GKaszewski/movies-diary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: GKaszewski:78e1f4ef721ccb8ee623cb8c9a0de4c037194e76
Branches Tags
GKaszewski:master
...
compare: GKaszewski:master
Branches Tags
GKaszewski:master

6 Commits
78e1f4ef72 ... master

Author SHA1 Message Date
Gabriel Kaszewski
7a66661932 css 2026-05-04 23:24:04 +02:00
Gabriel Kaszewski
b30a6a102b feat: per-page titles, OG/SEO tags, HOST/PORT env vars, BASE_URL in config 2026-05-04 22:38:58 +02:00
Gabriel Kaszewski
38a3aa6bbf fix: update .gitignore to include db-shm and db-wal files 
Co-authored-by: Copilot <copilot@github.com>
 2026-05-04 22:23:08 +02:00
Gabriel Kaszewski
3135a15cb3 fix: WAL mode + busy_timeout for SQLite, fix rate limiter TOCTOU race 2026-05-04 22:10:19 +02:00
Gabriel Kaszewski
d083f8ae3d refactor: use constant for minimum password length and API rate limit 
Co-authored-by: Copilot <copilot@github.com>
 2026-05-04 21:41:07 +02:00
Gabriel Kaszewski
874c406d4a fix: security hardening — SameSite=Strict, Secure cookie flag, password min length, generic registration error, auth rate limiting 2026-05-04 21:38:23 +02:00
14 changed files with 195 additions and 38 deletions
Expand all files Collapse all files

4
.dockerignore
View File

@@ -4,3 +4,7 @@ target/
*.db *.db
*.db-shm *.db-shm
*.db-wal *.db-wal
.cargo/
.sqlx/
docs/
dev.db

1
.env.example
View File

@@ -1,6 +1,7 @@
DATABASE_URL=sqlite:./dev.db DATABASE_URL=sqlite:./dev.db
BASE_URL=http://localhost:3000 BASE_URL=http://localhost:3000
PORT=3000 PORT=3000
SECURE_COOKIES=false
JWT_SECRET= JWT_SECRET=
JWT_TTL_SECONDS= JWT_TTL_SECONDS=
ALLOW_REGISTRATION=true ALLOW_REGISTRATION=true

4
.gitignore vendored
View File

@@ -8,7 +8,9 @@
.env.prod .env.prod
*.db *.db
*db-shm
*db-wal
.worktrees/ .worktrees/
.superpowers/ .superpowers/
docs/ docs/

10
crates/adapters/template-askama/templates/base.html
View File

@@ -3,7 +3,15 @@
<head> <head>
<meta charset="UTF-8"> <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="viewport" content="width=device-width, initial-scale=1">
<title>Movies Diary</title> <title>{{ ctx.page_title }}</title>
<meta name="description" content="A personal movie diary — track what you watch, rate and review films.">
<meta property="og:type" content="website">
<meta property="og:site_name" content="Movies Diary">
<meta property="og:title" content="{{ ctx.page_title }}">
<meta property="og:url" content="{{ ctx.canonical_url }}">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="{{ ctx.page_title }}">
<link rel="canonical" href="{{ ctx.canonical_url }}">
<link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Nunito:wght@400;600;700;800&display=swap" rel="stylesheet"> <link href="https://fonts.googleapis.com/css2?family=Nunito:wght@400;600;700;800&display=swap" rel="stylesheet">

5
crates/application/src/config.rs
View File

@@ -1,6 +1,7 @@
#[derive(Clone)] #[derive(Clone)]
pub struct AppConfig { pub struct AppConfig {
pub allow_registration: bool, pub allow_registration: bool,
pub base_url: String,
} }
impl AppConfig { impl AppConfig {
@@ -8,6 +9,8 @@ impl AppConfig {
let allow_registration = std::env::var("ALLOW_REGISTRATION") let allow_registration = std::env::var("ALLOW_REGISTRATION")
.map(|v| v == "true" || v == "1") .map(|v| v == "true" || v == "1")
.unwrap_or(false); .unwrap_or(false);
Self { allow_registration } let base_url = std::env::var("BASE_URL")
.unwrap_or_else(|_| "http://localhost:3000".to_string());
Self { allow_registration, base_url }
} }
} }

