Book Marx: Implement support for page-specific authentication tokens.

1 files changed, 31 insertions, 6 deletions

diff --git a/src/mulk/benki/webutil.clj b/src/mulk/benki/webutil.clj
index 37b93a3..3a2cb1e 100644
--- a/src/mulk/benki/webutil.clj
+++ b/src/mulk/benki/webutil.clj
@@ -8,15 +8,40 @@
             [noir.request  :as request]
             [noir.response :as response]
             [clojure.java.jdbc :as sql])
-  (:import [java.text DateFormat]))
+  (:import [java.text DateFormat]
+           [java.math BigDecimal]))
+
+
+
+(defn authlink []
+  (with-dbt
+    (let [req  (request/ring-request)
+          user *user*
+          uri  (:uri req)
+          dkey (sql/with-query-results results
+                   ["SELECT * FROM page_keys WHERE \"user\" = ? AND page = ?"
+                    user uri]
+                 (if-let [rec (first results)]
+                   (:key rec)
+                   (let [key (BigDecimal. (genkey))]
+                     (sql/with-query-results results
+                         ["INSERT INTO page_keys(\"user\", page, \"key\")
+                                VALUES (?, ?, ?)
+                             RETURNING \"key\""
+                          user uri key]
+                       (:key (first results))))))
+          key  (.toBigIntegerExact dkey)]
+      (fmt nil "~A?auth=~A" uri (.toString key 36)))))
 
 
 (defpartial login-message []
-  (let [user-id (session/get :user)
-        user    (and user-id
+  (let [user    (and *user*
                      (with-dbt (sql/with-query-results results
-                                   ["SELECT * FROM users WHERE id = ?" user-id]
+                                 ["SELECT * FROM users WHERE id = ?" *user*]
                                  (first results))))]
-    (if user-id
-      [:div {:class "logged-in-as"}  (:first_name user) " " (:last_name user)]
+    (if *user*
+      [:div {:class "logged-in-as"}
+       (:first_name user) " " (:last_name user)
+       " "
+       [:a {:href (authlink)} "[authlink]"]]
       [:div {:class "not-logged-in"} [:a {:href (link :login)} "Log in"]])))