rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Review fixes

Browse Source 
Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-04-14 13:16:24 +04:00
parent ced9ba3550
commit c8586346be
2 changed files with 51 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/coredata/cookie_banner.go
View File

@@ -168,6 +168,7 @@ LIMIT 1;
func (b *CookieBanner) LoadActiveByOrigin( func (b *CookieBanner) LoadActiveByOrigin(
ctx context.Context, ctx context.Context,
conn pg.Querier, conn pg.Querier,
scope Scoper,
origin string, origin string,
) error { ) error {
q := ` q := `
@@ -185,12 +186,16 @@ SELECT
FROM FROM
cookie_banners cookie_banners
WHERE WHERE
origin = @origin %s
AND origin = @origin
AND state = 'ACTIVE' AND state = 'ACTIVE'
LIMIT 1; LIMIT 1;
` `
q = fmt.Sprintf(q, scope.SQLFragment())
args := pgx.StrictNamedArgs{"origin": origin} args := pgx.StrictNamedArgs{"origin": origin}
maps.Copy(args, scope.SQLArguments())
rows, err := conn.Query(ctx, q, args) rows, err := conn.Query(ctx, q, args)
if err != nil { if err != nil {
@@ -345,8 +350,7 @@ INSERT INTO cookie_banners (
_, err := tx.Exec(ctx, q, args) _, err := tx.Exec(ctx, q, args)
if err != nil { if err != nil {
var pgErr *pgconn.PgError if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
if errors.As(err, &pgErr) {
if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_cookie_banners_unique_active_origin" { if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_cookie_banners_unique_active_origin" {
return ErrResourceAlreadyExists return ErrResourceAlreadyExists
} }
@@ -393,8 +397,7 @@ WHERE
result, err := tx.Exec(ctx, q, args) result, err := tx.Exec(ctx, q, args)
if err != nil { if err != nil {
var pgErr *pgconn.PgError if pgErr, ok := errors.AsType[*pgconn.PgError](err); ok {
if errors.As(err, &pgErr) {
if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_cookie_banners_unique_active_origin" { if pgErr.Code == "23505" && pgErr.ConstraintName == "idx_cookie_banners_unique_active_origin" {
return ErrResourceAlreadyExists return ErrResourceAlreadyExists
} }

84
pkg/server/api/cookiebanner/v1/cors_middleware.go
View File

@@ -26,54 +26,56 @@ import (
func newCORSMiddleware(logger *log.Logger, cookieBannerSvc *cookiebanner.Service) func(http.Handler) http.Handler { func newCORSMiddleware(logger *log.Logger, cookieBannerSvc *cookiebanner.Service) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler { return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { return http.HandlerFunc(
origin := r.Header.Get("Origin") func(w http.ResponseWriter, r *http.Request) {
if origin == "" { origin := r.Header.Get("Origin")
next.ServeHTTP(w, r) if origin == "" {
return next.ServeHTTP(w, r)
} return
}
bannerIDStr := chi.URLParam(r, "bannerID") bannerIDStr := chi.URLParam(r, "bannerID")
if bannerIDStr == "" { if bannerIDStr == "" {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
bannerID, err := gid.ParseGID(bannerIDStr)
if err != nil {
http.Error(w, "forbidden", http.StatusForbidden)
return
}
banner, err := cookieBannerSvc.GetActiveCookieBanner(r.Context(), bannerID)
if err != nil {
if errors.Is(err, cookiebanner.ErrBannerNotFound) {
http.Error(w, "forbidden", http.StatusForbidden) http.Error(w, "forbidden", http.StatusForbidden)
return return
} }
logger.ErrorCtx(r.Context(), "cannot load cookie banner for CORS check", log.Error(err))
http.Error(w, "internal server error", http.StatusInternalServerError)
return
}
canonicalOrigin := cookiebanner.CanonicalizeOrigin(origin) bannerID, err := gid.ParseGID(bannerIDStr)
if banner.Origin != canonicalOrigin { if err != nil {
http.Error(w, "forbidden", http.StatusForbidden) http.Error(w, "forbidden", http.StatusForbidden)
return return
} }
w.Header().Set("Access-Control-Allow-Origin", origin) banner, err := cookieBannerSvc.GetActiveCookieBanner(r.Context(), bannerID)
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS") if err != nil {
w.Header().Set("Access-Control-Allow-Headers", "Content-Type") if errors.Is(err, cookiebanner.ErrBannerNotFound) {
w.Header().Set("Access-Control-Max-Age", "600") http.Error(w, "forbidden", http.StatusForbidden)
w.Header().Set("Vary", "Origin") return
}
logger.ErrorCtx(r.Context(), "cannot load cookie banner for CORS check", log.Error(err))
http.Error(w, "internal server error", http.StatusInternalServerError)
return
}
if r.Method == http.MethodOptions { canonicalOrigin := cookiebanner.CanonicalizeOrigin(origin)
w.WriteHeader(http.StatusNoContent) if banner.Origin != canonicalOrigin {
return http.Error(w, "forbidden", http.StatusForbidden)
} return
}
next.ServeHTTP(w, r) w.Header().Set("Access-Control-Allow-Origin", origin)
}) w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
w.Header().Set("Access-Control-Max-Age", "600")
w.Header().Set("Vary", "Origin")
if r.Method == http.MethodOptions {
w.WriteHeader(http.StatusNoContent)
return
}
next.ServeHTTP(w, r)
},
)
} }
} }