diff options
Diffstat (limited to 'src/api/cors.rs')
| -rw-r--r-- | src/api/cors.rs | 25 |
1 files changed, 16 insertions, 9 deletions
diff --git a/src/api/cors.rs b/src/api/cors.rs index 406b7be..fc8270d 100644 --- a/src/api/cors.rs +++ b/src/api/cors.rs @@ -1,6 +1,6 @@ //! Pages of other origins reading this node: the dashboards of other members, which a //! page subscribes to for their own links and messages (`/admin/dashboard/links/own`, -//! `/admin/dashboard/messages/own/events`), refreshing its +//! `/admin/dashboard/messages/own/events`, and one written out), refreshing its //! token on any node (`/auth/refresh`, `/auth/whoami`). Only those endpoints, only for //! the origins of the dashboards the member list names and those of `--cors-origins`, //! and without credentials: a page sends its token itself (`Authorization: Bearer`), @@ -18,14 +18,19 @@ use crate::swarm::members; /// The endpoints other origins may call. fn open(path: &str) -> bool { - matches!( - path, - "/admin/dashboard/links/own" - | "/admin/dashboard/links/own/events" - | "/admin/dashboard/messages/own/events" - | "/auth/refresh" - | "/auth/whoami" - ) + // A message written out (`/admin/dashboard/messages/own/{seq}`). + let message = path + .strip_prefix("/admin/dashboard/messages/own/") + .is_some_and(|seq| !seq.is_empty() && seq.bytes().all(|byte| byte.is_ascii_digit())); + message + || matches!( + path, + "/admin/dashboard/links/own" + | "/admin/dashboard/links/own/events" + | "/admin/dashboard/messages/own/events" + | "/auth/refresh" + | "/auth/whoami" + ) } /// `url`'s origin (`scheme://host[:port]`), if it is a URL with one. @@ -138,6 +143,8 @@ mod tests { #[test] fn only_some_endpoints() { assert!(open("/admin/dashboard/links/own")); + assert!(open("/admin/dashboard/messages/own/42")); + assert!(!open("/admin/dashboard/messages/own/x")); assert!(open("/auth/refresh")); assert!(!open("/auth/login")); assert!(!open("/store")); |