i am going insane

src/main.rs

@@ -24,7 +24,7 @@ use rocket::fs::TempFile;
 use rocket::http::CookieJar;
 use rocket::serde::{json::Json, Deserialize};
 
-use fossil::tables::{Db, Image, Post, User};
+use fossil::tables::{Db, Image, LoginStatus, Post, User};
 
 #[get("/login")]
 fn login_page() -> RawHtml<String> {
@@ -114,38 +114,46 @@ async fn account(mut db: Connection<Db>, cookies: &CookieJar<'_>) -> status::Cus
 }
 
 #[post("/login", data = "<info>")]
-async fn login(mut db: Connection<Db>, info: Json<LoginInfo>, cookies: &CookieJar<'_>) -> String {
+async fn login(
+    mut db: Connection<Db>,
+    info: Json<LoginInfo>,
+    cookies: &CookieJar<'_>,
+) -> status::Custom<&'static str> {
     let token = cookies.get_private("token");
     match token {
         Some(_) => {
-            "already logged in".to_string()
+            status::Custom(Status::Continue, "already logged in")
         }
         None => {
             match User::get_by_username(&mut db, &info.username).await {
                 Some(user) => {
                     if user.password == sha256::digest(&info.password) {
                         match user.token {
-                            Some(t) => {cookies.add_private(("token", t)); "Logged in".to_string()},
+                            Some(t) => {cookies.add_private(("token", t)); status::Custom(Status::Ok, "Logged in")},
                             None => {
                                 match user.set_new_token(&mut db).await {
                                     Ok(t) => {
                                         cookies.add_private(("token", t));
-                                        "logged in".to_string()
+                                        status::Custom(Status::Ok, "Logged in")
+                                    },
+                                    Err(why) => {
+                                        eprintln!("{why:?}"); 
+                                        status::Custom(Status::InternalServerError, "Couldn't generate a token for you, therefore you weren't logged in.")
                                     },
-                                    Err(why) => why,
                                 }
                             }
                         }
                     } else {
-                        String::from("Invalid username or password (to those whining about why it doesn't tell you if the username or password is incorrect, security)")
+                        status::Custom(Status::Forbidden, "Invalid username or password (to those whining about why it doesn't tell you if the username or password is incorrect, security)")
                     }
                 }
                 None =>
-                        String::from("Invalid username or password (to those whining about why it doesn't tell you if the username or password is incorrect, security)"),
+                        status::Custom(Status::Forbidden, "Invalid username or password (to those whining about why it doesn't tell you if the username or password is incorrect, security)")
             }
         }
     }
 }
+
 #[post("/logout")]
 async fn logout(cookies: &CookieJar<'_>) -> status::Custom<&'static str> {
     match cookies.get_private("token") {
@@ -253,25 +261,29 @@ async fn toggleperms(
     cookies: &CookieJar<'_>,
 ) -> status::Custom<String> {
     match cookies.get_private("token") {
-        Some(t) => match User::get_by_token(&mut db, t).await {
+        Some(t) => {
-            Some(user) => match user.admin {
+            match User::get_by_token(&mut db, t).await {
-                true => match User::get_by_username(&mut db, &info.username).await {
+                Some(user) => {
-                    Some(toggled_user) => {
+                    match user.admin {
-                        match toggled_user.username == user.username && info.perm == "admin" {
+                        true => match User::get_by_username(&mut db, &info.username).await {
-                            true => status::Custom(
+                            Some(toggled_user) => {
-                                Status::Forbidden,
+                                match toggled_user.username == user.username && info.perm == "admin"
-                                "You can't change your own admin status".to_string(),
+                                {
-                            ),
-                            false => {
-                                let admin_username = std::env::var("ADMIN_USERNAME")
-                                    .expect("set ADMIN_USERNAME env var");
-                                match toggled_user.username == admin_username {
                                     true => status::Custom(
                                         Status::Forbidden,
-                                        "You can't change the system admin's perms.".to_string(),
+                                        "You can't change your own admin status".to_string(),
                                     ),
                                     false => {
-                                        match info.perm == "admin"
+                                        let admin_username = std::env::var("ADMIN_USERNAME")
+                                            .expect("set ADMIN_USERNAME env var");
+                                        match toggled_user.username == admin_username {
+                                            true => status::Custom(
+                                                Status::Forbidden,
+                                                "You can't change the system admin's perms."
+                                                    .to_string(),
+                                            ),
+                                            false => {
+                                                match info.perm == "admin"
                                             && user.username != admin_username
                                         {
                                             true => status::Custom(
@@ -288,26 +300,34 @@ async fn toggleperms(
                                                 }
                                             }
                                         }
+                                            }
+                                        }
                                     }
                                 }
                             }
+                            None => status::Custom(
+                                Status::NotFound,
+                                "The user you're trying to toggle perms for doesn't exist."
+                                    .to_string(),
+                            ),
+                        },
+                        false => {
+                            status::Custom(Status::Unauthorized, "You aren't an admin.".to_string())
                         }
                     }
-                    None => status::Custom(
+                }
-                        Status::NotFound,
+                None => status::Custom(Status::Unauthorized, "Invalid login token".to_string()),
-                        "The user you're trying to toggle perms for doesn't exist.".to_string(),
+            }
-                    ),
+        }
-                },
-                false => status::Custom(Status::Unauthorized, "You aren't an admin.".to_string()),
-            },
-            None => status::Custom(Status::Unauthorized, "Invalid login token".to_string()),
-        },
         None => status::Custom(Status::Unauthorized, "Not logged in".to_string()),
     }
 }
 
