@johnnyboy11234/esg-idea-contest 0.3.1 → 0.3.2

package/backend/internal/account/internal/passwords/passwords.go

@@ -0,0 +1,37 @@
+// Package passwords holds the bundled common-password blocklist (PRD §6.4,
+// rule COMMON_PASSWORD). Source and licence of the list: NOTICE in this
+// directory. The frontend lazy-loads the same file for its live checklist.
+package passwords
+
+import (
+	_ "embed"
+	"strings"
+)
+
+//go:embed common-passwords.txt
+var commonList string
+
+// common holds every list entry folded to lower case. The list is printable
+// ASCII, so strings.ToLower is an exact ASCII case fold here.
+var common = func() map[string]struct{} {
+	lines := strings.Split(commonList, "\n")
+	m := make(map[string]struct{}, len(lines))
+	for _, l := range lines {
+		l = strings.TrimSuffix(l, "\r")
+		if l != "" {
+			m[strings.ToLower(l)] = struct{}{}
+		}
+	}
+	return m
+}()
+
+// IsCommon reports whether pw equals a list entry, ignoring case. The whole
+// password is compared as submitted: nothing is trimmed, and a list entry
+// inside a longer password does not match.
+func IsCommon(pw string) bool {
+	_, ok := common[strings.ToLower(pw)]
+	return ok
+}
+
+// Len is the number of distinct entries (after case folding).
+func Len() int { return len(common) }

package/backend/internal/account/internal/passwords/passwords_test.go

@@ -0,0 +1,35 @@
+package passwords
+
+import "testing"
+
+func TestIsCommon(t *testing.T) {
+	for _, tc := range []struct {
+		pw   string
+		want bool
+	}{
+		{"password", true},
+		{"PASSWORD", true},
+		{"PassWord", true},
+		{"123456", true},
+		{"films+pic+galeries", true},
+		{"Films+Pic+Galeries", true},
+		{"eyphed", true}, // last line of the file
+		{"", false},
+		{" password", false}, // nothing is trimmed
+		{"password ", false},
+		{"password1!", false}, // not on the list
+		{"xpasswordx", false}, // an entry inside a longer password does not match
+		{"Correct-Horse-1", false},
+	} {
+		if got := IsCommon(tc.pw); got != tc.want {
+			t.Errorf("IsCommon(%q) = %v, want %v", tc.pw, got, tc.want)
+		}
+	}
+}
+
+func TestListIsLoaded(t *testing.T) {
+	// 10,001 lines, no case-folded duplicates (NOTICE).
+	if got := Len(); got != 10001 {
+		t.Errorf("Len() = %d, want 10001", got)
+	}
+}

package/backend/internal/account/password.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/account/internal/passwords"
 	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
 )
 
@@ -38,14 +39,15 @@ type Rule struct {
 // (testdata/password.json): later PRs add their rule at its table position.
 type Policy struct{ Rules []Rule }
 
-// DefaultPolicy returns the rules implemented so far, in table order.
-// SEQUENCE and COMMON_PASSWORD arrive with B1b-03 and later.
+// DefaultPolicy returns all eight rules of the PRD §6.4 table, in table order.
 func DefaultPolicy() *Policy {
 	return &Policy{Rules: []Rule{
 		{RuleLength, violatesLength},
 		{RuleCharset, violatesCharset},
 		{RuleComplexity, violatesComplexity},
+		{RuleCommon, violatesCommon},
 		{RuleKeyboardRun, violatesKeyboardRun},
+		{RuleSequence, violatesSequence},
 		{RuleRepeat, violatesRepeat},
 		{RuleContainsEmpNo, violatesEmpNo},
 	}}
@@ -103,6 +105,10 @@ func violatesComplexity(pw, _ string) bool {
 	return n < minPassClasses
 }
 