2
crates/application/src/ports.rs
View File

@@ -7,6 +7,8 @@ pub struct HtmlPageContext {
pub user_id: Option<Uuid>, pub user_id: Option<Uuid>,
pub register_enabled: bool, pub register_enabled: bool,
pub rss_url: String, pub rss_url: String,
pub page_title: String,
pub canonical_url: String,
} }
impl HtmlPageContext { impl HtmlPageContext {

12
crates/application/src/use_cases/register.rs
View File

@@ -2,15 +2,25 @@ use domain::{errors::DomainError, models::User, value_objects::Email};
use crate::{commands::RegisterCommand, context::AppContext}; use crate::{commands::RegisterCommand, context::AppContext};
const MIN_PASSWORD_LENGTH: usize = 8;
pub async fn execute(ctx: &AppContext, cmd: RegisterCommand) -> Result<(), DomainError> { pub async fn execute(ctx: &AppContext, cmd: RegisterCommand) -> Result<(), DomainError> {
if !ctx.config.allow_registration { if !ctx.config.allow_registration {
return Err(DomainError::Unauthorized("Registration is disabled".into())); return Err(DomainError::Unauthorized("Registration is disabled".into()));
} }
if cmd.password.len() < MIN_PASSWORD_LENGTH {
return Err(DomainError::ValidationError(
"Password must be at least 8 characters".into(),
));
}
let email = Email::new(cmd.email)?; let email = Email::new(cmd.email)?;
if ctx.user_repository.find_by_email(&email).await?.is_some() { if ctx.user_repository.find_by_email(&email).await?.is_some() {
return Err(DomainError::ValidationError("Email already registered".into())); return Err(DomainError::ValidationError(
"Email already registered".into(),
));
} }
let hash = ctx.password_hasher.hash(&cmd.password).await?; let hash = ctx.password_hasher.hash(&cmd.password).await?;

2
crates/presentation/src/event_handlers.rs
View File

@@ -160,7 +160,7 @@ mod tests {
auth_service: Arc::new(PanicAuth), auth_service: Arc::new(PanicAuth),
password_hasher: Arc::new(PanicHasher), password_hasher: Arc::new(PanicHasher),
user_repository: Arc::new(PanicUserRepo), user_repository: Arc::new(PanicUserRepo),
config: AppConfig { allow_registration: false }, config: AppConfig { allow_registration: false, base_url: "http://localhost:3000".to_string() },
} }
} }

