moderation

Author: docteurklein

postgres-language-server.jsonc

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://pg-language-server.com/0.24.0/schema.json",
+  "extends": [],
+  "vcs": {
+    "enabled": false,
+    "clientKind": "git",
+    "useIgnoreFile": false
+  },
+  "files": {
+    "ignore": []
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "splinter": {
+    "enabled": true
+  },
+  "format": {
+    "enabled": false
+  },
+  "pglinter": {
+    "enabled": true
+  },
+  "typecheck": {
+    "enabled": true,
+    "searchPath": ["*"]
+  },
+  "plpgsqlCheck": {
+    "enabled": false
+  },
+  "db": {
+    "host": "10.250.0.2",
+    "port": 5432,
+    "username": "postgres",
+    "database": "httpg",
+    "connTimeoutSecs": 10,
+    "disableConnection": false
+    // "allowStatementExecutionsAgainst": ["127.0.0.1/*", "localhost/*", "10.250.0.2/*"]
+  }
+}

sql/blog/index.sql

@@ -28,16 +28,37 @@ using (published_at is not null);
 -- drop table if exists comment cascade;
 create table if not exists comment (
     comment_id uuid primary key default uuidv7(),
-    author text not null check (trim(author) <> ''),
-    content text not null check (length(content) <= 10000 and trim(content) <> ''),
+    author text not null check (trim(author) <> '' and length(author) <= 100),
+    content text not null check (trim(content) <> '' and length(content) <= 10000),
     post_id uuid not null references post (post_id) on delete cascade,
-    published_at timestamptz default now()
+    published_at timestamptz default now(),
+    approved_at timestamptz default null
 );
 
 create index if not exists post_id on comment (post_id);
 
 grant select, insert on table comment to anon;
 
