Keys a members-only or private relay does not admit see a short notice instead of management forms that fail once signed. Paths that match no page return 404 instead of rendering the home page.
- commit
- a17b474809e2f2c6e2ee31fe66119b8f46adb553
- parent
- d9651de022c4c2283f82eb390a00bde09f477cc8
- author
- Dami <dami.etoile@gmail.com>
| M | tinyclient/ | 27 | +++++++++++++++++++++++++++ |
@@ -772,6 +772,12 @@ func (a *App) render(writer http.ResponseWriter, request *http.Request, data Pag
772772 }773773 data.Event, data.Feed, data.Error = nil, nil, ""774774 }775+ if !data.Private && data.Actor != "" && railKind(data.Tab) == "manage" && !data.Owner && !a.readAdmitted(request.Context(), actor) {776+ // A signed-in key the relay does not admit gets a short notice instead777+ // of management forms that would only fail once signed.778+ data.Tab = "manage-restricted"779+ data.Event, data.Feed, data.Error = nil, nil, ""780+ }775781 writer.Header().Set("Cache-Control", "private, no-store")776782 writer.Header().Set("content-type", "text/html; charset=utf-8")777783 var rendered bytes.Buffer@@ -820,6 +826,10 @@ func (a *App) qrImage(writer http.ResponseWriter, text string) {
820826 821827 func (a *App) page(writer http.ResponseWriter, request *http.Request) {822828 tab := tabForPath(request.URL.Path)829+ if tab == "home" && strings.Trim(strings.TrimPrefix(request.URL.Path, pathPrefix(request.URL.Path)), "/") != "" {830+ http.NotFound(writer, request)831+ return832+ }823833 actor, err := a.resolveActor(request)824834 if err != nil {825835 actor = ""@@ -1219,6 +1229,23 @@ func requestPrefix(request *http.Request) string {
12191229 return pathPrefix(request.URL.Path)12201230 }12211231 1232+// readAdmitted reports whether the relay lets actor read at all: the private1233+// service check when it is enabled, and the members-only read gate otherwise.1234+func (a *App) readAdmitted(ctx context.Context, actor string) bool {1235+ if reader, ok := a.backend.(PrivateReader); ok {1236+ if err := reader.ReadAllowed(ctx, actor); err != nil {1237+ return false1238+ }1239+ }1240+ if a.backend.Policy().Reads != "members" {1241+ return true1242+ }1243+ if _, err := a.backend.Query(ctx, "browserooms", []json.RawMessage{json.RawMessage(`{"limit":1}`)}, actor); err != nil {1244+ return !restricted(err.Error()) && !authRequired(err.Error())1245+ }1246+ return true1247+}1248+12221249 func tabForPath(path string) string {12231250 path = strings.TrimPrefix(path, pathPrefix(path))12241251 if path == "/" || path == "" {