diff options
Diffstat (limited to 'src/api/dashboard')
| -rw-r--r-- | src/api/dashboard/dashboard.html | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html index 8146f32..601b578 100644 --- a/src/api/dashboard/dashboard.html +++ b/src/api/dashboard/dashboard.html @@ -1592,7 +1592,7 @@ function editor(path, value, done, options = {}) { : null; if (extra) extra.value = options.extra.initial || ""; const send = options.send || ((body, type) => fetch(storeUrl(path, false), - { method: "PUT", body, headers: { "Content-Type": type } })); + withToken({ method: "PUT", body, headers: { "Content-Type": type } }))); const save = el("button", { type: "button" }, options.extra ? "Add" : "Save"); const cancel = el("button", { type: "button" }, "Cancel"); const submit = async () => { @@ -1642,7 +1642,7 @@ function editor(path, value, done, options = {}) { message.className = "note"; message.textContent = "Deleting…"; try { - const response = await fetch(storeUrl(path, false), { method: "DELETE" }); + const response = await fetch(storeUrl(path, false), withToken({ method: "DELETE" })); if (!response.ok) { let why = response.status === 403 ? "not allowed" : ""; try { why = (await response.json()).error || why; } catch { /* no body */ } @@ -1728,7 +1728,7 @@ function addButton(kind, path, known, place) { : (/^(-1|\d+)$/.test(extra.trim()) ? null : "The index: 0 or more, or -1 for the end."); }, send: (body, type, extra) => fetch(storeUrl([...path, map ? extra : extra.trim()], false), - { method: map ? "PUT" : "POST", body, headers: { "Content-Type": type } }), + withToken({ method: map ? "PUT" : "POST", body, headers: { "Content-Type": type } })), }); area.prepend(form); }); @@ -2282,6 +2282,12 @@ function unapplySubscriptions() { // Each refreshed half way through its life. let token = null, narrowToken = null, tokenWhy = "not logged in yet", tokenTimer = null; const READ_MEMBERS = [{ path: ["_continuum", "members"], rights: ["read"] }]; +// A request that changes something, with this page's token: the session's cookie lets +// in only those that read (`login::bearer`). +function withToken(init) { + if (token) init.headers = Object.assign({}, init.headers, { Authorization: "Bearer " + token.token }); + return init; +} async function tokenCall(url, bearer, body) { const headers = { "Content-Type": "application/json" }; if (bearer) headers.Authorization = "Bearer " + bearer; @@ -3320,8 +3326,8 @@ remakeForm.addEventListener("submit", event => { const rules = remakeRules(); if (rules.length) options.set("rules", JSON.stringify(rules)); const query = options.size ? "?" + options : ""; - request = fetch("remakes" + query, { method: "POST", body: file, - headers: { "Content-Type": "application/octet-stream" } }); + request = fetch("remakes" + query, withToken({ method: "POST", body: file, + headers: { "Content-Type": "application/octet-stream" } })); } else { const body = { kind }; if (settle) body.settle = settle; @@ -3338,8 +3344,8 @@ remakeForm.addEventListener("submit", event => { const rules = remakeRules(); if (rules.length) body.spec.rules = rules; } - request = fetch("remakes" + (force ? "?" + force : ""), { method: "POST", body: JSON.stringify(body), - headers: { "Content-Type": "application/json" } }); + request = fetch("remakes" + (force ? "?" + force : ""), withToken({ method: "POST", + body: JSON.stringify(body), headers: { "Content-Type": "application/json" } })); } remakeResult("Proposing…", false); request @@ -3392,7 +3398,7 @@ connection.style.cursor = "pointer"; connection.addEventListener("click", () => { pulse(); if (live) { - fetch("dashboard/refresh", { method: "POST" }).catch(() => {}); + fetch("dashboard/refresh", withToken({ method: "POST" })).catch(() => {}); documentChanged({ all: true }); } else { if (events) events.close(); |