Refactor feature flag to support more modules

[shhdgit]

ref #1047 (comment)

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• baurine

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[shhdgit]

/cc @baurine @breeswish
PTAL, thanks~

[shhdgit]

@breeswish
Updated, PTAL.

[baurine]

It's a nice improvement.

[baurine]

LGTM!

[breezewish]

the rest lgtm

[breezewish]

Seems that this FeatureFlagNonRootLogin is not used. It doesn't look good as this may imply that this protection is purely happening at frontend and there is no backend protection for corresponding features.

[shhdgit]

Create a new PR #1089 to refactor the "non root login" for better review experience.

[breezewish]

This feature should be placed inside SQL auth, as only SQL auth needs it and other kind of auth does not care about the "non root login".

[breezewish]

Seems that there is an "Abort". I'm worrying whether this is compatible with the standard rest.ErrorHandlerFn. Could you add a test to verify it?

[breezewish]

Oh. I'm sorry, I misled you. There is no way to attach the error status code into the error type for now.

Please use HTTPCodeProperty when initializing errors:

var ErrFeatureUnsupported = ErrNS.xxxx()

_ = c.Error(ErrFeatureUnsupported.NewWithNoMessage().WithProperty(HTTPCodeProperty(http.StatusForbidden)))

or:

_ = c.Error(rest.ErrForbidden.New("<ErrorMessages>"))

The whole point is to avoid the necessarilty to call c.Status() or c.AbortWithStatus() manually.

[breezewish]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: 0623ecc

[breezewish]

You can use CreateTestContext to test context directly. No need to use a middleware to test it. Example:

func TestDownload(t *testing.T) {
	handler := New()
	token := handler.mustGetDownloadToken(t, "foobar", "file.txt", time.Second*5)

	r := httptest.NewRecorder()
	c, _ := gin.CreateTestContext(r)
	c.Request, _ = http.NewRequest(http.MethodGet, "/download?token="+token, nil)
	handler.HandleDownloadRequest(c)

	require.Len(t, c.Errors, 0)
	require.Equal(t, http.StatusOK, r.Code)
	require.Equal(t, `attachment; filename="file.txt"`, r.Header().Get("Content-Disposition"))
	require.Equal(t, `application/octet-stream`, r.Header().Get("Content-Type"))
	require.Equal(t, "foobar", r.Body.String())

	// Download again
	r = httptest.NewRecorder()
	c, _ = gin.CreateTestContext(r)
	c.Request, _ = http.NewRequest(http.MethodGet, "/download?token="+token, nil)
	handler.HandleDownloadRequest(c)

	require.Len(t, c.Errors, 1)
	require.True(t, errorx.IsOfType(c.Errors[0].Err, rest.ErrBadRequest))
	require.Contains(t, c.Errors[0].Error(), "Download file not found")
}

[shhdgit]

Thanks! This is really helpful.

[breezewish]

Forbidden means Unauthorized: The HTTP 403 Forbidden response status code indicates that the server understands the request but refuses to authorize it.

However there is no way for this router to be authorized. So maybe BadRequest is better.

[shhdgit]

Oh, yes. I misunderstood the "forbidden".