desviar 0.0.16 → 0.0.17

data/README.md

@@ -72,10 +72,14 @@ For scripting, the list, link and config commands can be modified with a _/json_
 Security notes:
 Consider moving the default database location from /dev/shm/desviar, and set its permissions to 0600. You can modify config.ru to direct log output to a different file.
 
+User credentials:
+A file called .htdigest is part of this package (see https://raw.github.com/instantlinux/desviar/master/config/.htdigest); you can customize the list using the _htdigest_ utility (get it from [htdigest-ruby](https://rubygems.org/gems/htdigest-ruby) and define environment variable DESVIAR_HTDIGEST with the pathname of your customized file.  The configuration parameter _adminuser_ defines a "super-user" which can view/set configuration at run-time, and can access records other than its own via the list and link commands.
+
 #### Features implemented ####
 
 - [x] HTTP digest authentication for client API and user interface
-- [ ] Parse htpasswd files to support multiple credentials
+- [x] Multiple credentials, with designated _adminuser_
+- [x] Parse htdigest (password) file
 - [x] Bypass authentication for generated URIs
 - [x] Basic HTTP authentication for remote URIs
 - [ ] HTTP digest authentication for remote URIs

data/config/.htdigest

@@ -0,0 +1,2 @@
+desviar:desviar_user@instantlinux.net:8869405c6b1cec1825a65de76464e1e1
+test:desviar_user@instantlinux.net:8f21c3b4d00eb51ac1e9ee010e5d610f

data/config/config.rb.example

@@ -28,15 +28,12 @@ $config = {
     :msg_redir_retain => "Retention policy for URI - discard before saving db entry to be more secure",
 :redir_retain => "keep",
 
-    :msg_authprompt => "AuthPrompt appears in the browser authentication dialog",
+    :msg_authprompt => "AuthPrompt appears as the realm in the browser authentication dialog",
 :authprompt => "Please Authenticate",
 
     :msg_adminuser => "Administrative username - has access to all records",
 :adminuser => "desviar",
 
-    :msg_adminpw => "Admin PW secures the UI",
-:adminpw => "password",
-
     :msg_authsalt => "AuthSalt is used to randomize http-digest hash",
 :authsalt => "notveryrandom",
 
@@ -70,7 +67,7 @@ $config = {
 :hidden => [ "hidden", "hashed" ],
 
     # Hashed config items - secure passwords
-:hashed => [ "authsalt", "adminpw", "cryptkey", "captchapriv" ],
+:hashed => [ "authsalt", "cryptkey", "captchapriv" ],
 
     :msg_debug => "Debug mode",
 :debug => false

data/examples/ruby-client.rb

@@ -51,7 +51,8 @@ puts obj.fetch link['temp_uri']
 
 # Example 3: valid for 10 minutes 
 pp obj.create "https://rubygems.org/gems/desviar", 600, {
-   "notes"  => "example 3" }
+   :num_uses => 10,
+   :notes    => "example 3" }
 
 puts "========= Desviar::Client list ============"
 pp obj.list

data/lib/auth.rb

@@ -1,102 +1,53 @@
-require 'webrick/httpauth/htpasswd'
-
-module Desviar::Auth
-
-    def self.htpasswd
-#      @htpasswd ||= Htpasswd.new(git.path_to("htpasswd"))
-      @htpasswd ||= Htpasswd.new('.htpasswd')
-    end
-
-    def self.authentication
-      @authentication ||= Rack::Auth::Basic::Request.new request.env
-    end
-
-    def self.authenticated?
-      request.env["REMOTE_USER"] && request.env["desviar.authenticated"]
-    end
-
-    def self.authenticate(username, password)
-      checked   = [ username, password ] == authentication.credentials
-      validated = authentication.provided? && authentication.basic?
-      granted   = htpasswd.authenticated? username, password
-      if checked and validated and granted
-        request.env["desviar.authenticated"] = true
-        request.env["REMOTE_USER"] = authentication.username
-      else
-        nil
+# Authorization module for Desviar - RFC 2317 htdigest support
+#
+#   Copyright 2013 Richard Braun
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+module Desviar
+  class Auth
+    def initialize(htdigest_file, adminuser, realm, authsalt)
+      @users = Hash.new
+      File.open(htdigest_file) do |f|
+        f.each_line do |line|
+          if line.split(':')[1] == realm
+            @users[line.split(':')[0]] = line.split(':')[2].strip
+          end
+        end
       end
+      @realm     = realm
+      @adminuser = adminuser
+      @authsalt  = authsalt
     end
 
