6fb4dc6ca8
Some checks failed
continuous-integration/drone Build is failing
A publisher names the feed in hub.url (spec §7.1). This read hub.topic, which belongs to subscribe and unsubscribe, so every compliant publisher sent a notification the hub could not resolve: it logged "could not request topic :" and returned 200 with an empty body. Nothing was ever delivered, and the status said the opposite. hub.topic is still read, but only when hub.url is missing. The rest is the same class of bug — a response that reported success for work that did not happen: - a publish with no topic is 400, a topic that does not answer 2xx is 502, and a subscriber is told nothing about either; - the fetched body is bounded, its response closed, and a callback is retried once with the outcome logged instead of assuming the first POST landed; - unsubscribe wrote 200 and then an error body into the same response; it now answers once; - the challenge comes from crypto/rand and must be echoed exactly, since a substring match let any page that mentioned it pass verification; - pq.Error implements error on the pointer, so the value assertion never compiled; the statement now type-asserts the pointer; - the database password can come from HUB_DB_PASSWORD instead of only being baked into the binary. The build moves to go.mod and golang:1.22, because io.Discard does not exist in the 1.12 image the pipeline was pinned to.
82 lines
1.9 KiB
Go
82 lines
1.9 KiB
Go
package storage
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
|
|
"github.com/davecgh/go-spew/spew"
|
|
"github.com/lib/pq"
|
|
)
|
|
|
|
type postgres struct {
|
|
db *sql.DB
|
|
}
|
|
|
|
func New(dsn string) (Service, error) {
|
|
pool, err := sql.Open("postgres", dsn)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("could not open database connection: %v", err)
|
|
}
|
|
return &postgres{pool}, nil
|
|
}
|
|
|
|
func (s *postgres) Close() error {
|
|
return s.db.Close()
|
|
}
|
|
|
|
func (s *postgres) Subscribe(topic string, sub Subscriber) error {
|
|
_, err := s.db.Exec(`
|
|
INSERT INTO "subscribers"
|
|
("topic", "callback", "lease_seconds", "secret", "created", "updated")
|
|
VALUES ($1, $2, $3, $4, now(), now())
|
|
ON CONFLICT (topic, callback)
|
|
DO UPDATE SET lease_seconds = excluded.lease_seconds,
|
|
secret = excluded.secret,
|
|
updated = now(),
|
|
last_subscribed = now()
|
|
`,
|
|
topic,
|
|
sub.Callback,
|
|
sub.LeaseSeconds,
|
|
sub.Secret,
|
|
)
|
|
// pq.Error implements error on the pointer, so the value assertion never
|
|
// compiled into anything useful.
|
|
if e, ok := err.(*pq.Error); ok {
|
|
spew.Dump(e)
|
|
}
|
|
return err
|
|
}
|
|
|
|
func (s *postgres) RemoveExpiredSubscribers() error {
|
|
_, err := s.db.Exec(`DELETE FROM "subscribers" WHERE "last_subscribed" + "lease_seconds" * interval '1' second < now()`)
|
|
return err
|
|
}
|
|
|
|
func (s *postgres) Unsubscribe(topic, callback string) error {
|
|
_, err := s.db.Exec(
|
|
`DELETE FROM "subscribers" WHERE "topic" = $1 AND "callback" = $2`,
|
|
topic,
|
|
callback,
|
|
)
|
|
return err
|
|
}
|
|
|
|
func (s *postgres) Subscribers(topic string) ([]Subscriber, error) {
|
|
rows, err := s.db.Query(`SELECT callback, lease_seconds, secret, created FROM "subscribers" WHERE "topic" = $1`, topic)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var subscribers []Subscriber
|
|
for rows.Next() {
|
|
var sub Subscriber
|
|
err := rows.Scan(&sub.Callback, &sub.LeaseSeconds, &sub.Secret, &sub.Created)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
subscribers = append(subscribers, sub)
|
|
}
|
|
return subscribers, nil
|
|
}
|