auth: add AuthContext.Access
Same logic as server.Access, but lower-level. Useful to check for
a permission not covered by the GraphQL schema @access directives
(such as builds.sr.ht secrets).
server/email: don't panic in EmailRecover
A panic in here is not great, because this function is supposed to
be the panic handler. Let's just log the error instead.
server/email: log missing mail::error-to, treat empty string as unset
Log a message when mail::error-to is unset, just in case the admin
forgot to set it. Don't try to parse an email address if error-to
is set to the empty string (the default value in the default config
file).
server/email: simplify and cleanup
- Only print the error once
- Remove unnecessary var
- Use debug.Stack instead of hand-rolled logic
- Ignore json.Marshal errors in a simpler way
server: fix error message on missing grant in Access
The error returned when a token is missing a required grant would
be "Access denied for invalid auth method" which is confusing.
Fix this with a more accurate error message.
database/middleware: don't use sql.Conn in WithTx
We can just use sql.DB instead of sql.Conn here. Simplifies the
code and reduces the risk of getting "bad connection" errors.
auth: add /query/external/* to anonymous whitelist
redis: Update style
To match the s3 middleware.
auth/middleware: make auth scheme case-insensitive
According to RFC 7235 section 2.1, the auth scheme is
case-insensitive.
database/middleware: do not recover/panic in defer
defer always runs after a panic. There is no need to recover and
re-panic, we can just unconditionally tx.Rollback() (it will
silently error out if the transaction has already been committed or
rolled back).
This fixes the stack trace of the panic being incorrect. It points
to this function instead of the real culprit.
server/directives: handle auth.AUTH_ANON_INTERNAL in Access
email: remove content headers of passed-in message
The email has already been parsed according to the headers, but they are
still present. However, signing or encrypting the email will change the
content format, so remove any such headers before continuing.
server: register SQL collector
Missed this step
Add prometheus SQL connection stats
Also updates the prometheus client_go library
auth: fix invalid json tag in InternalAuth
email: handle error from Enqueue() in EnqueueStd()
Update pq (Postgres driver) to latest version
auth: Use canonical user IDs
When adding users to the database, use the canonical user ID from
meta.sr.ht.