Fix delete behaviour

README.md

@@ -1,12 +1,8 @@
 # gonotes
 
-A toyish project for a shared notebook of sorts implemented in go.  It's mostly
+A shared notebook of sorts implemented in go. Shared here means that the
-a learning opportunity for using go, and partially an intent to end up with a
+content is visible to more than one user.  It does not currently support
-shared notebook!
+simultaneous editing and there are no plans to do that.  Furthe, it
-
+*currently* does not support the concept of a lock or checkout when a note
-It's not shared in the sense of simultaneous editing, don't do that!
+is edited.  It's the responsibility of the editing parties to prevent races
-
+and conflicts.
-## TODO
-
-* handle static urls in the django url mapping style
-* Style up the templates better

cmd/server/main.go

@@ -12,18 +12,26 @@ import (
 	"forgejo.gwairfelin.com/max/gonotes/internal/middleware"
 	"forgejo.gwairfelin.com/max/gonotes/internal/notes"
 	"forgejo.gwairfelin.com/max/gonotes/internal/notes/views"
+	"golang.org/x/oauth2"
 )
 
 func main() {
 	var confFile string
 
-	sessions := middleware.NewSessionStore()
-
 	flag.StringVar(&confFile, "c", "/etc/gonotes/conf.toml", "Specify path to config file.")
 	flag.Parse()
 
 	conf.LoadConfig(confFile)
 
+	oauth := &oauth2.Config{
+		ClientID:     conf.Conf.OIDC.ClientID,
+		ClientSecret: conf.Conf.OIDC.ClientSecret,
+		Endpoint:     oauth2.Endpoint{AuthURL: conf.Conf.OIDC.AuthURL, TokenURL: conf.Conf.OIDC.TokenURL},
+		RedirectURL:  conf.Conf.OIDC.RedirectURL,
+	}
+
+	sessions := middleware.NewSessionStore(oauth, "/auth")
+
 	err := notes.Init()
 	if err != nil {
 		log.Fatal(err)
@@ -33,6 +41,7 @@ func main() {
 
 	router := http.NewServeMux()
 	notesRouter := views.GetRoutes("/notes")
+	sessionRouter := sessions.Routes.GetRouter()
 
 	cacheExpiration, err := time.ParseDuration("24h")
 	if err != nil {
@@ -41,31 +50,21 @@ func main() {
 
 	etag := middleware.NewETag("static", cacheExpiration)
 
-	if !conf.Conf.Production {
-		router.HandleFunc("/login/", func(w http.ResponseWriter, r *http.Request) {
-			user := r.FormValue("user")
-			if len(user) == 0 {
-				user = "anon"
-			}
-			sessions.Login(user, w)
-
-			http.Redirect(w, r, "/notes/", http.StatusFound)
-		})
-	}
-	router.Handle("/logout/", sessions.AsMiddleware(
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			user := r.FormValue("user")
-			if len(user) == 0 {
-				user = "anon"
-			}
-
-			sessions.Logout(w, r)
-
-			http.Redirect(w, r, "/notes/", http.StatusFound)
-		})))
-
 	router.Handle("/", middleware.LoggingMiddleware(http.RedirectHandler("/notes/", http.StatusFound)))
-	router.Handle("/notes/", sessions.AsMiddleware(middleware.LoggingMiddleware(http.StripPrefix("/notes", notesRouter))))
+	router.Handle(
+		"/notes/",
+		sessions.AsMiddleware(
+			middleware.LoggingMiddleware(
+				middleware.RejectAnonMiddleware(
+					"/auth/login/",
+					http.StripPrefix(
+						"/notes", notesRouter,
+					),
+				),
+			),
+		),
+	)
+	router.Handle("/auth/", sessions.AsMiddleware(middleware.LoggingMiddleware(http.StripPrefix("/auth", sessionRouter))))
 	router.Handle(
 		"/static/",
 		middleware.LoggingMiddleware(

go.mod

@@ -8,9 +8,7 @@ require (
 	forgejo.gwairfelin.com/max/gispatcho v0.1.2
 	github.com/pelletier/go-toml/v2 v2.2.3
 	github.com/teekennedy/goldmark-markdown v0.5.1
-)
+	github.com/yuin/goldmark-meta v1.1.0
-
+	golang.org/x/oauth2 v0.34.0
-require (
+	gopkg.in/yaml.v2 v2.3.0
-	github.com/yuin/goldmark-meta v1.1.0 // indirect
-	gopkg.in/yaml.v2 v2.3.0 // indirect
 )