-#    def self.unauthorized!(realm = Desviar::info)
-    def self.unauthorized!(realm = 'desviar-realm')
-      headers "WWW-Authenticate" => %(Basic realm="#{realm}")
-      throw :halt, [ 401, "Authorization Required" ]
+    def authenticate!(app)
+      auth = Rack::Auth::Digest::MD5.new(app) do |username|
+        @users[username]
+      end
+      auth.realm  = @realm
+      auth.opaque = @authsalt
+      auth.passwords_hashed = true
+      auth
     end
 
-    def self.bad_request!
-      throw :halt, [ 400, "Bad Request" ]
+=begin
+    # TODO: figure out how to access Rack::Request environment
+    def authorized?(owner)
+      request.env['REMOTE_USER'] == @adminuser ||
+            request.env['REMOTE_USER'] == owner
     end
 
-    def self.authenticate!
-      return if authenticated?
-      unauthorized! unless authentication.provided?
-      bad_request!  unless authentication.basic?
-      unauthorized! unless authenticate(*authentication.credentials)
-      request.env["REMOTE_USER"] = authentication.username
+    def authsuper?
+      request.env['REMOTE_USER'] == @adminuser
     end
 
-    def self.access_granted?(username, password)
-      authenticated? || authenticate(username, password)
+    def user_name
+      request.env['REMOTE_USER']
     end
-
+=end
+  end
 end
-
-class Desviar::Auth2
-
-      def initialize(file)
-        @handler = WEBrick::HTTPAuth::Htpasswd.new(file)
-        yield self if block_given?
-      end
-
-      def find(username)
-        password = @handler.get_passwd(nil, username, false)
-        if block_given?
-          yield password ? [password, password[0,2]] : [nil, nil]
-        else
-          password
-        end
-      end
-
-      def authenticated?(username, password)
-        self.find username do |crypted, salt|
-          crypted && salt && crypted == password.crypt(salt)
-        end
-      end
-
-      def create(username, password)
-        @handler.set_passwd(nil, username, password)
-      end
-      alias update create
-
-      def destroy(username)
-        @handler.delete_passwd(nil, username)
-      end
-
-      def include?(username)
-        users.include? username
-      end
-
-      def size
-        users.size
-      end
-
-      def write!
-        @handler.flush
-      end
-
-      private
-
-      def users
-        @handler.each{|username, password| username }
-      end
-    end

data/lib/desviar.rb

@@ -20,7 +20,6 @@ require 'dm-timestamps'
 require 'syntaxi'
 require 'syslog'
 require 'net/http'
-#require 'test/unit'
 require 'rack/test'
 require 'rack/recaptcha'
 require 'multi_json'
@@ -33,10 +32,76 @@ end
 require File.expand_path '../version', __FILE__
 require File.expand_path '../encrypt', __FILE__
 require File.expand_path '../model', __FILE__
-# Auth parsing is work-in-progress
-# require File.expand_path '../auth', __FILE__
+require File.expand_path '../auth', __FILE__
+$digest_file = ENV['DESVIAR_HTDIGEST'] || (File.expand_path '../../config/.htdigest', __FILE__)
 
