-
Link Your Last.fm Account
-
Enter your Last.fm username to start tracking your scrobbles.
-
+{{ template "components/navBar" .NavBar }}
+
+
+ {{ if .CurrentUsername }}Update your username.{{ else }}Connect Last.fm.{{ end }}
+ Piper reads your public scrobbles and adds them to the listening record tied to your Atmosphere account.
+
+
+ {{ if .CurrentUsername }}
+
+
+
Remove Last.fm
+
Stop syncing this account and remove the username from Piper.
+ {{ end }}
+
+{{ end }}
diff --git a/pages/templates/layouts/base.gohtml b/pages/templates/layouts/base.gohtml
index 62900b8..b885014 100644
--- a/pages/templates/layouts/base.gohtml
+++ b/pages/templates/layouts/base.gohtml
@@ -1,13 +1,20 @@
{{ define "layouts/base" }}
-
+
-
Piper - Spotify & Last.fm Tracker
-
+
+
+
+
Piper · Listening connections
+
+
+
+
-
-{{ block "content" . }}{{ end }}
-
+
+
+ {{ block "content" . }}{{ end }}
+
{{ end }}
diff --git a/service/apikey/apikey.go b/service/apikey/apikey.go
index 7abcd7e..cc8aa71 100644
--- a/service/apikey/apikey.go
+++ b/service/apikey/apikey.go
@@ -5,6 +5,7 @@ import (
"fmt"
"log"
"net/http"
+ "sync"
"time"
"github.com/teal-fm/piper/db"
@@ -16,15 +17,41 @@ import (
type Service struct {
db *db.DB
sessions *session.Manager
+ flashMu sync.Mutex
+ newKeys map[string]string
}
func NewAPIKeyService(database *db.DB, sessionManager *session.Manager) *Service {
return &Service{
db: database,
sessions: sessionManager,
+ newKeys: make(map[string]string),
}
}
+func (s *Service) storeNewKey(r *http.Request, key string) bool {
+ cookie, err := r.Cookie("session")
+ if err != nil || cookie.Value == "" {
+ return false
+ }
+ s.flashMu.Lock()
+ s.newKeys[cookie.Value] = key
+ s.flashMu.Unlock()
+ return true
+}
+
+func (s *Service) takeNewKey(r *http.Request) string {
+ cookie, err := r.Cookie("session")
+ if err != nil || cookie.Value == "" {
+ return ""
+ }
+ s.flashMu.Lock()
+ defer s.flashMu.Unlock()
+ key := s.newKeys[cookie.Value]
+ delete(s.newKeys, cookie.Value)
+ return key
+}
+
// jsonResponse is a helper to send JSON responses
func jsonResponse(w http.ResponseWriter, statusCode int, data any) {
w.Header().Set("Content-Type", "application/json")
@@ -95,7 +122,7 @@ func (s *Service) HandleAPIKeyManagement(database *db.DB, pg *pages.Pages) http.
// IMPORTANT: Assumes CreateAPIKeyAndReturnRawKey method exists on SessionManager
// and returns the database object and the raw key string.
// Signature: (apiKey *db_apikey.ApiKey, rawKeyString string, err error)
- apiKeyObj, err := s.sessions.CreateAPIKey(userID, keyName, validityDays)
+ apiKeyObj, rawKey, err := s.sessions.CreateAPIKey(userID, keyName, validityDays)
if err != nil {
jsonError(w, fmt.Sprintf("Error creating API key: %v", err), http.StatusInternalServerError)
return
@@ -103,6 +130,7 @@ func (s *Service) HandleAPIKeyManagement(database *db.DB, pg *pages.Pages) http.
jsonResponse(w, http.StatusCreated, map[string]any{
"id": apiKeyObj.ID,
+ "key": rawKey,
"name": apiKeyObj.Name,
"created_at": apiKeyObj.CreatedAt,
"expires_at": apiKeyObj.ExpiresAt,
@@ -146,18 +174,16 @@ func (s *Service) HandleAPIKeyManagement(database *db.DB, pg *pages.Pages) http.
}
validityDays := 1024
- // Uses the existing CreateAPIKey, which likely doesn't return the raw key.
