Convert all but regex routes to endpoints (#59)

src/MyWebLog/Handlers/Upload.fs

@@ -8,9 +8,9 @@ open Microsoft.Net.Http.Headers
 /// Helper functions for this module
 [<AutoOpen>]
 module private Helpers =
-    
+
     open Microsoft.AspNetCore.StaticFiles
-    
+
     /// A MIME type mapper instance to use when serving files from the database
     let mimeMap = FileExtensionContentTypeProvider()
 
@@ -19,10 +19,10 @@ module private Helpers =
         let hdr = CacheControlHeaderValue()
         hdr.MaxAge <- Some (TimeSpan.FromDays 30) |> Option.toNullable
         hdr
-    
+
     /// Shorthand for the directory separator
     let slash = Path.DirectorySeparatorChar
-    
+
     /// The base directory where uploads are stored, relative to the executable
     let uploadDir = Path.Combine("wwwroot", "upload")
 
@@ -128,7 +128,7 @@ let showNew : HttpHandler = requireAccess Author >=> fun next ctx ->
     adminPage "Upload a File" next ctx Views.WebLog.uploadNew
 
 // POST /admin/upload/save
-let save : HttpHandler = requireAccess Author >=> fun next ctx -> task {
+let save : HttpHandler = requireAccess Author >=> validateCsrf >=> fun next ctx -> task {
     if ctx.Request.HasFormContentType && ctx.Request.Form.Files.Count > 0 then
         let upload    = Seq.head ctx.Request.Form.Files
         let fileName  = String.Concat (makeSlug (Path.GetFileNameWithoutExtension upload.FileName),
@@ -138,7 +138,7 @@ let save : HttpHandler = requireAccess Author >=> fun next ctx -> task {
         let  year     = localNow.ToString "yyyy"
         let  month    = localNow.ToString "MM"
         let! form     = ctx.BindFormAsync<UploadFileModel>()
-        
+
         match UploadDestination.Parse form.Destination with
         | Database ->
             use stream = new MemoryStream()
@@ -155,7 +155,7 @@ let save : HttpHandler = requireAccess Author >=> fun next ctx -> task {
             let _        = Directory.CreateDirectory fullPath
             use stream   = new FileStream(Path.Combine(fullPath, fileName), FileMode.Create)
             do! upload.CopyToAsync stream
-        
+
         do! addMessage ctx { UserMessage.Success with Message = $"File uploaded to {form.Destination} successfully" }
         return! redirectToGet "admin/uploads" next ctx
     else
@@ -163,7 +163,7 @@ let save : HttpHandler = requireAccess Author >=> fun next ctx -> task {
 }
 
 // DELETE /admin/upload/{id}
-let deleteFromDb upId : HttpHandler = fun next ctx -> task {
+let deleteFromDb upId : HttpHandler = requireAccess WebLogAdmin >=> fun next ctx -> task {
     match! ctx.Data.Upload.Delete (UploadId upId) ctx.WebLog.Id with
     | Ok fileName ->
         do! addMessage ctx { UserMessage.Success with Message = $"{fileName} deleted successfully" }
@@ -181,9 +181,9 @@ let removeEmptyDirectories (webLog: WebLog) (filePath: string) =
             Directory.Delete fullPath
             path <- String.Join(slash, path.Split slash |> Array.rev |> Array.skip 1 |> Array.rev)
         else finished <- true
-    
+
 // DELETE /admin/upload/disk/{**path}
-let deleteFromDisk urlParts : HttpHandler = fun next ctx -> task {
+let deleteFromDisk urlParts : HttpHandler = requireAccess WebLogAdmin >=> fun next ctx -> task {
     let filePath = urlParts |> Seq.skip 1 |> Seq.head
     let path = Path.Combine(uploadDir, ctx.WebLog.Slug, filePath)
     if File.Exists path then