Merge pull request #99 from drduh/12jun26

gosec action, theme selection with swatches, neutral names

Author: drduh

.github/workflows/gosec.yml

@@ -0,0 +1,27 @@
+name: gosec
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  gosec:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      with:
+        go-version-file: 'go.mod'
+
+    - name: Install gosec
+      run: go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+    - name: Run gosec
+      run: gosec ./...

.github/workflows/lint.yml

@@ -8,17 +8,18 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
     - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
+
     - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
       with:
         version: v2.12.2
-    timeout-minutes: 5

.github/workflows/test.yml

@@ -8,15 +8,16 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
     - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
+
     - run: go test -short ./...
-    timeout-minutes: 5

Makefile

@@ -163,7 +163,7 @@ check-service:
 	@$(SYSTEMCTL) status $(APPNAME) || \
 		$(DEST_BIN) -conf $(DEST_CONF)
 
-uninstall-service:
+uninstall:
 	@sudo $(SYSTEMCTL) stop $(APPNAME)
 	@sudo $(SYSTEMCTL) disable $(APPNAME)
 	@sudo rm -f $(DEST_SERV)
@@ -207,7 +207,7 @@ static:
 		$(call WARN,skipping '$@': '$(GOSTATIC)' not found); \
 	fi
 
-build-race: prep
+build-race: prep-build
 	@$(GORACE)
 
 race: build-race
@@ -248,6 +248,7 @@ d: debug
 devug: debug
 f: fmt
 litn: lint
+prep: prep-build
 prod: release
 t: test
 tset: test

README.md

@@ -2,7 +2,9 @@ gone is an ephemeral content server written in [Go](https://go.dev/).
 
 The primary goal is to share files and text using an HTML interface and API.
 
-[![test](https://github.com/drduh/gone/actions/workflows/test.yml/badge.svg)](https://github.com/drduh/gone/actions/workflows/test.yml) [![lint](https://github.com/drduh/gone/actions/workflows/lint.yml/badge.svg)](https://github.com/drduh/gone/actions/workflows/lint.yml)
+[![test](https://github.com/drduh/gone/actions/workflows/test.yml/badge.svg)](https://github.com/drduh/gone/actions/workflows/test.yml)
+[![lint](https://github.com/drduh/gone/actions/workflows/lint.yml/badge.svg)](https://github.com/drduh/gone/actions/workflows/lint.yml)
+[![gosec](https://github.com/drduh/gone/actions/workflows/gosec.yml/badge.svg)](https://github.com/drduh/gone/actions/workflows/gosec.yml)
 
 ## Features
 

assets/style.css

@@ -1,4 +1,4 @@
-/* style.css */
+/* https://github.com/drduh/gone/blob/main/assets/style.css */
 
 * {
   box-sizing: border-box;
@@ -8,7 +8,6 @@ html {
   animation: var(--bg-animation);
   background: var(--bg-gradient);
   background-size: var(--bg-size);
-  background-attachment: fixed;
   min-height: 100%;
 }
 
@@ -19,14 +18,14 @@ body {
   display: flex;
   flex-direction: column;
   font-family: "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
-  font-size: 1em;
+  font-size: var(--font-size);
   margin: 1em auto;
 }
 
 .box {
   background-color: var(--bg-norm-half);
   border: 1px solid var(--fg-dark);
-  border-radius: var(--box-radius);
+  border-radius: var(--radius-box);
   flex: 1;
   margin: 1em auto;
   padding: 1em;
@@ -62,7 +61,6 @@ select {
 
 button[disabled] {
   opacity: 0.5;
-  pointer-events: none;
 }
 
 button:focus,
@@ -85,7 +83,7 @@ select {
   appearance: none;
   background-color: var(--bg-dark);
   border: none;
-  border-radius: var(--box-radius);
+  border-radius: var(--radius-box);
   color: var(--fg-light);
   cursor: pointer;
   margin: 10px;
@@ -106,7 +104,7 @@ input[type="number"] {
 
 .message .owner {
   background-color: var(--bg-light);
-  border-radius: var(--box-radius);
+  border-radius: var(--radius-box);
   bottom: 2em;
   color: var(--fg-light);
   padding: 6px 0;
@@ -121,7 +119,7 @@ input[type="number"] {
 .message .owner::after {
   border-color: var(--fg-light) transparent transparent transparent;
   border-style: solid;
-  border-width: var(--box-radius);
+  border-width: var(--radius-box);
   content: "";
   left: 50%;
   margin-left: -5px;
@@ -183,12 +181,17 @@ input[type="file"]::file-selector-button:hover {
 }
 
 input[type="radio"] {
-  display: none;
+  height: 1px;
+  margin: 0;
+  opacity: 0;
+  pointer-events: none;
+  position: absolute;
+  width: 1px;
 }
 
