No OneTemporary
Actions

Size

72 KB

Subscribers

None

View Options

	diff --git a/account.go b/account.go
	index 2ae5bf1..e6ddc7b 100644
	--- a/account.go
	+++ b/account.go
	@@ -1,1152 +1,1158 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"encoding/json"
	"fmt"
	"html/template"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"

	"github.com/gorilla/mux"
	"github.com/gorilla/sessions"
	"github.com/guregu/null/zero"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/data"
	"github.com/writeas/web-core/log"
	+
	"github.com/writeas/writefreely/author"
	"github.com/writeas/writefreely/config"
	"github.com/writeas/writefreely/page"
	)

	type (
	userSettings struct {
	Username string `schema:"username" json:"username"`
	Email string `schema:"email" json:"email"`
	NewPass string `schema:"new-pass" json:"new_pass"`
	OldPass string `schema:"current-pass" json:"current_pass"`
	IsLogOut bool `schema:"logout" json:"logout"`
	}

	UserPage struct {
	page.StaticPage

	PageTitle string
	Separator template.HTML
	IsAdmin bool
	CanInvite bool
	}
	)

	func NewUserPage(app App, r http.Request, u User, title string, flashes []string) UserPage {
	up := &UserPage{
	StaticPage: pageForReq(app, r),
	PageTitle: title,
	}
	up.Username = u.Username
	up.Flashes = flashes
	up.Path = r.URL.Path
	up.IsAdmin = u.IsAdmin()
	up.CanInvite = canUserInvite(app.cfg, up.IsAdmin)
	return up
	}

	func canUserInvite(cfg *config.Config, isAdmin bool) bool {
	return cfg.App.UserInvites != "" &&
	(isAdmin \|\| cfg.App.UserInvites != "admin")
	}

	func (up UserPage) SetMessaging(u User) {
	- //up.NeedsAuth = app.db.DoesUserNeedAuth(u.ID)
	+ // up.NeedsAuth = app.db.DoesUserNeedAuth(u.ID)
	}

	const (
	loginAttemptExpiration = 3 * time.Second
	)

	var actuallyUsernameReg = regexp.MustCompile("username is actually ([a-z0-9\\-]+)\\. Please try that, instead")

	func apiSignup(app App, w http.ResponseWriter, r http.Request) error {
	_, err := signup(app, w, r)
	return err
	}

	func signup(app App, w http.ResponseWriter, r http.Request) (*AuthUser, error) {
	reqJSON := IsJSON(r)

	// Get params
	var ur userRegistration
	if reqJSON {
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&ur)
	if err != nil {
	log.Error("Couldn't parse signup JSON request: %v\n", err)
	return nil, ErrBadJSON
	}
	} else {
	// Check if user is already logged in
	u := getUserSession(app, r)
	if u != nil {
	return &AuthUser{User: u}, nil
	}

	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse signup form request: %v\n", err)
	return nil, ErrBadFormData
	}

	err = app.formDecoder.Decode(&ur, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode signup form request: %v\n", err)
	return nil, ErrBadFormData
	}
	}

	return signupWithRegistration(app, ur, w, r)
	}

	func signupWithRegistration(app App, signup userRegistration, w http.ResponseWriter, r http.Request) (*AuthUser, error) {
	reqJSON := IsJSON(r)

	// Validate required params (alias)
	if signup.Alias == "" {
	return nil, impart.HTTPError{http.StatusBadRequest, "A username is required."}
	}
	if signup.Pass == "" {
	return nil, impart.HTTPError{http.StatusBadRequest, "A password is required."}
	}
	var desiredUsername string
	if signup.Normalize {
	// With this option we simply conform the username to what we expect
	// without complaining. Since they might've done something funny, like
	// enter: write.as/Way Out There, we'll use their raw input for the new
	// collection name and sanitize for the slug / username.
	desiredUsername = signup.Alias
	signup.Alias = getSlug(signup.Alias, "")
	}
	if !author.IsValidUsername(app.cfg, signup.Alias) {
	// Ensure the username is syntactically correct.
	return nil, impart.HTTPError{http.StatusPreconditionFailed, "Username is reserved or isn't valid. It must be at least 3 characters long, and can only include letters, numbers, and hyphens."}
	}

	// Handle empty optional params
	// TODO: remove this var
	createdWithPass := true
	hashedPass, err := auth.HashPass([]byte(signup.Pass))
	if err != nil {
	return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
	}

	// Create struct to insert
	u := &User{
	Username: signup.Alias,
	HashedPass: hashedPass,
	HasPass: createdWithPass,
	Email: prepareUserEmail(signup.Email, app.keys.EmailKey),
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	// Create actual user
	if err := app.db.CreateUser(app.cfg, u, desiredUsername); err != nil {
	return nil, err
	}

	// Log invite if needed
	if signup.InviteCode != "" {
	cu, err := app.db.GetUserForAuth(signup.Alias)
	if err != nil {
	return nil, err
	}
	err = app.db.CreateInvitedUser(signup.InviteCode, cu.ID)
	if err != nil {
	return nil, err
	}
	}

	// Add back unencrypted data for response
	if signup.Email != "" {
	u.Email.String = signup.Email
	}

	resUser := &AuthUser{
	User: u,
	}
	if !createdWithPass {
	resUser.Password = signup.Pass
	}
	title := signup.Alias
	if signup.Normalize {
	title = desiredUsername
	}
	resUser.Collections = &[]Collection{
	{
	Alias: signup.Alias,
	Title: title,
	},
	}

	var token string
	if reqJSON && !signup.Web {
	token, err = app.db.GetAccessToken(u.ID)
	if err != nil {
	return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
	}
	resUser.AccessToken = token
	} else {
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
	log.Error("Session: %v; ignoring", err)
	}
	session.Values[cookieUserVal] = resUser.User.Cookie()
	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't save session: %v", err)
	return nil, err
	}
	}
	if reqJSON {
	return resUser, impart.WriteSuccess(w, resUser, http.StatusCreated)
	}

	return resUser, nil
	}

	func viewLogout(app App, w http.ResponseWriter, r http.Request) error {
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	return ErrInternalCookieSession
	}

	// Ensure user has an email or password set before they go, so they don't
	// lose access to their account.
	val := session.Values[cookieUserVal]
	var u = &User{}
	var ok bool
	if u, ok = val.(*User); !ok {
	log.Error("Error casting user object on logout. Vals: %+v Resetting cookie.", session.Values)

	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't save session on logout: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
	}

	return impart.HTTPError{http.StatusFound, "/"}
	}

	u, err = app.db.GetUserByID(u.ID)
	if err != nil && err != ErrUserNotFound {
	return impart.HTTPError{http.StatusInternalServerError, "Unable to fetch user information."}
	}

	session.Options.MaxAge = -1

	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't save session on logout: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
	}

	return impart.HTTPError{http.StatusFound, "/"}
	}

	func handleAPILogout(app App, w http.ResponseWriter, r http.Request) error {
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}
	t := auth.GetToken(accessToken)
	if len(t) == 0 {
	return ErrNoAccessToken
	}
	err := app.db.DeleteToken(t)
	if err != nil {
	return err
	}
	return impart.HTTPError{Status: http.StatusNoContent}
	}

	func viewLogin(app App, w http.ResponseWriter, r http.Request) error {
	var earlyError string
	oneTimeToken := r.FormValue("with")
	if oneTimeToken != "" {
	log.Info("Calling login with one-time token.")
	err := login(app, w, r)
	if err != nil {
	log.Info("Received error: %v", err)
	earlyError = fmt.Sprintf("%s", err)
	}
	}

	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session; ignoring: %v", err)
	}

	p := &struct {
	page.StaticPage
	To string
	Message template.HTML
	Flashes []template.HTML
	LoginUsername string
	OauthSlack bool
	OauthWriteAs bool
	OauthGitlab bool
	GitlabDisplayName string
	}{
	pageForReq(app, r),
	r.FormValue("to"),
	template.HTML(""),
	[]template.HTML{},
	getTempInfo(app, "login-user", r, w),
	app.Config().SlackOauth.ClientID != "",
	app.Config().WriteAsOauth.ClientID != "",
	app.Config().GitlabOauth.ClientID != "",
	config.OrDefaultString(app.Config().GitlabOauth.DisplayName, gitlabDisplayName),
	}

	if earlyError != "" {
	p.Flashes = append(p.Flashes, template.HTML(earlyError))
	}

	// Display any error messages
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}
	err = pages["login.tmpl"].ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render login: %v", err)
	return err
	}
	return nil
	}

	func webLogin(app App, w http.ResponseWriter, r http.Request) error {
	err := login(app, w, r)
	if err != nil {
	username := r.FormValue("alias")
	// Login request was unsuccessful; save the error in the session and redirect them
	if err, ok := err.(impart.HTTPError); ok {
	session, _ := app.sessionStore.Get(r, cookieName)
	if session != nil {
	session.AddFlash(err.Message)
	session.Save(r, w)
	}

	if m := actuallyUsernameReg.FindStringSubmatch(err.Message); len(m) > 0 {
	// Retain fixed username recommendation for the login form
	username = m[1]
	}
	}

	// Pass along certain information
	saveTempInfo(app, "login-user", username, r, w)