+alter table comment enable row level security;
+
+drop policy if exists "moderated_select" on comment;
+create policy "moderated_select" on comment for all to anon
+using ((
+    with query (query) as (
+        select nullif(current_setting('httpg.query', true), '')::jsonb
+    )
+    select case when query->'qs' ? 'include_unmoderated' or comment.comment_id = coalesce(query->'qs'->>'comment_id', query->'body'->'params'->>0)::uuid
+        then true
+        else approved_at is not null
+    end
+    from query
+))
+with check (true);
+
+-- drop policy if exists "moderated_insert" on comment;
+-- create policy "moderated_insert" on comment as restrictive for insert to anon
+-- with check (true);
+
 truncate post cascade;
 insert into post (title, content, published_at)
 select i::text, xmlelement(name h3, 'hello '||i)::text, case when i > 6 then null else now() end
@@ -62,53 +83,86 @@ from generate_series(1, 5) i, post;
 -- drop view if exists post_html cascade;
 create or replace view post_html (post_id, body)
 with (security_invoker)
-as with entry (post_id, xml) as (
+as with httpg (params, comment_id, include_unmoderated) as (
+    with query (query) as (
+        select nullif(current_setting('httpg.query', true), '')::jsonb
+    )
+    select query->'body'->'params', (query->'qs'->>'comment_id')::uuid, query->'qs' ? 'include_unmoderated'
+    from query
+),
+entry (post_id, xml) as (
     select post_id, xmlelement(name div,
         xmlelement(name article, xmlattributes('card' as class),
-            xmlelement(name h2, post.title),
+            xmlelement(name a, xmlattributes(
+                url('/blog/query', jsonb_build_object(
+                    'sql', 'select * from blog.head union all select body::text from blog.post_html where post_id = $1::uuid',
+                    'params[]', post_id
+                )) as href
+            ),
+                xmlelement(name h2, post.title)
+            ),
             post.content::xml,
             xmlelement(name hr),
+            xmlelement(name h4, 'Comments'),
             xmlelement(name form, xmlattributes(
                 'POST' as method,
                 '/blog/query' as action
             ),
                 xmlelement(name input, xmlattributes(
                     'hidden' as type,
                     'sql' as name,
-                    'insert into blog.comment (author, content, post_id) values ($1, $2, $3::uuid)' as value
+                    $$
+                        insert into blog.comment (comment_id, author, content, post_id) values ($1::uuid, $2, $3, $4::uuid)
+                        returning 303 status, hstore('Location', url.url('/blog/query', jsonb_build_object(
+                            'sql', 'select * from blog.head union all select body::text from blog.post_html where post_id = $1::uuid',
+                            'params[0]', post_id,
+                            'comment_id', comment_id
+                        ))) header
+                    $$ as value
                 )),
                 xmlelement(name input, xmlattributes(
                     'hidden' as type,
                     'on_error' as name,
-                    'select * from blog.blog' as value
+                    'select * from blog.head union all select body::text from blog.post_html where post_id = $4::uuid' as value
                 )),
                 xmlelement(name input, xmlattributes(
                     'hidden' as type,
-                    'redirect' as name,
-                    url('/blog/query', jsonb_build_object('sql', 'select * from blog.blog')) as value
+                    'params[0]' as name,
+                    'author' as placeholder,
+                    coalesce(params->>0, uuidv7()::text) as value
                 )),
                 xmlelement(name input, xmlattributes(
                     'text' as type,
-                    'params[0]' as name,
-                    'author' as placeholder
+                    'params[1]' as name,
+                    'author' as placeholder,
+                    params->>1 as value
                 )),
                 xmlelement(name textarea, xmlattributes(
-                    'params[1]' as name,
-                    'comment' as placeholder
-                ), ''),
+                    'params[2]' as name,
+                    'comment' as placeholder,
+                    7 as rows
+                ), coalesce(params->>2, '')),
                 xmlelement(name input, xmlattributes(
                     'hidden' as type,
-                    'params[2]' as name,
+                    'params[3]' as name,
                     post_id as value
                 )),
                 xmlelement(name input, xmlattributes(
                     'submit' as type,
                     'Comment' as value
                 ))
             ),
+            xmlelement(name a, xmlattributes(
+                url('/blog/query', jsonb_build_object(
+                    'sql', 'select * from blog.head union all select body::text from blog.post_html where post_id = $1::uuid',
+                    'params[]', post_id,
+                    'include_unmoderated', null
+                )) as href
+            ), 'Include unmoderated'),
             xmlelement(name div, xmlattributes('messages' as class), xmlagg(
                 xmlelement(name article, xmlattributes('card' as class),
-                    comment.content,
+                    xmlelement(name address, comment.author),
+                    comment.content
                     -- (
                     --     with recursive n (comment_id, n, i, ordinality) as (
                     --         select comment_id, r.n, 0, ordinality
@@ -123,15 +177,14 @@ as with entry (post_id, xml) as (
                     --     group by comment_id
                     --     -- order by i, ordinality
                     -- )),
-                    xmlelement(name address, comment.author)
                 )
-                order by comment.published_at
+                order by comment.published_at desc
             ))
         )
     )
-    from post
+    from httpg, post
     left join comment using (post_id)
-    group by post_id
+    group by post_id, params
 )
 select post_id, xml
 from entry
@@ -153,33 +206,45 @@ select $html$<!DOCTYPE html>
     <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'self'; form-action 'self'; " />
     <link rel="stylesheet" href="/cpres/index.css?v=4" />
 </head>
-$html$;
-
-grant select on table head to anon;
-
--- drop view if exists blog cascade;
-create or replace view blog (html)
-with (security_invoker)
-as
-with httpg (error) as (
-    select nullif(current_setting('httpg.errors', true), '')::jsonb->>'error'
-)
-table head
+$html$
 union all
-select xmlelement(name h1, 'docteurklein''s blog')::text
+select xmlelement(name a, xmlattributes(
+    url('/blog/query', jsonb_build_object(
+        'sql', 'select * from blog.blog'
+    )) as href
+),
+    xmlelement(name h1, 'docteurklein''s blog')
+)::text
 union all
+(with httpg (error) as (
+    select nullif(current_setting('httpg.errors', true), '')::jsonb->>'error'
+)
 select xmlelement(name article, xmlattributes(
     'card error' as class
 ), coalesce(
-    pg_get_constraintdef((
-        select oid
-        from pg_constraint
-        where conname = substring(error, 'violates check constraint "(\w+)"')
-    )),
+    (
+        with c (oid, name) as (
+            select c.oid, a.attname
+            from pg_constraint c
+            join pg_attribute a on (a.attnum = any(c.conkey) and a.attrelid = c.conrelid)
+            where conname = substring(error, 'violates check constraint "(\w+)"')
+            and connamespace = to_regnamespace('blog')
+        )
+        select string_agg(format('%s: %s', name, pg_get_constraintdef(oid)), ', ')
+        from c
+    ),
     error
 ))::text
 from httpg
-where error is not null
+where error is not null)
+;
+
+grant select on table head to anon;
+
+-- drop view if exists blog cascade;
+create or replace view blog (html)
+with (security_invoker)
+as table head
 union all
 select body::text
 from post_html

sql/view.sql

@@ -2,6 +2,8 @@
 
 set  search_path to cpres, url, pg_catalog, public;
 