go.sum

@@ -18,6 +18,9 @@ github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUei
 github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
 go.abhg.dev/goldmark/toc v0.11.0 h1:IRixVy3/yVPKvFBc37EeBPi8XLTXrtH6BYaonSjkF8o=
 go.abhg.dev/goldmark/toc v0.11.0/go.mod h1:XMFIoI1Sm6dwF9vKzVDOYE/g1o5BmKXghLG8q/wJNww=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

internal/auth/oauth.go

@@ -0,0 +1,66 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"forgejo.gwairfelin.com/max/gonotes/internal/conf"
+	"golang.org/x/oauth2"
+)
+
+func GenerateStateOAUTHCookie(w http.ResponseWriter, prefix string) string {
+
+	b := make([]byte, 16)
+	rand.Read(b)
+	state := base64.URLEncoding.EncodeToString(b)
+	cookie := http.Cookie{
+		Name: "oauthstate", Value: state,
+		MaxAge: 30, Secure: true, HttpOnly: true, Path: prefix,
+	}
+	http.SetCookie(w, &cookie)
+
+	return state
+}
+
+func GetUserFromForgejo(code string, oauth *oauth2.Config) (string, error) {
+	// Use code to get token and get user info from Google.
+
+	token, err := oauth.Exchange(context.Background(), code)
+	if err != nil {
+		return "", fmt.Errorf("code exchange wrong: %s", err.Error())
+	}
+
+	request, err := http.NewRequest("GET", conf.Conf.OIDC.UserinfoURL, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to init http client for userinfo: %s", err.Error())
+	}
+	request.Header.Set("Authorization", fmt.Sprintf("token %s", token.AccessToken))
+	response, err := http.DefaultClient.Do(request)
+
+	if err != nil {
+		return "", fmt.Errorf("failed getting user info: %s", err.Error())
+	}
+	defer response.Body.Close()
+
+	uInf := make(map[string]any)
+
+	err = json.NewDecoder(response.Body).Decode(&uInf)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse response as json: %s", err.Error())
+	}
+
+	username, ok := uInf["preferred_username"]
+	if !ok {
+		return "", fmt.Errorf("no username in response: %s", err.Error())
+	}
+	userStr, ok := username.(string)
+	if !ok {
+		return "", fmt.Errorf("username not a string: %s", err.Error())
+	}
+
+	return userStr, nil
+}

internal/conf/conf.go

@@ -60,14 +60,24 @@ type Config struct {
 	NotesDir   string
 	LogAccess  bool
 	Production bool
+	OIDC       struct {
+		ClientID     string `toml:"client_id"`
+		ClientSecret string `toml:"client_secret"`
+		AuthURL      string `toml:"auth_url"`
+		TokenURL     string `toml:"token_url"`
+		RedirectURL  string `toml:"redirect_url"`
+		UserinfoURL  string `toml:"userinfo_url"`
+	}
+	AnonCIDRs []string `toml:"anon_networks"`
 }
 
 var (
 	Conf   Config
 	assets []Asset = []Asset{
-		{Path: "css/bootstrap.min.css", Url: "https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css"},
+		{Path: "css/bootstrap.min.css", Url: "https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css"},
-		{Path: "css/tiny-mde.min.css", Url: "https://unpkg.com/tiny-markdown-editor/dist/tiny-mde.min.css"},
+		{Path: "js/bootstrap.bundle.min.js", Url: "https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.bundle.min.js"},
-		{Path: "js/tiny-mde.min.js", Url: "https://unpkg.com/tiny-markdown-editor/dist/tiny-mde.min.js"},
+		{Path: "css/easy-mde.min.css", Url: "https://unpkg.com/easymde/dist/easymde.min.css"},
+		{Path: "js/easy-mde.min.js", Url: "https://unpkg.com/easymde/dist/easymde.min.js"},
 		{Path: "icons/eye.svg", Url: "https://raw.githubusercontent.com/twbs/icons/refs/heads/main/icons/eye.svg"},
 	}
 	BaseTemplate string = "base.tmpl.html"

