Add explicit login functionality

internal/server/upload.go

@@ -38,12 +38,6 @@ type uploadRequest struct {
 	vanity   string
 	expiry   string
 	filename string
-
-	// remember is set by the form's checkbox. It decides whether a token used
-	// here is stored in a cookie for next time, and unchecking it is how a
-	// remembered token is cleared from the upload page itself.
-	remember bool
-	explicit bool // the token was typed or sent, not read back from the cookie
 }
 
 func (s *Server) handleUpload(w http.ResponseWriter, r *http.Request) {
@@ -81,7 +75,6 @@ func (s *Server) uploadRaw(w http.ResponseWriter, r *http.Request, ip string) {
 		expiry:   strings.TrimSpace(r.Header.Get("Expiry")),
 		filename: filenameFromDisposition(r.Header.Get("Content-Disposition")),
 	}
-	req.explicit = req.token != ""
 	if req.token == "" {
 		req.token = cookieCredential(r)
 	}
@@ -111,7 +104,6 @@ func (s *Server) uploadMultipart(w http.ResponseWriter, r *http.Request, boundar
 		vanity: strings.TrimSpace(r.Header.Get("Vanity")),
 		expiry: strings.TrimSpace(r.Header.Get("Expiry")),
 	}
-	req.explicit = req.token != ""
 
 	for n := 0; ; n++ {
 		if n > maxFieldCount {
@@ -151,10 +143,8 @@ func (s *Server) uploadMultipart(w http.ResponseWriter, r *http.Request, boundar
 		switch part.FormName() {
 		case "token":
 			if v := strings.TrimSpace(value); v != "" {
-				req.token, req.explicit = v, true
+				req.token = v
 			}
-		case "remember":
-			req.remember = true
 		case "vanity":
 			if v := strings.TrimSpace(value); v != "" {
 				req.vanity = v
@@ -282,28 +272,11 @@ func (s *Server) storeUpload(w http.ResponseWriter, r *http.Request, req uploadR
 	}
 	committed = true
 
-	s.updateRemembered(w, r, req, lim)
-
 	s.log.Info("stored", "id", m.ID, "bytes", m.Size, "owner", orAnonymous(lim.Name),
 		"ip", ip, "expires", m.Expires)
 	s.respondUploaded(w, r, m, secret)
 }
 
-// updateRemembered applies the form's "remember" checkbox to the cookie. It
-// only ever acts on a browser form post: an API caller sending a bearer token
-// has its own way of keeping credentials and should not be handed a cookie.
-func (s *Server) updateRemembered(w http.ResponseWriter, r *http.Request, req uploadRequest, lim auth.Limits) {
-	if bearer(r) != "" {
-		return
-	}
-	switch {
-	case req.remember && req.explicit && lim.Name != "":
-		s.remember(w, r, req.token)
-	case !req.remember && cookieCredential(r) != "":
-		s.forget(w, r)
-	}
-}
-
 func orAnonymous(name string) string {
 	if name == "" {
 		return "(anonymous)"