	// Retain post-login URL if one was given
	redirectTo := "/login"
	postLoginRedirect := r.FormValue("to")
	if postLoginRedirect != "" {
	redirectTo += "?to=" + postLoginRedirect
	}

	log.Error("Unable to login: %v", err)
	return impart.HTTPError{http.StatusTemporaryRedirect, redirectTo}
	}

	return nil
	}

	var loginAttemptUsers = sync.Map{}

	func login(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r)
	oneTimeToken := r.FormValue("with")
	verbose := r.FormValue("all") == "true" \|\| r.FormValue("verbose") == "1" \|\| r.FormValue("verbose") == "true" \|\| (reqJSON && oneTimeToken != "")

	redirectTo := r.FormValue("to")
	if redirectTo == "" {
	if app.cfg.App.SingleUser {
	redirectTo = "/me/new"
	} else {
	redirectTo = "/"
	}
	}

	var u *User
	var err error
	var signin userCredentials

	// Log in with one-time token if one is given
	if oneTimeToken != "" {
	log.Info("Login: Logging user in via token.")
	userID := app.db.GetUserID(oneTimeToken)
	if userID == -1 {
	log.Error("Login: Got user -1 from token")
	err := ErrBadAccessToken
	err.Message = "Expired or invalid login code."
	return err
	}
	log.Info("Login: Found user %d.", userID)

	u, err = app.db.GetUserByID(userID)
	if err != nil {
	log.Error("Unable to fetch user on one-time token login: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "There was an error retrieving the user you want."}
	}
	log.Info("Login: Got user via token")
	} else {
	// Get params
	if reqJSON {
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&signin)
	if err != nil {
	log.Error("Couldn't parse signin JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse signin form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&signin, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode signin form request: %v\n", err)
	return ErrBadFormData
	}
	}

	log.Info("Login: Attempting login for '%s'", signin.Alias)

	// Validate required params (all)
	if signin.Alias == "" {
	msg := "Parameter `alias` required."
	if signin.Web {
	msg = "A username is required."
	}
	return impart.HTTPError{http.StatusBadRequest, msg}
	}
	if !signin.EmailLogin && signin.Pass == "" {
	msg := "Parameter `pass` required."
	if signin.Web {
	msg = "A password is required."
	}
	return impart.HTTPError{http.StatusBadRequest, msg}
	}

	// Prevent excessive login attempts on the same account
	// Skip this check in dev environment
	if !app.cfg.Server.Dev {
	now := time.Now()
	attemptExp, att := loginAttemptUsers.LoadOrStore(signin.Alias, now.Add(loginAttemptExpiration))
	if att {
	if attemptExpTime, ok := attemptExp.(time.Time); ok {
	if attemptExpTime.After(now) {
	// This user attempted previously, and the period hasn't expired yet
	return impart.HTTPError{http.StatusTooManyRequests, "You're doing that too much."}
	} else {
	// This user attempted previously, but the time expired; free up space
	loginAttemptUsers.Delete(signin.Alias)
	}
	} else {
	log.Error("Unable to cast expiration to time")
	}
	}
	}

	// Retrieve password
	u, err = app.db.GetUserForAuth(signin.Alias)
	if err != nil {
	log.Info("Unable to getUserForAuth on %s: %v", signin.Alias, err)
	if strings.IndexAny(signin.Alias, "@") > 0 {
	log.Info("Suggesting: %s", ErrUserNotFoundEmail.Message)
	return ErrUserNotFoundEmail
	}
	return err
	}
	// Authenticate
	if u.Email.String == "" {
	// User has no email set, so check if they haven't added a password, either,
	// so we can return a more helpful error message.
	if hasPass, _ := app.db.IsUserPassSet(u.ID); !hasPass {
	log.Info("Tried logging in to %s, but no password or email.", signin.Alias)
	return impart.HTTPError{http.StatusPreconditionFailed, "This user never added a password or email address. Please contact us for help."}
	}
	}
	if !auth.Authenticated(u.HashedPass, []byte(signin.Pass)) {
	return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
	}
	}

	if reqJSON && !signin.Web {
	var token string
	if r.Header.Get("User-Agent") == "" {
	// Get last created token when User-Agent is empty
	token = app.db.FetchLastAccessToken(u.ID)
	if token == "" {
	token, err = app.db.GetAccessToken(u.ID)
	}
	} else {
	token, err = app.db.GetAccessToken(u.ID)
	}
	if err != nil {
	log.Error("Login: Unable to create access token: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
	}
	resUser := getVerboseAuthUser(app, token, u, verbose)
	return impart.WriteSuccess(w, resUser, http.StatusOK)
	}

	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	log.Error("Login: Session: %v; ignoring", err)
	}

	// Remove unwanted data
	session.Values[cookieUserVal] = u.Cookie()
	err = session.Save(r, w)
	if err != nil {
	log.Error("Login: Couldn't save session: %v", err)
	// TODO: return error
	}

	// Send success
	if reqJSON {
	return impart.WriteSuccess(w, &AuthUser{User: u}, http.StatusOK)
	}
	log.Info("Login: Redirecting to %s", redirectTo)
	w.Header().Set("Location", redirectTo)
	w.WriteHeader(http.StatusFound)
	return nil
	}

	func getVerboseAuthUser(app App, token string, u User, verbose bool) *AuthUser {
	resUser := &AuthUser{
	AccessToken: token,
	User: u,
	}

	// Fetch verbose user data if requested
	if verbose {
	posts, err := app.db.GetUserPosts(u)
	if err != nil {
	log.Error("Login: Unable to get user posts: %v", err)
	}
	colls, err := app.db.GetCollections(u, app.cfg.App.Host)
	if err != nil {
	log.Error("Login: Unable to get user collections: %v", err)
	}
	passIsSet, err := app.db.IsUserPassSet(u.ID)
	if err != nil {
	// TODO: correct error meesage
	log.Error("Login: Unable to get user collections: %v", err)
	}

	resUser.Posts = posts
	resUser.Collections = colls
	resUser.User.HasPass = passIsSet
	}
	return resUser
	}

	func viewExportOptions(app App, u User, w http.ResponseWriter, r *http.Request) error {
	// Fetch extra user data
	p := NewUserPage(app, r, u, "Export", nil)

	showUserPage(w, "export", p)
	return nil
	}

	func viewExportPosts(app App, w http.ResponseWriter, r http.Request) ([]byte, string, error) {
	var filename string
	var u = &User{}
	reqJSON := IsJSON(r)
	if reqJSON {
	// Use given Authorization header
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return nil, filename, ErrNoAccessToken
	}

	userID := app.db.GetUserID(accessToken)
	if userID == -1 {
	return nil, filename, ErrBadAccessToken
	}

	var err error
	u, err = app.db.GetUserByID(userID)
	if err != nil {
	return nil, filename, impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve requested user."}
	}
	} else {
	// Use user cookie
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	log.Error("Session: %v; ignoring", err)
	}

	val := session.Values[cookieUserVal]
	var ok bool
	if u, ok = val.(*User); !ok {
	return nil, filename, ErrNotLoggedIn
	}
	}

	filename = u.Username + "-posts-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")

	// Fetch data we're exporting
	var err error
	var data []byte
	posts, err := app.db.GetUserPosts(u)
	if err != nil {
	return data, filename, err
	}

	// Export as CSV
	if strings.HasSuffix(r.URL.Path, ".csv") {
	data = exportPostsCSV(app.cfg.App.Host, u, posts)
	return data, filename, err
	}
	if strings.HasSuffix(r.URL.Path, ".zip") {
	data = exportPostsZip(u, posts)
	return data, filename, err
	}

	if r.FormValue("pretty") == "1" {
	data, err = json.MarshalIndent(posts, "", "\t")
	} else {
	data, err = json.Marshal(posts)
	}
	return data, filename, err
	}

	func viewExportFull(app App, w http.ResponseWriter, r http.Request) ([]byte, string, error) {
	var err error
	filename := ""
	u := getUserSession(app, r)
	if u == nil {
	return nil, filename, ErrNotLoggedIn
	}
	filename = u.Username + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")

	exportUser := compileFullExport(app, u)

	var data []byte
	if r.FormValue("pretty") == "1" {
	data, err = json.MarshalIndent(exportUser, "", "\t")
	} else {
	data, err = json.Marshal(exportUser)
	}
	return data, filename, err
	}

	func viewMeAPI(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r)
	uObj := struct {
	ID int64 `json:"id,omitempty"`
	Username string `json:"username,omitempty"`
	}{}
	var err error

	if reqJSON {
	_, uObj.Username, err = app.db.GetUserDataFromToken(r.Header.Get("Authorization"))
	if err != nil {
	return err
	}
	} else {
	u := getUserSession(app, r)
	if u == nil {
	return impart.WriteSuccess(w, uObj, http.StatusOK)
	}
	uObj.Username = u.Username
	}

	return impart.WriteSuccess(w, uObj, http.StatusOK)
	}

	func viewMyPostsAPI(app App, u User, w http.ResponseWriter, r *http.Request) error {
	reqJSON := IsJSON(r)
	if !reqJSON {
	return ErrBadRequestedType
	}

	var err error
	p := GetPostsCache(u.ID)
	if p == nil {
	userPostsCache.Lock()
	if userPostsCache.users[u.ID].ready == nil {
	userPostsCache.users[u.ID] = postsCacheItem{ready: make(chan struct{})}
	userPostsCache.Unlock()

	p, err = app.db.GetUserPosts(u)
	if err != nil {
	return err
	}

	CachePosts(u.ID, p)
	} else {
	userPostsCache.Unlock()

