server: add AnonRouter function
To expose anonymous (unauthenticated) routing to downstream core-go
users.
server: fix playground on config.Debug
A recent change made it so that the playground required authentication
to access in debug mode; this moves it under the other auth-free
endpoints.
server: use routing groups
Instead of hardcoding some exceptions in the auth middleware, use a
different routing group for routes that do not require auth. Makes the
auth middleware more generic and also removes a lot of unneccessary
middleware processing from routes that don't need it.
For now, the added group is not accessible from outside the module, but
if the need arises, this might be an option.
server/directives: disambiguate AnonInternal error message
AUTH_INTERNAL won't work with AnonInternal.
Migrate to chi v5
v1 is not maintained anymore.
server/email: use go-message for address parsing
No need to additionally depend on net/mail
auth: add AuthContext.Access
Same logic as server.Access, but lower-level. Useful to check for
a permission not covered by the GraphQL schema @access directives
(such as builds.sr.ht secrets).
server/email: don't panic in EmailRecover
A panic in here is not great, because this function is supposed to
be the panic handler. Let's just log the error instead.
server/email: log missing mail::error-to, treat empty string as unset
Log a message when mail::error-to is unset, just in case the admin
forgot to set it. Don't try to parse an email address if error-to
is set to the empty string (the default value in the default config
file).
server/email: simplify and cleanup
- Only print the error once
- Remove unnecessary var
- Use debug.Stack instead of hand-rolled logic
- Ignore json.Marshal errors in a simpler way
server: fix error message on missing grant in Access
The error returned when a token is missing a required grant would
be "Access denied for invalid auth method" which is confusing.
Fix this with a more accurate error message.
server/directives: handle auth.AUTH_ANON_INTERNAL in Access
server: register SQL collector
Missed this step
Add prometheus SQL connection stats
Also updates the prometheus client_go library
Normalize remote address before saving to context
One cause for https://todo.sr.ht/~sircmpwn/meta.sr.ht/193 was that code
performing this sanitization was in multiple places, and a fix was not
applied in all places. There is no reasonable expectation for the port
to be present anyways, e.g. if the address is taken from a trusted
reverse proxy's header. Hence, perform the normalization here, so that
the code doing this in applications can be simplified.
Note that this does not yet fix the below ticket, it will just make the
fix easier.
References: https://todo.sr.ht/~sircmpwn/meta.sr.ht/193
email.EnqueueStd: Don't overwrite headers
Sometimes we need to specify the Message-Id, From, and Reply-To headers
(e.g. for todo.sr.ht ticket notifications). Don't overwrite these
headers if they are present.
Allow AUTH_COOKIE to access @private fields
Add @anoninternal support code
This is a slightly better approach to the previous commit.