internal/conf/templates/base.tmpl.html

@@ -19,14 +19,25 @@
         <title>{{template "title" .}}</title>
         <link href="/static/css/bootstrap.min.css"
             rel="stylesheet"
-            integrity="sha384-QWTKZyjpPEjISv5WaRU9OFeRpok6YctnYmDr5pNlyT2bRjXh0JMhjY6hW+ALEwIH"
+            integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB"
             crossorigin="anonymous">
         <link rel="icon" type="image/svg+xml"
             href="/static/icons/favicon.svg">
+
+        <script src="/static/js/bootstrap.bundle.min.js"
+            integrity="sha384-FKyoEForCGlyvwx9Hj09JcYn3nv7wiPVlz7YYwJrWVcXK/BmnVDxM+D2scQbITxI"
+            crossorigin="anonymous"></script>
     </head>
     <body>
         <nav class="navbar navbar-expand-sm bg-body-tertiary mb-3">
             <div class="container-fluid">
+                <button class="navbar-toggler"
+                    type="button"
+                    data-bs-toggle="collapse" data-bs-target="#navCollapse"
+                    aria-controls="navCollapse" aria-expanded="false" aria-label="Toggle navigation">
+                    <span class="navbar-toggler-icon"></span>
+                </button>
+                <div class="collapse navbar-collapse mt-2" id="navCollapse">
                     <a class="navbar-brand" href="/">
                         <img src="/static/icons/favicon.svg" width="30" height="30" class="d-inline-block align-top" alt="">
                         GoNotes
@@ -35,13 +46,35 @@
                         <li class="nav-item">
                             <a class="nav-link" href="/notes/">All Notes</a>
                         </li>
-                    {{template "navLinks" .}}
+                        <li class="nav-item dropdown">
+                            <a class="nav-link dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown" aria-expanded="false">
+                                Tags
+                            </a>
+                            <ul class="dropdown-menu">
                                 <li>
-                        <a class="nav-link" href="/logout/">Logout {{.user}}</a>
+                                    <a class="dropdown-item nav-link" href="/notes/">All</a>
                                 </li>
+                                {{range .userTags}}
+                                <li>
+                                    <a class="dropdown-item nav-link" href="/notes/?tag={{.}}">{{.}}</a>
+                                </li>
+                                {{end}}
+                            </ul>
+                        </li>
+                        {{template "navLinks" .}}
+                        {{if eq .user "anon"}}
+                        <li>
+                            <a class="nav-link" href="/auth/login/">Login</a>
+                        </li>
+                        {{else}}
+                        <li>
+                            <a class="nav-link" href="/auth/logout/">Logout {{.user}}</a>
+                        </li>
+                        {{end}}
                     </ul>
                     {{template "navExtra" .}}
                 </div>
+            </div>
         </nav>
         <div class="container">
             <div class="row justify-content-md-center">

internal/conf/templates/edit.tmpl.html

@@ -17,38 +17,48 @@
     <button class="btn btn-primary" type="submit">Save</button>
 </form>
 
-<script src="/static/js/tiny-mde.min.js"></script>
+<script src="/static/js/easy-mde.min.js"></script>
 <link
   rel="stylesheet"
   type="text/css"
-  href="/static/css/tiny-mde.min.css"
+  href="/static/css/easy-mde.min.css"
 />
 <script type="text/javascript">
 
 
-var tinyMDE = new TinyMDE.Editor({ textarea: "noteBodyInput" });
+var easyMDE = new EasyMDE({
-var commandBar = new TinyMDE.CommandBar({
+    textarea: "noteBodyInput",
-    element: "toolbar",
+    toolbar: [
-    editor: tinyMDE,
+        'bold',
-    commands: [
+        'italic',
-        'bold', 'italic', 'strikethrough',
+        'strikethrough',
+        'heading',
         '|',
-        'code',
+        'unordered-list',
+        'ordered-list',
+        {
+            name: 'checklist',
+            action: (e) => {
+                e.codemirror.replaceSelection('* [ ]  ');
+                e.codemirror.focus();
+            },
+            className: 'fa fa-check-square-o',
+            title: 'Add task list',
+        },
         '|',
-        'h1', 'h2',
+        'link',
         '|',
-        'ul', 'ol',
+        'preview',
-        '|',
+        'side-by-side'
-        'blockquote', 'hr',
-        '|',
-        'insertLink', 'insertImage'
     ],
+    autosave: {enabled: true, uniqueId: "{{.note.Uid}}"},
+    forceSync: true
 });
 
 let editTimeout;
 let autoSaveDelay = 2000;
 
-tinyMDE.addEventListener("change", function() {
+easyMDE.codemirror.on("change" , function() {
     clearTimeout(editTimeout);
     editTimeout = setTimeout(() => {
         let form = document.querySelector("form");