	<-userPostsCache.users[u.ID].ready
	p = GetPostsCache(u.ID)
	}
	}

	return impart.WriteSuccess(w, p, http.StatusOK)
	}

	func viewMyCollectionsAPI(app App, u User, w http.ResponseWriter, r *http.Request) error {
	reqJSON := IsJSON(r)
	if !reqJSON {
	return ErrBadRequestedType
	}

	p, err := app.db.GetCollections(u, app.cfg.App.Host)
	if err != nil {
	return err
	}

	return impart.WriteSuccess(w, p, http.StatusOK)
	}

	func viewArticles(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p, err := app.db.GetAnonymousPosts(u)
	if err != nil {
	log.Error("unable to fetch anon posts: %v", err)
	}
	// nil-out AnonymousPosts slice for easy detection in the template
	if p != nil && len(*p) == 0 {
	p = nil
	}

	f, err := getSessionFlashes(app, w, r, nil)
	if err != nil {
	log.Error("unable to fetch flashes: %v", err)
	}

	c, err := app.db.GetPublishableCollections(u, app.cfg.App.Host)
	if err != nil {
	log.Error("unable to fetch collections: %v", err)
	}

	silenced, err := app.db.IsUserSilenced(u.ID)
	if err != nil {
	log.Error("view articles: %v", err)
	}
	d := struct {
	*UserPage
	AnonymousPosts *[]PublicPost
	Collections *[]Collection
	Silenced bool
	}{
	UserPage: NewUserPage(app, r, u, u.Username+"'s Posts", f),
	AnonymousPosts: p,
	Collections: c,
	Silenced: silenced,
	}
	d.UserPage.SetMessaging(u)
	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
	w.Header().Set("Expires", "Thu, 04 Oct 1990 20:00:00 GMT")
	showUserPage(w, "articles", d)

	return nil
	}

	func viewCollections(app App, u User, w http.ResponseWriter, r *http.Request) error {
	c, err := app.db.GetCollections(u, app.cfg.App.Host)
	if err != nil {
	log.Error("unable to fetch collections: %v", err)
	return fmt.Errorf("No collections")
	}

	f, _ := getSessionFlashes(app, w, r, nil)

	uc, _ := app.db.GetUserCollectionCount(u.ID)
	// TODO: handle any errors

	silenced, err := app.db.IsUserSilenced(u.ID)
	if err != nil {
	log.Error("view collections %v", err)
	return fmt.Errorf("view collections: %v", err)
	}
	d := struct {
	*UserPage
	Collections *[]Collection

	UsedCollections, TotalCollections int

	NewBlogsDisabled bool
	Silenced bool
	}{
	UserPage: NewUserPage(app, r, u, u.Username+"'s Blogs", f),
	Collections: c,
	UsedCollections: int(uc),
	NewBlogsDisabled: !app.cfg.App.CanCreateBlogs(uc),
	Silenced: silenced,
	}
	d.UserPage.SetMessaging(u)
	showUserPage(w, "collections", d)

	return nil
	}

	func viewEditCollection(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	c, err := app.db.GetCollection(vars["collection"])
	if err != nil {
	return err
	}
	if c.OwnerID != u.ID {
	return ErrCollectionNotFound
	}

	silenced, err := app.db.IsUserSilenced(u.ID)
	if err != nil {
	log.Error("view edit collection %v", err)
	return fmt.Errorf("view edit collection: %v", err)
	}
	flashes, _ := getSessionFlashes(app, w, r, nil)
	obj := struct {
	*UserPage
	*Collection
	Silenced bool
	}{
	UserPage: NewUserPage(app, r, u, "Edit "+c.DisplayTitle(), flashes),
	Collection: c,
	Silenced: silenced,
	}

	showUserPage(w, "collection", obj)
	return nil
	}

	func updateSettings(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r)

	var s userSettings
	var u *User
	var sess *sessions.Session
	var err error
	if reqJSON {
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}

	u, err = app.db.GetAPIUser(accessToken)
	if err != nil {
	return ErrBadAccessToken
	}

	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&s)
	if err != nil {
	log.Error("Couldn't parse settings JSON request: %v\n", err)
	return ErrBadJSON
	}

	// Prevent all username updates
	// TODO: support changing username via JSON API request
	s.Username = ""
	} else {
	u, sess = getUserAndSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}

	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse settings form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&s, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode settings form request: %v\n", err)
	return ErrBadFormData
	}
	}

	// Do update
	postUpdateReturn := r.FormValue("return")
	redirectTo := "/me/settings"
	if s.IsLogOut {
	redirectTo += "?logout=1"
	} else if postUpdateReturn != "" {
	redirectTo = postUpdateReturn
	}

	// Only do updates on values we need
	if s.Username != "" && s.Username == u.Username {
	// Username hasn't actually changed; blank it out
	s.Username = ""
	}
	err = app.db.ChangeSettings(app, u, &s)
	if err != nil {
	if reqJSON {
	return err
	}

	if err, ok := err.(impart.HTTPError); ok {
	addSessionFlash(app, w, r, err.Message, nil)
	}
	} else {
	// Successful update.
	if reqJSON {
	return impart.WriteSuccess(w, u, http.StatusOK)
	}

	if s.IsLogOut {
	redirectTo = "/me/logout"
	} else {
	sess.Values[cookieUserVal] = u.Cookie()
	addSessionFlash(app, w, r, "Account updated.", nil)
	}
	}

	w.Header().Set("Location", redirectTo)
	w.WriteHeader(http.StatusFound)
	return nil
	}

	func updatePassphrase(app App, w http.ResponseWriter, r http.Request) error {
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}

	curPass := r.FormValue("current")
	newPass := r.FormValue("new")
	// Ensure a new password is given (always required)
	if newPass == "" {
	return impart.HTTPError{http.StatusBadRequest, "Provide a new password."}
	}

	userID, sudo := app.db.GetUserIDPrivilege(accessToken)
	if userID == -1 {
	return ErrBadAccessToken
	}

	// Ensure a current password is given if the access token doesn't have sudo
	// privileges.
	if !sudo && curPass == "" {
	return impart.HTTPError{http.StatusBadRequest, "Provide current password."}
	}

	// Hash the new password
	hashedPass, err := auth.HashPass([]byte(newPass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
	}

	// Do update
	err = app.db.ChangePassphrase(userID, sudo, curPass, hashedPass)
	if err != nil {
	return err
	}

	return impart.WriteSuccess(w, struct{}{}, http.StatusOK)
	}

	func viewStats(app App, u User, w http.ResponseWriter, r *http.Request) error {
	var c *Collection
	var err error
	vars := mux.Vars(r)
	alias := vars["collection"]
	if alias != "" {
	c, err = app.db.GetCollection(alias)
	if err != nil {
	return err
	}
	if c.OwnerID != u.ID {
	return ErrCollectionNotFound
	}
	}

	topPosts, err := app.db.GetTopPosts(u, alias)
	if err != nil {
	log.Error("Unable to get top posts: %v", err)
	return err
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)
	titleStats := ""
	if c != nil {
	titleStats = c.DisplayTitle() + " "
	}

	silenced, err := app.db.IsUserSilenced(u.ID)
	if err != nil {
	log.Error("view stats: %v", err)
	return err
	}
	obj := struct {
	*UserPage
	VisitsBlog string
	Collection *Collection
	TopPosts *[]PublicPost
	APFollowers int
	Silenced bool
	}{
	UserPage: NewUserPage(app, r, u, titleStats+"Stats", flashes),
	VisitsBlog: alias,
	Collection: c,
	TopPosts: topPosts,
	Silenced: silenced,
	}
	if app.cfg.App.Federation {
	folls, err := app.db.GetAPFollowers(c)
	if err != nil {
	return err
	}
	obj.APFollowers = len(*folls)
	}

	showUserPage(w, "stats", obj)
	return nil
	}

	func viewSettings(app App, u User, w http.ResponseWriter, r *http.Request) error {
	fullUser, err := app.db.GetUserByID(u.ID)
	if err != nil {
	log.Error("Unable to get user for settings: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
	}

	passIsSet, err := app.db.IsUserPassSet(u.ID)
	if err != nil {
	log.Error("Unable to get isUserPassSet for settings: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)

	enableOauthSlack := app.Config().SlackOauth.ClientID != ""
	enableOauthWriteAs := app.Config().WriteAsOauth.ClientID != ""
	+ enableOauthGitLab := app.Config().GitlabOauth.ClientID != ""

	oauthAccounts, err := app.db.GetOauthAccounts(r.Context(), u.ID)
	if err != nil {
	log.Error("Unable to get oauth accounts for settings: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
	}
	for _, oauthAccount := range oauthAccounts {
	switch oauthAccount.Provider {
	case "slack":
	enableOauthSlack = false
	case "write.as":
	enableOauthWriteAs = false
	+ case "gitlab":
	+ enableOauthGitLab = false
	}
	}

