rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Review fixes

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-04-14 13:16:24 +04:00
parent ced9ba3550
commit c8586346be
2 changed files with 51 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/coredata/cookie_banner.go
View File

@@ -168,6 +168,7 @@ LIMIT 1;
func (b *CookieBanner) LoadActiveByOrigin(
ctx context.Context,
conn pg.Querier,
scope Scoper,
origin string,
) error {
q := `
@@ -185,12 +186,16 @@ SELECT
FROM
cookie_banners
WHERE
origin = @origin
%s
AND origin = @origin
AND state = 'ACTIVE'
LIMIT 1;
`
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"origin": origin}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args)
if err != nil {
@@ -345,8 +350,7 @@ INSERT INTO cookie_banners (
_, err := tx.Exec(ctx, q, args)
if err != nil {
var pgErr *pgconn.PgError
if errors.As(err, &pgErr) {
if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_cookie_banners_unique_active_origin" {
return ErrResourceAlreadyExists
}
@@ -393,8 +397,7 @@ WHERE
result, err := tx.Exec(ctx, q, args)
if err != nil {
var pgErr *pgconn.PgError
if errors.As(err, &pgErr) {
if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_cookie_banners_unique_active_origin" {
return ErrResourceAlreadyExists
}

84
pkg/server/api/cookiebanner/v1/cors_middleware.go
View File

@@ -26,54 +26,56 @@ import (
func newCORSMiddleware(logger *log.Logger, cookieBannerSvc *cookiebanner.Service) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
origin := r.Header.Get("Origin")
if origin == "" {
next.ServeHTTP(w, r)
return
}
return http.HandlerFunc(
func(w http.ResponseWriter, r *http.Request) {
origin := r.Header.Get("Origin")
if origin == "" {
next.ServeHTTP(w, r)
return
}
bannerIDStr := chi.URLParam(r, "bannerID")
if bannerIDStr == "" {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
bannerID, err := gid.ParseGID(bannerIDStr)
if err != nil {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
banner, err := cookieBannerSvc.GetActiveCookieBanner(r.Context(), bannerID)
if err != nil {
if errors.Is(err, cookiebanner.ErrBannerNotFound) {
bannerIDStr := chi.URLParam(r, "bannerID")
if bannerIDStr == "" {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
logger.ErrorCtx(r.Context(), "cannot load cookie banner for CORS check", log.Error(err))
http.Error(w, "internal server error", http.StatusInternalServerError)
return
}
canonicalOrigin := cookiebanner.CanonicalizeOrigin(origin)
if banner.Origin != canonicalOrigin {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
bannerID, err := gid.ParseGID(bannerIDStr)
if err != nil {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
w.Header().Set("Access-Control-Allow-Origin", origin)
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
w.Header().Set("Access-Control-Max-Age", "600")
w.Header().Set("Vary", "Origin")
banner, err := cookieBannerSvc.GetActiveCookieBanner(r.Context(), bannerID)
if err != nil {
if errors.Is(err, cookiebanner.ErrBannerNotFound) {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
logger.ErrorCtx(r.Context(), "cannot load cookie banner for CORS check", log.Error(err))
http.Error(w, "internal server error", http.StatusInternalServerError)
return
}
if r.Method == http.MethodOptions {
w.WriteHeader(http.StatusNoContent)
return
}
canonicalOrigin := cookiebanner.CanonicalizeOrigin(origin)
if banner.Origin != canonicalOrigin {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
next.ServeHTTP(w, r)
})
w.Header().Set("Access-Control-Allow-Origin", origin)
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
w.Header().Set("Access-Control-Max-Age", "600")
w.Header().Set("Vary", "Origin")
if r.Method == http.MethodOptions {
w.WriteHeader(http.StatusNoContent)
return
}
next.ServeHTTP(w, r)
},
)
}
}