden behind this one — which
|
||||
Reference in New Issue
Block a user