internal/conf/templates/view.tmpl.html

@@ -1,15 +1,34 @@
 {{define "title"}}{{.note.Title}}{{end}}
 {{define "main"}}
-<div>
+<style>
-{{.note.BodyRendered}}
+li:has(> input[type="checkbox"]) {
+    padding-top: 0.1em;
+    padding-bottom: 0.1em;
+    cursor: default;
+}
+</style>
+<div id="noteContent">
+    {{.note.BodyRendered}}
 </div>
 <div class="d-flex justify-content-between">
     <a class="btn btn-primary" href="{{.urlEdit}}">Edit</a>
     <a class="btn btn-danger" href="{{.urlDelete}}">Delete</a>
 </div>
 {{ if .isOwner }}
-<div class="mt-2">
+<div class="accordion mt-3" id="supplementaryAccordion">
-    <h3>Ownership</h3>
+    <div class="accordion-item">
+        <h3 class="accordion-header">
+            <button class="accordion-button collapsed"
+                type="button"
+                data-bs-toggle="collapse"
+                data-bs-target="#collapseOwnership"
+                aria-expanded="false"
+                aria-controls="collapseOwnership">
+                Ownership
+            </button>
+        </h3>
+        <div id="collapseOwnership" class="accordion-collapse collapse" data-bs-parent="#supplementaryAccordion">
+            <div class="accordion-body">
                 {{if .note.Viewers}}
                 <p>This note is owned by <em>{{.note.Owner}}</em> and is further visible to</p>
                 <form action="{{.urlUnshare}}" method="POST">
@@ -34,24 +53,61 @@
                         <div id="viewerHelp" class="form-text">Share with other user</div>
                     </div>
                     <button class="btn btn-primary" type="submit">Share</button>
+                </form>
+            </div>
+        </div>
+    </div>
+    <div class="accordion-item">
+        <h3 class="accordion-header">
+            <button class="accordion-button collapsed"
+                type="button"
+                data-bs-toggle="collapse"
+                data-bs-target="#collapseTags"
+                aria-expanded="false"
+                aria-controls="collapseTags">
+                Tags
+            </button>
+        </h3>
+        <div id="collapseTags" class="accordion-collapse collapse" data-bs-parent="#supplementaryAccordion">
+            <div class="accordion-body">
+                <form action="{{.urlSetTags}}" method="POST">
+                    <div class="mb-3">
+                        <input type="text" class="form-control" id="tagInput" name="tags" aria-described-by="tagHelp" value="{{.tags}}"/>
+                        <div id="tagHelp" class="form-text">Tags</div>
+                    </div>
+                    <button class="btn btn-primary" type="submit">Set Tags</button>
+                </form>
+            </div>
+        </div>
+    </div>
 </div>
 {{end}}
 
 <script>
-    let checkBoxes = document.querySelectorAll('input[type=checkbox]')
+let checkBoxes = document.querySelectorAll('input[type=checkbox]');
-    for (const i in checkBoxes) {
+let noteContentWrapper = document.querySelector('#noteContent');
+console.log(checkBoxes.keys())
+
+for (const i of checkBoxes.keys()) {
     let box = checkBoxes[i]
+    let parent = box.parentNode
     box.disabled = false
 
-        box.onchange = function(event) {
+    box.onclick = function(event) {
-            let form = new FormData()
+        return false;
-            form.append("box", i)
+    }
+
+    parent.onclick = function(event) {
+        let form = new FormData();
+        form.append("box", i);
 
         fetch("togglebox/", {method: "POST", body: form}).then((response) => {
-                location.reload();
+            return response.json();
+        }).then((json) => {
+            box.checked = json.checked;
         })
     }
-    }
+}
 
 </script>
 {{end}}

internal/middleware/reject_anon.go

@@ -0,0 +1,99 @@
+// Middleware designed to reject requests from anon users unless from 'safe'
+// IP addresses
+
+package middleware
+
+import (
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+
+	"forgejo.gwairfelin.com/max/gonotes/internal/conf"
+)
+
+type netList []net.IPNet
+
+const ipHeader = "x-forwarded-for"
+
+// Check if any IPNet in the netList contains the given IP
+func (n *netList) Contains(ip net.IP) bool {
+	for _, net := range *n {
+		if contains := net.Contains(ip); contains {
+			return true
+		}
+	}
+	return false
+}
+
+// Redirect to redirect url any request where the user is anon and the request
+// does not appear to come from a safe origin
+func RejectAnonMiddleware(redirect string, next http.Handler) http.Handler {
+	safeOriginNets := make(netList, 0, len(conf.Conf.AnonCIDRs))
+
+	for _, cidr := range conf.Conf.AnonCIDRs {
+		_, net, err := net.ParseCIDR(cidr)
+
+		if err != nil {
+			log.Printf("ignoring invalid cidr: %s", err)
+			continue
+		}
+
+		safeOriginNets = append(safeOriginNets, *net)
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user := r.Context().Value(ContextKey("user")).(string)
+
+		originIP, err := getOriginIP(r)
+
+		if err != nil {
+			log.Printf("unable to check origin ip: %s", err)
+			http.Redirect(w, r, redirect, http.StatusTemporaryRedirect)
+			return
+		}
+
+		log.Printf("origin ip: %s", originIP)
+		safeOrigin := safeOriginNets.Contains(originIP)
+
+		if user == "anon" && !safeOrigin {
+			http.Redirect(w, r, redirect, http.StatusTemporaryRedirect)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// Get the origin ip from the x-forwarded-for header, or the source of
+// the request if not available
+func getOriginIP(r *http.Request) (net.IP, error) {
+	sourceIpHeader, ok := r.Header[http.CanonicalHeaderKey(ipHeader)]
+
+	if !ok {
+		addrParts := strings.Split(r.RemoteAddr, ":")
+
+		if len(addrParts) == 0 {
+			return nil, errors.New("no source ip available")
+		}
+
+		ip := net.ParseIP(addrParts[0])
+		if ip == nil {
+			return nil, fmt.Errorf("ip could not be parsed: %s", addrParts[0])
+		}
+		return ip, nil
+	}
+
+	if len(sourceIpHeader) != 1 {
+		return nil, fmt.Errorf("header has more than 1 value: %s=%v", ipHeader, sourceIpHeader)
+	}
+
+	ips := strings.Split(sourceIpHeader[0], ",")
+	ip := net.ParseIP(ips[0])
+	if ip == nil {
+		return nil, fmt.Errorf("not parseable as ip: %s", ips[0])
+	}
+
+	return ip, nil
+}