	- displayOauthSection := enableOauthSlack \|\| enableOauthWriteAs \|\| len(oauthAccounts) > 0
	+ displayOauthSection := enableOauthSlack \|\| enableOauthWriteAs \|\| enableOauthGitLab \|\| len(oauthAccounts) > 0

	obj := struct {
	*UserPage
	Email string
	HasPass bool
	IsLogOut bool
	Silenced bool
	OauthSection bool
	OauthAccounts []oauthAccountInfo
	OauthSlack bool
	OauthWriteAs bool
	+ OauthGitLab bool
	}{
	UserPage: NewUserPage(app, r, u, "Account Settings", flashes),
	Email: fullUser.EmailClear(app.keys),
	HasPass: passIsSet,
	IsLogOut: r.FormValue("logout") == "1",
	Silenced: fullUser.IsSilenced(),
	OauthSection: displayOauthSection,
	OauthAccounts: oauthAccounts,
	OauthSlack: enableOauthSlack,
	OauthWriteAs: enableOauthWriteAs,
	+ OauthGitLab: enableOauthGitLab,
	}

	showUserPage(w, "settings", obj)
	return nil
	}

	func saveTempInfo(app App, key, val string, r http.Request, w http.ResponseWriter) error {
	session, err := app.sessionStore.Get(r, "t")
	if err != nil {
	return ErrInternalCookieSession
	}

	session.Values[key] = val
	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't saveTempInfo for key-val (%s:%s): %v", key, val, err)
	}
	return err
	}

	func getTempInfo(app App, key string, r http.Request, w http.ResponseWriter) string {
	session, err := app.sessionStore.Get(r, "t")
	if err != nil {
	return ""
	}

	// Get the information
	var s = ""
	var ok bool
	if s, ok = session.Values[key].(string); !ok {
	return ""
	}

	// Delete cookie
	session.Options.MaxAge = -1
	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't erase temp data for key %s: %v", key, err)
	}

	// Return value
	return s
	}

	func removeOauth(app App, u User, w http.ResponseWriter, r *http.Request) error {
	provider := r.FormValue("provider")
	clientID := r.FormValue("client_id")
	remoteUserID := r.FormValue("remote_user_id")

	err := app.db.RemoveOauth(r.Context(), u.ID, provider, clientID, remoteUserID)
	if err != nil {
	return impart.HTTPError{Status: http.StatusInternalServerError, Message: err.Error()}
	}

	return impart.HTTPError{Status: http.StatusFound, Message: "/me/settings"}
	}

	func prepareUserEmail(input string, emailKey []byte) zero.String {
	email := zero.NewString("", input != "")
	if len(input) > 0 {
	encEmail, err := data.Encrypt(emailKey, input)
	if err != nil {
	log.Error("Unable to encrypt email: %s\n", err)
	} else {
	email.String = string(encEmail)
	}
	}
	return email
	}
	diff --git a/go.mod b/go.mod
	index fe5b548..bb23137 100644
	--- a/go.mod
	+++ b/go.mod
	@@ -1,63 +1,65 @@
	module github.com/writeas/writefreely

	require (
	github.com/alecthomas/gometalinter v3.0.0+incompatible // indirect
	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf // indirect
	github.com/captncraig/cors v0.0.0-20180620154129-376d45073b49 // indirect
	github.com/clbanning/mxj v1.8.4 // indirect
	github.com/dchest/uniuri v0.0.0-20160212164326-8902c56451e9 // indirect
	github.com/dustin/go-humanize v1.0.0
	github.com/fatih/color v1.7.0
	github.com/go-fed/httpsig v0.1.1-0.20190924171022-f4c36041199d // indirect
	github.com/go-sql-driver/mysql v1.4.1
	github.com/go-test/deep v1.0.1 // indirect
	github.com/golang/lint v0.0.0-20181217174547-8f45f776aaf1 // indirect
	github.com/gologme/log v0.0.0-20181207131047-4e5d8ccb38e8 // indirect
	github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e // indirect
	github.com/gorilla/feeds v1.1.0
	github.com/gorilla/mux v1.7.0
	github.com/gorilla/schema v1.0.2
	github.com/gorilla/sessions v1.2.0
	github.com/guregu/null v3.4.0+incompatible
	github.com/hashicorp/go-multierror v1.0.0
	github.com/ikeikeikeike/go-sitemap-generator/v2 v2.0.2
	+ github.com/jteeuwen/go-bindata v3.0.7+incompatible // indirect
	github.com/jtolds/gls v4.2.1+incompatible // indirect
	github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec
	github.com/lunixbochs/vtclean v1.0.0 // indirect
	github.com/manifoldco/promptui v0.3.2
	github.com/mattn/go-colorable v0.1.0 // indirect
	github.com/mattn/go-sqlite3 v1.10.0
	github.com/microcosm-cc/bluemonday v1.0.2
	github.com/mitchellh/go-wordwrap v1.0.0
	github.com/nicksnyder/go-i18n v1.10.0 // indirect
	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d
	github.com/pelletier/go-toml v1.2.0 // indirect
	github.com/pkg/errors v0.8.1 // indirect
	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be // indirect
	github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 // indirect
	github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c // indirect
	github.com/stretchr/testify v1.3.0
	github.com/urfave/cli/v2 v2.1.1
	github.com/writeas/activity v0.1.2
	github.com/writeas/activityserve v0.0.0-20191115095800-dd6d19cc8b89
	github.com/writeas/go-strip-markdown v2.0.1+incompatible
	github.com/writeas/go-webfinger v0.0.0-20190106002315-85cf805c86d2
	github.com/writeas/httpsig v1.0.0
	github.com/writeas/impart v1.1.1-0.20191230230525-d3c45ced010d
	github.com/writeas/import v0.2.0
	github.com/writeas/monday v0.0.0-20181024183321-54a7dd579219
	github.com/writeas/nerds v1.0.0
	github.com/writeas/saturday v1.7.1
	github.com/writeas/slug v1.2.0
	github.com/writeas/web-core v1.2.0
	github.com/writefreely/go-nodeinfo v1.2.0
	+ golang.org/dl v0.0.0-20200319204010-bf12898a6070 // indirect
	golang.org/x/crypto v0.0.0-20200109152110-61a87790db17
	golang.org/x/lint v0.0.0-20181217174547-8f45f776aaf1 // indirect
	golang.org/x/tools v0.0.0-20190208222737-3744606dbb67 // indirect
	google.golang.org/appengine v1.4.0 // indirect
	gopkg.in/alecthomas/kingpin.v3-unstable v3.0.0-20180810215634-df19058c872c // indirect
	gopkg.in/ini.v1 v1.41.0
	src.techknowlogick.com/xgo v0.0.0-20200129005940-d0fae26e014b // indirect
	)

