API owner token

Author: matze

Cargo.lock

@@ -15,7 +15,7 @@ rusqlite_migration = { version = "2", default-features = false }
 rust-argon2 = "3.0.0"
 serde = { workspace = true }
 thiserror = { workspace = true }
-tokio = { workspace = true, features = ["io-util", "rt-multi-thread"] }
+tokio = { workspace = true, features = ["io-util", "macros", "rt-multi-thread", "sync", "time"] }
 tracing = { workspace = true }
 zstd = "0.13"
 

crates/wastebin_core/Cargo.toml

@@ -3,7 +3,7 @@ use std::path::PathBuf;
 use std::time::Duration;
 
 use chacha20poly1305::XNonce;
-use rusqlite::{Connection, Transaction, params};
+use rusqlite::{Connection, Transaction, params, params_from_iter};
 use rusqlite_migration::{HookError, M, Migrations};
 use tokio::sync::oneshot;
 
@@ -80,7 +80,7 @@ enum Command {
     },
     DeleteFor {
         id: Id,
-        uid: i64,
+        uids: Vec<i64>,
         result: oneshot::Sender<Result<(), Error>>,
     },
     NextUid {
@@ -420,9 +420,9 @@ impl Handler {
                         .send(self.delete_many(ids))
                         .map_err(|_| Error::ResultSendError)?;
                 }
-                Command::DeleteFor { id, uid, result } => {
+                Command::DeleteFor { id, uids, result } => {
                     result
-                        .send(self.delete_for(id, uid))
+                        .send(self.delete_for(id, &uids))
                         .map_err(|_| Error::ResultSendError)?;
                 }
                 Command::NextUid { result } => {
@@ -571,12 +571,28 @@ impl Handler {
         Ok(affected)
     }
 
-    fn delete_for(&mut self, id: Id, uid: i64) -> Result<(), Error> {
+    fn delete_for(&mut self, id: Id, uids: &[i64]) -> Result<(), Error> {
+        if uids.is_empty() {
+            return Err(Error::Delete);
+        }
+
+        let placeholders = vec!["?"; uids.len()].join(",");
+        let select_sql = format!(
+            "SELECT 1 FROM entries WHERE id=? AND uid IN ({placeholders})",
+        );
+        let delete_sql = format!(
+            "DELETE FROM entries WHERE id=? AND uid IN ({placeholders})",
+        );
+
+        let mut params = Vec::with_capacity(uids.len() + 1);
+        params.push(id.to_i64());
+        params.extend_from_slice(uids);
+
         let tx = self.conn.transaction()?;
 
         let exists = match tx.query_row(
-            "SELECT 1 FROM entries WHERE (id=?1 AND uid=?2)",
-            params![id.to_i64(), uid],
+            &select_sql,
+            params_from_iter(&params),
             |row| row.get::<_, i64>(0),
         ) {
             Ok(_) => true,
@@ -588,10 +604,7 @@ impl Handler {
             return Err(Error::Delete);
         }
 
-        tx.execute(
-            "DELETE FROM entries WHERE (id=?1 AND uid=?2)",
-            params![id.to_i64(), uid],
-        )?;
+        tx.execute(&delete_sql, params_from_iter(&params))?;
 
         tx.commit()?;
         Ok(())
@@ -722,11 +735,15 @@ impl Database {
         command_result.await?
     }
 
-    /// Delete paste with `id` for user `uid`.
-    pub async fn delete_for(&self, id: Id, uid: i64) -> Result<(), Error> {
+    /// Delete paste with `id` if any of `uids` owns it.
+    pub async fn delete_for(&self, id: Id, uids: &[i64]) -> Result<(), Error> {
         let (result, command_result) = oneshot::channel();
         self.sender
-            .send(Command::DeleteFor { id, uid, result })
+            .send(Command::DeleteFor {
+                id,
+                uids: uids.to_vec(),
+                result,
+            })
             .await
             .map_err(|_| Error::SendError)?;
         command_result.await?
@@ -867,7 +884,7 @@ mod tests {
         let (id, _entry) = db.insert(entry).await?;
 
         assert!(db.get(id, None).await.is_ok());
-        assert!(db.delete_for(id, uid).await.is_ok());
+        assert!(db.delete_for(id, &[uid]).await.is_ok());
         assert!(db.get(id, None).await.is_err());
 
         let entry = write::Entry {
@@ -878,7 +895,29 @@ mod tests {
 
         let incorrect_uid = 99;
         assert!(matches!(
-            db.delete_for(id, incorrect_uid).await,
+            db.delete_for(id, &[incorrect_uid]).await,
+            Err(Error::Delete)
+        ));
+
+        // Multi-uid: passes if any uid in the list matches.
+        let entry = write::Entry {
+            uid: Some(uid),
+            ..Default::default()
+        };
+        let (id, _entry) = db.insert(entry).await?;
+
+        assert!(db.delete_for(id, &[99, uid, 7]).await.is_ok());
+        assert!(db.get(id, None).await.is_err());
+
+        // Empty slice: nothing to authorize against.
+        let entry = write::Entry {
+            uid: Some(uid),
+            ..Default::default()
+        };
+        let (id, _entry) = db.insert(entry).await?;
+
+        assert!(matches!(
+            db.delete_for(id, &[]).await,
             Err(Error::Delete)
         ));
 