 module Desviar
+
+  #############################################
+  # Class Desviar::Public - routes without auth
+
+  class Public < Sinatra::Base
+
+    configure do
+      use Rack::Recaptcha, :public_key => $config[:captchapub], :private_key => $config[:captchapriv]
+      helpers Rack::Recaptcha::Helpers
+    end
+
+    # display content
+    get '/:temp_uri' do
+      @desviar = Desviar::Model::Main.first(:temp_uri => params[:temp_uri])
+      cache_control :public, :max_age => 30
+      if @desviar && DateTime.now < @desviar[:expires_at] && @desviar[:num_uses] !=0
+        if @desviar[:captcha] && !@desviar[:captcha_validated]
+          @button = @desviar[:captcha_button]
+          erb :captcha
+        else
+          @desviar.update(:captcha_validated => false) if @desviar[:captcha_validated]
+          if !$config[:dbencrypt]
+            @content = @desviar[:content]
+          else
+            obj = Desviar::EncryptedItem::Decryptor::for({
+                'cipher'         => $config[:dbencrypt], 
+                'version'        => 2, 
+                'encrypted_data' => @desviar[:content],
+                'iv'             => Base64.encode64(@desviar[:cipher_iv]),
+                'hmac'           => @desviar[:hmac]}, $config[:cryptkey])
+            @content = obj.for_decrypted_item
+          end
+          if @desviar[:num_uses] > 0
+            @desviar.update(:num_uses => @desviar[:num_uses] - 1)
+          end
+          Desviar::Public::log "Fetched #{@desviar.id} #{@desviar.redir_uri} #{@desviar.content.bytesize} #{@desviar.notes[0,50]}"
+          erb :content, :layout => false
+        end
+      else
+        error 404
+      end
+    end
+
+    # handle reCAPTCHA
+    post '/:temp_uri' do
+      if recaptcha_valid?
+        @desviar = Desviar::Model::Main.first(
+                       :temp_uri => params[:temp_uri],
+                       :fields => [ :id, :temp_uri, :captcha_validated ])
+        @desviar.update(:captcha_validated => true)
+      end
+      redirect "/desviar/#{params[:temp_uri]}"
+    end
+
+    # Syslog utility
+    def self.log(message, priority = Syslog::LOG_INFO)
+      if $config[:log_facility]    
+        Syslog.open($0, Syslog::LOG_PID | Syslog::LOG_CONS | $config[:log_facility]) { |obj| obj.info message }
+      end
+      puts "#{Time.now} #{message}" if $config[:debug]
+    end
+  end
+
+  #############################################
+  # Class Desviar::Authorized - routes (commands) which require authorization
+
   class Authorized < Sinatra::Base
 
     configure do
@@ -45,19 +110,21 @@ module Desviar
       DataMapper.auto_upgrade! if DataMapper.respond_to?(:auto_upgrade!)
       $config[:cryptkey] = SecureRandom.base64(32) if $config[:cryptkey].nil?
       helpers Sinatra::JSON
+      @auth = Desviar::Auth.new($digest_file, $config[:adminuser], $config[:authprompt], $config[:authsalt])
+      Desviar::Public::log "Starting #{Desviar.info}"
     end
 
     get '/' do
       redirect '/create'
     end
   
-    # create
+    # form: new temporary URI
     get '/create' do
       puts request.env.inspect if $config[:debug]
       erb :create
     end
   
-    # submit
+    # create new temporary URI
     post '/create' do
       error 400 if params[:redir_uri].strip == ""
 
@@ -66,7 +133,8 @@ module Desviar
       @desviar = Desviar::Model::Main.new(params.merge({
         :temp_uri => "#{$config[:uriprefix]}#{SecureRandom.urlsafe_base64($config[:hashlength])[0,$config[:hashlength]]}#{$config[:urisuffix]}",
         :expires_at     => Time.now + params[:expiration].to_i,
-        :captcha_validated => false
+        :captcha_validated => false,
+        :owner => request.env['REMOTE_USER']
       }).delete_if {|key, val| key == "redir_uri" || key == "remoteuser" || key == "remotepw"})
 
