daemon: golang WS hub, REST, gitlab, docker spawner, sqlite (18/18 tests)

2026-08-18 13:42:34 +02:00
parent 7d5f866527
commit c62900e613
17 changed files with 3100 additions and 0 deletions
@@ -0,0 +1,366 @@
+package main
+
+// api.go — REST /api/* handlers, bearer auth, static web serving.
+
+import (
+	"crypto/subtle"
+	"embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+// Route names, event query defaults and limits.
+const (
+	envToken string = "LVMH_TOKEN"
+
+	defaultEventsAfter int64  = 0
+	defaultEventsLimit int    = 1000
+	maxEventsLimit     int    = 10000
+	maxBodyBytes       int64  = 1 << 20
+	webIndexFallback   string = "index.html"
+)
+
+//go:embed webdist
+var embeddedWeb embed.FS
+
+// Server wires store, hub, spawner and gitlab client into HTTP handlers.
+type Server struct {
+	store  *Store
+	hub    *Hub
+	spawn  *Spawner
+	gitlab *GitLab
+}
+
+// NewServer builds the Server and cross-links hub callbacks.
+func NewServer(store *Store, hub *Hub, spawn *Spawner, gl *GitLab) *Server {
+	s := &Server{store: store, hub: hub, spawn: spawn, gitlab: gl}
+	hub.SpawnStatus = spawn.JobsSnapshot
+	return s
+}
+
+// Routes assembles the full mux with auth middleware on /api and /agent.
+func (s *Server) Routes(webdist string) http.Handler {
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("GET /agent/ws", s.hub.ServeAgentWS)
+	mux.HandleFunc("GET /ws", s.handleWebWS)
+
+	api := http.NewServeMux()
+	api.HandleFunc("GET /api/sessions", s.handleSessions)
+	api.HandleFunc("GET /api/sessions/{id}/events", s.handleSessionEvents)
+	api.HandleFunc("POST /api/sessions/{id}/prompt", s.handlePrompt)
+	api.HandleFunc("POST /api/sessions/{id}/abort", s.handleAbort)
+	api.HandleFunc("DELETE /api/sessions/{id}/container", s.handleDeleteContainer)
+	api.HandleFunc("POST /api/spawn", s.handleSpawn)
+	api.HandleFunc("GET /api/spawn/status", s.handleSpawnStatus)
+	api.HandleFunc("GET /api/gitlab/status", s.handleGitLabStatus)
+	api.HandleFunc("POST /api/gitlab/connect", s.handleGitLabConnect)
+	api.HandleFunc("DELETE /api/gitlab/connect", s.handleGitLabDisconnect)
+	api.HandleFunc("GET /api/gitlab/repos", s.handleGitLabRepos)
+	mux.Handle("/api/", s.bearerAuth(api))
+
+	mux.Handle("/", s.webHandler(webdist))
+	return recoverMiddleware(mux)
+}
+
+// recoverMiddleware converts panics into 500s instead of killing the server.
+func recoverMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			if rec := recover(); rec != nil {
+				writeError(w, http.StatusInternalServerError, fmt.Sprintf("internal error: %v", rec))
+			}
+		}()
+		next.ServeHTTP(w, r)
+	})
+}
+
+// bearerAuth rejects non-matching bearer tokens with 401.
+func (s *Server) bearerAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !tokenMatches(r.Header.Get("Authorization")) {
+			writeError(w, http.StatusUnauthorized, "unauthorized")
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// TokenMatches validates an Authorization header value against LVMH_TOKEN.
+func tokenMatches(header string) bool {
+	const prefix = "Bearer "
+	if !strings.HasPrefix(header, prefix) {
+		return false
+	}
+	token := strings.TrimSpace(strings.TrimPrefix(header, prefix))
+	want := strings.TrimSpace(daemonToken)
+	if want == "" || token == "" {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(token), []byte(want)) == 1
+}
+
+// handleWebWS upgrades /ws with token from query param (?token=).
+func (s *Server) handleWebWS(w http.ResponseWriter, r *http.Request) {
+	token := r.URL.Query().Get("token")
+	want := strings.TrimSpace(daemonToken)
+	if want == "" || token == "" ||
+		subtle.ConstantTimeCompare([]byte(token), []byte(want)) != 1 {
+		// Reject before upgrade: browsers can't read WS close codes well.