crates/wastebin_core/src/db.rs

@@ -11,6 +11,7 @@ askama_web = { version = "0.15.0", features = ["axum-0.8"] }
 axum = { version = "0.8", features = ["json", "query", "macros"] }
 axum-extra = { version = "0.12", features = ["cookie-signed", "typed-header"] }
 cached = { version = "0.59.0", default-features = false }
+cookie = { version = "0.18", features = ["signed"] }
 futures = "0.3.31"
 hex = "0.4"
 hostname = "0.4.0"

crates/wastebin_server/Cargo.toml

@@ -2,15 +2,15 @@ use axum::extract::{Path, State};
 
 use crate::Database;
 use crate::errors::{Error, JsonErrorResponse};
-use crate::handlers::extract::Uid;
+use crate::handlers::extract::Uids;
 
 pub async fn delete(
     Path(id): Path<String>,
     State(db): State<Database>,
-    Uid(uid): Uid,
+    Uids(uids): Uids,
 ) -> Result<(), JsonErrorResponse> {
     let id = id.parse().map_err(Error::Id)?;
-    db.delete_for(id, uid).await.map_err(Error::Database)?;
+    db.delete_for(id, &uids).await.map_err(Error::Database)?;
     Ok(())
 }
 

crates/wastebin_server/src/handlers/delete/api.rs

@@ -1,20 +1,20 @@
 use axum::extract::{Path, State};
 use axum::response::Redirect;
 
-use crate::handlers::extract::{Theme, Uid};
+use crate::handlers::extract::{Theme, Uids};
 use crate::handlers::html::{ErrorResponse, make_error};
 use crate::{Database, Page};
 
 pub async fn delete(
     Path(id): Path<String>,
     State(db): State<Database>,
     State(page): State<Page>,
-    Uid(uid): Uid,
+    Uids(uids): Uids,
     theme: Option<Theme>,
 ) -> Result<Redirect, ErrorResponse> {
     async {
         let id = id.parse()?;
-        db.delete_for(id, uid).await?;
+        db.delete_for(id, &uids).await?;
         Ok(Redirect::to("/"))
     }
     .await

crates/wastebin_server/src/handlers/delete/form.rs

@@ -8,6 +8,7 @@ use axum::http::request::Parts;
 use axum::response::Redirect;
 use axum_extra::extract::cookie::Key;
 use axum_extra::extract::{CookieJar, SignedCookieJar};
+use cookie::Cookie;
 use serde::Deserialize;
 
 use wastebin_core::crypto;
@@ -39,7 +40,12 @@ pub(crate) struct Preference {
 pub(crate) struct Password(pub crypto::Password);
 
 /// Uid cookie value extractor, extracted from the `uid` cookie.
-pub(crate) struct Uid(pub i64);
+///
+/// The cookie holds a comma-separated list of i64 values: index 0 is the client's
+/// primary identity (used by the form route when tagging new pastes), subsequent
+/// entries are uids claimed via the magic-link `?owner=` handoff. An empty list
+/// is valid (e.g. cookie was just signed-but-empty).
+pub(crate) struct Uids(pub Vec<i64>);
 
 /// Password header to encrypt a paste.
 pub(crate) const PASSWORD_HEADER_NAME: http::HeaderName =
@@ -87,7 +93,46 @@ where
     }
 }
 
-impl<S> FromRequestParts<S> for Uid
+/// Parse the comma-separated `uid` cookie value into a list of i64s.
+/// Non-numeric tokens are skipped silently — a tampered cookie that survives
+/// HMAC verification but contains junk should not 500 the request.
+pub(crate) fn parse_uids(value: &str) -> Vec<i64> {
+    value
+        .split(',')
+        .filter_map(|s| s.trim().parse::<i64>().ok())
+        .collect()
+}
+
+/// Serialize a uid list back into the cookie wire format.
+pub(crate) fn serialize_uids(uids: &[i64]) -> String {
+    uids.iter()
+        .map(i64::to_string)
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+/// Sign a single uid using the same key as the `uid` cookie. The returned
+/// string is meant to be carried in the `?owner=` query of a paste URL so the
+/// server can promote it to a proper signed cookie on first GET.
+pub(crate) fn sign_owner_token(key: &Key, uid: i64) -> String {
+    let mut jar = cookie::CookieJar::new();
+    jar.signed_mut(key)
+        .add(Cookie::new("uid", uid.to_string()));
+    jar.get("uid")
+        .map(|cookie| cookie.value().to_string())
+        .unwrap_or_default()
+}
+
+/// Verify a token produced by [`sign_owner_token`] and recover the uid.
+pub(crate) fn verify_owner_token(key: &Key, token: &str) -> Option<i64> {
+    let mut jar = cookie::CookieJar::new();
+    jar.add(Cookie::new("uid", token.to_owned()));
+    jar.signed(key)
+        .get("uid")
+        .and_then(|cookie| cookie.value().parse::<i64>().ok())
+}
+
+impl<S> FromRequestParts<S> for Uids
 where
     S: Send + Sync,
     Key: FromRef<S>,
@@ -99,19 +144,16 @@ where
             .await
             .map_err(|_| ())?;
 