+// violatesCommon: the whole password equals an entry of the bundled Top-10,000
+// list, ignoring case (internal/passwords/NOTICE for the source).
+func violatesCommon(pw, _ string) bool { return passwords.IsCommon(pw) }
+
 // violatesRepeat: the same character three or more times in a row, compared
 // exactly (case-sensitive: "aAa" is fine).
 func violatesRepeat(pw, _ string) bool {

package/backend/internal/account/sequence.go

@@ -0,0 +1,54 @@
+package account
+
+const minSequence = 4
+
+// seqKey places a character on one of two alphabets: letters a–z (case
+// folded) and digits 0–9. ok is false for anything else, which breaks a
+// sequence. Letters and digits never join each other ("89ab" is two runs of 2),
+// and neighbours in ASCII outside an alphabet do not count ("xyz{" is 3).
+func seqKey(r rune) (alpha int8, pos int8, ok bool) {
+	switch {
+	case r >= 'a' && r <= 'z':
+		return 0, int8(r - 'a'), true
+	case r >= 'A' && r <= 'Z':
+		return 0, int8(r - 'A'), true
+	case r >= '0' && r <= '9':
+		return 1, int8(r - '0'), true
+	}
+	return 0, 0, false
+}
+
+// violatesSequence: four or more consecutive letters or digits, ascending or
+// descending, case-insensitive ("abcd", "DcBa", "4321"). Sequences do not wrap
+// ("xyza", "9012" are fine), the same character repeated is not a sequence
+// (that is REPEAT), and a run must keep one direction ("abcba" is fine).
+// Mirrors violatesKeyboardRun.
+func violatesSequence(pw, _ string) bool {
+	var prevAlpha, prevPos int8
+	have, run, dir := false, 0, int8(0)
+	for _, r := range pw {
+		a, p, ok := seqKey(r)
+		if !ok {
+			have, run, dir = false, 0, 0
+			continue
+		}
+		step := int8(0)
+		if have && a == prevAlpha {
+			step = p - prevPos
+		}
+		if step == 1 || step == -1 {
+			if run >= 2 && step == dir {
+				run++
+			} else {
+				run, dir = 2, step
+			}
+		} else {
+			run, dir = 1, 0
+		}
+		prevAlpha, prevPos, have = a, p, true
+		if run >= minSequence {
+			return true
+		}
+	}
+	return false
+}

package/backend/internal/account/sequence_test.go

@@ -0,0 +1,38 @@
+package account
+
+import "testing"
+
+func TestViolatesSequence(t *testing.T) {
+	for _, tc := range []struct {
+		pw   string
+		want bool
+	}{
+		{"", false},
+		{"abc", false},
+		{"abcd", true},
+		{"dcba", true},
+		{"aBcD", true},
+		{"WXYZ", true},
+		{"0123", true},
+		{"9876", true},
+		{"3210", true},
+		{"x-abcdefg-y", true}, // longer run, inside other text
+		{"xyza", false},       // no wrap
+		{"9012", false},       // no wrap
+		{"zyxw", true},
+		{"abcba", false},  // direction change restarts the count
+		{"abbc", false},   // a repeat breaks the run
+		{"aaaa", false},   // repeat is not a sequence
+		{"89ab", false},   // letters and digits do not join
+		{"xyz{", false},   // ASCII neighbour outside the alphabet
+		{"/012", false},   // ASCII neighbour outside the alphabet
+		{"ab-cd", false},  // a separator breaks the run
+		{"abécd", false},  // non-ASCII breaks the run
+		{"ab12cd", false}, // alphabets switching break the run
+		{"abc0123", true},
+	} {
+		if got := violatesSequence(tc.pw, ""); got != tc.want {
+			t.Errorf("violatesSequence(%q) = %v, want %v", tc.pw, got, tc.want)
+		}
+	}
+}

package/backend/internal/api/api.gen.go

@@ -336,6 +336,9 @@ type ServerInterface interface {
 	// GetIdea Idea detail
 	// (GET /ideas/{id})
 	GetIdea(w http.ResponseWriter, r *http.Request, id IdeaId)
+	// DownloadSlides Download the Idea's slides (Leader, Member, Admin)
+	// (GET /ideas/{id}/slides)
+	DownloadSlides(w http.ResponseWriter, r *http.Request, id IdeaId)
 }
 
 // Unimplemented server implementation that returns http.StatusNotImplemented for each endpoint.
@@ -396,6 +399,12 @@ func (_ Unimplemented) GetIdea(w http.ResponseWriter, r *http.Request, id IdeaId
 	w.WriteHeader(http.StatusNotImplemented)
 }
 
