GitLab

(when GET is not allowed).

* Staticcheck fixes

This fixes all staticcheck warnings for this library.

Addresses browsers being able to POST without control due to things like
https://bugzilla.mozilla.org/show_bug.cgi?id=429594

Allowing methods isn't as simple as just allowing/disallowing them because
different methods do different things.

* HEAD: should be allowed everywhere GET is allowed.
* OPTIONS:
  * When a CORS request is made, this will be handled by the CORS library.
  * Otherewise, we need to return the allowed methods.
* POST: always allowed.
* Everything else: always denied.

Changing HandledMethods to a simple AllowGet makes it easier to "do the right
thing".

Part of the work to unblock: https://github.com/ipfs/go-log/pull/65

This Handler option is used it to allow/deny request by their method.

The API is an RPC API so it normally should only work with PUT, but we also
use a read-only, GET-based partial API that runs with the gateway.

This commit makes the actual allowed (or handled) methods configurable.

A test is added, and test facilities improved to be able to set/modify
this option.

This:

1. Ensures the correct content type.
2. Tells browsers not to sniff the content type.

This prevents any nasties from happening...

CloseNotifier has been deprecated for a while.

Also, ditch the "environment" context. We don't actually _need_ this.

We can't stream a response while reading a body *unless* we've configured the
connection to close after we're done sending a response.

This patch works around that issue by doing exactly that.

Only use custom encoders for values.

fixes #65

Also, remove SetEncoder. Always derive the correct encoder from the request.

**Returning errors/calling:**

Instead of having a dance where we:
  * Close the response emitter immediately if the command succeeds.
  * Return an error, call SetError, and then close the response emitter if it
    fails.

Just set the error from within the `Call` command and always close the response
emitter.

**Doner**

Get rid of the Done channel/doner interface from the response emitter. We close
the response emitter after finishing the Call *anyways* so this channel isn't
necessary (anymore, at least).

Instead, handle it at the boundaries (in ServeHTTP and the CLI's Run function).
This ensures that we actually *wait* to finish writing everything before
canceling the context.

We *always* expect environments to be able to return a context so we might as
well enforce this with the type system.

Every log event resulting from a command will have a uuid associated with it.
Copied from go-ipfs#4392.

Source: https://github.com/ipfs/go-ipfs/commit/b4eeff2d84447eb367360a5b4adef16188a32a27

- made Response.Request() return Request not *Request
- added ResponseEmitter.Tee()
- added a wrapper that wraps a Response and provides an oldcmds.Response

this way we can share the code with the legace commands package and don't have to convert everything