added on local at 2026-07-01 21:47:33
| 1 | #!/usr/bin/perl | |
| 2 | #====================================================================== | |
| 3 | # RePricer - Marketplace push actions. | |
| 4 | # | |
| 5 | # Single POST chokepoint for cancel / retry on a marketplace_pushes | |
| 6 | # row. All actions are owner-scoped: the row's user_id must match the | |
| 7 | # logged-in user (or admin via impersonation). | |
| 8 | # | |
| 9 | # Actions: | |
| 10 | # act=cancel id=<push_id> -- delete the row (only if status=pending) | |
| 11 | # act=retry id=<push_id> -- flip status back to pending so the | |
| 12 | # worker re-attempts on its next sweep | |
| 13 | #====================================================================== | |
| 14 | use strict; | |
| 15 | use warnings; | |
| 16 | ||
| 17 | use lib '/var/www/vhosts/3dshawn.com/repricer.3dshawn.com'; | |
| 18 | use CGI; | |
| 19 | use MODS::DBConnect; | |
| 20 | use MODS::Login; | |
| 21 | use MODS::RePricer::Config; | |
| 22 | ||
| 23 | my $q = CGI->new; | |
| 24 | my $form = $q->Vars; | |
| 25 | my $auth = MODS::Login->new; | |
| 26 | my $db = MODS::DBConnect->new; | |
| 27 | my $cfg = MODS::RePricer::Config->new; | |
| 28 | my $DB = $cfg->settings('database_name'); | |
| 29 | ||
| 30 | $| = 1; | |
| 31 | ||
| 32 | # POST-only. Drive-by GETs cannot mutate state. | |
| 33 | if (($ENV{REQUEST_METHOD} || '') ne 'POST') { | |
| 34 | print "Status: 405 Method Not Allowed\nContent-Type: text/plain\n\nPOST required\n"; | |
| 35 | exit; | |
| 36 | } | |
| 37 | ||
| 38 | my $userinfo = $auth->login_verify(); | |
| 39 | if (!$userinfo) { | |
| 40 | print "Status: 302 Found\nLocation: /login.cgi\n\n"; | |
| 41 | exit; | |
| 42 | } | |
| 43 | require MODS::RePricer::Permissions; | |
| 44 | MODS::RePricer::Permissions->new->require_feature($userinfo, 'manage_marketplaces'); | |
| 45 | my $uid = $userinfo->{user_id}; | |
| 46 | $uid =~ s/[^0-9]//g; | |
| 47 | ||
| 48 | my $act = lc($form->{act} || ''); | |
| 49 | $act =~ s/[^a-z_]//g; | |
| 50 | ||
| 51 | my $push_id = $form->{id} || 0; | |
| 52 | $push_id =~ s/[^0-9]//g; | |
| 53 | ||
| 54 | # Bail home if either is missing or invalid. | |
| 55 | if (!$act || !$push_id) { | |
| 56 | print "Status: 302 Found\nLocation: /welcome.cgi\n\n"; | |
| 57 | exit; | |
| 58 | } | |
| 59 | ||
| 60 | my $dbh = $db->db_connect(); | |
| 61 | ||
| 62 | # Guard against missing table on a fresh DB. | |
| 63 | my $have_tbl = $db->db_readwrite($dbh, qq~ | |
| 64 | SELECT COUNT(*) AS n FROM information_schema.tables | |
| 65 | WHERE table_schema='$DB' AND table_name='marketplace_pushes' | |
| 66 | ~, $ENV{SCRIPT_NAME}, __LINE__); | |
| 67 | unless ($have_tbl && $have_tbl->{n}) { | |
| 68 | $db->db_disconnect($dbh); | |
| 69 | print "Status: 302 Found\nLocation: /welcome.cgi\n\n"; | |
| 70 | exit; | |
| 71 | } | |
| 72 | ||
| 73 | # Verify ownership. The row must belong to the logged-in user. Admins | |
| 74 | # acting-as another user inherit that user's row visibility via the | |
| 75 | # impersonation swap in MODS::Login. | |
| 76 | my $row = $db->db_readwrite($dbh, qq~ | |
| 77 | SELECT id, user_id, status | |
| 78 | FROM `${DB}`.marketplace_pushes | |
| 79 | WHERE id='$push_id' AND user_id='$uid' | |
| 80 | LIMIT 1 | |
| 81 | ~, $ENV{SCRIPT_NAME}, __LINE__); | |
| 82 | ||
| 83 | unless ($row && $row->{id}) { | |
| 84 | $db->db_disconnect($dbh); | |
| 85 | print "Status: 302 Found\nLocation: /welcome.cgi\n\n"; | |
| 86 | exit; | |
| 87 | } | |
| 88 | ||
| 89 | if ($act eq 'cancel') { | |
| 90 | # Only cancel pending pushes -- once status=success the listing is | |
| 91 | # live on the platform and "cancel" would not actually undo it. | |
| 92 | if (($row->{status} || '') eq 'pending') { | |
| 93 | $db->db_readwrite($dbh, qq~ | |
| 94 | DELETE FROM `${DB}`.marketplace_pushes | |
| 95 | WHERE id='$push_id' AND user_id='$uid' AND status='pending' | |
| 96 | ~, $ENV{SCRIPT_NAME}, __LINE__); | |
| 97 | } | |
| 98 | } | |
| 99 | elsif ($act eq 'retry') { | |
| 100 | # Retry: only valid on failed rows. Flip back to pending and the | |
| 101 | # worker picks it up on its next sweep. We do not touch the error_ | |
| 102 | # message column so the history of the prior failure is preserved | |
| 103 | # until the next attempt overwrites it. | |
| 104 | if (($row->{status} || '') eq 'failed') { | |
| 105 | $db->db_readwrite($dbh, qq~ | |
| 106 | UPDATE `${DB}`.marketplace_pushes | |
| 107 | SET status='pending' | |
| 108 | WHERE id='$push_id' AND user_id='$uid' AND status='failed' | |
| 109 | ~, $ENV{SCRIPT_NAME}, __LINE__); | |
| 110 | } | |
| 111 | } | |
| 112 | # Any other act value: no-op, just redirect home. | |
| 113 | ||
| 114 | $db->db_disconnect($dbh); | |
| 115 | print "Status: 302 Found\nLocation: /welcome.cgi\n\n"; |