- // The HTML flow currently redirects and shows the key ID.
- // The template message about "only time you'll see this key" is misleading if it shows ID.
- // This might require a separate enhancement if the HTML view should show the raw key.
- apiKey, err := s.sessions.CreateAPIKey(userID, keyName, validityDays)
+ _, rawKey, err := s.sessions.CreateAPIKey(userID, keyName, validityDays)
if err != nil {
http.Error(w, fmt.Sprintf("Error creating API key: %v", err), http.StatusInternalServerError)
return
}
- // Redirects, passing the ID of the created key.
- // The template shows this ID in the ".NewKey" section.
- http.Redirect(w, r, "/api-keys?created="+apiKey.ID, http.StatusSeeOther)
+ if !s.storeNewKey(r, rawKey) {
+ http.Error(w, "Failed to prepare the new API key for display", http.StatusInternalServerError)
+ return
+ }
+ http.Redirect(w, r, "/api-keys", http.StatusSeeOther)
return
}
@@ -191,27 +217,16 @@ func (s *Service) HandleAPIKeyManagement(database *db.DB, pg *pages.Pages) http.
return
}
- // newlyCreatedKey will be the ID from the redirect after form POST
- newlyCreatedKeyID := r.URL.Query().Get("created")
- var newKeyValueToShow string
-
- if newlyCreatedKeyID != "" {
- // For HTML, we only have the ID. The template message should be adjusted
- // if it implies the raw key is shown.
- // If you enhance CreateAPIKey for HTML to also pass the raw key (e.g. via flash message),
- // this logic would change. For now, it's the ID.
- newKeyValueToShow = newlyCreatedKeyID
- }
-
data := struct {
- Keys []*dbapikey.ApiKey // Assuming GetUserApiKeys returns this type
- NewKeyID string // Changed from NewKey for clarity as it's an ID
- NavBar pages.NavBar
+ Keys []*dbapikey.ApiKey
+ NewKey string
+ NavBar pages.NavBar
}{
- Keys: keys,
- NewKeyID: newKeyValueToShow,
+ Keys: keys,
+ NewKey: s.takeNewKey(r),
NavBar: pages.NavBar{
- IsLoggedIn: ok,
+ IsLoggedIn: ok,
+ CurrentPage: pages.NavAPIAccess,
//Just leaving empty so we don't have to pull in the db here, may change
LastFMUsername: lastfmUsername,
},
diff --git a/service/apikey/apikey_test.go b/service/apikey/apikey_test.go
new file mode 100644
index 0000000..e6759db
--- /dev/null
+++ b/service/apikey/apikey_test.go
@@ -0,0 +1,31 @@
+package apikey
+
+import (
+ "net/http"
+ "net/http/httptest"
+ "testing"
+)
+
+func TestNewKeyFlashIsScopedAndConsumedOnce(t *testing.T) {
+ service := &Service{newKeys: make(map[string]string)}
+ request := httptest.NewRequest(http.MethodGet, "/api-keys", nil)
+ request.AddCookie(&http.Cookie{Name: "session", Value: "session-a"})
+
+ if !service.storeNewKey(request, "secret-key") {
+ t.Fatal("storeNewKey returned false")
+ }
+ if got := service.takeNewKey(request); got != "secret-key" {
+ t.Fatalf("first take got %q, want secret-key", got)
+ }
+ if got := service.takeNewKey(request); got != "" {
+ t.Fatalf("second take got %q, want empty", got)
+ }
+}
+
+func TestNewKeyFlashRequiresSessionCookie(t *testing.T) {
+ service := &Service{newKeys: make(map[string]string)}
+ request := httptest.NewRequest(http.MethodGet, "/api-keys", nil)
+ if service.storeNewKey(request, "secret-key") {
+ t.Fatal("storeNewKey succeeded without a session cookie")
+ }
+}
diff --git a/service/profile/profile.go b/service/profile/profile.go
new file mode 100644