	go 1.13
	diff --git a/go.sum b/go.sum
	index b0a423a..1de5654 100644
	--- a/go.sum
	+++ b/go.sum
	@@ -1,206 +1,210 @@
	code.as/core/socks v1.0.0 h1:SPQXNp4SbEwjOAP9VzUahLHak8SDqy5n+9cm9tpjZOs=
	code.as/core/socks v1.0.0/go.mod h1:BAXBy5O9s2gmw6UxLqNJcVbWY7C/UPs+801CcSsfWOY=
	github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
	github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
	github.com/alecthomas/gometalinter v2.0.11+incompatible/go.mod h1:qfIpQGGz3d+NmgyPBqv+LSh50emm1pt72EtcX2vKYQk=
	github.com/alecthomas/gometalinter v3.0.0+incompatible h1:e9Zfvfytsw/e6Kd/PYd75wggK+/kX5Xn8IYDUKyc5fU=
	github.com/alecthomas/gometalinter v3.0.0+incompatible/go.mod h1:qfIpQGGz3d+NmgyPBqv+LSh50emm1pt72EtcX2vKYQk=
	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf h1:qet1QNfXsQxTZqLG4oE62mJzwPIB8+Tee4RNCL9ulrY=
	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
	github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
	github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
	github.com/captncraig/cors v0.0.0-20180620154129-376d45073b49 h1:jWNY1NDg6a/c8RSXkai7IX6UOhir0LD39I4Dukg+4Ks=
	github.com/captncraig/cors v0.0.0-20180620154129-376d45073b49/go.mod h1:EIlIeMufZ8nqdUhnesledB15xLRl4wIJUppwDLPrdrQ=
	github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE=
	github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e h1:fY5BOSpyZCqRo5OhCuC+XN+r/bBCmeuuJtjz+bCNIf8=
	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
	github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8=
	github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
	github.com/clbanning/mxj v1.8.3/go.mod h1:BVjHeAH+rl9rs6f+QIpeRl0tfu10SXn1pUSa5PVGJng=
	github.com/clbanning/mxj v1.8.4 h1:HuhwZtbyvyOw+3Z1AowPkU87JkJUSv751ELWaiTpj8I=
	github.com/clbanning/mxj v1.8.4/go.mod h1:BVjHeAH+rl9rs6f+QIpeRl0tfu10SXn1pUSa5PVGJng=
	github.com/client9/misspell v0.3.4 h1:ta993UF76GwbvJcIo3Y68y/M3WxlpEHPWIGDkJYwzJI=
	github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
	github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
	github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
	github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
	github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
	github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
	github.com/dchest/uniuri v0.0.0-20160212164326-8902c56451e9 h1:74lLNRzvsdIlkTgfDSMuaPjBr4cf6k7pwQQANm/yLKU=
	github.com/dchest/uniuri v0.0.0-20160212164326-8902c56451e9/go.mod h1:GgB8SF9nRG+GqaDtLcwJZsQFhcogVCJ79j4EdT0c2V4=
	github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
	github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
	github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
	github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
	github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
	github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
	github.com/go-fed/httpsig v0.1.0 h1:6F2OxRVnNTN4OPN+Mc2jxs2WEay9/qiHT/jphlvAwIY=
	github.com/go-fed/httpsig v0.1.0/go.mod h1:T56HUNYZUQ1AGUzhAYPugZfp36sKApVnGBgKlIY+aIE=
	github.com/go-fed/httpsig v0.1.1-0.20190924171022-f4c36041199d h1:+uoOvOnNDgsYbWtAij4xP6Rgir3eJGjocFPxBJETU/U=
	github.com/go-fed/httpsig v0.1.1-0.20190924171022-f4c36041199d/go.mod h1:T56HUNYZUQ1AGUzhAYPugZfp36sKApVnGBgKlIY+aIE=
	github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
	github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
	github.com/go-test/deep v1.0.1 h1:UQhStjbkDClarlmv0am7OXXO4/GaPdCGiUiMTvi28sg=
	github.com/go-test/deep v1.0.1/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
	github.com/golang/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
	github.com/golang/lint v0.0.0-20181217174547-8f45f776aaf1 h1:6DVPu65tee05kY0/rciBQ47ue+AnuY8KTayV6VHikIo=
	github.com/golang/lint v0.0.0-20181217174547-8f45f776aaf1/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
	github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
	github.com/gologme/log v0.0.0-20181207131047-4e5d8ccb38e8 h1:WD8iJ37bRNwvETMfVTusVSAi0WdXTpfNVGY2aHycNKY=
	github.com/gologme/log v0.0.0-20181207131047-4e5d8ccb38e8/go.mod h1:gq31gQ8wEHkR+WekdWsqDuf8pXTUZA9BnnzTuPz1Y9U=
	github.com/google/shlex v0.0.0-20181106134648-c34317bd91bf h1:7+FW5aGwISbqUtkfmIpZJGRgNFg2ioYPvFaUxdqpDsg=
	github.com/google/shlex v0.0.0-20181106134648-c34317bd91bf/go.mod h1:RpwtwJQFrIEPstU94h88MWPXP2ektJZ8cZ0YntAmXiE=
	github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
	github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
	github.com/gordonklaus/ineffassign v0.0.0-20180909121442-1003c8bd00dc h1:cJlkeAx1QYgO5N80aF5xRGstVsRQwgLR7uA2FnP1ZjY=
	github.com/gordonklaus/ineffassign v0.0.0-20180909121442-1003c8bd00dc/go.mod h1:cuNKsD1zp2v6XfE/orVX2QE1LC+i254ceGcVeDT3pTU=
	github.com/gorilla/feeds v1.1.0 h1:pcgLJhbdYgaUESnj3AmXPcB7cS3vy63+jC/TI14AGXk=
	github.com/gorilla/feeds v1.1.0/go.mod h1:Nk0jZrvPFZX1OBe5NPiddPw7CfwF6Q9eqzaBbaightA=
	github.com/gorilla/mux v1.7.0 h1:tOSd0UKHQd6urX6ApfOn4XdBMY6Sh1MfxV3kmaazO+U=
	github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
	github.com/gorilla/schema v1.0.2 h1:sAgNfOcNYvdDSrzGHVy9nzCQahG+qmsg+nE8dK85QRA=
	github.com/gorilla/schema v1.0.2/go.mod h1:kgLaKoK1FELgZqMAVxx/5cbj0kT+57qxUrAlIO2eleU=
	github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
	github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
	github.com/gorilla/sessions v1.2.0 h1:S7P+1Hm5V/AT9cjEcUD5uDaQSX0OE577aCXgoaKpYbQ=
	github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
	github.com/guregu/null v3.4.0+incompatible h1:a4mw37gBO7ypcBlTJeZGuMpSxxFTV9qFfFKgWxQSGaM=
	github.com/guregu/null v3.4.0+incompatible/go.mod h1:ePGpQaN9cw0tj45IR5E5ehMvsFlLlQZAkkOXZurJ3NM=
	github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
	github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
	github.com/hashicorp/go-multierror v1.0.0 h1:iVjPR7a6H0tWELX5NxNe7bYopibicUzc7uPribsnS6o=
	github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
	github.com/ikeikeikeike/go-sitemap-generator/v2 v2.0.2 h1:wIdDEle9HEy7vBPjC6oKz6ejs3Ut+jmsYvuOoAW2pSM=
	github.com/ikeikeikeike/go-sitemap-generator/v2 v2.0.2/go.mod h1:WtaVKD9TeruTED9ydiaOJU08qGoEPP/LyzTKiD3jEsw=
	+github.com/jteeuwen/go-bindata v3.0.7+incompatible h1:91Uy4d9SYVr1kyTJ15wJsog+esAZZl7JmEfTkwmhJts=
	+github.com/jteeuwen/go-bindata v3.0.7+incompatible/go.mod h1:JVvhzYOiGBnFSYRyV00iY8q7/0PThjIYav1p9h5dmKs=
	github.com/jtolds/gls v4.2.1+incompatible h1:fSuqC+Gmlu6l/ZYAoZzx2pyucC8Xza35fpRVWLVmUEE=
	github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
	github.com/juju/ansiterm v0.0.0-20180109212912-720a0952cc2a h1:FaWFmfWdAUKbSCtOU2QjDaorUexogfaMgbipgYATUMU=
	github.com/juju/ansiterm v0.0.0-20180109212912-720a0952cc2a/go.mod h1:UJSiEoRfvx3hP73CvoARgeLjaIOjybY9vj8PUPPFGeU=
	github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
	github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
	github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
	github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
	github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
	github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec h1:ZXWuspqypleMuJy4bzYEqlMhJnGAYpLrWe5p7W3CdvI=
	github.com/kylemcc/twitter-text-go v0.0.0-20180726194232-7f582f6736ec/go.mod h1:voECJzdraJmolzPBgL9Z7ANwXf4oMXaTCsIkdiPpR/g=
	github.com/lunixbochs/vtclean v0.0.0-20180621232353-2d01aacdc34a h1:weJVJJRzAJBFRlAiJQROKQs8oC9vOxvm4rZmBBk0ONw=
	github.com/lunixbochs/vtclean v0.0.0-20180621232353-2d01aacdc34a/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
	github.com/lunixbochs/vtclean v1.0.0 h1:xu2sLAri4lGiovBDQKxl5mrXyESr3gUr5m5SM5+LVb8=
	github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
	github.com/manifoldco/promptui v0.3.2 h1:rir7oByTERac6jhpHUPErHuopoRDvO3jxS+FdadEns8=
	github.com/manifoldco/promptui v0.3.2/go.mod h1:8JU+igZ+eeiiRku4T5BjtKh2ms8sziGpSYl1gN8Bazw=
	github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
	github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
	github.com/mattn/go-colorable v0.1.0 h1:v2XXALHHh6zHfYTJ+cSkwtyffnaOyR1MXaA91mTrb8o=
	github.com/mattn/go-colorable v0.1.0/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
	github.com/mattn/go-isatty v0.0.4 h1:bnP0vzxcAdeI1zdubAl5PjU6zsERjGZb7raWodagDYs=
	github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
	github.com/mattn/go-sqlite3 v1.10.0 h1:jbhqpg7tQe4SupckyijYiy0mJJ/pRyHvXf7JdWK860o=
	github.com/mattn/go-sqlite3 v1.10.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
	github.com/microcosm-cc/bluemonday v1.0.2 h1:5lPfLTTAvAbtS0VqT+94yOtFnGfUWYyx0+iToC3Os3s=
	github.com/microcosm-cc/bluemonday v1.0.2/go.mod h1:iVP4YcDBq+n/5fb23BhYFvIMq/leAFZyRl6bYmGDlGc=
	github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
	github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
	github.com/nicksnyder/go-i18n v1.10.0 h1:5AzlPKvXBH4qBzmZ09Ua9Gipyruv6uApMcrNZdo96+Q=