       # Cache the remote URI
@@ -96,21 +164,29 @@ module Desviar
         @desviar[:cipher_iv] = obj.iv
       end
 
+      # Apply field rules:
+      #  - Discard redir_uri from data record if redir_retain != 'keep'
+      #  - Set num_uses to -1 (unlimited) if not set
       @desviar[:redir_uri] = $config[:redir_retain] == "keep" ? params[:redir_uri] : ""
+      if @params[:num_uses].to_i <= 0 || @params[:num_uses].empty?
+        @desviar[:num_uses] = -1
+      end
 
       # Insert the new record and display the new link
       if @desviar.save
-        Desviar::Public::log "Created #{@desviar.id} #{@desviar.redir_uri} #{@desviar.expires_at} #{request.ip}"
+        Desviar::Public::log "Created #{@desviar.id} #{@desviar.redir_uri} #{@desviar.expires_at} #{@desviar.num_uses} #{request.ip} #{request.env['REMOTE_USER']}"
         redirect "/link/#{@desviar.id}"
       else
         error 400
       end
     end
   
-    # show link ID
+    # show link metadata info
     get '/link/:id' do
       @desviar = Desviar::Model::Main.get(params[:id])
-      if @desviar && DateTime.now < @desviar[:expires_at]
+      if @desviar && DateTime.now < @desviar[:expires_at] &&
+        (request.env['REMOTE_USER'] == $config[:adminuser] ||
+         request.env['REMOTE_USER'] == @desviar['owner'])
         erb :show
       else
         error 404
@@ -120,7 +196,9 @@ module Desviar
     # show link info - json format
     get '/link/json/:id' do
       @desviar = Desviar::Model::Main.get(params[:id])
-      if @desviar && DateTime.now < @desviar[:expires_at]
+      if @desviar && DateTime.now < @desviar[:expires_at] &&
+        (request.env['REMOTE_USER'] == $config[:adminuser] ||
+         request.env['REMOTE_USER'] == @desviar['owner'])
         json @desviar.attributes.delete_if {|key, val| key == :content || key == :cipher_iv || key == :hmac}
       else
         error 404
@@ -132,23 +210,33 @@ module Desviar
       # TODO: figure out the clean "native" way of DataMapper::Collection.destroy
       #   - but this works fine for small databases
       @desviar = DataMapper.repository(:default).adapter
-      @records = Desviar::Model::Main.all(:expires_at.lt => DateTime.now,
-                                          :fields => [ :id ])
-      Desviar::Public::log "debug cleanup found #{@records.length}"
+      query = {
+         :expires_at.lt => DateTime.now,
+         :fields => [ :id ]
+      }
+      if request.env['REMOTE_USER'] != $config[:adminuser]
+        query[:owner] = request.env['REMOTE_USER']
+      end
+      @records = Desviar::Model::Main.all(query)
       count = @records.length
       @records.each do |item|
         @desviar.execute("DELETE FROM desviar_model_mains WHERE id=#{item.id};")
       end
-      Desviar::Public::log "Cleaned #{count} records" if count != 0
+      Desviar::Public::log "Cleaned #{count} records by #{request.env['REMOTE_USER']}" if count != 0
       redirect "/list"
     end
 
-    # list of most recent records
+    # list most recent records
     get '/list' do
-      @desviar = Desviar::Model::Main.all(
+      query = {
          :limit => $config[:recordsmax],
          :order => [ :created_at.desc ],
-         :fields => [ :id, :created_at, :expires_at, :redir_uri, :captcha, :notes ])
+         :fields => [ :id, :created_at, :expires_at, :redir_uri, :captcha, :notes ]
+      }
+      if request.env['REMOTE_USER'] != $config[:adminuser]
+        query[:owner] = request.env['REMOTE_USER']
+      end
+      @desviar = Desviar::Model::Main.all(query)
       @total = @desviar.length
       @count = [ @total, $config[:recordsmax] ].min
       erb :list
@@ -156,11 +244,15 @@ module Desviar
 
