From 4fb4bec5a840471064fbc5177a67e25604585bbf Mon Sep 17 00:00:00 2001
From: Maximilian Friedersdorff <max@gwairfelin.com>
Date: Thu, 9 Oct 2025 21:04:45 +0100
Subject: [PATCH] Allow unsharing, only show share controls for owner

---
 internal/conf/templates/view.tmpl.html | 15 ++++++++---
 internal/notes/notes.go                | 23 ++++++++++++----
 internal/notes/views/views.go          | 37 +++++++++++++++++++++-----
 3 files changed, 60 insertions(+), 15 deletions(-)

diff --git a/internal/conf/templates/view.tmpl.html b/internal/conf/templates/view.tmpl.html
index 932e5fc..6e93842 100644
--- a/internal/conf/templates/view.tmpl.html
+++ b/internal/conf/templates/view.tmpl.html
@@ -7,15 +7,23 @@
     <a class="btn btn-primary" href="{{.urlEdit}}">Edit</a>
     <a class="btn btn-danger" href="{{.urlDelete}}">Delete</a>
 </div>
+{{ if .isOwner }}
 <div class="mt-2">
     <h3>Ownership</h3>
     {{if .note.Viewers}}
     <p>This note is owned by <em>{{.note.Owner}}</em> and is further visible to</p>
-    <ul>
+    <form action="{{.urlUnshare}}" method="POST">
+    <table class="table vertical-align-middle">
         {{range .viewers}}
-            <li>{{.}}</li>
+            <tr>
+                <td>{{.}}</td>
+                <td class="text-end">
+                    <button class="btn btn-outline-warning btn-sm" type="submit" name="viewer" value="{{.}}">Un-Share</button>
+                </td>
+            </tr>
         {{end}}
-    </ul>
+    </table>
+    </form>
     {{else}}
     <p>This note is owned by <em>{{.note.Owner}}</em>.</p>
     {{end}}
@@ -27,6 +35,7 @@
     </div>
     <button class="btn btn-primary" type="submit">Share</button>
 </div>
+{{end}}
 
 <script>
     let checkBoxes = document.querySelectorAll('input[type=checkbox]')
diff --git a/internal/notes/notes.go b/internal/notes/notes.go
index 774956c..9ab0338 100644
--- a/internal/notes/notes.go
+++ b/internal/notes/notes.go
@@ -40,8 +40,10 @@ type Note struct {
 	LastModified time.Time
 }
 
+type noteSet map[*Note]bool
+
 type NoteStore struct {
-	notes map[string][]*Note
+	notes map[string]noteSet
 }
 
 var (
@@ -51,7 +53,7 @@ var (
 
 func Init() error {
 	Notes = NoteStore{
-		notes: make(map[string][]*Note),
+		notes: make(map[string]noteSet),
 	}
 
 	md = goldmark.New(
@@ -95,14 +97,14 @@ func Init() error {
 	return nil
 }
 
-func (ns *NoteStore) Get(owner string) []*Note {
+func (ns *NoteStore) Get(owner string) noteSet {
 	return ns.notes[owner]
 }
 
 func (ns *NoteStore) GetOne(owner string, uid string) (*Note, bool) {
 	notes := ns.Get(owner)
 
-	for _, note := range notes {
+	for note, _ := range notes {
 		if note.Uid == uid {
 			log.Printf("Found single note during GetOne %s", note.Title)
 			return note, true
@@ -112,7 +114,14 @@ func (ns *NoteStore) GetOne(owner string, uid string) (*Note, bool) {
 }
 
 func (ns *NoteStore) Add(note *Note, user string) {
-	ns.notes[user] = append(ns.notes[user], note)
+	if ns.notes[user] == nil {
+		ns.notes[user] = make(noteSet)
+	}
+	ns.notes[user][note] = true
+}
+
+func (ns *NoteStore) Del(note *Note, user string) {
+	delete(ns.notes[user], note)
 }
 
 func fmtPath(path string) string {
@@ -268,6 +277,10 @@ func (n *Note) AddViewer(viewer string) {
 	n.Viewers[viewer] = struct{}{}
 }
 
