Version 0.2.0

Changes:
- forbid to overwrite secrets of other users
- add some logs of success
- add validation on code (length 50)
- use same limiter for POST requests

internal/api/handlers.go

@@ -6,8 +6,10 @@ import (
 
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
+	"go.uber.org/zap"
 
 	"github.com/kanootoko/codevault/internal/db"
+	"github.com/kanootoko/codevault/internal/observability/logging"
 	"github.com/kanootoko/codevault/internal/observability/metrics"
 )
 
@@ -22,7 +24,7 @@ func NewHandler(secrets *db.SecretsRepository, m metrics.ValueMetrics) *StrictHa
 }
 
 func (h *StrictHandler) GetValue(ctx context.Context, request GetValueRequestObject) (GetValueResponseObject, error) {
-	if request.Body == nil || request.Body.Code == "" {
+	if request.Body == nil || request.Body.Code == "" || len(request.Body.Code) > 50 {
 		return GetValue400Response{}, nil
 	}
 
@@ -35,21 +37,36 @@ func (h *StrictHandler) GetValue(ctx context.Context, request GetValueRequestObj
 		return nil, err
 	}
 
+	logger := logging.LoggerMustFromContext(ctx)
+
 	h.Metrics.GetSuccessTotal.Add(ctx, 1, metric.WithAttributes(attribute.String("code", request.Body.Code)))
+	ip, _ := IPFromContext(ctx)
+	logger.Info("get value succeeded", zap.String("code", request.Body.Code), zap.String("ip", ip))
 	return GetValue200JSONResponse{Value: value}, nil
 }
 
 func (h *StrictHandler) SetValue(ctx context.Context, request SetValueRequestObject) (SetValueResponseObject, error) {
-	if request.Body == nil || request.Body.Code == "" || request.Body.Value == "" || len(request.Body.Value) > 10*1024*1024 {
+	if request.Body == nil || request.Body.Code == "" || len(request.Body.Code) > 50 ||
+		request.Body.Value == "" || len(request.Body.Value) > 10*1024*1024 {
 		h.Metrics.SetFailedTotal.Add(ctx, 1, metric.WithAttributes(attribute.String("reason", "bad_request")))
 		return SetValue400Response{}, nil
 	}
 
-	if err := h.Secrets.Set(ctx, request.Body.Code, request.Body.Value); err != nil {
+	login, _ := LoginFromContext(ctx)
+	ip, _ := IPFromContext(ctx)
+
+	logger := logging.LoggerMustFromContext(ctx)
+
+	if err := h.Secrets.Set(ctx, request.Body.Code, request.Body.Value, login); err != nil {
+		if errors.Is(err, db.ErrForbidden) {
+			h.Metrics.SetFailedTotal.Add(ctx, 1, metric.WithAttributes(attribute.String("reason", "forbidden")))
+			logger.Warn("set value forbidden", zap.String("code", request.Body.Code), zap.String("ip", ip), zap.String("user", login))
+			return SetValue403Response{}, nil
+		}
 		return nil, err
 	}
 
-	login, _ := LoginFromContext(ctx)
 	h.Metrics.SetSuccessTotal.Add(ctx, 1, metric.WithAttributes(attribute.String("user", login)))
+	logger.Info("set value succeeded", zap.String("code", request.Body.Code), zap.String("ip", ip), zap.String("user", login))
 	return SetValue204Response{}, nil
 }