6
crates/presentation/src/extractors.rs
View File

@@ -175,7 +175,7 @@ mod tests {
auth_service: Arc::new(PanicAuth), auth_service: Arc::new(PanicAuth),
password_hasher: Arc::new(PanicHasher), password_hasher: Arc::new(PanicHasher),
user_repository: Arc::new(PanicUserRepo), user_repository: Arc::new(PanicUserRepo),
config: application::config::AppConfig { allow_registration: false }, config: application::config::AppConfig { allow_registration: false, base_url: "http://localhost:3000".to_string() },
}, },
html_renderer: Arc::new(PanicRenderer), html_renderer: Arc::new(PanicRenderer),
rss_renderer: Arc::new(PanicRssRenderer), rss_renderer: Arc::new(PanicRssRenderer),
@@ -282,7 +282,7 @@ mod tests {
auth_service: Arc::new(PanicAuth2), auth_service: Arc::new(PanicAuth2),
password_hasher: Arc::new(PanicHasher2), password_hasher: Arc::new(PanicHasher2),
user_repository: Arc::new(PanicUserRepo2), user_repository: Arc::new(PanicUserRepo2),
config: application::config::AppConfig { allow_registration: false }, config: application::config::AppConfig { allow_registration: false, base_url: "http://localhost:3000".to_string() },
}, },
html_renderer: Arc::new(PanicRenderer2), html_renderer: Arc::new(PanicRenderer2),
rss_renderer: Arc::new(PanicRssRenderer2), rss_renderer: Arc::new(PanicRssRenderer2),
@@ -341,7 +341,7 @@ mod tests {
auth_service: Arc::new(RejectingAuth), auth_service: Arc::new(RejectingAuth),
password_hasher: Arc::new(PanicHasher3), password_hasher: Arc::new(PanicHasher3),
user_repository: Arc::new(PanicUserRepo3), user_repository: Arc::new(PanicUserRepo3),
config: application::config::AppConfig { allow_registration: false }, config: application::config::AppConfig { allow_registration: false, base_url: "http://localhost:3000".to_string() },
}, },
html_renderer: Arc::new(PanicRenderer3), html_renderer: Arc::new(PanicRenderer3),
rss_renderer: Arc::new(PanicRssRenderer3), rss_renderer: Arc::new(PanicRssRenderer3),