-        jar.get("uid")
-            .map(|cookie| {
-                cookie
-                    .value_trimmed()
-                    .parse::<i64>()
-                    .map(Uid)
-                    .map_err(|_| ())
-            })
-            .ok_or(())?
+        let uids = jar
+            .get("uid")
+            .map(|cookie| parse_uids(cookie.value_trimmed()))
+            .ok_or(())?;
+
+        Ok(Uids(uids))
     }
 }
 
-impl<S> OptionalFromRequestParts<S> for Uid
+impl<S> OptionalFromRequestParts<S> for Uids
 where
     S: Send + Sync,
     Key: FromRef<S>,
@@ -123,7 +165,7 @@ where
         state: &S,
     ) -> Result<Option<Self>, Self::Rejection> {
         Ok(
-            <Uid as FromRequestParts<S>>::from_request_parts(parts, state)
+            <Uids as FromRequestParts<S>>::from_request_parts(parts, state)
                 .await
                 .ok(),
         )

crates/wastebin_server/src/handlers/extract.rs

@@ -1,18 +1,31 @@
 use askama::Template;
 use askama_web::WebTemplate;
-use axum::extract::{Form, Path, State};
-use axum::response::{IntoResponse, Response};
+use axum::extract::{Form, Path, Query, State};
+use axum::response::{IntoResponse, Redirect, Response};
+use axum_extra::extract::SignedCookieJar;
+use axum_extra::extract::cookie::Key as CookieKey;
 use serde::Deserialize;
 
 use crate::cache::{Key, Mode};
-use crate::handlers::extract::{Theme, Uid};
+use crate::handlers::cookie;
+use crate::handlers::extract::{Theme, Uids, serialize_uids, verify_owner_token};
 use crate::handlers::html::{BurnConfirmation, ErrorResponse, PasswordInput, make_error};
 use crate::{Cache, Database, Highlighter, Page};
 use wastebin_core::crypto::Password;
 use wastebin_core::db;
 use wastebin_core::db::read::{Data, Entry, Metadata};
 use wastebin_core::expiration::Expiration;
 
+/// Magic-link handoff: when a paste was created via the JSON API, the response
+/// contains a signed `owner` token. Opening `/<id>?owner=<token>` lets the
+/// browser claim ownership of the paste — the server validates the token,
+/// appends the uid to the user's signed `uid` cookie, and redirects to the
+/// clean paste URL so the token never leaks via Referer.
+#[derive(Deserialize, Debug)]
+pub(crate) struct OwnerHandoff {
+    pub(crate) owner: Option<String>,
+}
+
 #[derive(Deserialize, Debug)]
 pub(crate) struct PasswordForm {
     pub(crate) password: String,
@@ -55,11 +68,29 @@ pub async fn get<E>(
     State(page): State<Page>,
     State(db): State<Database>,
     State(highlighter): State<Highlighter>,
+    State(cookie_key): State<CookieKey>,
     Path(id): Path<String>,
-    uid: Option<Uid>,
+    Query(handoff): Query<OwnerHandoff>,
+    jar: SignedCookieJar,
+    uids: Option<Uids>,
     theme: Option<Theme>,
     form: Result<Form<PasteForm>, E>,
 ) -> Result<Response, ErrorResponse> {
+    if let Some(token) = handoff.owner.as_deref()
+        && let Some(claimed_uid) = verify_owner_token(&cookie_key, token)
+    {
+        let mut new_uids = uids
+            .as_ref()
+            .map(|Uids(list)| list.clone())
+            .unwrap_or_default();
+        if !new_uids.contains(&claimed_uid) {
+            new_uids.push(claimed_uid);
+        }
+        let mut cookie = cookie("uid", serialize_uids(&new_uids));
+        cookie.set_secure(true);
+        return Ok((jar.add(cookie), Redirect::to(&format!("/{id}"))).into_response());
+    }
+
     async {
         let form = form.ok().map(|Form(form)| form);
         let password = form
@@ -108,9 +139,10 @@ pub async fn get<E>(
             ..
         } = metadata;
 
-        let can_delete = uid
-            .zip(owner_uid)
-            .is_some_and(|(Uid(user_uid), owner_uid)| user_uid == owner_uid);
+        let can_delete = match (uids, owner_uid) {
+            (Some(Uids(uids)), Some(owner_uid)) => uids.contains(&owner_uid),
+            _ => false,
+        };
 
         let html = if let Some(html) = cache.get(&key, Mode::Source) {
             tracing::trace!(?key, "found cached item");