internal/middleware/session.go

@@ -4,7 +4,12 @@ package middleware
 import (
 	"context"
 	"crypto/rand"
+	"log"
 	"net/http"
+
+	urls "forgejo.gwairfelin.com/max/gispatcho"
+	"forgejo.gwairfelin.com/max/gonotes/internal/auth"
+	"golang.org/x/oauth2"
 )
 
 type Session struct {
@@ -13,14 +18,29 @@ type Session struct {
 
 type SessionStore struct {
 	sessions map[string]Session
+	oauth    *oauth2.Config
+	Routes   urls.URLs
 }
 
 type ContextKey string
 
-func NewSessionStore() SessionStore {
+func NewSessionStore(oauth *oauth2.Config, prefix string) SessionStore {
-	return SessionStore{sessions: make(map[string]Session, 10)}
+	store := SessionStore{
+		sessions: make(map[string]Session, 10),
+		oauth:    oauth,
+	}
+	store.Routes = urls.URLs{
+		Prefix: prefix,
+		URLs: map[string]urls.URL{
+			"login":    {Path: "/login/", Protocol: "GET", Handler: store.LoginViewOAUTH},
+			"callback": {Path: "/callback/", Protocol: "GET", Handler: store.CallbackViewOAUTH},
+			"logout":   {Path: "/logout/", Protocol: "GET", Handler: store.LogoutView},
+		},
+	}
+	return store
 }
 
+// Log a user in
 func (s *SessionStore) Login(user string, w http.ResponseWriter) string {
 	sessionID := rand.Text()
 	s.sessions[sessionID] = Session{User: user}
@@ -34,7 +54,8 @@ func (s *SessionStore) Login(user string, w http.ResponseWriter) string {
 	return sessionID
 }
 
-func (s *SessionStore) Logout(w http.ResponseWriter, r *http.Request) {
+// View to logout a user
+func (s *SessionStore) LogoutView(w http.ResponseWriter, r *http.Request) {
 	session := r.Context().Value(ContextKey("session")).(string)
 
 	delete(s.sessions, session)
@@ -44,42 +65,68 @@ func (s *SessionStore) Logout(w http.ResponseWriter, r *http.Request) {
 	}
 
 	http.SetCookie(w, &cookie)
+	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
 }
 
+// View to log in a user via oauth
+func (s *SessionStore) LoginViewOAUTH(w http.ResponseWriter, r *http.Request) {
+	log.Printf("%+v", *s.oauth)
+
+	oauthState := auth.GenerateStateOAUTHCookie(w, s.Routes.Prefix)
+
+	url := s.oauth.AuthCodeURL(oauthState)
+	log.Printf("Redirecting to %s", url)
+	http.Redirect(w, r, url, http.StatusTemporaryRedirect)
+}
+
+// Oauth callback view
+func (s *SessionStore) CallbackViewOAUTH(w http.ResponseWriter, r *http.Request) {
+	// Read oauthState from Cookie
+	oauthState, err := r.Cookie("oauthstate")
+	if err != nil {
+		log.Printf("An error occured during login: %s", err)
+		http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+		return
+	}
+
+	log.Printf("%v", oauthState)
+
+	if r.FormValue("state") != oauthState.Value {
+		log.Println("invalid oauth state")
+		http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+		return
+	}
+
+	username, err := auth.GetUserFromForgejo(r.FormValue("code"), s.oauth)
+	if err != nil {
+		log.Println(err.Error())
+		http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+		return
+	}
+
+	s.Login(username, w)
+	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+}
+
+// Turn the session store into a middleware.
+// Sets the user on the context based on the available session cookie
 func (s *SessionStore) AsMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		sessionCookie, err := r.Cookie("id")
-		// No session yet
+		user := "anon"
-		if err != nil {
+		var cookieVal string
-			user := r.Header.Get("X-Auth-Request-User")
+		// Session exists
-
+		if err == nil {
-			if user != "" {
-				sessionID := s.Login(user, w)
-				nextWithSessionContext(w, r, next, user, sessionID)
-			} else {
-				http.Redirect(w, r, "/login/", http.StatusFound)
-			}
-
-			return
-		}
-
 			session, ok := s.sessions[sessionCookie.Value]
 