	github.com/nicksnyder/go-i18n v1.10.0/go.mod h1:HrK7VCrbOvQoUAQ7Vpy7i87N7JZZZ7R2xBGjv0j365Q=
	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d h1:VhgPp6v9qf9Agr/56bj7Y/xa04UccTW04VP0Qed4vnQ=
	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d/go.mod h1:YUTz3bUH2ZwIWBy3CJBeOBEugqcmXREj14T+iG/4k4U=
	github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
	github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
	github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
	github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
	github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
	github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be h1:ta7tUOvsPHVHGom5hKW5VXNc2xZIkfCKP8iaqOyYtUQ=
	github.com/rainycape/unidecode v0.0.0-20150907023854-cb7f23ec59be/go.mod h1:MIDFMn7db1kT65GmV94GzpX9Qdi7N/pQlwb+AN8wh+Q=
	github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
	github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
	github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
	github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
	github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
	github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
	github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c h1:Ho+uVpkel/udgjbwB5Lktg9BtvJSh2DT0Hi6LPSyI2w=
	github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
	github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
	github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
	github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
	github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
	github.com/tsenart/deadcode v0.0.0-20160724212837-210d2dc333e9 h1:vY5WqiEon0ZSTGM3ayVVi+twaHKHDFUVloaQ/wug9/c=
	github.com/tsenart/deadcode v0.0.0-20160724212837-210d2dc333e9/go.mod h1:q+QjxYvZ+fpjMXqs+XEriussHjSYqeXVnAdSV1tkMYk=
	github.com/urfave/cli/v2 v2.1.1 h1:Qt8FeAtxE/vfdrLmR3rxR6JRE0RoVmbXu8+6kZtYU4k=
	github.com/urfave/cli/v2 v2.1.1/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2caLfQ=
	github.com/writeas/activity v0.1.2 h1:Y12B5lIrabfqKE7e7HFCWiXrlfXljr9tlkFm2mp7DgY=
	github.com/writeas/activity v0.1.2/go.mod h1:mYYgiewmEM+8tlifirK/vl6tmB2EbjYaxwb+ndUw5T0=
	github.com/writeas/activityserve v0.0.0-20191115095800-dd6d19cc8b89 h1:NJhzq9aTccL3SSSZMrcnYhkD6sObdY9otNZ1X6/ZKNE=
	github.com/writeas/activityserve v0.0.0-20191115095800-dd6d19cc8b89/go.mod h1:Kz62mzYsCnrFTSTSFLXFj3fGYBQOntmBWTDDq57b46A=
	github.com/writeas/go-strip-markdown v2.0.1+incompatible h1:IIqxTM5Jr7RzhigcL6FkrCNfXkvbR+Nbu1ls48pXYcw=
	github.com/writeas/go-strip-markdown v2.0.1+incompatible/go.mod h1:Rsyu10ZhbEK9pXdk8V6MVnZmTzRG0alMNLMwa0J01fE=
	github.com/writeas/go-webfinger v0.0.0-20190106002315-85cf805c86d2 h1:DUsp4OhdfI+e6iUqcPQlwx8QYXuUDsToTz/x82D3Zuo=
	github.com/writeas/go-webfinger v0.0.0-20190106002315-85cf805c86d2/go.mod h1:w2VxyRO/J5vfNjJHYVubsjUGHd3RLDoVciz0DE3ApOc=
	github.com/writeas/go-writeas v1.1.0 h1:WHGm6wriBkxYAOGbvriXH8DlMUGOi6jhSZLUZKQ+4mQ=
	github.com/writeas/go-writeas v1.1.0/go.mod h1:oh9U1rWaiE0p3kzdKwwvOpNXgp0P0IELI7OLOwV4fkA=
	github.com/writeas/go-writeas/v2 v2.0.2 h1:akvdMg89U5oBJiCkBwOXljVLTqP354uN6qnG2oOMrbk=
	github.com/writeas/go-writeas/v2 v2.0.2/go.mod h1:9sjczQJKmru925fLzg0usrU1R1tE4vBmQtGnItUMR0M=
	github.com/writeas/httpsig v1.0.0 h1:peIAoIA3DmlP8IG8tMNZqI4YD1uEnWBmkcC9OFPjt3A=
	github.com/writeas/httpsig v1.0.0/go.mod h1:7ClMGSrSVXJbmiLa17bZ1LrG1oibGZmUMlh3402flPY=
	github.com/writeas/impart v1.1.0 h1:nPnoO211VscNkp/gnzir5UwCDEvdHThL5uELU60NFSE=
	github.com/writeas/impart v1.1.0/go.mod h1:g0MpxdnTOHHrl+Ca/2oMXUHJ0PcRAEWtkCzYCJUXC9Y=
	github.com/writeas/impart v1.1.1-0.20191230230525-d3c45ced010d h1:PK7DOj3JE6MGf647esPrKzXEHFjGWX2hl22uX79ixaE=
	github.com/writeas/impart v1.1.1-0.20191230230525-d3c45ced010d/go.mod h1:g0MpxdnTOHHrl+Ca/2oMXUHJ0PcRAEWtkCzYCJUXC9Y=
	github.com/writeas/import v0.2.0 h1:Ov23JW9Rnjxk06rki1Spar45bNX647HhwhAZj3flJiY=
	github.com/writeas/import v0.2.0/go.mod h1:gFe0Pl7ZWYiXbI0TJxeMMyylPGZmhVvCfQxhMEc8CxM=
	github.com/writeas/monday v0.0.0-20181024183321-54a7dd579219 h1:baEp0631C8sT2r/hqwypIw2snCFZa6h7U6TojoLHu/c=
	github.com/writeas/monday v0.0.0-20181024183321-54a7dd579219/go.mod h1:NyM35ayknT7lzO6O/1JpfgGyv+0W9Z9q7aE0J8bXxfQ=
	github.com/writeas/nerds v1.0.0 h1:ZzRcCN+Sr3MWID7o/x1cr1ZbLvdpej9Y1/Ho+JKlqxo=
	github.com/writeas/nerds v1.0.0/go.mod h1:Gn2bHy1EwRcpXeB7ZhVmuUwiweK0e+JllNf66gvNLdU=
	github.com/writeas/openssl-go v1.0.0 h1:YXM1tDXeYOlTyJjoMlYLQH1xOloUimSR1WMF8kjFc5o=
	github.com/writeas/openssl-go v1.0.0/go.mod h1:WsKeK5jYl0B5y8ggOmtVjbmb+3rEGqSD25TppjJnETA=
	github.com/writeas/saturday v1.6.0/go.mod h1:ETE1EK6ogxptJpAgUbcJD0prAtX48bSloie80+tvnzQ=
	github.com/writeas/saturday v1.7.1 h1:lYo1EH6CYyrFObQoA9RNWHVlpZA5iYL5Opxo7PYAnZE=
	github.com/writeas/saturday v1.7.1/go.mod h1:ETE1EK6ogxptJpAgUbcJD0prAtX48bSloie80+tvnzQ=
	github.com/writeas/slug v1.2.0 h1:EMQ+cwLiOcA6EtFwUgyw3Ge18x9uflUnOnR6bp/J+/g=
	github.com/writeas/slug v1.2.0/go.mod h1:RE8shOqQP3YhsfsQe0L3RnuejfQ4Mk+JjY5YJQFubfQ=
	github.com/writeas/web-core v1.2.0 h1:CYqvBd+byi1cK4mCr1NZ6CjILuMOFmiFecv+OACcmG0=
	github.com/writeas/web-core v1.2.0/go.mod h1:vTYajviuNBAxjctPp2NUYdgjofywVkxUGpeaERF3SfI=
	github.com/writefreely/go-nodeinfo v1.2.0 h1:La+YbTCvmpTwFhBSlebWDDL81N88Qf/SCAvRLR7F8ss=
	github.com/writefreely/go-nodeinfo v1.2.0/go.mod h1:UTvE78KpcjYOlRHupZIiSEFcXHioTXuacCbHU+CAcPg=
	+golang.org/dl v0.0.0-20200319204010-bf12898a6070 h1:m3RoSUFYtel4F/gCw0tosY5Exe7hm2NbeNv/737FbSo=
	+golang.org/dl v0.0.0-20200319204010-bf12898a6070/go.mod h1:IUMfjQLJQd4UTqG1Z90tenwKoCX93Gn3MAQJMOSBsDQ=
	golang.org/x/crypto v0.0.0-20180527072434-ab813273cd59 h1:hk3yo72LXLapY9EXVttc3Z1rLOxT9IuAPPX3GpY2+jo=
	golang.org/x/crypto v0.0.0-20180527072434-ab813273cd59/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
	golang.org/x/crypto v0.0.0-20190131182504-b8fe1690c613/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
	golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
	golang.org/x/crypto v0.0.0-20200109152110-61a87790db17 h1:nVJ3guKA9qdkEQ3TUdXI9QSINo2CUPM/cySEvw2w8I0=
	golang.org/x/crypto v0.0.0-20200109152110-61a87790db17/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
	golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
	golang.org/x/lint v0.0.0-20181217174547-8f45f776aaf1 h1:rJm0LuqUjoDhSk2zO9ISMSToQxGz7Os2jRiOL8AWu4c=
	golang.org/x/lint v0.0.0-20181217174547-8f45f776aaf1/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
	golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
	golang.org/x/net v0.0.0-20181220203305-927f97764cc3 h1:eH6Eip3UpmR+yM/qI9Ijluzb1bNv/cAU/n+6l8tRSis=
	golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
	golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
	golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
	golang.org/x/sys v0.0.0-20180525142821-c11f84a56e43/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
	golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
	golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
	golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
	golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
	golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
	golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
	golang.org/x/tools v0.0.0-20181122213734-04b5d21e00f1/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
	golang.org/x/tools v0.0.0-20190208222737-3744606dbb67 h1:bPP/rGuN1LUM0eaEwo6vnP6OfIWJzJBulzGUiKLjjSY=
	golang.org/x/tools v0.0.0-20190208222737-3744606dbb67/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
	google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
	google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
	gopkg.in/alecthomas/kingpin.v3-unstable v3.0.0-20180810215634-df19058c872c h1:vTxShRUnK60yd8DZU+f95p1zSLj814+5CuEh7NjF2/Y=
	gopkg.in/alecthomas/kingpin.v3-unstable v3.0.0-20180810215634-df19058c872c/go.mod h1:3HH7i1SgMqlzxCcBmUHW657sD4Kvv9sC3HpL3YukzwA=
	gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
	gopkg.in/ini.v1 v1.41.0 h1:Ka3ViY6gNYSKiVy71zXBEqKplnV35ImDLVG+8uoIklE=
	gopkg.in/ini.v1 v1.41.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
	gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0 h1:POO/ycCATvegFmVuPpQzZFJ+pGZeX22Ufu6fibxDVjU=
	gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
	gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
	gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
	src.techknowlogick.com/xgo v0.0.0-20200129005940-d0fae26e014b h1:rPAdjgXks4ToezTjygsnKZroxKVnA1L35DSpsJXPtfc=
	src.techknowlogick.com/xgo v0.0.0-20200129005940-d0fae26e014b/go.mod h1:31CE1YKtDOrKTk9PSnjTpe6YbO6W/0LTYZ1VskL09oU=
	diff --git a/oauth.go b/oauth.go
	index 59350bd..80f3e1d 100644
	--- a/oauth.go
	+++ b/oauth.go
	@@ -1,340 +1,349 @@
	package writefreely

