Follow-up to the comprehensive code review. Five batches: 1. Cross-event authorization: host_delete_upload, unban_user, and host_delete_comment now scope by auth.event_id. Adds Upload::find_by_id_and_event / soft_delete_in_event and a Comment::soft_delete_in_event variant that joins through upload. 2. Token exposure: SSE auth no longer puts the JWT in the URL. New /api/v1/stream/ticket endpoint mints a short-lived single-use ticket bound to the session; the EventSource passes ?ticket=... instead. Refuse to start in APP_ENV=production with the dev JWT sentinel; warn loudly otherwise. 3. Account hardening: per-IP+name rate limit on /recover (mitigates targeted lockout DoS), per-IP rate limit on /admin/login, random 32-char admin recovery PIN (replaces "0000"), structured tracing events for wrong PIN, lockout, failed admin login, ban/unban/role change/pin-reset/host-delete. 4. DoS / correctness: comment listing paginated (LIMIT 50 + ?before= cursor), hashtag extraction whitelisted to ASCII alnum+underscore (≤40 chars) with unit tests, display_name / caption / comment body length validated in chars rather than bytes. 5. Cleanup: session-touch failures now logged, DATABASE_MAX_CONNECTIONS env var (default 10). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
114 lines
3.4 KiB
Rust
114 lines
3.4 KiB
Rust
use chrono::{DateTime, Utc};
|
|
use serde::Serialize;
|
|
use sqlx::PgPool;
|
|
use uuid::Uuid;
|
|
|
|
#[derive(Debug, sqlx::FromRow)]
|
|
pub struct Comment {
|
|
pub id: Uuid,
|
|
pub upload_id: Uuid,
|
|
pub user_id: Uuid,
|
|
pub body: String,
|
|
pub created_at: DateTime<Utc>,
|
|
pub deleted_at: Option<DateTime<Utc>>,
|
|
}
|
|
|
|
#[derive(Debug, Serialize, sqlx::FromRow)]
|
|
pub struct CommentDto {
|
|
pub id: Uuid,
|
|
pub upload_id: Uuid,
|
|
pub user_id: Uuid,
|
|
pub uploader_name: String,
|
|
pub body: String,
|
|
pub created_at: DateTime<Utc>,
|
|
}
|
|
|
|
impl Comment {
|
|
pub async fn create(
|
|
pool: &PgPool,
|
|
upload_id: Uuid,
|
|
user_id: Uuid,
|
|
body: &str,
|
|
) -> Result<Self, sqlx::Error> {
|
|
sqlx::query_as::<_, Self>(
|
|
"INSERT INTO comment (upload_id, user_id, body) VALUES ($1, $2, $3) RETURNING *",
|
|
)
|
|
.bind(upload_id)
|
|
.bind(user_id)
|
|
.bind(body)
|
|
.fetch_one(pool)
|
|
.await
|
|
}
|
|
|
|
/// Paginated comment listing — returns up to `limit` rows in chronological
|
|
/// order (oldest first). If `before` is set, only comments older than that
|
|
/// timestamp are returned, enabling backward cursor pagination ("load
|
|
/// earlier"). Without the LIMIT a hot post with thousands of comments could
|
|
/// OOM the server on a single GET.
|
|
pub async fn list_for_upload(
|
|
pool: &PgPool,
|
|
upload_id: Uuid,
|
|
before: Option<DateTime<Utc>>,
|
|
limit: i64,
|
|
) -> Result<Vec<CommentDto>, sqlx::Error> {
|
|
// Two-step: pick the newest `limit` rows older than `before`, then flip
|
|
// them back into ascending order so the caller can render top-to-bottom.
|
|
sqlx::query_as::<_, CommentDto>(
|
|
"SELECT * FROM (
|
|
SELECT c.id, c.upload_id, c.user_id, u.display_name AS uploader_name,
|
|
c.body, c.created_at
|
|
FROM comment c
|
|
JOIN \"user\" u ON u.id = c.user_id
|
|
WHERE c.upload_id = $1 AND c.deleted_at IS NULL
|
|
AND ($2::timestamptz IS NULL OR c.created_at < $2)
|
|
ORDER BY c.created_at DESC
|
|
LIMIT $3
|
|
) page
|
|
ORDER BY created_at ASC",
|
|
)
|
|
.bind(upload_id)
|
|
.bind(before)
|
|
.bind(limit)
|
|
.fetch_all(pool)
|
|
.await
|
|
}
|
|
|
|
pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
|
|
sqlx::query_as::<_, Self>(
|
|
"SELECT * FROM comment WHERE id = $1 AND deleted_at IS NULL",
|
|
)
|
|
.bind(id)
|
|
.fetch_optional(pool)
|
|
.await
|
|
}
|
|
|
|
pub async fn soft_delete(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
|
|
sqlx::query("UPDATE comment SET deleted_at = NOW() WHERE id = $1")
|
|
.bind(id)
|
|
.execute(pool)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
/// Event-scoped variant of [`Self::soft_delete`]. Returns `false` if the
|
|
/// comment doesn't exist or belongs to a different event.
|
|
pub async fn soft_delete_in_event(
|
|
pool: &PgPool,
|
|
id: Uuid,
|
|
event_id: Uuid,
|
|
) -> Result<bool, sqlx::Error> {
|
|
let result = sqlx::query(
|
|
"UPDATE comment
|
|
SET deleted_at = NOW()
|
|
WHERE id = $1
|
|
AND deleted_at IS NULL
|
|
AND upload_id IN (SELECT id FROM upload WHERE event_id = $2)",
|
|
)
|
|
.bind(id)
|
|
.bind(event_id)
|
|
.execute(pool)
|
|
.await?;
|
|
Ok(result.rows_affected() > 0)
|
|
}
|
|
}
|