-		// Session expired
+			// Session not expired
-		if !ok {
+			if ok {
-			user := r.Header.Get("X-Auth-Request-User")
+				user = session.User
-
+				cookieVal = sessionCookie.Value
-			if user != "" {
+			}
-				sessionID := s.Login(user, w)
-				nextWithSessionContext(w, r, next, user, sessionID)
-			} else {
-				http.Redirect(w, r, "/login/", http.StatusFound)
 		}
 
-			return
+		nextWithSessionContext(w, r, next, user, cookieVal)
-		}
-
-		nextWithSessionContext(w, r, next, session.User, sessionCookie.Value)
 	})
 }
 

internal/notes/notes.go

@@ -5,13 +5,16 @@ package notes
 import (
 	"bufio"
 	"bytes"
+	"cmp"
 	"crypto/rand"
 	"errors"
 	"fmt"
 	"html/template"
 	"log"
+	"maps"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -38,6 +41,7 @@ type Note struct {
 	Viewers      map[string]struct{}
 	Uid          string
 	LastModified time.Time
+	Tags         []string
 }
 
 type noteSet map[*Note]bool
@@ -97,14 +101,26 @@ func Init() error {
 	return nil
 }
 
+func (ns *noteSet) Sort() []*Note {
+	orderByTitle := func(a, b *Note) int {
+		return cmp.Compare(a.Title, b.Title)
+	}
+	return slices.SortedFunc(maps.Keys(*ns), orderByTitle)
+}
+
 func (ns *NoteStore) Get(owner string) noteSet {
 	return ns.notes[owner]
 }
 
+func (ns *NoteStore) GetOrdered(owner string) []*Note {
+	notes := ns.Get(owner)
+	return notes.Sort()
+}
+
 func (ns *NoteStore) GetOne(owner string, uid string) (*Note, bool) {
 	notes := ns.Get(owner)
 
-	for note, _ := range notes {
+	for note := range notes {
 		if note.Uid == uid {
 			log.Printf("Found single note during GetOne %s", note.Title)
 			return note, true
@@ -120,8 +136,32 @@ func (ns *NoteStore) Add(note *Note, user string) {
 	ns.notes[user][note] = true
 }
 
-func (ns *NoteStore) Del(note *Note, user string) {
+func (ns *NoteStore) Del(note *Note, user string) error {
 	delete(ns.notes[user], note)
+	return note.Delete()
+}
+
+func (ns *NoteStore) UserTags(user string) []string {
+	tagSet := make(map[string]bool)
+
+	notes, ok := ns.notes[user]
+
+	if !ok {
+		return make([]string, 0)
+	}
+
+	log.Printf("Got notes for user %v", notes)
+
+	for note := range notes {
+		log.Printf("considering note %s (%s)", note.Title, note.Tags)
+		for _, tag := range note.Tags {
+			tagSet[tag] = true
+		}
+	}
+
+	log.Printf("Tagset is %v", tagSet)
+
+	return slices.Sorted(maps.Keys(tagSet))
 }
 
 func fmtPath(path string) string {
@@ -134,10 +174,11 @@ func (n *Note) marshalFrontmatter() ([]byte, error) {
 	for viewer := range n.Viewers {
 		viewers = append(viewers, viewer)
 	}
-	frontmatter := make(map[string]interface{})
+	frontmatter := make(map[string]any)
 	frontmatter["owner"] = n.Owner
 	frontmatter["viewers"] = viewers
 	frontmatter["title"] = n.Title
+	frontmatter["tags"] = n.Tags
 
 	marshaled, err := yaml.Marshal(&frontmatter)
 	return marshaled, err
@@ -154,6 +195,7 @@ func (n *Note) ViewersAsList() []string {
 func NewNoteNoSave(title string, owner string) *Note {
 	note := &Note{Title: title, Owner: owner}
 	note.Viewers = make(map[string]struct{})
+	note.Tags = make([]string, 0, 5)
 	return note
 }
 