index 0000000..5d23191
--- /dev/null
+++ b/service/profile/profile.go
@@ -0,0 +1,364 @@
+package profile
+
+import (
+ "context"
+ "encoding/json"
+ "errors"
+ "fmt"
+ "net"
+ "net/http"
+ "net/netip"
+ "net/url"
+ "strings"
+ "sync"
+ "time"
+
+ "github.com/bluesky-social/indigo/atproto/identity"
+ "github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+const tealProfileCollection = "fm.teal.actor.profile"
+const playCollection = "fm.teal.feed.play"
+
+var ErrProfilePending = errors.New("profile lookup is still pending")
+
+type Account struct {
+ Handle string `json:"handle"`
+ PDS string `json:"pds"`
+ AvatarURL string `json:"avatar_url"`
+}
+
+type RecordTarget struct {
+ TrackName string
+ PlayedAt time.Time
+}
+
+type cacheEntry struct {
+ account Account
+ expiresAt time.Time
+}
+
+type Resolver struct {
+ directory identity.Directory
+ client *http.Client
+ refreshTimeout time.Duration
+
+ mu sync.RWMutex
+ cache map[string]cacheEntry
+ refreshing map[string]bool
+}
+
+func NewResolver() *Resolver {
+ transport := http.DefaultTransport.(*http.Transport).Clone()
+ transport.Proxy = nil
+ transport.DialContext = safeDialContext
+ client := &http.Client{
+ Timeout: 4 * time.Second,
+ Transport: transport,
+ CheckRedirect: func(req *http.Request, via []*http.Request) error {
+ if len(via) >= 10 {
+ return errors.New("too many redirects")
+ }
+ return validateHTTPSURL(req.URL)
+ },
+ }
+ return &Resolver{
+ directory: identity.DefaultDirectory(),
+ client: client,
+ refreshTimeout: 5 * time.Second,
+ cache: make(map[string]cacheEntry),
+ refreshing: make(map[string]bool),
+ }
+}
+
+// Cached returns immediately. Expired data remains usable while one background
+// refresh runs, and a first-time lookup never delays the connections page.
+func (r *Resolver) Cached(rawDID string) (Account, bool) {
+ r.mu.Lock()
+ cached, ok := r.cache[rawDID]
+ needsRefresh := !ok || time.Now().After(cached.expiresAt)
+ if needsRefresh && !r.refreshing[rawDID] {
+ r.refreshing[rawDID] = true
+ go r.refresh(rawDID)
+ }
+ r.mu.Unlock()
+ return cached.account, ok
+}
+
+func (r *Resolver) refresh(rawDID string) {
+ ctx, cancel := context.WithTimeout(context.Background(), r.refreshTimeout)
+ defer cancel()
+ account, err := r.resolve(ctx, rawDID)
+ r.mu.Lock()
+ defer r.mu.Unlock()
+ delete(r.refreshing, rawDID)
+ if err == nil {
+ r.cache[rawDID] = cacheEntry{account: account, expiresAt: time.Now().Add(10 * time.Minute)}
+ }
+}
+
+func (r *Resolver) Resolve(ctx context.Context, rawDID string) (Account, error) {
+ r.mu.RLock()
+ cached, ok := r.cache[rawDID]
+ r.mu.RUnlock()
+ if ok && time.Now().Before(cached.expiresAt) {
+ return cached.account, nil
+ }
+
+ account, err := r.resolve(ctx, rawDID)
+ if err != nil {
+ return Account{}, err
+ }
+ r.mu.Lock()
+ r.cache[rawDID] = cacheEntry{account: account, expiresAt: time.Now().Add(10 * time.Minute)}
+ r.mu.Unlock()
+ return account, nil
+}
+
+func (r *Resolver) resolve(ctx context.Context, rawDID string) (Account, error) {
+ did, err := syntax.ParseDID(rawDID)
+ if err != nil {
+ return Account{}, fmt.Errorf("parse DID: %w", err)
+ }
+ ident, err := r.directory.LookupDID(ctx, did)
+ if err != nil {
+ return Account{}, fmt.Errorf("resolve DID: %w", err)
+ }
+
