feat(web): move from react-router to @tanstack/router

internal/http/auth.go

@@ -66,36 +66,37 @@ func (h authHandler) login(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	h.cookieStore.Options.HttpOnly = true
-	h.cookieStore.Options.SameSite = http.SameSiteLaxMode
-	h.cookieStore.Options.Path = h.config.BaseURL
-
-	// autobrr does not support serving on TLS / https, so this is only available behind reverse proxy
-	// if forwarded protocol is https then set cookie secure
-	// SameSite Strict can only be set with a secure cookie. So we overwrite it here if possible.
-	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
-	if r.Header.Get("X-Forwarded-Proto") == "https" {
-		h.cookieStore.Options.Secure = true
-		h.cookieStore.Options.SameSite = http.SameSiteStrictMode
-	}
-
 	if _, err := h.service.Login(r.Context(), data.Username, data.Password); err != nil {
 		h.log.Error().Err(err).Msgf("Auth: Failed login attempt username: [%s] ip: %s", data.Username, r.RemoteAddr)
-		h.encoder.StatusError(w, http.StatusUnauthorized, errors.New("could not login: bad credentials"))
+		h.encoder.StatusError(w, http.StatusForbidden, errors.New("could not login: bad credentials"))
 		return
 	}
 
 	// create new session
-	session, err := h.cookieStore.New(r, "user_session")
+	session, err := h.cookieStore.Get(r, "user_session")
 	if err != nil {
-		h.log.Error().Err(err).Msgf("Auth: Failed to parse cookies with attempt username: [%s] ip: %s", data.Username, r.RemoteAddr)
-		h.encoder.StatusError(w, http.StatusUnauthorized, errors.New("could not parse cookies"))
+		h.log.Error().Err(err).Msgf("could not get session from cookieStore: %s", r.RemoteAddr)
+		h.encoder.StatusError(w, http.StatusInternalServerError, err)
 		return
 	}
 
 	// Set user as authenticated
 	session.Values["authenticated"] = true
 
+	// Set cookie options
+	session.Options.HttpOnly = true
+	session.Options.SameSite = http.SameSiteLaxMode
+	session.Options.Path = h.config.BaseURL
+
+	// autobrr does not support serving on TLS / https, so this is only available behind reverse proxy
+	// if forwarded protocol is https then set cookie secure
+	// SameSite Strict can only be set with a secure cookie. So we overwrite it here if possible.
+	// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
+	if r.Header.Get("X-Forwarded-Proto") == "https" {
+		session.Options.Secure = true
+		session.Options.SameSite = http.SameSiteStrictMode
+	}
+
 	if err := session.Save(r, w); err != nil {
 		h.encoder.StatusError(w, http.StatusInternalServerError, errors.Wrap(err, "could not save session"))
 		return

internal/http/auth_test.go

@@ -21,6 +21,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/gorilla/sessions"
 	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
 )
 
 type authServiceMock struct {
@@ -144,9 +145,7 @@ func TestAuthHandlerLogin(t *testing.T) {
 	defer resp.Body.Close()
 
 	// check for response, here we'll just check for 204 NoContent
-	if status := resp.StatusCode; status != http.StatusNoContent {
-		t.Errorf("login: handler returned wrong status code: got %v want %v", status, http.StatusNoContent)
-	}
+	assert.Equalf(t, http.StatusNoContent, resp.StatusCode, "login handler: unexpected http status")
 
 	if v := resp.Header.Get("Set-Cookie"); v == "" {
 		t.Errorf("handler returned no cookie")
@@ -207,12 +206,10 @@ func TestAuthHandlerValidateOK(t *testing.T) {
 	defer resp.Body.Close()
 
 	// check for response, here we'll just check for 204 NoContent
-	if status := resp.StatusCode; status != http.StatusNoContent {
-		t.Errorf("login: handler returned wrong status code: got %v want %v", status, http.StatusNoContent)
-	}
+	assert.Equalf(t, http.StatusNoContent, resp.StatusCode, "login handler: bad response")
 
 	if v := resp.Header.Get("Set-Cookie"); v == "" {
-		t.Errorf("handler returned no cookie")
+		assert.Equalf(t, "", v, "login handler: expected Set-Cookie header")
 	}
 
 	// validate token
@@ -223,9 +220,7 @@ func TestAuthHandlerValidateOK(t *testing.T) {
 
 	defer resp.Body.Close()
 
-	if status := resp.StatusCode; status != http.StatusNoContent {
-		t.Errorf("validate: handler returned wrong status code: got %v want %v", status, http.StatusNoContent)
-	}
+	assert.Equalf(t, http.StatusNoContent, resp.StatusCode, "validate handler: unexpected http status")
 }
 
 func TestAuthHandlerValidateBad(t *testing.T) {
@@ -272,9 +267,7 @@ func TestAuthHandlerValidateBad(t *testing.T) {
 
 	defer resp.Body.Close()
 