 #[get("/images/<image>")]
-async fn get_image(image: String, mut db: Connection<Db>) -> Result<NamedFile, Status> {
+async fn get_image(
+    image: String,
+    mut db: Connection<Db>,
+) -> Result<NamedFile, status::Custom<&'static str>> {
     let mut split = image.split('.').collect::<Vec<&str>>();
     let format = split.pop().unwrap();
     let image = split.join(".");
@@ -335,76 +355,94 @@ async fn get_image(image: String, mut db: Connection<Db>) -> Result<NamedFile, S
                     Ok(file)
                 }
                 Err(why) => Err(match &why.to_string()[..] {
-                    "Format error decoding Png: Invalid PNG signature." => Status::NotAcceptable,
+                    "Format error decoding Png: Invalid PNG signature." => {
-                    _ => Status::InternalServerError,
+                        status::Custom(Status::NotAcceptable, "That file isn't an image.")
+                    }
+                    _ => status::Custom(Status::InternalServerError, "Unknown decoding error"),
                 }),
             },
-            Err(_) => Err(Status::NotFound),
+            Err(_) => Err(status::Custom(
+                Status::InternalServerError,
+                "Unknown decoding error",
+            )),
         },
-        Err(_) => Err(Status::ImATeapot),
+        Err(_) => Err(status::Custom(
+            Status::InternalServerError,
+            "File not found",
+        )),
     }
 }
 