+ handle := ident.Handle.String()
+ if handle == "handle.invalid" {
+ handle = ""
+ }
+ pds := strings.TrimRight(ident.PDSEndpoint(), "/")
+ account := Account{
+ Handle: handle,
+ PDS: strings.TrimPrefix(strings.TrimPrefix(pds, "https://"), "http://"),
+ }
+ account.AvatarURL = r.tealAvatar(ctx, pds, rawDID)
+ if account.AvatarURL == "" {
+ account.AvatarURL = r.blueskyAvatar(ctx, rawDID)
+ }
+
+ return account, nil
+}
+
+func (r *Resolver) tealAvatar(ctx context.Context, pds, did string) string {
+ if pds == "" {
+ return ""
+ }
+ endpoint, err := url.Parse(pds + "/xrpc/com.atproto.repo.getRecord")
+ if err != nil {
+ return ""
+ }
+ query := endpoint.Query()
+ query.Set("repo", did)
+ query.Set("collection", tealProfileCollection)
+ query.Set("rkey", "self")
+ endpoint.RawQuery = query.Encode()
+
+ var record struct {
+ Value struct {
+ Avatar struct {
+ Ref struct {
+ Link string `json:"$link"`
+ } `json:"ref"`
+ } `json:"avatar"`
+ } `json:"value"`
+ }
+ if err := r.getJSON(ctx, endpoint.String(), &record); err != nil || record.Value.Avatar.Ref.Link == "" {
+ return ""
+ }
+
+ blobURL, err := url.Parse(pds + "/xrpc/com.atproto.sync.getBlob")
+ if err != nil {
+ return ""
+ }
+ query = blobURL.Query()
+ query.Set("did", did)
+ query.Set("cid", record.Value.Avatar.Ref.Link)
+ blobURL.RawQuery = query.Encode()
+ return blobURL.String()
+}
+
+func (r *Resolver) blueskyAvatar(ctx context.Context, did string) string {
+ endpoint, _ := url.Parse("https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile")
+ query := endpoint.Query()
+ query.Set("actor", did)
+ endpoint.RawQuery = query.Encode()
+
+ var actor struct {
+ Avatar string `json:"avatar"`
+ }
+ if err := r.getJSON(ctx, endpoint.String(), &actor); err != nil {
+ return ""
+ }
+ return actor.Avatar
+}
+
+func (r *Resolver) LatestRecords(ctx context.Context, rawDID string, targets map[string]RecordTarget) (map[string]string, error) {
+ account, ready := r.Cached(rawDID)
+ if !ready || account.PDS == "" {
+ return nil, ErrProfilePending
+ }
+ endpoint, err := url.Parse("https://" + account.PDS + "/xrpc/com.atproto.repo.listRecords")
+ if err != nil {
+ return nil, err
+ }
+ records := make(map[string]string)
+ if len(targets) == 0 {
+ return records, nil
+ }
+ cursor := ""
+ for page := 0; page < 10 && len(records) < len(targets); page++ {
+ query := endpoint.Query()
+ query.Set("repo", rawDID)
+ query.Set("collection", playCollection)
+ query.Set("limit", "100")
+ if cursor != "" {
+ query.Set("cursor", cursor)
+ }
+ endpoint.RawQuery = query.Encode()
+ var result struct {
+ Cursor string `json:"cursor"`
+ Records []struct {
+ URI string `json:"uri"`
+ Value struct {
+ MusicServiceURI string `json:"musicServiceUri"`
+ TrackName string `json:"trackName"`
+ PlayedTime string `json:"playedTime"`
+ } `json:"value"`
+ } `json:"records"`
+ }
+ if err := r.getJSON(ctx, endpoint.String(), &result); err != nil {
+ return nil, err
+ }
+ for _, record := range result.Records {
+ service := musicServiceName(record.Value.MusicServiceURI)
+ target, wanted := targets[service]
+ if !wanted || records[service] != "" || !recordMatchesTarget(record.Value.TrackName, record.Value.PlayedTime, target) {
+ continue
+ }
+ atURI, err := syntax.ParseATURI(record.URI)
+ if err != nil {
+ continue