 table {
   border-collapse: collapse;
-  border-radius: var(--box-radius);
+  border-radius: var(--radius-box);
   margin: 1em auto;
   overflow: hidden;
   width: 80%;
@@ -248,3 +251,109 @@ summary::marker {
   content: "";
   display: none;
 }
+
+.themes {
+  display: grid;
+  gap: 1em;
+  grid-template-columns: repeat(5, 1fr);
+}
+
+.themes label {
+  display: block;
+  width: var(--width-theme);
+  height: var(--width-theme);
+  border-radius: var(--radius-theme);
+  cursor: pointer;
+  outline: 2px solid transparent;
+  outline-offset: 2px;
+}
+
+.themes label:hover,
+.themes label:has(input:checked) {
+  outline-color: var(--fg-dark);
+}
+
+.themes label:has(input:focus-visible) {
+  outline-color: var(--fg-light);
+}
+
+.theme {
+  clip: rect(0,0,0,0);
+  position: absolute;
+}
+
+.theme-light {
+  background: linear-gradient(var(--rotation),
+    rgba(238,232,213,1) 0%,
+    rgba(253,246,227,1) 100%);
+}
+.theme-dark {
+  background: linear-gradient(var(--rotation),
+    rgba(101,123,131,1) 0%,
+    rgba(  0, 43, 54,1) 100%);
+}
+.theme-navy {
+  background: linear-gradient(var(--rotation),
+    rgba(  0, 91,150,1) 0%,
+    rgba(  1, 31, 75,1) 100%);
+}
+.theme-rose {
+  background: linear-gradient(var(--rotation),
+    rgba(220,130,130,1) 0%,
+    rgba(145, 55, 55,1) 100%);
+}
+.theme-green {
+  background: linear-gradient(var(--rotation),
+    rgba(119,171, 89,1) 0%,
+    rgba( 35, 77, 32,1) 100%);
+}
+.theme-lime {
+  background: linear-gradient(var(--rotation),
+    rgba(170,220,130,1) 0%,
+    rgba( 80,130, 50,1) 100%);
+}
+.theme-pink {
+  background: linear-gradient(var(--rotation),
+    rgba(255,185,210,1) 0%,
+    rgba(210, 90,140,1) 100%);
+}
+.theme-gold {
+  background: linear-gradient(var(--rotation),
+    rgba(255,212, 71,1) 0%,
+    rgba(166,124,  0,1) 100%);
+}
+.theme-purple {
+  background: linear-gradient(var(--rotation),
+    rgba(170,145,230,1) 0%,
+    rgba( 80, 60,160,1) 100%);
+}
+.theme-lush {
+  background: linear-gradient(var(--rotation),
+    rgba(169,132,248,1) 0%,
+    rgba( 26,184,126,1) 100%);
+}
+.theme-beach {
+  background: linear-gradient(var(--rotation),
+    rgba(246, 97, 81,1) 0%,
+    rgba( 66,142,186,1) 100%);
+}
+.theme-dusk {
+  background: linear-gradient(var(--rotation),
+    rgba(255,190,111,1) 0%,
+    rgba( 38, 36, 48,1) 100%);
+}
+.theme-neon {
+  background: linear-gradient(var(--rotation),
+    rgba(146, 21,245,1) 0%,
+    rgba(  0,  0,  0,1) 100%);
+}
+.theme-night {
+  background: linear-gradient(var(--rotation),
+    rgba(128,  0,  0,1) 0%,
+    rgba(  0,  0,  0,1) 100%);
+}
+.theme-ember {
+  background: linear-gradient(var(--rotation),
+    rgba(240,130, 30,1) 0%,
+    rgba(120, 40,  0,1) 100%);
+}

audit/handler.go

@@ -15,7 +15,7 @@ const errMarshal = `{"time":%q,` +
 
 // Handle formats and prints audit events in JSON format.
 func (a *Auditor) Handle(
-	ctx context.Context,
+	_ context.Context,
 	r slog.Record,
 ) error {
 	data := make(map[string]any, r.NumAttrs())

audit/handler_test.go

@@ -3,25 +3,9 @@ package audit
 import (
 	"bytes"
 	"encoding/json"
-	"io"
-	"log"
-	"log/slog"
 	"testing"
 )
 
-// newTestAuditor creates a new Auditor writing to buf.
-func newTestAuditor(buf *bytes.Buffer) *Auditor {
-	a := &Auditor{
-		Config: Config{
-			TimeFormat: "2006-01-02 15:04:05",
-		},
-		Handler: slog.NewJSONHandler(io.Discard, nil),
-		Logger:  log.New(buf, "", 0),
-	}
-	a.Log = slog.New(a)
-	return a
-}
-
 // TestHandleMarshalable tests a log entry is written
 // as valid JSON with expected fields.
 func TestHandleMarshalable(t *testing.T) {
@@ -30,8 +14,9 @@ func TestHandleMarshalable(t *testing.T) {
 	a.Log.Info("test event", "key", "value")
 
 	var entry map[string]any
-	if err := json.Unmarshal(buf.Bytes(), &entry); err != nil {
-		t.Fatalf("expected valid json, got error: %v\noutput: %s",
+	if err := json.Unmarshal(
+		buf.Bytes(), &entry); err != nil {
+		t.Fatalf("expected json, got error: %v\noutput: %s",
 			err, buf.String())
 	}
 

audit/testutil_test.go

@@ -0,0 +1,39 @@
+package audit
+
+import (
+	"bytes"
+	"context"
+	"log"
+	"log/slog"
+)
+
+type testHandler struct{}
+
+func (testHandler) Enabled(context.Context, slog.Level) bool {
+	return true
+}
+
+func (h testHandler) Handle(context.Context, slog.Record) error {
+	return nil
+}
+
+func (h testHandler) WithAttrs([]slog.Attr) slog.Handler {
+	return h
+}
+
+func (h testHandler) WithGroup(string) slog.Handler {
+	return h
+}
+
+// newTestAuditor creates a new Auditor writing to buf.
+func newTestAuditor(buf *bytes.Buffer) *Auditor {
+	a := &Auditor{
+		Config: Config{
+			TimeFormat: "2006-01-02 15:04:05",
+		},
+		Handler: testHandler{},
+		Logger:  log.New(buf, "", 0),
+	}
+	a.Log = slog.New(a)
+	return a
+}

auth/cookie.go

@@ -14,6 +14,7 @@ func GetCookie(w http.ResponseWriter, r *http.Request,
 		http.SetCookie(w, NewCookie(defaultValue, id, t))
 		return defaultValue
 	}
+
 	return cookie.Value
 }