@@ -254,7 +296,7 @@ func loadNote(uid string) (*Note, error) {
 	note.Body = body
 	note.LastModified = stat.ModTime()
 
-	viewers := metaData["viewers"].([]interface{})
+	viewers := metaData["viewers"].([]any)
 
 	for _, viewer := range viewers {
 		v, ok := viewer.(string)
@@ -270,6 +312,24 @@ func loadNote(uid string) (*Note, error) {
 	}
 	log.Printf("Note %s shared with %v", note.Title, note.Viewers)
 
+	tags, ok := metaData["tags"]
+
+	if ok {
+		tags := tags.([]any)
+
+		for _, tag := range tags {
+			t, ok := tag.(string)
+			if !ok {
+				return nil, errors.New("invalid note, non string type in 'tags' in frontmatter")
+			}
+
+			if t == "" {
+				continue
+			}
+			note.Tags = append(note.Tags, t)
+		}
+	}
+
 	return note, nil
 }
 
@@ -281,12 +341,16 @@ func (n *Note) DelViewer(viewer string) {
 	delete(n.Viewers, viewer)
 }
 
-func DeleteNote(uid string) error {
+func (n *Note) Delete() error {
-	filename := filepath.Join(conf.Conf.NotesDir, fmtPath(uid))
+	filename := filepath.Join(conf.Conf.NotesDir, fmtPath(n.Uid))
 	return os.Remove(filename)
 }
 
-type toggleCheckboxTransformer struct{ nthBox int }
+type toggleCheckboxTransformer struct {
+	nthBox     int
+	boxToggled bool
+	boxChecked bool
+}
 
 func (t *toggleCheckboxTransformer) Transform(node *ast.Document, reader text.Reader, pc parser.Context) {
 	boxesFound := 0
@@ -308,6 +372,8 @@ func (t *toggleCheckboxTransformer) Transform(node *ast.Document, reader text.Re
 		}
 
 		box.IsChecked = !box.IsChecked
+		t.boxToggled = true
+		t.boxChecked = box.IsChecked
 		return ast.WalkStop, nil
 	})
 }
@@ -330,8 +396,8 @@ func renderTaskCheckBox(writer util.BufWriter, source []byte, node ast.Node, ent
 	return ast.WalkContinue, err
 }
 
-func (n *Note) ToggleBox(nthBox int) {
+func (n *Note) ToggleBox(nthBox int) (bool, bool) {
-	checkboxTransformer := toggleCheckboxTransformer{nthBox: nthBox}
+	checkboxTransformer := toggleCheckboxTransformer{nthBox: nthBox, boxToggled: false}
 	transformer := util.Prioritized(&checkboxTransformer, 0)
 
 	renderer := markdown.NewRenderer()
@@ -347,4 +413,10 @@ func (n *Note) ToggleBox(nthBox int) {
 	md.Convert(n.Body, &buf)
 	n.Body = buf.Bytes()
 	n.Save()
+
+	return checkboxTransformer.boxToggled, checkboxTransformer.boxChecked
+}
+
+func (n *Note) HasTag(tag string) bool {
+	return slices.Contains(n.Tags, tag)
 }

internal/notes/views/views.go

@@ -1,9 +1,11 @@
 package views
 
 import (
+	"encoding/json"
 	"log"
 	"net/http"
 	"strconv"
+	"strings"
 
 	urls "forgejo.gwairfelin.com/max/gispatcho"
 	"forgejo.gwairfelin.com/max/gonotes/internal/middleware"
@@ -25,6 +27,7 @@ func GetRoutes(prefix string) *http.ServeMux {
 			"new":       {Path: "/new", Protocol: "GET", Handler: new},
 			"view_":     {Path: "/{note}", Protocol: "GET", Handler: view},
 			"view":      {Path: "/{note}/", Protocol: "GET", Handler: view},
+			"setTags":   {Path: "/{note}/tags/", Protocol: "POST", Handler: setTags},
 			"delete":    {Path: "/{note}/delete/", Protocol: "GET", Handler: delete},
 			"edit":      {Path: "/{note}/edit/", Protocol: "GET", Handler: edit},
 			"share":     {Path: "/{note}/share/", Protocol: "POST", Handler: share},
@@ -55,7 +58,9 @@ func view(w http.ResponseWriter, r *http.Request) {
 		"urlNew":     myurls.Reverse("new", urls.Repl{}),
 		"urlShare":   myurls.Reverse("share", urls.Repl{"note": uid}),
 		"urlUnshare": myurls.Reverse("unshare", urls.Repl{"note": uid}),
+		"urlSetTags": myurls.Reverse("setTags", urls.Repl{"note": uid}),
 		"viewers":    viewers,
+		"tags":       strings.Join(note.Tags, " "),
 		"isOwner":    user == note.Owner,
 	}
 
