polish

orders/error_handler.go

@@ -0,0 +1,23 @@
+package orders
+
+import (
+	"net/http"
+	"piekarnikgosipl/html"
+)
+
+func errorMessages(err error) []string {
+	if j, ok := err.(interface{ Unwrap() []error }); ok {
+		var out []string
+		for _, e := range j.Unwrap() {
+			out = append(out, e.Error())
+		}
+		return out
+	}
+	return []string{err.Error()}
+}
+
+func writeErrors(w http.ResponseWriter, r *http.Request, status int, msgs ...string) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(status)
+	html.FormErrors(msgs).Render(r.Context(), w)
+}

orders/order.go

@@ -97,6 +97,9 @@ func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
 	id := newOrderID()
 	log.Println("ORDER_PENDING", id, o)
 
+	url := r.URL.RequestURI()
+	log.Println(url)
+
 	s, err := session.New(&stripe.CheckoutSessionParams{
 		Mode:              stripe.String("payment"),
 		ClientReferenceID: stripe.String(id),
@@ -111,12 +114,12 @@ func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
 				},
 			},
 		}},
-		SuccessURL: stripe.String("https://piekarnikgosi.pl/dziekujemy"),
+		SuccessURL: stripe.String("https://piekarnikgosi.pl/dziekujemy?order=" + id),
 		CancelURL:  stripe.String("https://piekarnikgosi.pl/"),
 	})
 	if err != nil {
 		log.Println("ORDER_STRIPE_ERROR", id, err)
-		http.Error(w, "payment error", http.StatusInternalServerError)
+		writeErrors(w, r, http.StatusInternalServerError, "Nie udało się przejść do płatności. Spróbuj ponownie lub zadzwoń: 690 214 515.")
 		return
 	}
 	if r.Header.Get("HX-Request") == "true" {
@@ -128,10 +131,15 @@ func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
 }
 
 func OrderHandler(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 16<<10)
+	if err := r.ParseForm(); err != nil {
+		writeErrors(w, r, http.StatusRequestEntityTooLarge, "Formularz jest nieprawidłowy.")
+		return
+	}
 	o, err := parseOrder(r)
 	if err != nil {
 		log.Println("ORDER_INVALID", o, err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeErrors(w, r, http.StatusUnprocessableEntity, errorMessages(err)...)
 		return
 	}
 	startCheckout(w, r, o)

orders/ratelimit.go

@@ -0,0 +1,62 @@
+package orders
+
+import (
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+type visitor struct {
+	lim  *rate.Limiter
+	seen time.Time
+}
+
+func Limit(next http.Handler, every time.Duration, burst int) http.Handler {
+	var mu sync.Mutex
+	visitors := map[string]*visitor{}
+
+	go func() {
+		for range time.Tick(10 * time.Minute) {
+			mu.Lock()
+			for ip, v := range visitors {
+				if time.Since(v.seen) > 10*time.Minute {
+					delete(visitors, ip)
+				}
+			}
+			mu.Unlock()
+		}
+	}()
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ip := clientIP(r)
+		mu.Lock()
+		v, ok := visitors[ip]
+		if !ok {
+			v = &visitor{lim: rate.NewLimiter(rate.Every(every), burst)}
+			visitors[ip] = v
+		}
+		v.seen = time.Now()
+		allowed := v.lim.Allow()
+		mu.Unlock()
+
+		if !allowed {
+			http.Error(w, "Zbyt wiele prób. Spróbuj ponownie za chwilę.", http.StatusTooManyRequests)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func clientIP(r *http.Request) string {
+	host, _, _ := net.SplitHostPort(r.RemoteAddr)
+	if ip := net.ParseIP(host); ip != nil && ip.IsLoopback() {
+		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+			return strings.TrimSpace(strings.Split(xff, ",")[0])
+		}
+	}
+	return host
+}