     # list - json
     get '/list/json' do
-      @desviar = Desviar::Model::Main.all(
+      query = {
          :limit => $config[:recordsmax],
          :order => [ :created_at.desc ],
-         :fields => [ :id, :redir_uri, :temp_uri, :expiration, :captcha,
-                      :notes, :owner, :created_at, :expires_at ])
+         :fields => [ :id, :created_at, :expires_at, :redir_uri, :captcha, :notes ]
+      }
+      if request.env['REMOTE_USER'] != $config[:adminuser]
+        query[:owner] = request.env['REMOTE_USER']
+      end
+      @desviar = Desviar::Model::Main.all(query)
       list = Array.new
       @desviar.each do |item|
         list << {
@@ -173,144 +265,63 @@ module Desviar
       json list
     end
 
-    # configuration
+    # form - configuration
     get '/config' do
-      erb :config
+      @ver = Desviar.info
+      if request.env['REMOTE_USER'] == $config[:adminuser]
+        erb :config
+      else
+        error 404
+      end
     end
 
-    # configuration - json
+    # query configuration - json
     get '/config/json' do
-      json $config.reject { |opt, val| 
+      if request.env['REMOTE_USER'] == $config[:adminuser]
+        json $config.reject { |opt, val| 
           opt.to_s.index('msg_') == 0 ||
           $config[:hidden].include?(opt.to_s) ||
           $config[:hashed].include?(opt.to_s)
-      }
-    end
-
-    # submit
-    post '/config' do
-      params['config'].each do |opt, val|
-        if $config[opt.to_sym].class == Fixnum
-          $config[opt.to_sym] = val.to_i
-        elsif val != "" || !$config[:hashed].include?(opt)
-          $config[opt.to_sym] = case val
-            when "true" then true
-            when "false" then false
-            when "nil" then nil
-            else val
-            end
-        end
-      end
-
-      DataMapper::Logger.new($stdout, :debug) if $config[:debug]
-      $config[:cryptkey] = SecureRandom.base64(32) if $config[:cryptkey].nil?
-
-      puts $config.inspect if $config[:debug]
-      Desviar::Public::log "Configuration updated"
-      redirect "/list"
-    end
-
-    def self.new(*)
-  #   TODO: htpasswd parsing
-  #   Desviar::Auth::authenticate!
-  #   @auth.call()
-      app = Rack::Auth::Digest::MD5.new(super) do |username|
-        {$config[:adminuser] => $config[:adminpw]}[username]
-      end
-      app.realm  = $config[:authprompt]
-      app.opaque = $config[:authsalt]
-      app
-    end
-
-=begin
-  class Mytest
-    def initialize(app)
-#      Desviar::Public::log "Initializing auth from .htpasswd"
-      @obj = Rack::Auth::Basic.new(app) do |username, password|
-        unless File.exist?('../config/.htpasswd')
-          raise PasswordFileNotFound.new("#{file} is not found. Please create it with htpasswd")
-        end
-        htpasswd = WEBrick::HTTPAuth::Htpasswd.new(file)
-        crypted = htpasswd.get_passwd(nil, user, false)
-        crypted == pass.crypt(crypted) if crypted
+        }
+      else
+        error 404
       end
     end
-  end
-=end
-
-  end
 