@@ -102,10 +107,18 @@ func new(w http.ResponseWriter, r *http.Request) {
 }
 
 func delete(w http.ResponseWriter, r *http.Request) {
-	// user := r.Context().Value(middleware.ContextKey("user")).(string)
+	user := r.Context().Value(middleware.ContextKey("user")).(string)
+
+	uid := r.PathValue("note")
+
+	note, ok := notes.Notes.GetOne(user, uid)
+
+	if !ok {
+		http.NotFound(w, r)
+	}
+
+	err := notes.Notes.Del(note, user)
 
-	encodedTitle := r.PathValue("note")
-	err := notes.DeleteNote(encodedTitle)
 	if err != nil {
 		log.Print(err.Error())
 		http.Error(w, "Couldn't delete note", http.StatusInternalServerError)
@@ -177,18 +190,25 @@ func togglebox(w http.ResponseWriter, r *http.Request) {
 	nthBox, err := strconv.Atoi(r.FormValue("box"))
 	if err != nil {
 		log.Fatal("You fucked up boy")
+		http.Error(w, "Box not provided as numeric value", 400)
 		return
 	}
 
 	note, ok := notes.Notes.GetOne(user, uid)
 	if !ok {
-		http.Redirect(w, r, myurls.Reverse("view", urls.Repl{"note": uid}), http.StatusFound)
+		http.Error(w, "Note not found", 404)
 		return
 	}
 
-	note.ToggleBox(nthBox)
+	toggled, checked := note.ToggleBox(nthBox)
 
-	http.Redirect(w, r, myurls.Reverse("view", urls.Repl{"note": note.Uid}), http.StatusFound)
+	if !toggled {
+		http.Error(w, "Failed to toggle box", 500)
+	} else {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]any{"checked": checked})
+	}
 }
 
 type titleAndURL struct {
@@ -199,18 +219,22 @@ type titleAndURL struct {
 func list(w http.ResponseWriter, r *http.Request) {
 	user := r.Context().Value(middleware.ContextKey("user")).(string)
 
+	tag := r.FormValue("tag")
+
 	titlesAndUrls := make([]titleAndURL, 0)
 
-	ns := notes.Notes.Get(user)
+	ns := notes.Notes.GetOrdered(user)
 	log.Printf("Notes: %+v", notes.Notes)
 	log.Printf("Notes for %s: %+v", user, ns)
 
-	for note := range ns {
+	for _, note := range ns {
+		if tag == "" || note.HasTag(tag) {
 			titlesAndUrls = append(
 				titlesAndUrls,
 				titleAndURL{Title: note.Title, URL: myurls.Reverse("view", urls.Repl{"note": note.Uid})},
 			)
 		}
+	}
 
 	urlNew := myurls.Reverse("new", urls.Repl{})
 
@@ -221,3 +245,19 @@ func list(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 }
+
+func setTags(w http.ResponseWriter, r *http.Request) {
+	user := r.Context().Value(middleware.ContextKey("user")).(string)
+	uid := r.PathValue("note")
+	tags := r.FormValue("tags")
+
+	note, ok := notes.Notes.GetOne(user, uid)
+	if !ok || note.Owner != user {
+		http.Redirect(w, r, myurls.Reverse("view", urls.Repl{"note": uid}), http.StatusFound)
+		return
+	}
+
+	note.Tags = strings.Split(tags, " ")
+	note.Save()
+	http.Redirect(w, r, myurls.Reverse("view", urls.Repl{"note": note.Uid}), http.StatusFound)
+}

internal/templ/templ.go

@@ -7,6 +7,7 @@ import (
 
 	"forgejo.gwairfelin.com/max/gonotes/internal/conf"
 	"forgejo.gwairfelin.com/max/gonotes/internal/middleware"
+	"forgejo.gwairfelin.com/max/gonotes/internal/notes"
 )
 
 type Ctx map[string]any
@@ -31,7 +32,9 @@ func RenderTemplate(w http.ResponseWriter, r *http.Request, tmpl string, context
 		return err
 	}
 
-	context["user"] = r.Context().Value(middleware.ContextKey("user")).(string)
+	user := r.Context().Value(middleware.ContextKey("user")).(string)
+	context["user"] = user
+	context["userTags"] = notes.Notes.UserTags(user)
 
 	err = t.ExecuteTemplate(w, "base", context)
 	return err