Logins + sessions working

server/src/main.cpp

@@ -67,7 +67,7 @@ int main() {
     });
 
     svr.Get("/script.js", [&script](const httplib::Request& request, httplib::Response& response) {
-        response.set_content(script, "text/css");
+        response.set_content(script, "text/javascript");
     });
 
     svr.Get("/login", [&login](const httplib::Request& request, httplib::Response& response) {
@@ -93,13 +93,52 @@ int main() {
                     response.set_content("<p>wrong password lmao</p><img src='https://media.tenor.com/wWX7upr7SvwAAAAM/byuntear-cat.gif' alt='your stupid lol'>", "text/html");
                     return;
                 }
+            } else {
+                response.status = 400;
+                response.set_content("<p>that username doesn't exist</p>", "text/html");
+                return;
+            }
+ 
+            std::optional<std::string> token = database.createNewToken(user->id);
+            if (!token.has_value()) {
+                response.status = 500;
+                response.set_content("<p>couldn't create a session, sorry</p>", "text/html");
+                return;
+            }
+ 
+            // HttpOnly so script.js can't read/leak it, SameSite=Lax so it
+            // isn't sent on cross-site POSTs (basic CSRF mitigation),
+            // Max-Age matches the 30 day expiry stored in the DB
+            response.set_header(
+                "Set-Cookie",
+                "session=" + *token + "; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000"
+            );
+            response.set_redirect("/");
+        } catch (const std::runtime_error& e) {
+            response.status = 500;
+            response.set_content("<p>there was an error :( it is: " + std::string(e.what()) + "</p>", "text/html");
+        }
+    });
+
+    svr.Post("/register", [&database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
+        std::string username = request.form.get_field("username");
+        std::string password = request.form.get_field("password");
+ 
+        std::lock_guard<std::mutex> lock(data_mutex);
+ 
+        try {
+            std::optional<User> user = database.getUserByName(username);
+ 
+            if (user.has_value()) {
+                response.status = 400;
+                response.set_content("<p>that username already exists</p>", "text/html");
+                return;
             } else {
                 if (username.empty()) {
                     response.status = 400;
                     response.set_content("<p>hey you can't have an empty username!!!!1!!!1! >:(</p>", "text/html");
                     return;
                 }
-                // register on the fly, same as make_post currently does
                 User newUser{0, username, bcrypt::generateHash(password)};
                 database.addUser(newUser);
                 user = newUser;
@@ -152,6 +191,7 @@ int main() {
 
     svr.Get("/posts/:id", [&headerTop, &headerBottom, &footer, &e404, &database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
         std::string postId = request.path_params.at("id");
+        std::lock_guard<std::mutex> lock(data_mutex);
         try {
             uint64_t postIdNum = std::stoll(postId);
             std::optional<Post> post = database.getPost(postIdNum);
@@ -174,6 +214,7 @@ int main() {
         }
     });
 
+    // endpoint to be used by HTML forms
     svr.Post("/make_post", [&database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
 
         std::string username = request.get_param_value("username");
@@ -213,6 +254,32 @@ int main() {
 
     });
 
+    // endpoint to be used in Javascript
+    svr.Post("/post", [&database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
+        try {
+            std::lock_guard<std::mutex> lock(data_mutex);
+            std::string post = request.form.get_field("post");
+
+            std::optional<User> user = getLoggedInUser(request, database);
+            if (!user.has_value()) {
+                response.status = 401;
+                response.set_content("<p>you're not logged in, so you can't post</p>", "text/html");
+                return;
+            }
+
+            database.addPost(Post(post, user->id));
+            response.status = 200;
+            response.set_content("OK", "text/text");
+
+        } catch (const std::runtime_error& e) {
+            response.status = 500;
+            response.set_content("<p>there was an error :( it is: " + std::string(e.what()) + "</p>", "text/html");
+        } catch (const std::exception& e) {
+            response.status = 500;
+            response.set_content("<p>there was an error :( it is: " + std::string(e.what()) + "</p>", "text/html");
+        }
+    });
+
     svr.Post("/like", [&database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
         try {
             std::string username = request.form.get_field("username");
@@ -233,14 +300,16 @@ int main() {
     });
 
     svr.Get("/me", [&database, &data_mutex](const httplib::Request& request, httplib::Response& response) {
+        std::lock_guard<std::mutex> lock(data_mutex);
         std::optional<User> user = getLoggedInUser(request, database);
+        response.set_header("Cache-Control", "no-store");
 
         if (!user.has_value()) {
             response.set_header("X-Logged-In", "false");
             return;
         }
 
-        response.set_header("X-Logged-In", "false");
+        response.set_header("X-Logged-In", "true");
         response.set_header("X-Username", user->name);
 
     });