+		writeError(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+	s.hub.ServeWebWS(w, r)
+}
+
+func writeError(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(v)
+}
+
+func decodeBody(w http.ResponseWriter, r *http.Request, dst any) bool {
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodyBytes)
+	dec := json.NewDecoder(r.Body)
+	if err := dec.Decode(dst); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return false
+	}
+	return true
+}
+
+func (s *Server) handleSessions(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, s.hub.SessionsView())
+}
+
+func (s *Server) handleSessionEvents(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	after := defaultEventsAfter
+	if raw := r.URL.Query().Get("after"); raw != "" {
+		v, err := strconv.ParseInt(raw, 10, 64)
+		if err != nil || v < 0 {
+			writeError(w, http.StatusBadRequest, "invalid after")
+			return
+		}
+		after = v
+	}
+	limit := defaultEventsLimit
+	if raw := r.URL.Query().Get("limit"); raw != "" {
+		v, err := strconv.Atoi(raw)
+		if err != nil || v <= 0 {
+			writeError(w, http.StatusBadRequest, "invalid limit")
+			return
+		}
+		limit = v
+	}
+	if limit > maxEventsLimit {
+		limit = maxEventsLimit
+	}
+	events, err := s.store.EventsAfter(id, after, limit)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if events == nil {
+		events = []Event{}
+	}
+	out := make([]map[string]any, 0, len(events))
+	for _, e := range events {
+		var payload map[string]any
+		if len(e.Payload) > 0 {
+			if err := json.Unmarshal(e.Payload, &payload); err != nil {
+				payload = map[string]any{}
+			}
+		}
+		frameMap := map[string]any{}
+		for k, v := range payload {
+			frameMap[k] = v
+		}
+		frameMap["v"] = daemonVersion
+		frameMap["sessionId"] = e.SessionID
+		frameMap["seq"] = e.Seq
+		frameMap["ts"] = e.TS
+		frameMap["type"] = e.Type
+		out = append(out, frameMap)
+	}
+	writeJSON(w, http.StatusOK, out)
+}
+
+func (s *Server) handlePrompt(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	var body struct {
+		Message string `json:"message"`
+	}
+	if !decodeBody(w, r, &body) {
+		return
+	}
+	if strings.TrimSpace(body.Message) == "" {
+		writeError(w, http.StatusBadRequest, "message required")
+		return
+	}
+	if err := s.hub.Prompt(id, body.Message); err != nil {
+		if errors.Is(err, ErrOffline) {
+			writeError(w, http.StatusConflict, "session offline")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleAbort(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if err := s.hub.Abort(id); err != nil {
+		if errors.Is(err, ErrOffline) {
+			writeError(w, http.StatusConflict, "session offline")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleDeleteContainer(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if err := s.spawn.RemoveSession(r.Context(), id); err != nil {
+		if errors.Is(err, errNoContainer) {
+			writeError(w, http.StatusNotFound, "no container for session")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleSpawn(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Repo   string `json:"repo"`
+		Branch string `json:"branch"`
+	}
+	if !decodeBody(w, r, &body) {
+		return
+	}
+	if !validRepoPath(body.Repo) {
+		writeError(w, http.StatusBadRequest, "repo must look like group/project")
+		return
+	}
+	res, err := s.spawn.Start(r.Context(), body.Repo, body.Branch)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusCreated, res)
+}
+
+func (s *Server) handleSpawnStatus(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, s.spawn.JobsSnapshot())
+}
+
+func (s *Server) handleGitLabStatus(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, s.gitlab.Status())
+}
+
+func (s *Server) handleGitLabConnect(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Token string `json:"token"`
+	}
+	if !decodeBody(w, r, &body) {
+		return
+	}
+	if strings.TrimSpace(body.Token) == "" {
+		writeError(w, http.StatusBadRequest, "token required")
+		return
+	}
+	username, err := s.gitlab.Connect(r.Context(), body.Token)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"username": username})
+}
+
+func (s *Server) handleGitLabDisconnect(w http.ResponseWriter, r *http.Request) {
+	if err := s.gitlab.Disconnect(); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (s *Server) handleGitLabRepos(w http.ResponseWriter, r *http.Request) {
+	repos, err := s.gitlab.Repos(r.Context())
+	if err != nil {
+		status := http.StatusInternalServerError
+		var httpErr *GitLabError
+		if errors.As(err, &httpErr) {
+			status = http.StatusBadGateway
+		}
+		if errors.Is(err, errNotConnected) {
+			status = http.StatusConflict
+		}
+		writeError(w, status, err.Error())
+		return
+	}
+	if repos == nil {
+		repos = []GitLabRepo{}
+	}
+	writeJSON(w, http.StatusOK, repos)
+}
+
+// webHandler serves the embedded web/dist, or an override directory when
+// webdist is non-empty (dev mode / mounted volume).
+func (s *Server) webHandler(webdist string) http.Handler {
+	if webdist != "" {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Guard against path traversal outside the override dir.
+			cleaned := filepath.Clean("/" + r.URL.Path)
+			full := filepath.Join(webdist, cleaned)
+			if !strings.HasPrefix(full, filepath.Clean(webdist)) {
+				http.NotFound(w, r)
+				return
+			}
+			st, err := os.Stat(full)
+			if err == nil && !st.IsDir() {
+				http.ServeFile(w, r, full)
+				return
+			}
+			http.ServeFile(w, r, filepath.Join(webdist, webIndexFallback))
+		})
+	}
+	sub, err := fs.Sub(embeddedWeb, "webdist")
+	if err != nil {
+		panic(err)
+	}
+	fileServer := http.FileServer(http.FS(sub))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := strings.TrimPrefix(r.URL.Path, "/")
+		if path == "" {
+			path = webIndexFallback
+		}
+		if _, err := fs.Stat(sub, path); err != nil {
+			r.URL.Path = "/" + webIndexFallback // SPA fallback
+		}
+		fileServer.ServeHTTP(w, r)
+	})
+}
+
+var _ = daemonVersion
+
+// daemonToken is set by main from LVMH_TOKEN (single process, read-only).
+var daemonToken string