-  #############################################
-  # Class Desviar::Public - routes without auth
-
-  class Public < Sinatra::Base
-
-    configure do
-      use Rack::Recaptcha, :public_key => $config[:captchapub], :private_key => $config[:captchapriv]
-      helpers Rack::Recaptcha::Helpers
-    end
-
-    # display content
-    get '/:temp_uri' do
-      @desviar = Desviar::Model::Main.first(:temp_uri => params[:temp_uri])
-      cache_control :public, :max_age => 30
-      if @desviar && DateTime.now < @desviar[:expires_at]
-        if @desviar[:captcha] && !@desviar[:captcha_validated]
-          @button = @desviar[:captcha_button]
-          erb :captcha
-        else
-          @desviar.update(:captcha_validated => false) if @desviar[:captcha_validated]
-          if !$config[:dbencrypt]
-            @content = @desviar[:content]
-          else
-            obj = Desviar::EncryptedItem::Decryptor::for({
-                'cipher'         => $config[:dbencrypt], 
-                'version'        => 2, 
-                'encrypted_data' => @desviar[:content],
-                'iv'             => Base64.encode64(@desviar[:cipher_iv]),
-                'hmac'           => @desviar[:hmac]}, $config[:cryptkey])
-            @content = obj.for_decrypted_item
+    # config update
+    post '/config' do
+      if request.env['REMOTE_USER'] == $config[:adminuser]
+        params['config'].each do |opt, val|
+          if $config[opt.to_sym].class == Fixnum
+            $config[opt.to_sym] = val.to_i
+          elsif val != "" || !$config[:hashed].include?(opt)
+            $config[opt.to_sym] = case val
+              when "true" then true
+              when "false" then false
+              when "nil" then nil
+              else val
+              end
           end
-          Desviar::Public::log "Fetched #{@desviar.id} #{@desviar.redir_uri} #{@desviar.content.bytesize} #{@desviar.notes[0,50]}"
-          erb :content, :layout => false
         end
+ 
+        DataMapper::Logger.new($stdout, :debug) if $config[:debug]
+        $config[:cryptkey] = SecureRandom.base64(32) if $config[:cryptkey].nil?
+
+        puts $config.inspect if $config[:debug]
+        Desviar::Public::log "Configuration updated by #{request.env['REMOTE_USER']}"
+        redirect "/list"
       else
         error 404
       end
     end
 
-    # handle reCAPTCHA
-    post '/:temp_uri' do
-      if recaptcha_valid?
-        @desviar = Desviar::Model::Main.first(:temp_uri => params[:temp_uri],
-                                       :fields => [ :id, :temp_uri, :captcha_validated ])
-        @desviar.update(:captcha_validated => true)
-      end
-      redirect "/desviar/#{params[:temp_uri]}"
-    end
-
-    def self.log(message, priority = Syslog::LOG_INFO)
-      if $config[:log_facility]    
-        Syslog.open($0, Syslog::LOG_PID | Syslog::LOG_CONS | $config[:log_facility]) { |obj| obj.info message }
-      end
-      puts "#{Time.now} #{message}" if $config[:debug]
-    end
-  end
-
-=begin
-  # TODO - switch to MiniTest, move to test subdir
-  class Test <Test::Unit::TestCase
-    include Rack::Test::Methods
-
-    def app
-      Desviar
-    end
- 
-    def test_list
-      get '/list'
-      assert last_response.ok?
+    def self.new(*)
+      app = @auth.authenticate!(super)
+#     TODO - scope of request.env is needed
+#     user = request.env['REMOTE_USER']
+      Desviar::Public::log "Authenticated new user session"
+      app
     end
   end
-=end
 end
 

data/lib/model.rb

@@ -29,6 +29,7 @@ module Desviar
     property :cipher_iv,  Binary, :length => 16
     property :hmac,       String, :length => 46
     property :owner,      String, :length => 16
+    property :num_uses,   Integer
     property :created_at, DateTime
     property :updated_at, DateTime
     property :expires_at, DateTime

data/lib/version.rb

@@ -1,7 +1,7 @@
 module Desviar
-  VERSION = "0.0.16"
-  RELEASE = "2013-08-03"
-  TIMESTAMP = "2013-08-03 09:12:27 -07:00"
+  VERSION = "0.0.17"
+  RELEASE = "2013-08-04"
+  TIMESTAMP = "2013-08-04 21:02:33 -07:00"
 