	import (
	"context"
	"encoding/json"
	"fmt"
	- "github.com/gorilla/mux"
	- "github.com/gorilla/sessions"
	- "github.com/writeas/impart"
	- "github.com/writeas/web-core/log"
	- "github.com/writeas/writefreely/config"
	"io"
	"io/ioutil"
	"net/http"
	"net/url"
	"strings"
	"time"
	+
	+ "github.com/gorilla/mux"
	+ "github.com/gorilla/sessions"
	+ "github.com/writeas/impart"
	+ "github.com/writeas/web-core/log"
	+
	+ "github.com/writeas/writefreely/config"
	)

	// TokenResponse contains data returned when a token is created either
	// through a code exchange or using a refresh token.
	type TokenResponse struct {
	AccessToken string `json:"access_token"`
	ExpiresIn int `json:"expires_in"`
	RefreshToken string `json:"refresh_token"`
	TokenType string `json:"token_type"`
	Error string `json:"error"`
	}

	// InspectResponse contains data returned when an access token is inspected.
	type InspectResponse struct {
	ClientID string `json:"client_id"`
	UserID string `json:"user_id"`
	ExpiresAt time.Time `json:"expires_at"`
	Username string `json:"username"`
	DisplayName string `json:"-"`
	Email string `json:"email"`
	Error string `json:"error"`
	}

	// tokenRequestMaxLen is the most bytes that we'll read from the /oauth/token
	// endpoint. One megabyte is plenty.
	const tokenRequestMaxLen = 1000000

	// infoRequestMaxLen is the most bytes that we'll read from the
	// /oauth/inspect endpoint.
	const infoRequestMaxLen = 1000000

	// OAuthDatastoreProvider provides a minimal interface of data store, config,
	// and session store for use with the oauth handlers.
	type OAuthDatastoreProvider interface {
	DB() OAuthDatastore
	Config() *config.Config
	SessionStore() sessions.Store
	}

	// OAuthDatastore provides a minimal interface of data store methods used in
	// oauth functionality.
	type OAuthDatastore interface {
	GetIDForRemoteUser(context.Context, string, string, string) (int64, error)
	RecordRemoteUserID(context.Context, int64, string, string, string, string) error
	ValidateOAuthState(context.Context, string) (string, string, int64, error)
	GenerateOAuthState(context.Context, string, string, int64) (string, error)

	CreateUser(config.Config, User, string) error
	GetUserByID(int64) (*User, error)
	}

	type HttpClient interface {
	Do(req http.Request) (http.Response, error)
	}

	type oauthClient interface {
	GetProvider() string
	GetClientID() string
	GetCallbackLocation() string
	buildLoginURL(state string) (string, error)
	exchangeOauthCode(ctx context.Context, code string) (*TokenResponse, error)
	inspectOauthAccessToken(ctx context.Context, accessToken string) (*InspectResponse, error)
	}

	type callbackProxyClient struct {
	server string
	callbackLocation string
	httpClient HttpClient
	}

	type oauthHandler struct {
	Config *config.Config
	DB OAuthDatastore
	Store sessions.Store
	EmailKey []byte
	oauthClient oauthClient
	callbackProxy *callbackProxyClient
	}

	func (h oauthHandler) viewOauthInit(app App, w http.ResponseWriter, r http.Request) error {
	ctx := r.Context()

	var attachUser int64
	if attach := r.URL.Query().Get("attach"); attach == "t" {
	user, _ := getUserAndSession(app, r)
	if user == nil {
	return impart.HTTPError{http.StatusInternalServerError, "cannot attach auth to user: user not found in session"}
	}
	attachUser = user.ID
	}

	state, err := h.DB.GenerateOAuthState(ctx, h.oauthClient.GetProvider(), h.oauthClient.GetClientID(), attachUser)
	if err != nil {
	log.Error("viewOauthInit error: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "could not prepare oauth redirect url"}
	}

	if h.callbackProxy != nil {
	if err := h.callbackProxy.register(ctx, state); err != nil {
	log.Error("viewOauthInit error: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "could not register state server"}
	}
	}

	location, err := h.oauthClient.buildLoginURL(state)
	if err != nil {
	log.Error("viewOauthInit error: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "could not prepare oauth redirect url"}
	}
	return impart.HTTPError{http.StatusTemporaryRedirect, location}
	}

	func configureSlackOauth(parentHandler Handler, r mux.Router, app *App) {
	if app.Config().SlackOauth.ClientID != "" {
	callbackLocation := app.Config().App.Host + "/oauth/callback/slack"

	var stateRegisterClient *callbackProxyClient = nil
	if app.Config().SlackOauth.CallbackProxyAPI != "" {
	stateRegisterClient = &callbackProxyClient{
	server: app.Config().SlackOauth.CallbackProxyAPI,
	callbackLocation: app.Config().App.Host + "/oauth/callback/slack",
	httpClient: config.DefaultHTTPClient(),
	}
	callbackLocation = app.Config().SlackOauth.CallbackProxy
	}
	oauthClient := slackOauthClient{
	ClientID: app.Config().SlackOauth.ClientID,
	ClientSecret: app.Config().SlackOauth.ClientSecret,
	TeamID: app.Config().SlackOauth.TeamID,
	HttpClient: config.DefaultHTTPClient(),
	CallbackLocation: callbackLocation,
	}
	configureOauthRoutes(parentHandler, r, app, oauthClient, stateRegisterClient)
	}
	}

	func configureWriteAsOauth(parentHandler Handler, r mux.Router, app *App) {
	if app.Config().WriteAsOauth.ClientID != "" {
	callbackLocation := app.Config().App.Host + "/oauth/callback/write.as"

	var callbackProxy *callbackProxyClient = nil
	if app.Config().WriteAsOauth.CallbackProxy != "" {
	callbackProxy = &callbackProxyClient{
	server: app.Config().WriteAsOauth.CallbackProxyAPI,
	callbackLocation: app.Config().App.Host + "/oauth/callback/write.as",
	httpClient: config.DefaultHTTPClient(),
	}
	callbackLocation = app.Config().WriteAsOauth.CallbackProxy
	}

	oauthClient := writeAsOauthClient{
	ClientID: app.Config().WriteAsOauth.ClientID,
	ClientSecret: app.Config().WriteAsOauth.ClientSecret,
	ExchangeLocation: config.OrDefaultString(app.Config().WriteAsOauth.TokenLocation, writeAsExchangeLocation),
	InspectLocation: config.OrDefaultString(app.Config().WriteAsOauth.InspectLocation, writeAsIdentityLocation),
	AuthLocation: config.OrDefaultString(app.Config().WriteAsOauth.AuthLocation, writeAsAuthLocation),
	HttpClient: config.DefaultHTTPClient(),
	CallbackLocation: callbackLocation,
	}
	configureOauthRoutes(parentHandler, r, app, oauthClient, callbackProxy)
	}
	}

	func configureGitlabOauth(parentHandler Handler, r mux.Router, app *App) {
	if app.Config().GitlabOauth.ClientID != "" {
	callbackLocation := app.Config().App.Host + "/oauth/callback/gitlab"

	var callbackProxy *callbackProxyClient = nil
	if app.Config().GitlabOauth.CallbackProxy != "" {
	callbackProxy = &callbackProxyClient{
	server: app.Config().GitlabOauth.CallbackProxyAPI,
	callbackLocation: app.Config().App.Host + "/oauth/callback/gitlab",
	httpClient: config.DefaultHTTPClient(),
	}
	callbackLocation = app.Config().GitlabOauth.CallbackProxy
	}

	address := config.OrDefaultString(app.Config().GitlabOauth.Host, gitlabHost)
	oauthClient := gitlabOauthClient{
	ClientID: app.Config().GitlabOauth.ClientID,
	ClientSecret: app.Config().GitlabOauth.ClientSecret,
	ExchangeLocation: address + "/oauth/token",
	InspectLocation: address + "/api/v4/user",
	AuthLocation: address + "/oauth/authorize",
	HttpClient: config.DefaultHTTPClient(),
	CallbackLocation: callbackLocation,
	}
	configureOauthRoutes(parentHandler, r, app, oauthClient, callbackProxy)
	}
	}

	func configureOauthRoutes(parentHandler Handler, r mux.Router, app App, oauthClient oauthClient, callbackProxy callbackProxyClient) {
	handler := &oauthHandler{
	Config: app.Config(),
	DB: app.DB(),
	Store: app.SessionStore(),
	oauthClient: oauthClient,
	EmailKey: app.keys.EmailKey,
	callbackProxy: callbackProxy,
	}
	r.HandleFunc("/oauth/"+oauthClient.GetProvider(), parentHandler.OAuth(handler.viewOauthInit)).Methods("GET")
	r.HandleFunc("/oauth/callback/"+oauthClient.GetProvider(), parentHandler.OAuth(handler.viewOauthCallback)).Methods("GET")
	r.HandleFunc("/oauth/signup", parentHandler.OAuth(handler.viewOauthSignup)).Methods("POST")
	}

	func (h oauthHandler) viewOauthCallback(app App, w http.ResponseWriter, r http.Request) error {
	ctx := r.Context()

	code := r.FormValue("code")
	state := r.FormValue("state")

	provider, clientID, attachUserID, err := h.DB.ValidateOAuthState(ctx, state)
	if err != nil {
	log.Error("Unable to ValidateOAuthState: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}

	tokenResponse, err := h.oauthClient.exchangeOauthCode(ctx, code)
	if err != nil {
	log.Error("Unable to exchangeOauthCode: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}

