uploads: Implement deleting uploads

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/hub/__init__.py b/src/hub/__init__.py
index dce0b828785a4fbe779cdbbcddc3a8d99dada084..e6a7c0cdc5b0d9df56a338ffd8521d7c8767df0d 100644 (file)
--- a/src/hub/__init__.py
+++ b/src/hub/__init__.py
@@ -43,7 +43,7 @@ class Application(tornado.web.Application):
                                (r"/test", handlers.TestHandler),
 
                                # Uploads
-                               (r"/uploads", uploads.CreateHandler),
+                               (r"/uploads", uploads.IndexHandler),
                        ],
 
                        # Forward any other settings

diff --git a/src/hub/uploads.py b/src/hub/uploads.py
index 485dfedfe5df206d7e4db0b5b1689e1de40e78ee..86ab35d7459a19d539600278e856450b984519b4 100644 (file)
--- a/src/hub/uploads.py
+++ b/src/hub/uploads.py
@@ -26,7 +26,7 @@ from .handlers import BaseHandler
 from .. import users
 
 @tornado.web.stream_request_body
-class CreateHandler(BaseHandler):
+class IndexHandler(BaseHandler):
        def initialize(self):
                # Buffer to cache the uploaded content
                self.buffer = io.BytesIO()
@@ -84,3 +84,29 @@ class CreateHandler(BaseHandler):
                        "id"         : upload.uuid,
                        "expires_at" : upload.expires_at.isoformat(),
                })
+
+       @tornado.web.authenticated
+       async def delete(self):
+               """
+                       Deletes an upload with a certain UUID
+               """
+               # Fetch the UUID
+               uuid = self.get_argument("id")
+
+               # Fetch the upload
+               upload = self.backend.uploads.get_by_uuid(uuid)
+               if not upload:
+                       raise tornado.web.HTTPError(404, "Could not find upload %s" % uuid)
+
+               # Check for permissions
+               if not upload.has_perm(self.current_user):
+                       raise tornado.web.HTTPError(403, "%s has no permission to delete %s" \
+                               % (self.current_user, upload))
+
+               # Delete the upload
+               with self.db.transaction():
+                       await upload.delete()
+
+               self.finish({
+                       "status" : "ok",
+               })