[Bugfix] Improve OPML route security (#535)

* WIP - moved plugs; set up a new token-protected route plug

* Added a route_token column to settings model

* Hooked up token_protected_route plug to database

* Hooked up new OPML route to UI; turned RSS and OPML feed buttons into links

* Docs, tests

* Added a note about the phoenix bug

lib/pinchflat_web/controllers/sources/source_html.ex

@@ -40,11 +40,13 @@ defmodule PinchflatWeb.Sources.SourceHTML do
   end
 
   def rss_feed_url(conn, source) do
+    # NOTE: The reason for this concatenation is to avoid what appears to be a bug in Phoenix
+    # See: https://github.com/phoenixframework/phoenix/issues/6033
     url(conn, ~p"/sources/#{source.uuid}/feed") <> ".xml"
   end
 
   def opml_feed_url(conn) do
-    url(conn, ~p"/sources/opml") <> ".xml"
+    url(conn, ~p"/sources/opml.xml?#{[route_token: Settings.get!(:route_token)]}")
   end
 
   def output_path_template_override_placeholders(media_profiles) do

lib/pinchflat_web/controllers/sources/source_html/actions_dropdown.html.heex

@@ -1,18 +1,16 @@
 <.button_dropdown text="Actions" class="justify-center w-full sm:w-50">
   <:option>
-    <span
-      x-data="{ copied: false }"
-      x-on:click={"
-        copyWithCallbacks(
-          '#{rss_feed_url(@conn, @source)}', 
-          () => copied = true, 
-          () => copied = false
-        )
-      "}
-    >
+    <.link href={rss_feed_url(@conn, @source)} x-data="{ copied: false }" x-on:click={~s"
+          $event.preventDefault();
+          copyWithCallbacks(
+            '#{rss_feed_url(@conn, @source)}',
+            () => copied = true,
+            () => copied = false
+          )
+        "}>
       Copy RSS Feed
       <span x-show="copied" x-transition.duration.150ms><.icon name="hero-check" class="ml-2 h-4 w-4" /></span>
-    </span>
+    </.link>
   </:option>
   <:option>
     <span x-data="{ copied: false }" x-on:click={~s"

lib/pinchflat_web/controllers/sources/source_html/index.html.heex

@@ -1,16 +1,17 @@
 <div class="mb-6 flex gap-3 flex-row items-center justify-between">
   <h2 class="text-title-md2 font-bold text-black dark:text-white">Sources</h2>
-  <nav>
-    <.button color="bg-transparent" x-data="{ copied: false }" x-on:click={~s"
+  <nav class="flex items-center justify-between gap-6">
+    <.link href={opml_feed_url(@conn)} x-data="{ copied: false }" x-on:click={~s"
+          $event.preventDefault();
           copyWithCallbacks(
             '#{opml_feed_url(@conn)}',
             () => copied = true,
             () => copied = false
           )
         "}>
-      Copy OPML Feed
+      Copy OPML <span class="hidden sm:inline">Feed</span>
       <span x-show="copied" x-transition.duration.150ms><.icon name="hero-check" class="ml-2 h-4 w-4" /></span>
-    </.button>
+    </.link>
     <.link href={~p"/sources/new"}>
       <.button color="bg-primary" rounding="rounded-lg">
         <span class="font-bold mx-2">+</span> New <span class="hidden sm:inline pl-1">Source</span>