+ }
+ records[service] = atURI.String()
+ }
+ cursor = result.Cursor
+ if cursor == "" {
+ break
+ }
+ }
+ return records, nil
+}
+
+func recordMatchesTarget(trackName, playedTime string, target RecordTarget) bool {
+ if target.TrackName != "" && !strings.EqualFold(strings.TrimSpace(trackName), strings.TrimSpace(target.TrackName)) {
+ return false
+ }
+ if target.PlayedAt.IsZero() {
+ return true
+ }
+ recordedAt, err := time.Parse(time.RFC3339Nano, playedTime)
+ return err == nil && recordedAt.Equal(target.PlayedAt)
+}
+
+func musicServiceName(rawURI string) string {
+ normalized := strings.ToLower(rawURI)
+ switch {
+ case strings.Contains(normalized, "spotify"):
+ return "spotify"
+ case strings.Contains(normalized, "music.apple"), strings.Contains(normalized, "applemusic"):
+ return "applemusic"
+ case strings.Contains(normalized, "last.fm"), strings.Contains(normalized, "lastfm"):
+ return "lastfm"
+ default:
+ return ""
+ }
+}
+
+func (r *Resolver) getJSON(ctx context.Context, endpoint string, target any) error {
+ parsed, err := url.Parse(endpoint)
+ if err != nil {
+ return err
+ }
+ if err := validateHTTPSURL(parsed); err != nil {
+ return err
+ }
+ req, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
+ if err != nil {
+ return err
+ }
+ resp, err := r.client.Do(req)
+ if err != nil {
+ return err
+ }
+ defer resp.Body.Close()
+ if resp.StatusCode != http.StatusOK {
+ return fmt.Errorf("unexpected status %s", resp.Status)
+ }
+ return json.NewDecoder(resp.Body).Decode(target)
+}
+
+func validateHTTPSURL(target *url.URL) error {
+ if target == nil || target.Scheme != "https" || target.Hostname() == "" || target.User != nil {
+ return errors.New("remote profile URL must be an HTTPS URL without user information")
+ }
+ return nil
+}
+
+func safeDialContext(ctx context.Context, network, address string) (net.Conn, error) {
+ host, port, err := net.SplitHostPort(address)
+ if err != nil {
+ return nil, err
+ }
+ addresses, err := net.DefaultResolver.LookupNetIP(ctx, "ip", host)
+ if err != nil {
+ return nil, err
+ }
+ for _, address := range addresses {
+ if !safePublicAddress(address) {
+ continue
+ }
+ return (&net.Dialer{}).DialContext(ctx, network, net.JoinHostPort(address.String(), port))
+ }
+ return nil, fmt.Errorf("remote profile host %q has no allowed public address", host)
+}
+
+var blockedAddressRanges = []netip.Prefix{
+ netip.MustParsePrefix("0.0.0.0/8"),
+ netip.MustParsePrefix("10.0.0.0/8"),
+ netip.MustParsePrefix("100.64.0.0/10"),
+ netip.MustParsePrefix("127.0.0.0/8"),
+ netip.MustParsePrefix("169.254.0.0/16"),
+ netip.MustParsePrefix("172.16.0.0/12"),
+ netip.MustParsePrefix("192.0.0.0/24"),
+ netip.MustParsePrefix("192.0.2.0/24"),
+ netip.MustParsePrefix("192.168.0.0/16"),
+ netip.MustParsePrefix("198.18.0.0/15"),
+ netip.MustParsePrefix("198.51.100.0/24"),
+ netip.MustParsePrefix("203.0.113.0/24"),
+ netip.MustParsePrefix("224.0.0.0/4"),
+ netip.MustParsePrefix("240.0.0.0/4"),
+ netip.MustParsePrefix("::/128"),
+ netip.MustParsePrefix("::1/128"),
+ netip.MustParsePrefix("fc00::/7"),
+ netip.MustParsePrefix("fe80::/10"),
+ netip.MustParsePrefix("ff00::/8"),
+ netip.MustParsePrefix("2001:db8::/32"),
+}
+
+func safePublicAddress(address netip.Addr) bool {
+ if address.Is4In6() {