+// DownloadSlides Download the Idea's slides (Leader, Member, Admin)
+// (GET /ideas/{id}/slides)
+func (_ Unimplemented) DownloadSlides(w http.ResponseWriter, r *http.Request, id IdeaId) {
+	w.WriteHeader(http.StatusNotImplemented)
+}
+
 // ServerInterfaceWrapper converts contexts to parameters.
 type ServerInterfaceWrapper struct {
 	Handler            ServerInterface
@@ -800,6 +809,32 @@ func (siw *ServerInterfaceWrapper) GetIdea(w http.ResponseWriter, r *http.Reques
 	handler.ServeHTTP(w, r)
 }
 
+// DownloadSlides operation middleware
+func (siw *ServerInterfaceWrapper) DownloadSlides(w http.ResponseWriter, r *http.Request) {
+
+	var err error
+	_ = err
+
+	// ------------- Path parameter "id" -------------
+	var id IdeaId
+
+	err = runtime.BindStyledParameterWithOptions("simple", "id", chi.URLParam(r, "id"), &id, runtime.BindStyledParameterOptions{ParamLocation: runtime.ParamLocationPath, Explode: false, Required: true, Type: "string", Format: "uuid", ValueIsUnescaped: r.URL.RawPath == ""})
+	if err != nil {
+		siw.ErrorHandlerFunc(w, r, &InvalidParamFormatError{ParamName: "id", Err: err})
+		return
+	}
+
+	handler := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		siw.Handler.DownloadSlides(w, r, id)
+	}))
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		handler = middleware(handler)
+	}
+
+	handler.ServeHTTP(w, r)
+}
+
 type UnescapedCookieParamError struct {
 	ParamName string
 	Err       error
@@ -940,6 +975,9 @@ func HandlerWithOptions(si ServerInterface, options ChiServerOptions) http.Handl
 	r.Group(func(r chi.Router) {
 		r.Get(options.BaseURL+"/ideas/{id}", wrapper.GetIdea)
 	})
+	r.Group(func(r chi.Router) {
+		r.Get(options.BaseURL+"/ideas/{id}/slides", wrapper.DownloadSlides)
+	})
 
 	return r
 }

package/backend/internal/idea/create.go

@@ -69,9 +69,13 @@ type SlideRules struct {
 	Validate func(f SlideFile, expectedBase string) (ext string, err error)
 }
 
-// ObjectStore is the part of the MinIO port create needs (storage.SlideStore).
+// ObjectStore is the part of the MinIO port idea needs (storage.SlideStore):
+// Put for create, Get for download. Outages are *web.Error
+// STORAGE_UNAVAILABLE; any other Get error (a missing object) answers 500.
 type ObjectStore interface {
 	Put(ctx context.Context, key string, r io.Reader, size int64, contentType string) error
+	// Get opens key; the caller closes the reader. size is the object length.
+	Get(ctx context.Context, key string) (rc io.ReadCloser, size int64, err error)
 }
 
 // UploadAborter compensates an uploaded object whose transaction did not

package/backend/internal/idea/create_integration_test.go

@@ -34,7 +34,10 @@ import (
 
 // fakeObjects is an in-memory storage.SlideStore. before runs inside Put, so a
 // test can change the database between the pre-checks and the transaction.
-// deleteErr makes Delete fail (MinIO down after the upload).
+// deleteErr makes Delete fail (MinIO down after the upload). For Get: onGet
+// runs first, getErr fails the open (MinIO down before the first byte), and
+// a positive failAfter makes the stream fail with streamErr after that many
+// bytes (MinIO down mid-stream).
 type fakeObjects struct {
 	mu        sync.Mutex
 	puts      map[string][]byte
@@ -44,6 +47,12 @@ type fakeObjects struct {
 	deleted   []string
 	last      string // key of the last successful Put
 	before    func()
+
+	onGet     func()
+	getErr    error
+	failAfter int64
+	streamErr error
+	gets      int
 }
 
 func newFakeObjects() *fakeObjects {
@@ -71,10 +80,31 @@ func (f *fakeObjects) Put(_ context.Context, key string, r io.Reader, size int64
 	return nil
 }
 
