92e1b4e09c
- POST /_feedback/api/v1/{key}/submit validates as PHP, refuses non-image screenshots (ImageContentGuard copy) and stores the submission, its public screenshot and the G15Office job in one transaction
- PUT /_feedback/api/v1/me/hidden (jwt.auth) stores the caller's preference; feedback_widget_hidden joins every golem15.user payload
- preflights stay with the framework CORS layer
25 lines
1.0 KiB
Go
25 lines
1.0 KiB
Go
package feedback
|
|
|
|
import (
|
|
"git.golem15.com/golem15/sm-feedback-plugin/controllers/api"
|
|
"git.golem15.com/golem15/summercms/modules/pact"
|
|
"git.golem15.com/golem15/summercms/modules/surf"
|
|
)
|
|
|
|
// Routes mounts the widget API. The public group has no auth: the widget
|
|
// key in the path and the Origin allow-list are its gate, backed by the
|
|
// per-IP buckets. CORS preflights (OPTIONS) on _feedback/api/* are answered
|
|
// by surf's path-scoped CORS layer, which the application's http.cors.paths
|
|
// must list, so no OPTIONS route is registered. A second group on the same
|
|
// prefix carries the per-user preference behind golem15.user's jwt.auth.
|
|
func (p *Plugin) Routes(r pact.Router) error {
|
|
r.Group("/_feedback/api/v1", nil, func(g pact.Router) {
|
|
g.Get("/{key}/config", api.Config(p.app), "throttle:"+BucketConfig)
|
|
g.Post("/{key}/submit", api.Submit(p.app), "throttle:"+BucketSubmit)
|
|
})
|
|
r.Group("/_feedback/api/v1", surf.Use("jwt.auth"), func(g pact.Router) {
|
|
g.Put("/me/hidden", api.MeHidden(p.app))
|
|
})
|
|
return nil
|
|
}
|