aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/main.lisp13
1 files changed, 12 insertions, 1 deletions
diff --git a/src/main.lisp b/src/main.lisp
index 2c00512..5dde475 100644
--- a/src/main.lisp
+++ b/src/main.lisp
@@ -608,26 +608,35 @@ started, this will allow remote live debugging of the system.
(and (stringp signature)
(<= (length signature) +oneliner-brief-max-length+)))
-
+(defun is-current-password-p (contributor pw)
+ (with-slots (salt hashed-pw) contributor
+ (equal hashed-pw (pw-hash pw salt))))
;;; ENDPOINT DEFINITIONS
(defendpoint* :get "/contributor/:who a-contributor-by-handle:" () ()
+ "Return a [contributor](#contributor) data object."
(to-json who))
(defendpoint* :put "/contributor/:who a-contributor-by-handle:/locked" ((value a-boolean)
(token an-api-token))
+ "Admin users may lock a particular contributor, preventing that
+contributor for making edits or adding new oneliners."
(:auth 'admin-only)
(set-contributor-locked who value)
"true")
(defendpoint* :put "/contributor/:who a-contributor-by-handle:/password" ((value a-string)
(repeated a-string)
+ (current a-string)
(token an-api-token))
(:auth t)
+ "Change a contributor's password."
(unless (or (eq who (api-contributor token))
(adminp (api-contributor token)))
(http-err 403 "Cannot change that password."))
+ (unless (is-current-password-p who current)
+ (http-err 400 "The old password is incorrect."))
(unless (equalp value repeated)
(http-err 400 "The two passwords do not match."))
(update-password who value)
@@ -635,6 +644,7 @@ started, this will allow remote live debugging of the system.
(defendpoint* :put "/contributor/:who a-contributor-by-handle:/signature" ((token an-api-token))
(:auth t)
+ "Update a [contributor's](#contributor) signature."
(unless (or (eq who (api-contributor token))
(adminp (api-contributor token)))
(http-err 403))
@@ -674,6 +684,7 @@ started, this will allow remote live debugging of the system.
(or (eq requesting-contributor target-contributor)
(adminp requesting-contributor)))
+;TODO: Might rewrite this to be by user-name
(defendpoint* :delete "/access/:access an-api-token:" ((token an-api-token))
(:auth t)
"Revoke access of CONTRIBUTOR"