Brummel
2c6062a53e
The /web/ prefix predated the /api/ split; today it just clutters every URL
without disambiguating anything. All 16 browser routes move to the apex
(/cases, /login, /magic, /events, /audio/...). The 6 /api/* routes are
unchanged. A new /->>/cases redirect closes the apex 404.
The open-redirect guard in magic.rs and case_actions.rs flips from a
positive whitelist (starts_with("/web/")) to a deny-list: same-origin path,
not protocol-relative, not under /api/, no \. The /api/ exclusion is now
load-bearing and covered by tests.
Pre-production: no transition redirects.
74 lines
2.3 KiB
Rust
74 lines
2.3 KiB
Rust
//! URL path constants and builders.
|
|
//!
|
|
//! Centralising these catches routing refactors at compile time (a
|
|
//! rename to the constant/fn shows up in every test file in one
|
|
//! `cargo check`) rather than as a scatter of 404s.
|
|
//!
|
|
//! The public `/api/*` surface lives in `doctate_common` and is
|
|
//! re-exported from there (see `ONELINERS_PATH`, `UPLOAD_PATH`).
|
|
|
|
pub use doctate_common::{ONELINERS_PATH, UPLOAD_PATH};
|
|
|
|
// -- browser UI routes --
|
|
|
|
/// `POST /login` — form login (slug, password).
|
|
pub const LOGIN: &str = "/login";
|
|
/// `POST /logout` — CSRF-protected logout.
|
|
pub const LOGOUT: &str = "/logout";
|
|
/// `GET /cases` — case list; also triggers the lazy retention sweep.
|
|
pub const CASES: &str = "/cases";
|
|
/// `POST /cases/bulk` — admin bulk action (close/analyze/reset).
|
|
pub const BULK: &str = "/cases/bulk";
|
|
/// `POST /cases/purge-closed` — admin hard-delete of closed cases.
|
|
pub const PURGE_CLOSED: &str = "/cases/purge-closed";
|
|
/// `GET /events` — SSE stream (per-user scoped).
|
|
pub const EVENTS: &str = "/events";
|
|
|
|
// -- per-case builders --
|
|
|
|
/// `/cases/{case_id}`.
|
|
pub fn case_detail(case_id: &str) -> String {
|
|
format!("/cases/{case_id}")
|
|
}
|
|
|
|
/// `/cases/{case_id}/recordings`.
|
|
pub fn case_recordings(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/recordings")
|
|
}
|
|
|
|
/// `POST /cases/{case_id}/close`.
|
|
pub fn case_close(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/close")
|
|
}
|
|
|
|
/// `POST /cases/{case_id}/reopen`.
|
|
pub fn case_reopen(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/reopen")
|
|
}
|
|
|
|
/// `POST /cases/{case_id}/analyze`.
|
|
pub fn case_analyze(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/analyze")
|
|
}
|
|
|
|
/// `POST /cases/{case_id}/reset` — admin-only hard-reset.
|
|
pub fn case_reset(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/reset")
|
|
}
|
|
|
|
/// `POST /cases/{case_id}/recordings/delete` — per-recording delete.
|
|
pub fn recording_delete(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/recordings/delete")
|
|
}
|
|
|
|
/// `POST /cases/{case_id}/oneliner` — session-authenticated manual
|
|
/// oneliner override (browser web UI).
|
|
pub fn case_oneliner_web(case_id: &str) -> String {
|
|
format!("/cases/{case_id}/oneliner")
|
|
}
|
|
|
|
/// `GET /magic?token={token}` — magic-link consumption.
|
|
pub fn magic(token: &str) -> String {
|
|
format!("/magic?token={token}")
|
|
}
|