   def self.info
       "#{name} v#{VERSION} (#{RELEASE})"

data/lib/views/captcha.erb

@@ -2,7 +2,11 @@
 <%= @desviar.captcha_prompt %>
 <hr>
   <form action="/desviar/<%= @desviar.temp_uri %>" method="POST">
-    <%= recaptcha_tag(:challenge) %>
+    <%= if $config[:captchapub].empty? 
+         "<b>Configuration error</b>: CAPTCHA required but no key is set -- get one at <a href='http://www.google.com/recaptcha/whyrecaptcha'>Google signup</a>"
+        else
+          recaptcha_tag(:challenge)
+        end %>
     <input type="submit" value="<%= @button %>"/>
   </form>
 </div>

data/lib/views/config.erb

@@ -2,6 +2,7 @@
   <h2>Run-time configuration</h2>
   <hr>
   <form action="/config" method="POST">
+  <font size=-1 color='DarkSlateGray'><%= @ver %> Copyright &copy; 2013 Rich Braun <a href='http://www.apache.org/licenses/LICENSE-2.0'>Apache 2.0</a></font>
     <p>
 <%=
    values = $config.select { |key, val| !$config[:hidden].include?(key.to_s) &&

data/lib/views/create.erb

@@ -4,6 +4,7 @@
   <form action="/create" method="POST">
     <p><label for="uri">Existing URI: </label><input type="text" name="redir_uri" /><br>
     <label for="expire">Seconds before Expiration: </label><input type="text" name="expiration" value="<%= $config[:exp] %>"/><p>
+    <label for="num_uses">Number of allowed uses: </label><input type="text" name="num_uses" /><p>
     <label for="user">Username (if needed): </label><input type="text" name="remoteuser" /><p>
     <label for="pass">Password (if needed): </label><input type="password" name="remotepw" /><p>
     <label for="captcha">Require CAPTCHA: </label><input type="radio" name="captcha" value="0" checked/>No

data/lib/views/list.erb

@@ -1,11 +1,45 @@
 <div class="desviar">
 <h2>URI Listing (<%= @count %> of <%= @total %>)</h2>
  <table class="grid">
- <tr><th>id</th><th>created_at</th><th>expires_at</th><th>redir_uri</th><th>c</th><th>size</th><th>notes</th></tr>
- <% @desviar.each do |item| %>
- <%= "<tr><td><a href=/link/#{item.id}>#{item.id}</a></td><td>#{item.created_at}</td><td>#{item.expires_at}</td><td>#{item.redir_uri}</td><td>#{'&bull;' if item.captcha}</td><td>#{item.content.bytesize}</td><td>#{item.notes[0,50]}</td>" %>
- <% end %>
+<%=
+ cols = [ 'id', 'created_at', 'expires_at', 'num_uses', 'redir_uri', 'captcha', 'size', 'owner', 'notes' ]
+ html = ""
+ html << "<tr>"
+ cols.each do |col| html << "<th>#{col}</th>" end
+ html << "</tr>"
+ @desviar.each do |item|
+   html << "<tr>"
+   cols.each do |col|
+     html << "<td>"
+     case col
+       when 'id'
+         if item['expires_at'] < DateTime.now || item['num_uses'] == 0
+           html << item[col].to_s
+         else
+           html << "<a href=/link/#{item[col]}>#{item[col].to_s}</a>"
+         end
+       when 'expires_at'
+         if item['expires_at'] < DateTime.now || item['num_uses'] == 0
+           html << "<del>#{item[col].to_s}</del>"
+         else
+           html << item[col].to_s
+         end
+       when 'captcha'
+         html << (item[col] ? "<center>&bull;</center>" : "")
+       when 'size'
+         html << item['content'].bytesize.to_s
+       else
+         html << item[col].to_s[0..50]
+     end
+     html << "</td>"
+   end
+   html << "</tr>"
+ end
+ html
+%>
  </table>
-<p><a href="/create">Create</a> <a href="/config">Config</a> <a href="/clean">Clean</a>
+<p><a href="/create">Create</a> 
+  <% if request.env['REMOTE_USER'] == $config[:adminuser] %><a href="/config">Config</a> <% end %>
+  <a href="/clean">Clean</a>
 <hr>
 </div>

