From f9731e15c37f8591f36a0728fd4d931c3ce1a253 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Wed, 17 Feb 2021 13:08:34 -0500
Subject: [PATCH] Various bug fixes per pages.sr.ht

---
 auth/middleware.go | 15 +++++++--------
 auth/token.go      |  2 +-
 config/config.go   |  6 +++++-
 3 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/auth/middleware.go b/auth/middleware.go
index 14f418e38b77357f882c1dae4fd244a271b7b731..aa59ce21317f0a176a486b5d77a960a78cbf7329 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -277,7 +277,7 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 
 	payload = crypto.DecryptWithExpiration(payload, 30*time.Second)
 	if payload == nil {
-		authError(w, "Invalid Authorization header", http.StatusForbidden)
+		authError(w, "Invalid Authorization header (encryption error)", http.StatusForbidden)
 		return
 	}
 
@@ -287,7 +287,7 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 	}
 
 	if internalAuth.ClientID == "" || internalAuth.NodeID == "" {
-		authError(w, "Invalid Authorization header", http.StatusForbidden)
+		authError(w, "Invalid Authorization header (missing Client ID or Node ID)", http.StatusForbidden)
 	}
 
 	var auth *AuthContext
@@ -372,7 +372,7 @@ func FetchMetaProfile(ctx context.Context, username string, user *AuthContext) e
 				$1, $2, $3, $4, $5, $6, $7
 			)
 			ON CONFLICT DO NOTHING
-			RETURNING (
+			RETURNING
 				id,
 				created,
 				updated,
@@ -382,13 +382,12 @@ func FetchMetaProfile(ctx context.Context, username string, user *AuthContext) e
 				url,
 				location,
 				bio,
-				suspension_notice
-			);`,
-			profile.Username, profile.Email, profile.UserType, profile.URL,
-			profile.Location, profile.Bio, profile.SuspensionNotice)
+				suspension_notice;`,
+			&profile.Username, &profile.Email, &profile.UserType, &profile.URL,
+			&profile.Location, &profile.Bio, &profile.SuspensionNotice)
 
 		// TODO: Register webhooks
-		if err := row.Scan(&user.UserID, user.Created, user.Updated,
+		if err := row.Scan(&user.UserID, &user.Created, &user.Updated,
 			&user.Username, &user.Email, &user.UserType, &user.URL,
 			&user.Location, &user.Bio, &user.SuspensionNotice); err != nil {
 			if err == sql.ErrNoRows {
diff --git a/auth/token.go b/auth/token.go
index ca2baeacc15827d9ba32fc4050c07cdfa6f7ca5a..6076e020ec9c998d92893fe68837f33c56359287 100644
--- a/auth/token.go
+++ b/auth/token.go
@@ -54,7 +54,7 @@ func DecodeToken(token string) *OAuth2Token {
 	mac := payload[len(payload)-32:]
 	payload = payload[:len(payload)-32]
 	if crypto.HMACVerify(payload, mac) == false {
-		log.Printf("Invalid bearer token: HMAC verification failed (MAC: [%d]%s; payload: [%d]%s)",
+		log.Printf("Invalid bearer token: HMAC verification failed (MAC: [%d]%s; payload: [%d]%s",
 			len(mac), hex.EncodeToString(mac), len(payload), hex.EncodeToString(payload))
 		return nil
 	}
diff --git a/config/config.go b/config/config.go
index ad157751547f7f64e765ab53b8251062c2d0027d..24a20d2a3cd95590cc70e3b1099ac7aad90ca1de 100644
--- a/config/config.go
+++ b/config/config.go
@@ -37,7 +37,11 @@ func LoadConfig(defaultAddr string) ini.File {
 		}
 	}
 
-	for _, path := range []string{"../config.ini", "/etc/sr.ht/config.ini"} {
+	for _, path := range []string{
+			"config.ini",
+			"../config.ini",
+			"/etc/sr.ht/config.ini",
+		} {
 		config, err = ini.LoadFile(path)
 		if err == nil {
 			break