+ address = address.Unmap()
+ }
+ if !address.IsValid() || !address.IsGlobalUnicast() {
+ return false
+ }
+ for _, blocked := range blockedAddressRanges {
+ if blocked.Contains(address) {
+ return false
+ }
+ }
+ return true
+}
diff --git a/service/profile/profile_test.go b/service/profile/profile_test.go
new file mode 100644
index 0000000..deafeca
--- /dev/null
+++ b/service/profile/profile_test.go
@@ -0,0 +1,104 @@
+package profile
+
+import (
+ "context"
+ "net/http"
+ "net/http/httptest"
+ "net/netip"
+ "net/url"
+ "strings"
+ "testing"
+ "time"
+)
+
+func TestCachedReturnsExpiredAccountWithoutWaiting(t *testing.T) {
+ resolver := &Resolver{
+ cache: map[string]cacheEntry{
+ "did:plc:test": {
+ account: Account{Handle: "listener.example"},
+ expiresAt: time.Now().Add(-time.Minute),
+ },
+ },
+ refreshing: map[string]bool{"did:plc:test": true},
+ }
+
+ start := time.Now()
+ account, ok := resolver.Cached("did:plc:test")
+ if !ok || account.Handle != "listener.example" {
+ t.Fatalf("got %#v, %v", account, ok)
+ }
+ if elapsed := time.Since(start); elapsed > 20*time.Millisecond {
+ t.Fatalf("cached lookup took %s", elapsed)
+ }
+}
+
+func TestLatestRecordsReturnsNewestRecordPerService(t *testing.T) {
+ server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ if r.URL.Path != "/xrpc/com.atproto.repo.listRecords" || r.URL.Query().Has("reverse") || r.URL.Query().Get("limit") != "100" {
+ t.Errorf("unexpected request: %s", r.URL.String())
+ }
+ w.Header().Set("Content-Type", "application/json")
+ _, _ = w.Write([]byte(`{"records":[
+ {"uri":"at://did:plc:listener/fm.teal.feed.play/3wrong","value":{"musicServiceUri":"https://last.fm","trackName":"Older","playedTime":"2026-08-26T22:36:19Z"}},
+ {"uri":"at://did:plc:listener/fm.teal.feed.play/3lastfm","value":{"musicServiceUri":"https://last.fm","trackName":"Latest Last.fm","playedTime":"2026-08-27T22:36:19Z"}},
+ {"uri":"at://did:plc:listener/fm.teal.feed.play/3spotify","value":{"musicServiceUri":"https://open.spotify.com","trackName":"Latest Spotify","playedTime":"2026-08-27T21:00:00Z"}},
+ {"uri":"at://did:plc:listener/fm.teal.feed.play/3apple","value":{"musicServiceUri":"https://music.apple.com","trackName":"Latest Apple","playedTime":"2026-08-27T20:00:00Z"}}
+ ]}`))
+ }))
+ defer server.Close()
+ resolver := &Resolver{
+ client: server.Client(),
+ cache: map[string]cacheEntry{
+ "did:plc:listener": {
+ account: Account{PDS: strings.TrimPrefix(server.URL, "https://")},
+ expiresAt: time.Now().Add(time.Minute),
+ },
+ },
+ refreshing: make(map[string]bool),
+ }
+ records, err := resolver.LatestRecords(context.Background(), "did:plc:listener", map[string]RecordTarget{
+ "lastfm": {TrackName: "Latest Last.fm", PlayedAt: time.Date(2026, 8, 27, 22, 36, 19, 0, time.UTC)},
+ "spotify": {TrackName: "Latest Spotify", PlayedAt: time.Date(2026, 8, 27, 21, 0, 0, 0, time.UTC)},
+ "applemusic": {TrackName: "Latest Apple", PlayedAt: time.Date(2026, 8, 27, 20, 0, 0, 0, time.UTC)},
+ })
+ if err != nil {
+ t.Fatalf("LatestRecords: %v", err)
+ }
+ if records["lastfm"] != "at://did:plc:listener/fm.teal.feed.play/3lastfm" ||
+ records["spotify"] != "at://did:plc:listener/fm.teal.feed.play/3spotify" ||
+ records["applemusic"] != "at://did:plc:listener/fm.teal.feed.play/3apple" {
