flyemoji
3b43f05a83
The passwordless migration (b330d77) removed the password-login route, leaving concurrencyLimiter — its bcrypt concurrency cap — with no caller, and scattered stale "local-password" / "change-password" references through the surviving auth code's comments. - Remove the dead concurrencyLimiter (type + newConcurrencyLimiter + acquire): no caller, no struct field, no test. Reword the one streamLimiter doc that contrasted against it. - Realign comments in repo.go, pgrepo.go, session.go, util.go to the passwordless reality: staff lookups feed email-OTP / passkey / setup redeem, not a password compare; RevokeUserSessionsExcept and DeleteAllPasskeyCredentialsForUser are retained (uncalled) for the P5 account-remediation path (#78); "local sessions" no longer implies a password. Comments and dead code only; no behavior change. Full WSL test tree green.
46 lines
1.9 KiB
Go
46 lines
1.9 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"mime"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// maxBodyBytes caps request bodies; the API only accepts small JSON documents.
|
|
const maxBodyBytes = 1 << 20 // 1 MiB
|
|
|
|
// requireJSONContentType rejects a request whose body is not declared
|
|
// application/json, returning 415 before any decode. It guards the credential-bearing
|
|
// auth writes (email-OTP, passkey, op-login, setup redeem) against a cross-site
|
|
// forgery: an HTML form can
|
|
// only POST as application/x-www-form-urlencoded, multipart/form-data, or text/plain
|
|
// — never JSON — and a cross-site fetch that forces application/json triggers a CORS
|
|
// preflight this API never answers, so neither form can be forged off-origin. The
|
|
// session cookie's SameSite=Lax already blocks the bearing of credentials cross-site;
|
|
// this is the belt to that suspenders, and it costs a legitimate same-origin caller
|
|
// nothing (the panel always sends application/json on a bodied request). Media-type
|
|
// parameters (e.g. "; charset=utf-8") are ignored — only the type/subtype must match.
|
|
func requireJSONContentType(r *http.Request) error {
|
|
mt, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
|
|
if err != nil || !strings.EqualFold(mt, "application/json") {
|
|
return newError(http.StatusUnsupportedMediaType, "unsupported_media_type",
|
|
"Content-Type must be application/json")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// decodeJSON strictly decodes a small request body into v, rejecting unknown
|
|
// fields and trailing data so malformed callers fail fast with 400.
|
|
func decodeJSON(w http.ResponseWriter, r *http.Request, v any) error {
|
|
dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, maxBodyBytes))
|
|
dec.DisallowUnknownFields()
|
|
if err := dec.Decode(v); err != nil {
|
|
return newError(http.StatusBadRequest, "bad_request", "invalid request body: %v", err)
|
|
}
|
|
if dec.More() {
|
|
return newError(http.StatusBadRequest, "bad_request", "unexpected trailing data in body")
|
|
}
|
|
return nil
|
|
}
|