38
crates/presentation/src/handlers.rs
View File

@@ -43,6 +43,8 @@ pub mod html {
user_id: uuid, user_id: uuid,
register_enabled: state.app_ctx.config.allow_registration, register_enabled: state.app_ctx.config.allow_registration,
rss_url: "/feed.rss".to_string(), rss_url: "/feed.rss".to_string(),
page_title: "Movies Diary".to_string(),
canonical_url: state.app_ctx.config.base_url.clone(),
} }
} }
@@ -53,10 +55,14 @@ pub mod html {
.replace('"', "%22") .replace('"', "%22")
} }
fn secure_flag() -> &'static str {
if std::env::var("SECURE_COOKIES").as_deref() == Ok("true") { "; Secure" } else { "" }
}
fn set_cookie_header(token: &str, max_age: i64) -> (axum::http::HeaderName, HeaderValue) { fn set_cookie_header(token: &str, max_age: i64) -> (axum::http::HeaderName, HeaderValue) {
let val = format!( let val = format!(
"token={}; HttpOnly; Path=/; SameSite=Lax; Max-Age={}", "token={}; HttpOnly; Path=/; SameSite=Strict; Max-Age={}{}",
token, max_age token, max_age, secure_flag()
); );
(SET_COOKIE, HeaderValue::from_str(&val).expect("valid cookie")) (SET_COOKIE, HeaderValue::from_str(&val).expect("valid cookie"))
} }
@@ -70,6 +76,8 @@ pub mod html {
user_id: None, user_id: None,
register_enabled: state.app_ctx.config.allow_registration, register_enabled: state.app_ctx.config.allow_registration,
rss_url: "/feed.rss".to_string(), rss_url: "/feed.rss".to_string(),
page_title: "Login — Movies Diary".to_string(),
canonical_url: format!("{}/login", state.app_ctx.config.base_url),
}; };
let html = state let html = state
.html_renderer .html_renderer
@@ -104,10 +112,8 @@ pub mod html {
} }
pub async fn get_logout() -> impl IntoResponse { pub async fn get_logout() -> impl IntoResponse {
let cookie = ( let val = format!("token=; HttpOnly; Path=/; SameSite=Strict; Max-Age=0{}", secure_flag());
SET_COOKIE, let cookie = (SET_COOKIE, HeaderValue::from_str(&val).expect("valid cookie"));
HeaderValue::from_static("token=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0"),
);
([cookie], Redirect::to("/")).into_response() ([cookie], Redirect::to("/")).into_response()
} }
@@ -123,6 +129,8 @@ pub mod html {
user_id: None, user_id: None,
register_enabled: true, register_enabled: true,
rss_url: "/feed.rss".to_string(), rss_url: "/feed.rss".to_string(),
page_title: "Register — Movies Diary".to_string(),
canonical_url: format!("{}/register", state.app_ctx.config.base_url),
}; };
let html = state let html = state
.html_renderer .html_renderer
@@ -162,9 +170,8 @@ pub mod html {
Err(_) => Redirect::to("/login").into_response(), Err(_) => Redirect::to("/login").into_response(),
} }
} }
Err(e) => { Err(_) => {
let msg = encode_error(&e.to_string()); Redirect::to("/register?error=Registration+failed.+Please+try+again.").into_response()
Redirect::to(&format!("/register?error={}", msg)).into_response()
} }
} }
} }
@@ -174,7 +181,9 @@ pub mod html {
State(state): State<AppState>, State(state): State<AppState>,
Query(params): Query<ErrorQuery>, Query(params): Query<ErrorQuery>,
) -> impl IntoResponse { ) -> impl IntoResponse {
let ctx = build_page_context(&state, Some(user_id)).await; let mut ctx = build_page_context(&state, Some(user_id)).await;
ctx.page_title = "Log a Review — Movies Diary".to_string();
ctx.canonical_url = format!("{}/reviews/new", state.app_ctx.config.base_url);
let html = state let html = state
.html_renderer .html_renderer
.render_new_review_page(NewReviewPageData { .render_new_review_page(NewReviewPageData {
@@ -261,7 +270,9 @@ pub mod html {
OptionalCookieUser(user_id): OptionalCookieUser, OptionalCookieUser(user_id): OptionalCookieUser,
State(state): State<AppState>, State(state): State<AppState>,
) -> impl IntoResponse { ) -> impl IntoResponse {
let ctx = build_page_context(&state, user_id).await; let mut ctx = build_page_context(&state, user_id).await;
ctx.page_title = "Members — Movies Diary".to_string();
ctx.canonical_url = format!("{}/users", state.app_ctx.config.base_url);
match application::use_cases::get_users::execute(&state.app_ctx, application::queries::GetUsersQuery).await { match application::use_cases::get_users::execute(&state.app_ctx, application::queries::GetUsersQuery).await {
Ok(users) => { Ok(users) => {
let data = application::ports::UsersPageData { ctx, users }; let data = application::ports::UsersPageData { ctx, users };
@@ -292,6 +303,11 @@ pub mod html {
Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response(), Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response(),
}; };
let display_name = profile_user.email().value()
.split('@').next().unwrap_or("User");
ctx.page_title = format!("{}'s Diary — Movies Diary", display_name);
ctx.canonical_url = format!("{}/users/{}", state.app_ctx.config.base_url, profile_user_uuid);
let query = application::queries::GetUserProfileQuery { let query = application::queries::GetUserProfileQuery {
user_id: profile_user_uuid, user_id: profile_user_uuid,
view: view.clone(), view: view.clone(),

11
crates/presentation/src/main.rs
View File

@@ -32,8 +32,11 @@ async fn main() -> anyhow::Result<()> {
let app = routes::build_router(state); let app = routes::build_router(state);
let listener = TcpListener::bind("0.0.0.0:3000").await?; let host = std::env::var("HOST").unwrap_or_else(|_| "0.0.0.0".to_string());
tracing::info!("Listening on 0.0.0.0:3000"); let port = std::env::var("PORT").unwrap_or_else(|_| "3000".to_string());
let addr = format!("{}:{}", host, port);
let listener = TcpListener::bind(&addr).await?;
tracing::info!("Listening on {}", addr);
axum::serve(listener, app).await?; axum::serve(listener, app).await?;
Ok(()) Ok(())
@@ -48,7 +51,9 @@ async fn wire_dependencies() -> anyhow::Result<AppState> {
let database_url = std::env::var("DATABASE_URL").context("DATABASE_URL must be set")?; let database_url = std::env::var("DATABASE_URL").context("DATABASE_URL must be set")?;
let opts = SqliteConnectOptions::from_str(&database_url) let opts = SqliteConnectOptions::from_str(&database_url)
.context("Invalid DATABASE_URL")? .context("Invalid DATABASE_URL")?
.create_if_missing(true); .create_if_missing(true)
.journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
.busy_timeout(std::time::Duration::from_secs(5));
let pool = SqlitePool::connect_with(opts) let pool = SqlitePool::connect_with(opts)
.await .await
.context("Failed to connect to SQLite database")?; .context("Failed to connect to SQLite database")?;