+grant execute on function url to anon, person, httpg;
+
 create or replace function _(id_ text, lang_ text = null)
 returns text
 immutable parallel safe -- leakproof
@@ -24,7 +26,7 @@ begin atomic
     );
 end;
 
-grant execute on function _ to anon, httpg;
+grant execute on function _ to anon, person, httpg;
 
 create or replace function max_interest_price(good good) returns xml
 language sql
@@ -45,7 +47,7 @@ begin atomic;
     where price > 0;
 end;
 
-grant execute on function max_interest_price to anon, httpg;
+grant execute on function max_interest_price to anon, person, httpg;
 
 create or replace function interest_control(good good, interest interest) returns xml
 language sql
@@ -125,7 +127,7 @@ begin atomic;
     );
 end;
 
-grant execute on function interest_control to anon;
+grant execute on function interest_control to anon, person;
 
 drop view if exists route cascade;
 create or replace view route (geom, node, cost, id, "group", style, tooltip, popup)

src/extract/query.rs

@@ -254,11 +254,11 @@ where
         let sql = qs.sql.or(body.sql).unwrap_or("".into());
         let sql = match Parser::parse_sql(&PostgreSqlDialect{}, sql.as_str()) {
             Ok(mut statements) => {
-                let mut whitelist = Whitelist(None);
+                let mut whitelist = Whitelist(Err(HttpgError::RefusedSql { query: sql.clone() }));
                 let _ = statements.visit(&mut whitelist);
 
-                if let Some(query) = whitelist.0 {
-                    return Err(HttpgError::RefusedSql {query}.into_response());
+                if whitelist.0.is_err() {
+                    return Err(whitelist.0.into_response());
                 }
 
                 if let Some(order) = order.to_owned() {

src/sql/mod.rs

@@ -1,20 +1,22 @@
 use sqlparser::{ast::{Expr, Function, Ident, OrderBy, OrderByExpr, Query, SetExpr, Spanned, Statement, TableFactor, TableWithJoins, VisitorMut}};
 use std::{collections::BTreeMap, ops::{ControlFlow, Not}};
 
+use crate::error::HttpgError;
+
 pub struct VisitOrderBy(pub BTreeMap<String, serde_json::Value>);
 
 #[derive(Debug)]
-pub struct Whitelist(pub Option<String>);
+pub struct Whitelist(pub Result<(), HttpgError>);
 
 impl VisitorMut for Whitelist {
     type Break = ();
 
     fn pre_visit_expr(&mut self, expr: &mut Expr) -> ControlFlow<Self::Break> {
         self.0 = match expr {
-            Expr::Function(Function { name, ..}) if name.to_string() == "set_config" => Some(expr.to_string()),
-            _ => None,
+            Expr::Function(Function { name, ..}) if name.to_string() == "set_config" => Err(HttpgError::RefusedSql {query: expr.to_string()}),
+            _ => Ok(()),
         };
-        if self.0.is_some() {
+        if self.0.is_err() {
             return ControlFlow::Break(());
         }
         ControlFlow::Continue(())
@@ -28,11 +30,11 @@ impl VisitorMut for Whitelist {
             | Statement::Update(_)
             | Statement::Delete(_)
         ) {
-            None
+            Ok(())
         } else {
-            Some(statement.to_string())
+            Err(HttpgError::RefusedSql { query: statement.to_string() })
         };
-        if self.0.is_some() {
+        if self.0.is_err() {
             return ControlFlow::Break(());
         }
         ControlFlow::Continue(())
@@ -49,11 +51,11 @@ impl VisitorMut for Whitelist {
             | SetExpr::Table(_)
             | SetExpr::SetOperation {..}
         ) {
-            None
+            Ok(())
         } else {
-            Some(query.to_string())
+            Err(HttpgError::RefusedSql { query: query.to_string() })
         };
-        if self.0.is_some() {
+        if self.0.is_err() {
             return ControlFlow::Break(());
         }
         ControlFlow::Continue(())