+ t.Fatalf("got %#v", records)
+ }
+}
+
+func TestValidateHTTPSURL(t *testing.T) {
+ for _, rawURL := range []string{"http://pds.example", "https://user@pds.example", "https://"} {
+ target, _ := url.Parse(rawURL)
+ if err := validateHTTPSURL(target); err == nil {
+ t.Errorf("validateHTTPSURL(%q) succeeded", rawURL)
+ }
+ }
+ target, _ := url.Parse("https://pds.example")
+ if err := validateHTTPSURL(target); err != nil {
+ t.Fatalf("valid HTTPS URL rejected: %v", err)
+ }
+}
+
+func TestSafePublicAddress(t *testing.T) {
+ tests := map[string]bool{
+ "127.0.0.1": false,
+ "10.0.0.1": false,
+ "169.254.169.254": false,
+ "192.0.2.10": false,
+ "::1": false,
+ "fc00::1": false,
+ "2001:db8::1": false,
+ "1.1.1.1": true,
+ "2606:4700:4700::1111": true,
+ }
+ for rawAddress, want := range tests {
+ if got := safePublicAddress(netip.MustParseAddr(rawAddress)); got != want {
+ t.Errorf("safePublicAddress(%s) = %v, want %v", rawAddress, got, want)
+ }
+ }
+}
diff --git a/session/session.go b/session/session.go
index 8b619bd..f23c614 100644
--- a/session/session.go
+++ b/session/session.go
@@ -25,10 +25,15 @@ type Session struct {
}
type Manager struct {
- db *db.DB
- sessions map[string]*Session // use in memory cache if necessary
- ApiKeyMgr *apikey.Manager
- mu sync.RWMutex
+ db *db.DB
+ sessions map[string]*Session // use in memory cache if necessary
+ ApiKeyMgr *apikey.Manager
+ mu sync.RWMutex
+ secureCookies bool
+}
+
+func (sm *Manager) SetSecureCookies(secure bool) {
+ sm.secureCookies = secure
}
func NewSessionManager(database *db.DB) *Manager {
@@ -192,7 +197,8 @@ func (sm *Manager) SetSessionCookie(w http.ResponseWriter, session *Session) {
Value: session.ID,
Path: "/",
HttpOnly: true,
- Secure: false,
+ Secure: sm.secureCookies,
+ SameSite: http.SameSiteLaxMode,
Expires: session.ExpiresAt,
}
http.SetCookie(w, cookie)
@@ -205,7 +211,8 @@ func (sm *Manager) ClearSessionCookie(w http.ResponseWriter) {
Value: "",
Path: "/",
HttpOnly: true,
- Secure: false,
+ Secure: sm.secureCookies,
+ SameSite: http.SameSiteLaxMode,
MaxAge: -1,
}
http.SetCookie(w, cookie)
@@ -215,7 +222,7 @@ func (sm *Manager) GetAPIKeyManager() *apikey.Manager {
return sm.ApiKeyMgr
}
-func (sm *Manager) CreateAPIKey(userID int64, name string, validityDays int) (*apikey.ApiKey, error) {
+func (sm *Manager) CreateAPIKey(userID int64, name string, validityDays int) (*apikey.ApiKey, string, error) {
return sm.ApiKeyMgr.CreateApiKey(userID, name, validityDays)
}
diff --git a/session/session_cookie_test.go b/session/session_cookie_test.go
new file mode 100644
index 0000000..d547955
--- /dev/null
+++ b/session/session_cookie_test.go
@@ -0,0 +1,22 @@
+package session
+
+import (
+ "net/http"
+ "net/http/httptest"
+ "testing"
+ "time"
+)
+
+func TestSessionCookieSecurityAttributes(t *testing.T) {
+ manager := &Manager{secureCookies: true}
+ recorder := httptest.NewRecorder()
+ manager.SetSessionCookie(recorder, &Session{ID: "session-id", ExpiresAt: time.Now().Add(time.Hour)})
+ cookies := recorder.Result().Cookies()
+ if len(cookies) != 1 {
+ t.Fatalf("got %d cookies, want 1", len(cookies))
+ }
+ cookie := cookies[0]
+ if !cookie.HttpOnly || !cookie.Secure || cookie.SameSite != http.SameSiteLaxMode {
+ t.Fatalf("unexpected cookie attributes: %#v", cookie)
+ }
+}