diff --git a/README.md b/README.md index 031da578..610f5c9e 100644 --- a/README.md +++ b/README.md @@ -32,8 +32,6 @@ Remark42 is a self-hosted, lightweight, and simple (yet functional) comment engi | --------------- | -------------------- | ---------------------- | ----- | ------ | ------------------------------- | | --url | REMARK_URL | `https://remark42.com` | no | all | url to remark server | | --bolt | BOLTDB_PATH | `/tmp` | no | all | path to data directory | -| --dbg | DEBUG | `false` | no | all | debug mode | -| --dev | DEV | `false` | no | all | development mode, no auth! | | --site | SITE | `remark` | yes | server | site name(s) | | --admin | ADMIN | | yes | server | admin(s) names (user id) | | --backup | BACKUP_PATH | `/tmp` | no | server | backups location | @@ -49,6 +47,9 @@ Remark42 is a self-hosted, lightweight, and simple (yet functional) comment engi | --provider | | `disqus` | no | import | provider type for import | | --site | | `remark` | no | import | site ID | | --file | | `disqus.xml` | no | import | import file | +| --dbg | DEBUG | `false` | no | all | debug mode | +| --dev | DEV | `false` | no | all | enable `dev` user | +| --dev-password | DEV_PASSWD | `password` | no | all | password for `dev` user | #### Run modes @@ -236,7 +237,7 @@ _all calls require auth and admin_ - All heavy REST calls cached internally, default expiration 4h - Users activity throttled globally (up to 1000) and limited locally (per user, up to 10 req/sec) - Request timeout set to 60sec -- Development mode (`--dev`) allows to test remark42 without login and with admin privileges. **should not be used in production deployment** +- Development mode (`--dev`) allows to test remark42 without social login and with admin privileges. Adds basic-auth for username: `dev`, password: `${DEV_PASSWD}`. **should not be used in production deployment** - User can vote for the comment multiple times but only to change his/her vote. Double-voting not allowed. - User can edit comments in 5 mins window after creation. - User ID prefixed by oauth provider name in order to avoid collisions and potential abuse. diff --git a/app/rest/api/rest.go b/app/rest/api/rest.go index 2199a47d..673f2879 100644 --- a/app/rest/api/rest.go +++ b/app/rest/api/rest.go @@ -222,7 +222,7 @@ func (s *Rest) findCommentsCtrl(w http.ResponseWriter, r *http.Request) { locator := store.Locator{SiteID: r.URL.Query().Get("site"), URL: r.URL.Query().Get("url")} log.Printf("[DEBUG] get comments for %+v", locator) - data, err := s.Cache.Get(s.urlKey(r), time.Hour, func() ([]byte, error) { + data, err := s.Cache.Get(rest.URLKey(r), time.Hour, func() ([]byte, error) { comments, e := s.DataService.Find(locator, r.URL.Query().Get("sort")) if e != nil { return nil, e @@ -255,7 +255,7 @@ func (s *Rest) lastCommentsCtrl(w http.ResponseWriter, r *http.Request) { max = 0 } - data, err := s.Cache.Get(s.urlKey(r), time.Hour, func() ([]byte, error) { + data, err := s.Cache.Get(rest.URLKey(r), time.Hour, func() ([]byte, error) { comments, e := s.DataService.Last(r.URL.Query().Get("site"), max) if e != nil { return nil, e @@ -303,7 +303,7 @@ func (s *Rest) findUserCommentsCtrl(w http.ResponseWriter, r *http.Request) { log.Printf("[DEBUG] get comments for userID %s, %s", userID, siteID) - data, err := s.Cache.Get(s.urlKey(r), time.Hour, func() ([]byte, error) { + data, err := s.Cache.Get(rest.URLKey(r), time.Hour, func() ([]byte, error) { comments, count, e := s.DataService.User(siteID, userID) if e != nil { return nil, e @@ -368,7 +368,7 @@ func (s *Rest) countCtrl(w http.ResponseWriter, r *http.Request) { func (s *Rest) listCtrl(w http.ResponseWriter, r *http.Request) { siteID := r.URL.Query().Get("site") - data, err := s.Cache.Get(s.urlKey(r), 8*time.Hour, func() ([]byte, error) { + data, err := s.Cache.Get(rest.URLKey(r), 8*time.Hour, func() ([]byte, error) { posts, e := s.DataService.List(siteID) if e != nil { return nil, e @@ -465,16 +465,6 @@ func (s *Rest) addFileServer(r chi.Router, path string, root http.FileSystem) { })) } -// urlKey gets url from request to use is as cache key -// admins will have separate keys in order tp prevent leak of admin-only data to regular users -func (s *Rest) urlKey(r *http.Request) string { - key := r.URL.String() - if user, err := rest.GetUserInfo(r); err == nil && user.Admin { // make seprate cache key for admins - key = "admin!!" + key - } - return key -} - // renderJSONWithHTML allows html tags and forces charset=utf-8 func renderJSONWithHTML(w http.ResponseWriter, r *http.Request, v interface{}) { data, err := encodeJSONWithHTML(v) diff --git a/app/rest/cache.go b/app/rest/cache.go index 37f62706..bb8b097d 100644 --- a/app/rest/cache.go +++ b/app/rest/cache.go @@ -2,6 +2,7 @@ package rest import ( "log" + "net/http" "time" cache "github.com/patrickmn/go-cache" @@ -46,3 +47,13 @@ func (lc *loadingCache) Flush() { go lc.postFlushFn() } } + +// URLKey gets url from request to use is as cache key +// admins will have separate keys in order tp prevent leak of admin-only data to regular users +func URLKey(r *http.Request) string { + key := r.URL.String() + if user, err := GetUserInfo(r); err == nil && user.Admin { // make seprate cache key for admins + key = "admin!!" + key + } + return key +} diff --git a/remark.rest b/remark.rest index aa9d0627..cbf3fed0 100644 --- a/remark.rest +++ b/remark.rest @@ -76,3 +76,7 @@ PUT {{host}}/api/v1/notify?site=remark&url=https://radio-t.com/p/2017/12/16/podc ### subscribtion status GET {{host}}/api/v1/notify?site=remark&url=https://radio-t.com/p/2017/12/16/podcast-576/ + +### ping +GET {{host}}/ping +