 #[post("/upload", format = "image/png", data = "<file>")]
-async fn upload(mut file: TempFile<'_>, cookies: &CookieJar<'_>, mut db: Connection<Db>) -> String {
+async fn upload(
+    mut file: TempFile<'_>,
+    cookies: &CookieJar<'_>,
+    mut db: Connection<Db>,
+) -> status::Custom<String> {
     let uuid = Uuid::new_v4().to_string();
-    match file.copy_to(format!("/srv/tmpimages/{uuid}.png")).await {
+
-        Ok(_) => {
+    // login & perms check
-            // validate that it is, in fact, an image
+    match User::login_status(&mut db, cookies).await {
-            match Reader::open(format!("/srv/tmpimages/{uuid}.png")) {
+        LoginStatus::LoggedIn(user) => {
-                Ok(_) => {
+            match user.make_posts || user.admin {
-                    match cookies.get_private("token") {
+                // image validation check
-                        Some(t) => {
+                true => {
-                            match User::get_by_token(&mut db, t).await {
+                    match file.copy_to(format!("/srv/tmpimages/{uuid}.png")).await {
-                                Some(user) => {
+                        Ok(_) => {
-                                    if user.make_posts == true || user.admin == true {
+                            // validate that it is, in fact, an image
-                                        // upload to db
+                            match Reader::open(format!("/srv/tmpimages/{uuid}.png")) {
-                                        match Image::create(&mut db, &uuid, user).await {
+                                Ok(_) => {
+                                    match file.copy_to(format!("/srv/images/{uuid}.png")).await {
+                                        Ok(_) => match Image::create(&mut db, &uuid, user).await {
                                             Ok(_) => {
-                                                // move image
+                                                match fs::remove_file(format!(
-                                                match file
+                                                    "/srv/tmpimages/{uuid}.png"
-                                                    .copy_to(format!("/srv/images/{uuid}.png"))
+                                                )) {
-                                                    .await
+                                                    Ok(_) => status::Custom(Status::Created, uuid),
-                                                {
-                                                    Ok(_) => {
-                                                        match fs::remove_file(format!(
-                                                            "/srv/tmpimages/{uuid}.png"
-                                                        )) {
-                                                            Ok(_) => uuid,
-                                                            Err(why) => {
-                                                                eprintln!("{why:?}");
-                                                                "couldn't delete old file"
-                                                                    .to_string()
-                                                            }
-                                                        }
-                                                    }
                                                     Err(why) => {
-                                                        eprintln!("{why:?}");
+                                                        eprintln!("couldn't clear image from tmpimages: {why:?}");
-                                                        "couldn't save file to final destination"
+                                                        status::Custom(Status::Ok, uuid)
-                                                            .to_string()
                                                     }
                                                 }
                                             }
-                                            Err(_) => "Couldn't save to DB".to_string(),
+                                            Err(why) => {
-                                        }
+                                                eprintln!("{why:?}");
-                                    } else {
+                                                status::Custom(
-                                        "Invalid perms".to_string()
+                                                    Status::InternalServerError,
+                                                    "Couldn't save to DB".to_string(),
+                                                )
+                                            }
+                                        },
+                                        Err(_) => status::Custom(
+                                            Status::InternalServerError,
+                                            "Couldn't copy file to final location".to_string(),
+                                        ),
                                     }
                                 }
-                                None => "Invalid login token".to_string(),
+                                Err(_) => status::Custom(
+                                    Status::Forbidden,
+                                    "File isn't an image".to_string(),
+                                ),
                             }
                         }
-                        None => "Not logged in".to_string(),
+                        Err(_) => status::Custom(
+                            Status::InternalServerError,
+                            "Couldn't save temporary file".to_string(),
+                        ),
                     }
                 }
-                Err(why) => {
+                false => status::Custom(
-                    // isn't an image, or something else went wrong
+                    Status::Unauthorized,
-                    eprintln!("{why:?}");
+                    "You don't have the right permissions for that".to_string(),
-                    "error".to_string()
+                ),
-                }
             }
         }
-        Err(why) => why.to_string(),
+        LoginStatus::InvalidToken => {
+            status::Custom(Status::Unauthorized, "Invalid login token".to_string())
+        }
+        LoginStatus::NotLoggedIn => {
+            status::Custom(Status::Unauthorized, "Not logged in".to_string())
+        }
     }
 }
 

src/tables.rs

@@ -1,7 +1,7 @@
 use base64::{engine::general_purpose, Engine};
 use rand::{RngCore, SeedableRng};
 use regex::Regex;
-use rocket::http::Cookie;
+use rocket::http::{Cookie, CookieJar};
 use rocket_db_pools::sqlx::Executor;
 use rocket_db_pools::Connection;
 use rocket_db_pools::{
@@ -67,6 +67,12 @@ pub struct User {
     pub comment: bool,
 }
 
+pub enum LoginStatus {
+    InvalidToken,
+    NotLoggedIn,
+    LoggedIn(User)
+}
+
 impl User {
     pub async fn create(db: &mut Connection<Db>, username: &String, password: &String) -> Result<String, String> {
         match Regex::new(r"[^A-Za-z0-9_]") {
@@ -217,6 +223,22 @@ impl User {
             }
         }
     }
+
+    pub async fn login_status(db: &mut Connection<Db>, cookies: &CookieJar<'_>) -> LoginStatus {
+        match cookies.get_private("token") {
+            Some(t) => {
+                match User::get_by_token(db, t).await {
+                    Some(user) => {
+                        LoginStatus::LoggedIn(user)
+                    },
+                    None => {
+                        LoginStatus::InvalidToken
+                    }
+                }
+            },
+            None => LoginStatus::NotLoggedIn
+        }
+    }
 }
 
 pub struct Image {

web/uploadimage.html

@@ -32,6 +32,8 @@
       },
       body: input.files[0] 
     })
+
+    // TODO: if status is 200, not 201, alert the user to tell the admins to clear tmpimages
     alert(await token.text());
   });