-func (f *fakeObjects) Get(context.Context, string) (io.ReadCloser, int64, error) {
-	return nil, 0, storage.ErrObjectNotFound
+func (f *fakeObjects) Get(_ context.Context, key string) (io.ReadCloser, int64, error) {
+	if f.onGet != nil {
+		f.onGet()
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.gets++
+	if f.getErr != nil {
+		return nil, 0, f.getErr
+	}
+	b, ok := f.puts[key]
+	if !ok {
+		return nil, 0, storage.ErrObjectNotFound
+	}
+	var r io.Reader = bytes.NewReader(b)
+	if f.failAfter > 0 {
+		r = io.MultiReader(io.LimitReader(r, f.failAfter), failingReader{f.streamErr})
+	}
+	return io.NopCloser(r), int64(len(b)), nil
 }
 
+type failingReader struct{ err error }
+
+func (r failingReader) Read([]byte) (int, error) { return 0, r.err }
+
 func (f *fakeObjects) Delete(_ context.Context, key string) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()

package/backend/internal/idea/download.go

@@ -0,0 +1,193 @@
+package idea
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/api"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/idea/internal/store"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/db"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Download is an opened slide file. Body yields exactly Idea.Slides.Size bytes
+// unless storage fails mid-stream; the caller must Close it.
+type Download struct {
+	Idea Idea
+	Body io.ReadCloser
+}
+
+// Download runs GET /ideas/{id}/slides (Sequence.md §6): the visibility query
+// and the SLIDES_DOWNLOAD row share one transaction, and the object is opened
+// only after that transaction has committed, so no byte is served without a
+// durable audit row (fail-closed, PRD 6.11). A missing and a hidden Idea both
+// return NOT_FOUND. An unknown commit outcome serves nothing (503), because
+// the audit row may not exist. Downloads are never state-limited.
+//
+// If storage fails after the commit, the audit row stays for a download that
+// answered 503: accepted, the intent was real (Sequence.md §6).
+func (s *Service) Download(ctx context.Context, id uuid.UUID, caller security.Principal, req Request) (Download, error) {
+	var got Idea
+	out, err := db.InTx(ctx, s.DB, func(ctx context.Context, tx *sql.Tx) error {
+		var err error
+		if got, err = store.GetVisible(ctx, tx, id, caller.UserID, caller.IsAdmin()); err != nil {
+			return err
+		}
+		return s.Audit.Record(ctx, tx, audit.Event{
+			Action: audit.SlidesDownload, Outcome: audit.Success,
+			TargetType: audit.TargetIdea, TargetID: id,
+			Method: req.Method, Route: req.Route, Status: http.StatusOK,
+			IP: req.IP, UserAgent: req.UserAgent,
+		})
+	})
+	switch {
+	case out == db.Unknown:
+		e := web.NewError(web.CodeServiceUnavailable, "The download could not be recorded; please retry.")
+		e.Cause = err
+		return Download{}, e
+	case errors.Is(err, store.ErrNotFound):
+		return Download{}, web.NewError(web.CodeNotFound, "")
+	case err != nil:
+		return Download{}, err
+	}
+
+	// Storage outages are *web.Error STORAGE_UNAVAILABLE (503); a missing
+	// object is a consistency fault and answers 500.
+	body, size, err := s.Objects.Get(ctx, got.Slides.ObjectKey)
+	if err != nil {
+		return Download{}, fmt.Errorf("open slides of idea %s: %w", id, err)
+	}
+	// Content-Length is the stored slides_size; an object of another length
+	// would make every client see a truncated or overlong body.
+	if size != got.Slides.Size {
+		_ = body.Close()
+		return Download{}, fmt.Errorf("slides of idea %s: object is %d bytes, row says %d", id, size, got.Slides.Size)
+	}
+	return Download{Idea: got, Body: body}, nil
+}
+
+// DownloadSlides serves GET /ideas/{id}/slides: 200 with the file named by the
+// current expected filename (PRD 6.6, 6.8). HEAD never reaches this handler