+func (n *Note) DelViewer(viewer string) {
+	delete(n.Viewers, viewer)
+}
+
 func DeleteNote(uid string) error {
 	filename := filepath.Join(conf.Conf.NotesDir, fmtPath(uid))
 	return os.Remove(filename)
diff --git a/internal/notes/views/views.go b/internal/notes/views/views.go
index 23570cf..8452840 100644
--- a/internal/notes/views/views.go
+++ b/internal/notes/views/views.go
@@ -28,6 +28,7 @@ func GetRoutes(prefix string) *http.ServeMux {
 			"delete":    {Path: "/{note}/delete/", Protocol: "GET", Handler: delete},
 			"edit":      {Path: "/{note}/edit/", Protocol: "GET", Handler: edit},
 			"share":     {Path: "/{note}/share/", Protocol: "POST", Handler: share},
+			"unshare":   {Path: "/{note}/unshare/", Protocol: "POST", Handler: unshare},
 			"save":      {Path: "/{note}/edit/save/", Protocol: "POST", Handler: save},
 			"togglebox": {Path: "/{note}/togglebox/", Protocol: "POST", Handler: togglebox},
 		},
@@ -47,12 +48,17 @@ func view(w http.ResponseWriter, r *http.Request) {
 	}
 	viewers := note.ViewersAsList()
 
-	urlEdit := myurls.Reverse("edit", urls.Repl{"note": uid})
-	urlNew := myurls.Reverse("new", urls.Repl{})
-	urlDelete := myurls.Reverse("delete", urls.Repl{"note": uid})
-	urlShare := myurls.Reverse("share", urls.Repl{"note": uid})
+	context := templ.Ctx{
+		"note":       note,
+		"urlEdit":    myurls.Reverse("edit", urls.Repl{"note": uid}),
+		"urlDelete":  myurls.Reverse("delete", urls.Repl{"note": uid}),
+		"urlNew":     myurls.Reverse("new", urls.Repl{}),
+		"urlShare":   myurls.Reverse("share", urls.Repl{"note": uid}),
+		"urlUnshare": myurls.Reverse("unshare", urls.Repl{"note": uid}),
+		"viewers":    viewers,
+		"isOwner":    user == note.Owner,
+	}
 
-	context := templ.Ctx{"note": note, "urlEdit": urlEdit, "urlDelete": urlDelete, "urlNew": urlNew, "urlShare": urlShare, "viewers": viewers}
 	note.Render()
 	err := templ.RenderTemplate(w, r, "view.tmpl.html", context)
 	if err != nil {
@@ -135,7 +141,7 @@ func share(w http.ResponseWriter, r *http.Request) {
 	uid := r.PathValue("note")
 	note, ok := notes.Notes.GetOne(user, uid)
 
-	if !ok {
+	if !ok || note.Owner != user {
 		http.NotFound(w, r)
 	}
 
@@ -147,6 +153,23 @@ func share(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, myurls.Reverse("view", urls.Repl{"note": note.Uid}), http.StatusFound)
 }
 
+func unshare(w http.ResponseWriter, r *http.Request) {
+	user := r.Context().Value(middleware.ContextKey("user")).(string)
+	uid := r.PathValue("note")
+	note, ok := notes.Notes.GetOne(user, uid)
+
+	if !ok || note.Owner != user {
+		http.NotFound(w, r)
+	}
+
+	viewer := r.FormValue("viewer")
+	note.DelViewer(viewer)
+	note.Save()
+	notes.Notes.Del(note, viewer)
+
+	http.Redirect(w, r, myurls.Reverse("view", urls.Repl{"note": note.Uid}), http.StatusFound)
+}
+
 func togglebox(w http.ResponseWriter, r *http.Request) {
 	user := r.Context().Value(middleware.ContextKey("user")).(string)
 
@@ -182,7 +205,7 @@ func list(w http.ResponseWriter, r *http.Request) {
 	log.Printf("Notes: %+v", notes.Notes)
 	log.Printf("Notes for %s: %+v", user, ns)
 
-	for _, note := range ns {
+	for note := range ns {
 		titlesAndUrls = append(
 			titlesAndUrls,
 			titleAndURL{Title: note.Title, URL: myurls.Reverse("view", urls.Repl{"note": note.Uid})},