-	if status := resp.StatusCode; status != http.StatusUnauthorized {
-		t.Errorf("validate: handler returned wrong status code: got %v want %v", status, http.StatusUnauthorized)
-	}
+	assert.Equalf(t, http.StatusForbidden, resp.StatusCode, "validate handler: unexpected http status")
 }
 
 func TestAuthHandlerLoginBad(t *testing.T) {
@@ -321,9 +314,7 @@ func TestAuthHandlerLoginBad(t *testing.T) {
 	defer resp.Body.Close()
 
 	// check for response, here we'll just check for 204 NoContent
-	if status := resp.StatusCode; status != http.StatusUnauthorized {
-		t.Errorf("handler returned wrong status code: got %v want %v", status, http.StatusUnauthorized)
-	}
+	assert.Equalf(t, http.StatusForbidden, resp.StatusCode, "login handler: unexpected http status")
 }
 
 func TestAuthHandlerLogout(t *testing.T) {
@@ -384,6 +375,8 @@ func TestAuthHandlerLogout(t *testing.T) {
 		t.Errorf("login: handler returned wrong status code: got %v want %v", status, http.StatusNoContent)
 	}
 
+	assert.Equalf(t, http.StatusNoContent, resp.StatusCode, "login handler: unexpected http status")
+
 	if v := resp.Header.Get("Set-Cookie"); v == "" {
 		t.Errorf("handler returned no cookie")
 	}
@@ -396,9 +389,7 @@ func TestAuthHandlerLogout(t *testing.T) {
 
 	defer resp.Body.Close()
 
-	if status := resp.StatusCode; status != http.StatusNoContent {
-		t.Errorf("validate: handler returned wrong status code: got %v want %v", status, http.StatusNoContent)
-	}
+	assert.Equalf(t, http.StatusNoContent, resp.StatusCode, "validate handler: unexpected http status")
 
 	// logout
 	resp, err = client.Post(testServer.URL+"/auth/logout", "application/json", nil)
@@ -408,9 +399,7 @@ func TestAuthHandlerLogout(t *testing.T) {
 
 	defer resp.Body.Close()
 
-	if status := resp.StatusCode; status != http.StatusNoContent {
-		t.Errorf("logout: handler returned wrong status code: got %v want %v", status, http.StatusNoContent)
-	}
+	assert.Equalf(t, http.StatusNoContent, resp.StatusCode, "logout handler: unexpected http status")
 
 	//if v := resp.Header.Get("Set-Cookie"); v != "" {
 	//	t.Errorf("logout handler returned cookie")

internal/http/middleware.go

@@ -24,7 +24,7 @@ func (s Server) IsAuthenticated(next http.Handler) http.Handler {
 			}
 
 		} else if key := r.URL.Query().Get("apikey"); key != "" {
-			// check query param lke ?apikey=TOKEN
+			// check query param like ?apikey=TOKEN
 			if !s.apiService.ValidateAPIKey(r.Context(), key) {
 				http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
 				return
@@ -33,18 +33,18 @@ func (s Server) IsAuthenticated(next http.Handler) http.Handler {
 			// check session
 			session, err := s.cookieStore.Get(r, "user_session")
 			if err != nil {
-				http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+				http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
 				return
 			}
 
 			if session.IsNew {
-				http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+				http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
 				return
 			}
 
 			// Check if user is authenticated
 			if auth, ok := session.Values["authenticated"].(bool); !ok || !auth {
-				http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+				http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
 				return
 			}
 

web/src/App.tsx

@@ -21,7 +21,7 @@ const queryClient = new QueryClient({
       // See https://tanstack.com/query/v4/docs/guides/query-retries#retry-delay
       // delay = Math.min(1000 * 2 ** attemptIndex, 30000)
       retry: true,
-      throwOnError: true,
+      throwOnError: false,
     },
     mutations: {
       onError: (error) => {

web/src/api/APIClient.ts

@@ -89,10 +89,15 @@ export async function HttpClient<T = unknown>(
   case 401: {
     // Remove auth info from localStorage
     AuthContext.reset();
-  }
-
     // Show an error toast to notify the user what occurred
     return Promise.reject(new Error(`[401] Unauthorized: "${endpoint}"`));
+  }
+  case 403: {
+    // Remove auth info from localStorage
+    AuthContext.reset();
+    // Show an error toast to notify the user what occurred
+    return Promise.reject(new Error(`[403] Forbidden: "${endpoint}"`));
+  }
   case 404: {
     return Promise.reject(new Error(`[404] Not found: "${endpoint}"`));
   }