+// (explicit 405 route, D47/D59).
+func (h Handler) DownloadSlides(w http.ResponseWriter, r *http.Request, id api.IdeaId) {
+	p, ok := security.PrincipalFrom(r.Context())
+	if !ok {
+		h.Fail(w, r, web.NewError(web.CodeUnauthenticated, "authentication required"))
+		return
+	}
+	d, err := h.Service.Download(r.Context(), uuid.UUID(id), p,
+		Request{Method: r.Method, Route: web.RoutePattern(r), UserAgent: r.UserAgent(), IP: web.ClientIP(r)})
+	if err != nil {
+		var e *web.Error
+		switch {
+		case errors.As(err, &e) && e.Code == web.CodeNotFound:
+			e.AuditAction = string(audit.SlidesDownload)
+			e.AuditReason = auditReasonHidden
+			e.AuditTargetType = string(audit.TargetIdea)
+			e.AuditTargetID = uuid.UUID(id)
+		case e == nil:
+			h.log().ErrorContext(r.Context(), "slides download failed", "ideaId", uuid.UUID(id).String(), "error", err)
+		}
+		h.Fail(w, r, err)
+		return
+	}
+	defer func() { _ = d.Body.Close() }()
+
+	i := d.Idea
+	base, err := h.ExpectedFilename(i.Category, i.Org, i.LeaderName, i.LeaderEmpNo, i.Name)
+	if err != nil {
+		h.Fail(w, r, err)
+		return
+	}
+	hd := w.Header()
+	hd.Set("Content-Type", contentTypes[i.Slides.Ext])
+	hd.Set("Content-Length", strconv.FormatInt(i.Slides.Size, 10))
+	hd.Set("Content-Disposition", ContentDisposition(base+"."+i.Slides.Ext))
+	hd.Set("Cache-Control", "no-store")
+	hd.Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(http.StatusOK)
+
+	src := &readErrRecorder{r: d.Body}
+	n, err := io.CopyN(w, src, i.Slides.Size)
+	if err == nil {
+		return
+	}
+	if src.err != nil || errors.Is(err, io.EOF) {
+		// Headers are out, so no error body can follow. Abort the connection
+		// (HTTP/1.1 close, HTTP/2 RST_STREAM): with Content-Length set the
+		// client sees an incomplete body instead of a silently short file.
+		h.log().ErrorContext(r.Context(), "slides download aborted: storage failed mid-stream",
+			"ideaId", i.ID.String(), "sent", n, "size", i.Slides.Size, "error", err)
+		panic(http.ErrAbortHandler)
+	}
+	// The client went away; nothing left to tell it.
+	h.log().InfoContext(r.Context(), "slides download interrupted by client",
+		"ideaId", i.ID.String(), "sent", n, "size", i.Slides.Size, "error", err)
+}
+
+func (h Handler) log() *slog.Logger {
+	if h.Log == nil {
+		return slog.New(slog.DiscardHandler)
+	}
+	return h.Log
+}
+
+// readErrRecorder remembers the source's first non-EOF error, so a failed copy
+// can be blamed on storage (abort) or on the client (just stop).
+type readErrRecorder struct {
+	r   io.Reader
+	err error
+}
+
+func (x *readErrRecorder) Read(p []byte) (int, error) {
+	n, err := x.r.Read(p)
+	if err != nil && !errors.Is(err, io.EOF) && x.err == nil {
+		x.err = err
+	}
+	return n, err
+}
+
+// ContentDisposition is the RFC 6266 attachment header for name: an ASCII
+// fallback filename (non-ASCII, quotes, backslashes and controls become "_")
+// and the exact UTF-8 name as filename* (RFC 8187 percent-encoding).
+func ContentDisposition(name string) string {
+	var fallback, ext strings.Builder
+	for _, r := range name {
+		if r < 0x20 || r > 0x7e || r == '"' || r == '\\' {
+			fallback.WriteByte('_')
+		} else {
+			fallback.WriteRune(r)
+		}
+	}
+	const hex = "0123456789ABCDEF"
+	for _, b := range []byte(name) {
+		if isAttrChar(b) {
+			ext.WriteByte(b)
+		} else {
+			ext.WriteByte('%')
+			ext.WriteByte(hex[b>>4])
+			ext.WriteByte(hex[b&0x0f])
+		}
+	}
+	return `attachment; filename="` + fallback.String() + `"; filename*=UTF-8''` + ext.String()
+}
+
+// isAttrChar is RFC 8187 attr-char: ALPHA / DIGIT / "!#$&+-.^_`|~".
+func isAttrChar(b byte) bool {
+	switch {
+	case b >= 'a' && b <= 'z', b >= 'A' && b <= 'Z', b >= '0' && b <= '9':
+		return true
+	}
+	return strings.IndexByte("!#$&+-.^_`|~", b) >= 0
+}