121
crates/presentation/src/routes.rs
View File

@@ -1,8 +1,52 @@
use axum::{Router, routing}; use std::sync::{
Arc,
atomic::{AtomicU64, Ordering},
};
use std::time::{SystemTime, UNIX_EPOCH};
use axum::{Router, http::StatusCode, middleware, response::IntoResponse, routing};
use tower_http::{services::ServeDir, trace::TraceLayer}; use tower_http::{services::ServeDir, trace::TraceLayer};
use crate::{handlers, state::AppState}; use crate::{handlers, state::AppState};
const API_RATE_LIMIT: u64 = 20; // 20 requests per minute globally for API routes
/// Simple global rate limiter: tracks request count per 60-second window.
/// Not per-IP — suitable for a low-traffic personal app.
#[derive(Clone)]
struct RateLimiter {
window: Arc<AtomicU64>,
count: Arc<AtomicU64>,
limit: u64,
}
impl RateLimiter {
fn new(limit: u64) -> Self {
Self {
window: Arc::new(AtomicU64::new(0)),
count: Arc::new(AtomicU64::new(0)),
limit,
}
}
fn check(&self) -> bool {
let now = SystemTime::now()
.duration_since(UNIX_EPOCH)
.unwrap_or_default()
.as_secs()
/ 60;
let prev = self.window.load(Ordering::Acquire);
if now != prev {
// compare_exchange ensures only one thread wins the window reset
if self.window.compare_exchange(prev, now, Ordering::AcqRel, Ordering::Relaxed).is_ok() {
self.count.store(1, Ordering::Release);
return true;
}
}
self.count.fetch_add(1, Ordering::Relaxed) + 1 <= self.limit
}
}
pub fn build_router(state: AppState) -> Router { pub fn build_router(state: AppState) -> Router {
Router::new() Router::new()
.merge(html_routes()) .merge(html_routes())
@@ -13,30 +57,73 @@ pub fn build_router(state: AppState) -> Router {
} }
fn html_routes() -> Router<AppState> { fn html_routes() -> Router<AppState> {
Router::new() // Auth routes: 20 requests per minute globally.
.route("/", routing::get(handlers::html::get_activity_feed)) let limiter = RateLimiter::new(API_RATE_LIMIT);
.route("/users", routing::get(handlers::html::get_users_list)) let auth = Router::new()
.route("/users/{id}", routing::get(handlers::html::get_user_profile))
.route( .route(
"/login", "/login",
routing::get(handlers::html::get_login_page) routing::get(handlers::html::get_login_page).post(handlers::html::post_login),
.post(handlers::html::post_login),
) )
.route("/logout", routing::get(handlers::html::get_logout)) .route("/logout", routing::get(handlers::html::get_logout))
.route( .route(
"/register", "/register",
routing::get(handlers::html::get_register_page) routing::get(handlers::html::get_register_page).post(handlers::html::post_register),
.post(handlers::html::post_register), )
.route_layer(middleware::from_fn(
move |req: axum::extract::Request, next: middleware::Next| {
let limiter = limiter.clone();
async move {
if limiter.check() {
next.run(req).await
} else {
StatusCode::TOO_MANY_REQUESTS.into_response()
}
}
},
));
Router::new()
.route("/", routing::get(handlers::html::get_activity_feed))
.route("/users", routing::get(handlers::html::get_users_list))
.route(
"/users/{id}",
routing::get(handlers::html::get_user_profile),
)
.merge(auth)
.route(
"/reviews/new",
routing::get(handlers::html::get_new_review_page),
) )
.route("/reviews/new", routing::get(handlers::html::get_new_review_page))
.route("/reviews", routing::post(handlers::html::post_review)) .route("/reviews", routing::post(handlers::html::post_review))
.route("/reviews/{id}/delete", routing::post(handlers::html::post_delete_review)) .route(
.route("/posters/{path}", routing::get(handlers::posters::get_poster)) "/reviews/{id}/delete",
routing::post(handlers::html::post_delete_review),
)
.route(
"/posters/{path}",
routing::get(handlers::posters::get_poster),
)
.route("/feed.rss", routing::get(handlers::rss::get_feed)) .route("/feed.rss", routing::get(handlers::rss::get_feed))
.route("/users/{id}/feed.rss", routing::get(handlers::rss::get_user_feed)) .route(
"/users/{id}/feed.rss",
routing::get(handlers::rss::get_user_feed),
)
} }
fn api_routes() -> Router<AppState> { fn api_routes() -> Router<AppState> {
let limiter = RateLimiter::new(API_RATE_LIMIT);
let auth_rate_limit =
middleware::from_fn(move |req: axum::extract::Request, next: middleware::Next| {
let limiter = limiter.clone();
async move {
if limiter.check() {
next.run(req).await
} else {
StatusCode::TOO_MANY_REQUESTS.into_response()
}
}
});
Router::new().nest( Router::new().nest(
"/api", "/api",
Router::new() Router::new()
@@ -46,12 +133,16 @@ fn api_routes() -> Router<AppState> {
routing::get(handlers::api::get_review_history), routing::get(handlers::api::get_review_history),
) )
.route("/reviews", routing::post(handlers::api::post_review)) .route("/reviews", routing::post(handlers::api::post_review))
.route("/reviews/{id}", routing::delete(handlers::api::delete_review)) .route(
"/reviews/{id}",
routing::delete(handlers::api::delete_review),
)
.route( .route(
"/movies/{id}/sync-poster", "/movies/{id}/sync-poster",
routing::post(handlers::api::sync_poster), routing::post(handlers::api::sync_poster),
) )
.route("/auth/login", routing::post(handlers::api::login)) .route("/auth/login", routing::post(handlers::api::login))
.route("/auth/register", routing::post(handlers::api::register)), .route("/auth/register", routing::post(handlers::api::register))
.route_layer(auth_rate_limit),
) )
} }