data/lib/views/show.erb

@@ -9,8 +9,9 @@
      Created <%= @desviar.created_at.strftime("%D at %T %Z") %><br>
      Expires <%= @desviar.expires_at.strftime("%D at %T %Z") %><br>
      ID: <%= @desviar.id %>
+     <%= if @desviar.num_uses > 0 then "<br>Uses: #{@desviar.num_uses}" end %>
      <%= @desviar.captcha ? "<br>CAPTCHA is required" : "" %>
   </div>
   <hr>
-  <a href="/create">Create new temporary URI!</a>
+  <a href="/create">Create Another</a> <a href="/list">List</a>
 </div>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: desviar
 version: !ruby/object:Gem::Version
-  version: 0.0.16
+  version: 0.0.17
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-03 00:00:00.000000000 Z
+date: 2013-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dm-core
@@ -236,12 +236,12 @@ files:
 - Apache-License.txt
 - README.md
 - config.ru
+- config/.htdigest
 - config/config.rb.example
 - desviar.gemspec
 - examples/bash-client.sh
 - examples/ruby-client.rb
 - lib/auth.rb
-- lib/authorization.rb
 - lib/desviar.rb
 - lib/desviar/client.rb
 - lib/encrypt.rb
@@ -258,7 +258,7 @@ files:
 homepage: http://github.com/instantlinux/desviar
 licenses: []
 post_install_message: ! "------------------------------------------------------------------------------\nDesviar
-  v0.0.16\n\nTo configure, download from:\n   https://raw.github.com/instantlinux/desviar/master/config/config.rb.example\ninto
+  v0.0.17\n\nTo configure, download from:\n   https://raw.github.com/instantlinux/desviar/master/config/config.rb.example\ninto
   a new file config.rb and export DESVIAR_CONFIG=<path>/config.rb.\n\nThanks for using
   Desviar.\n------------------------------------------------------------------------------\n"
 rdoc_options: []

data/lib/authorization.rb

@@ -1,55 +0,0 @@
-require 'htauth'
-
-module Sinatra
- module Authorization
-  module HelperMethods
-
-  def passwd_file
-    File.expand_path '../config/.htpasswd', __FILE__
-  end
-
-  def auth
-    @auth ||= Rack::Auth::Basic::Request.new(request.env)
-#    @auth ||= Rack::Auth::Digest::MD5.new(request.env)
-  end
-
-  def unauthorized!(realm = "Please Authenticate")
-    header 'WWW-Authenticate' => %(Basic realm="#{realm}")
-    throw :halt, [ 401, 'Authorization Required' ]
-  end
-
-  def bad_request!
-    throw :halt, [ 400, 'Bad Request' ]
-  end
-
-  def authorized?
-    request.env['REMOTE_USER']
-  end
-
-  def authorize(username, password)
-    return false if !File.exists?(passwd_file)
-    pf = HTAuth::PasswdFile.new(passwd_file)
-    user = pf.fetch(username)
-    !user.nil? && user.authenticated?(password)
-  end
-
-  def require_administrative_privileges
-    return if authorized?
-    unauthorized! unless auth.provided?
-    bad_request! unless auth.basic?
-    unauthorized! unless authorize(*auth.credentials)
-    request.env['REMOTE_USER'] = auth.username
-  end
-
-  def admin?
-    authorized?
-  end
-
-  
-  end
-  def self.registered(app)
-    app.helpers HelperMethods
-  end
- end
- register Authorization
-end