	// Now that we have the access token, let's use it real quick to make sur
	// it really really works.
	tokenInfo, err := h.oauthClient.inspectOauthAccessToken(ctx, tokenResponse.AccessToken)
	if err != nil {
	log.Error("Unable to inspectOauthAccessToken: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}

	localUserID, err := h.DB.GetIDForRemoteUser(ctx, tokenInfo.UserID, provider, clientID)
	if err != nil {
	log.Error("Unable to GetIDForRemoteUser: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}

	+ if localUserID != -1 && attachUserID > 0 {
	+ if err = addSessionFlash(app, w, r, "Slack account is already attached to a user.", nil); err != nil {
	+ return impart.HTTPError{Status: http.StatusInternalServerError, Message: err.Error()}
	+ }
	+ return impart.HTTPError{http.StatusFound, "/me/settings"}
	+ }
	+
	if localUserID != -1 {
	user, err := h.DB.GetUserByID(localUserID)
	if err != nil {
	log.Error("Unable to GetUserByID %d: %s", localUserID, err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}
	if err = loginOrFail(h.Store, w, r, user); err != nil {
	log.Error("Unable to loginOrFail %d: %s", localUserID, err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}
	return nil
	}
	if attachUserID > 0 {
	log.Info("attaching to user %d", attachUserID)
	err = h.DB.RecordRemoteUserID(r.Context(), attachUserID, tokenInfo.UserID, provider, clientID, tokenResponse.AccessToken)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}
	return impart.HTTPError{http.StatusFound, "/me/settings"}
	}

	displayName := tokenInfo.DisplayName
	if len(displayName) == 0 {
	displayName = tokenInfo.Username
	}

	tp := &oauthSignupPageParams{
	AccessToken: tokenResponse.AccessToken,
	TokenUsername: tokenInfo.Username,
	TokenAlias: tokenInfo.DisplayName,
	TokenEmail: tokenInfo.Email,
	TokenRemoteUser: tokenInfo.UserID,
	Provider: provider,
	ClientID: clientID,
	}
	tp.TokenHash = tp.HashTokenParams(h.Config.Server.HashSeed)

	return h.showOauthSignupPage(app, w, r, tp, nil)
	}

	func (r *callbackProxyClient) register(ctx context.Context, state string) error {
	form := url.Values{}
	form.Add("state", state)
	form.Add("location", r.callbackLocation)
	req, err := http.NewRequestWithContext(ctx, "POST", r.server, strings.NewReader(form.Encode()))
	if err != nil {
	return err
	}
	req.Header.Set("User-Agent", "writefreely")
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	resp, err := r.httpClient.Do(req)
	if err != nil {
	return err
	}
	if resp.StatusCode != http.StatusCreated {
	return fmt.Errorf("unable register state location: %d", resp.StatusCode)
	}

	return nil
	}

	func limitedJsonUnmarshal(body io.ReadCloser, n int, thing interface{}) error {
	lr := io.LimitReader(body, int64(n+1))
	data, err := ioutil.ReadAll(lr)
	if err != nil {
	return err
	}
	if len(data) == n+1 {
	return fmt.Errorf("content larger than max read allowance: %d", n)
	}
	return json.Unmarshal(data, thing)
	}

	func loginOrFail(store sessions.Store, w http.ResponseWriter, r http.Request, user User) error {
	// An error may be returned, but a valid session should always be returned.
	session, _ := store.Get(r, cookieName)
	session.Values[cookieUserVal] = user.Cookie()
	if err := session.Save(r, w); err != nil {
	fmt.Println("error saving session", err)
	return err
	}
	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
	return nil
	}
	diff --git a/templates/user/settings.tmpl b/templates/user/settings.tmpl
	index 3b91c83..14f8e47 100644
	--- a/templates/user/settings.tmpl
	+++ b/templates/user/settings.tmpl
	@@ -1,115 +1,118 @@
	{{define "settings"}}
	{{template "header" .}}

	<style type="text/css">
	.option { margin: 2em 0em; }
	h3 { font-weight: normal; }
	.section > *:not(input) { font-size: 0.86em; }
	</style>
	<div class="content-container snug">
	{{if .Silenced}}
	{{template "user-silenced"}}
	{{end}}
	<h1>{{if .IsLogOut}}Before you go...{{else}}Account Settings {{if .IsAdmin}}<a href="/admin">admin settings</a>{{end}}{{end}}</h1>
	{{if .Flashes}}<ul class="errors">
	{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
	</ul>{{end}}

	{{ if .IsLogOut }}
	<div class="alert info">
	<p class="introduction">Please add an <strong>email address</strong> and/or <strong>passphrase</strong> so you can log in again later.</p>
	</div>
	{{ else }}
	<div>
	<p>Change your account settings here.</p>
	</div>

	<form method="post" action="/api/me/self" autocomplete="false">
	<div class="option">
	<h3>Username</h3>
	<div class="section">
	<input type="text" name="username" value="{{.Username}}" tabindex="1" />
	<input type="submit" value="Update" style="margin-left: 1em;" />
	</div>
	</div>
	</form>
	{{ end }}

	<form method="post" action="/api/me/self" autocomplete="false">
	<input type="hidden" name="logout" value="{{.IsLogOut}}" />
	<div class="option">
	<h3>Passphrase</h3>
	<div class="section">
	{{if and (not .HasPass) (not .IsLogOut)}}<div class="alert info"><p>Add a passphrase to easily log in to your account.</p></div>{{end}}
	{{if .HasPass}}<p>Current passphrase</p>
	<input type="password" name="current-pass" placeholder="Current passphrase" tabindex="1" /> <input class="show" type="checkbox" id="show-cur-pass" /><label for="show-cur-pass"> Show</label>
	<p>New passphrase</p>
	{{end}}
	{{if .IsLogOut}}<input type="text" value="{{.Username}}" style="display:none" />{{end}}
	<input type="password" name="new-pass" autocomplete="new-password" placeholder="New passphrase" tabindex="{{if .IsLogOut}}1{{else}}2{{end}}" /> <input class="show" type="checkbox" id="show-new-pass" /><label for="show-new-pass"> Show</label>
	</div>
	</div>

	<div class="option">
	<h3>Email</h3>
	<div class="section">
	{{if and (not .Email) (not .IsLogOut)}}<div class="alert info"><p>Add your email to get:</p>
	<ul>
	<li>No-passphrase login</li>
	<li>Account recovery if you forget your passphrase</li>
	</ul></div>{{end}}
	<input type="email" name="email" style="letter-spacing: 1px" placeholder="Email address" value="{{.Email}}" size="40" tabindex="{{if .IsLogOut}}2{{else}}3{{end}}" />
	</div>
	</div>

	<div class="option" style="text-align: center; margin-top: 4em;">
	<input type="submit" value="Save changes" tabindex="4" />
	</div>
	</form>

	{{ if .OauthSection }}
	<h1>OAuth Management</h1>
	{{ if .OauthAccounts }}
	<p>Existing OAuth accounts can be removed from your account.</p>
	{{ range $oauth_account := .OauthAccounts }}
	<form method="post" action="/me/oauth/remove" autocomplete="false">
	<input type="hidden" name="provider" value="{{ $oauth_account.Provider }}" />
	<input type="hidden" name="client_id" value="{{ $oauth_account.ClientID }}" />
	<input type="hidden" name="remote_user_id" value="{{ $oauth_account.RemoteUserID }}" />
	<div class="option">
	<div class="section">
	<input type="submit" value="Remove {{ $oauth_account.Provider \| title }}" style="margin-left: 1em;" />
	</div>
	</div>
	</form>
	{{ end }}
	{{ end }}
	{{ if or .OauthSlack .OauthWriteAs }}
	<p>
	{{ if .OauthSlack }}
	<a class="loginbtn" href="/oauth/slack?attach=t"><img alt="Sign in with Slack" height="40" width="172" src="/img/sign_in_with_slack.png" srcset="/img/sign_in_with_slack.png 1x, /img/sign_in_with_slack@2x.png 2x" /></a>
	{{ end }}
	{{ if .OauthWriteAs }}
	<a class="btn cta loginbtn" id="writeas-login" href="/oauth/write.as?attach=t">Link your <strong>Write.as</strong> account.</a>
	{{ end }}
	+ {{ if .OauthGitLab }}
	+ <a class="btn cta loginbtn" id="gitlab-login" href="/oauth/gitlab?attach=t">Link your <strong>GitLab</strong> account.</a>
	+ {{ end }}
	</p>
	{{ end }}
	{{ end }}
	</div>

	<script>
	var showChecks = document.querySelectorAll('input.show');
	for (var i=0; i<showChecks.length; i++) {
	showChecks[i].addEventListener('click', function() {
	var prevEl = this.previousElementSibling;
	if (prevEl.type == "password") {
	prevEl.type = "text";
	} else {
	prevEl.type = "password";
	}
	});
	}
	</script>

	{{template "footer" .}}
	{{end}}

File Metadata

Mime Type: text/x-diff
Expires: Sat, Nov 23, 1:20 PM (1 d, 8 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3104546

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions