From: Michael Tremer <michael.tremer@ipfire.org>
Date: Sun, 23 Oct 2022 15:43:27 +0000 (+0000)
Subject: uploads: Implement deleting uploads
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9eaf98bfd67bc4311254804a4d3a8aaa07d6b3e0;p=pbs.git

uploads: Implement deleting uploads

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/hub/__init__.py b/src/hub/__init__.py
index dce0b828..e6a7c0cd 100644
--- a/src/hub/__init__.py
+++ b/src/hub/__init__.py
@@ -43,7 +43,7 @@ class Application(tornado.web.Application):
 				(r"/test", handlers.TestHandler),
 
 				# Uploads
-				(r"/uploads", uploads.CreateHandler),
+				(r"/uploads", uploads.IndexHandler),
 			],
 
 			# Forward any other settings
diff --git a/src/hub/uploads.py b/src/hub/uploads.py
index 485dfedf..86ab35d7 100644
--- a/src/hub/uploads.py
+++ b/src/hub/uploads.py
@@ -26,7 +26,7 @@ from .handlers import BaseHandler
 from .. import users
 
 @tornado.web.stream_request_body
-class CreateHandler(BaseHandler):
+class IndexHandler(BaseHandler):
 	def initialize(self):
 		# Buffer to cache the uploaded content
 		self.buffer = io.BytesIO()
@@ -84,3 +84,29 @@ class CreateHandler(BaseHandler):
 			"id"         : upload.uuid,
 			"expires_at" : upload.expires_at.isoformat(),
 		})
+
+	@tornado.web.authenticated
+	async def delete(self):
+		"""
+			Deletes an upload with a certain UUID
+		"""
+		# Fetch the UUID
+		uuid = self.get_argument("id")
+
+		# Fetch the upload
+		upload = self.backend.uploads.get_by_uuid(uuid)
+		if not upload:
+			raise tornado.web.HTTPError(404, "Could not find upload %s" % uuid)
+
+		# Check for permissions
+		if not upload.has_perm(self.current_user):
+			raise tornado.web.HTTPError(403, "%s has no permission to delete %s" \
+				% (self.current_user, upload))
+
+		# Delete the upload
+		with self.db.transaction():
+			await upload.delete()
+
+		self.finish({
+			"status" : "ok",
+		})