2
crates/presentation/tests/api_test.rs
View File

@@ -105,7 +105,7 @@ async fn test_app() -> Router {
auth_service: Arc::new(PanicAuth), auth_service: Arc::new(PanicAuth),
password_hasher: Arc::new(PanicHasher), password_hasher: Arc::new(PanicHasher),
user_repository: Arc::new(NobodyUserRepo), user_repository: Arc::new(NobodyUserRepo),
config: AppConfig { allow_registration: false }, config: AppConfig { allow_registration: false, base_url: "http://localhost:3000".to_string() },
}, },
html_renderer: Arc::new(AskamaHtmlRenderer::new()), html_renderer: Arc::new(AskamaHtmlRenderer::new()),
rss_renderer: Arc::new(RssAdapter::new("http://localhost:3000".into())), rss_renderer: Arc::new(RssAdapter::new("http://localhost:3000".into())),

15
static/style.css
View File

@@ -34,6 +34,21 @@ body {
background: url("/static/background.avif") center / cover no-repeat fixed; background: url("/static/background.avif") center / cover no-repeat fixed;
min-height: 100%; min-height: 100%;
line-height: 1.5; line-height: 1.5;
position: relative;
}
body::before {
content: "";
position: fixed;
inset: 0;
background: rgba(0, 0, 0, 0.2);
z-index: 0;
pointer-events: none;
}
body > * {
position: relative;
z-index: 1;
} }
a { a {