local-server/cmd/dkl-local-server/ws.go

package main

import (
	"errors"
	"fmt"
	"log"
	"net"
	"net/http"
	"strings"
	"text/template"

	cfsslconfig "github.com/cloudflare/cfssl/config"
	"github.com/emicklei/go-restful"
	"m.cluseau.fr/go/httperr"

	"novit.tech/direktil/pkg/localconfig"

	"novit.tech/direktil/local-server/pkg/mime"
)

func registerWS(rest *restful.Container) {
	// public-level APIs
	{
		ws := &restful.WebService{}
		ws.
			Path("/public").
			Produces("application/json").
			Consumes("application/json").
			Route(ws.POST("/unlock-store").To(wsUnlockStore).
				Reads("").
				Writes("").
				Doc("Try to unlock the store")).
			Route(ws.GET("/store.tar").To(wsStoreDownload).
				Produces(mime.TAR).
				Param(ws.QueryParameter("token", "the download token")).
				Doc("Fetch the encrypted store")).
			Route(ws.GET("/downloads/{token}/{asset}").To(wsDownload).
				Param(ws.PathParameter("token", "the download token")).
				Param(ws.PathParameter("asset", "the requested asset")).
				Doc("Fetch an asset via a download token"))

		rest.Add(ws)
	}

	// Admin-level APIs
	ws := &restful.WebService{}
	ws.
		Filter(adminAuth).
		HeaderParameter("Authorization", "Admin bearer token")

	// - store management
	ws.Route(ws.POST("/store/add-key").To(wsStoreAddKey).
		Consumes("application/json").Reads("").
		Produces("application/json").
		Doc("Add an unlock key to the store"))

	// - downloads
	ws.Route(ws.POST("/authorize-download").To(wsAuthorizeDownload).
		Consumes("application/json").Reads(DownloadSpec{}).
		Produces("application/json").
		Doc("Create a download token for the given download"))

	// - configs API
	ws.Route(ws.POST("/configs").To(wsUploadConfig).
		Consumes(mime.YAML).
		Doc("Upload a new current configuration, archiving the previous one"))

	// - clusters API
	ws.Route(ws.GET("/clusters").To(wsListClusters).
		Doc("List clusters"))

	const (
		GET = http.MethodGet
		PUT = http.MethodPut
	)

	cluster := func(method, subPath string) *restful.RouteBuilder {
		return ws.Method(method).Path("/clusters/{cluster-name}" + subPath).
			Param(ws.PathParameter("cluster-name", "name of the cluster"))
	}

	for _, builder := range []*restful.RouteBuilder{
		cluster(GET, "").To(wsCluster).
			Doc("Get cluster details"),

		cluster(GET, "/addons").To(wsClusterAddons).
			Produces(mime.YAML).
			Doc("Get cluster addons").
			Returns(http.StatusOK, "OK", nil).
			Returns(http.StatusNotFound, "The cluster does not exists or does not have addons defined", nil),

		cluster(GET, "/tokens").To(wsClusterTokens).
			Doc("List cluster's tokens"),
		cluster(GET, "/tokens/{token-name}").To(wsClusterToken).
			Doc("Get cluster's token"),

		cluster(GET, "/passwords").To(wsClusterPasswords).
			Doc("List cluster's passwords"),
		cluster(GET, "/passwords/{password-name}").To(wsClusterPassword).
			Doc("Get cluster's password"),
		cluster(PUT, "/passwords/{password-name}").To(wsClusterSetPassword).
			Doc("Set cluster's password"),

		cluster(GET, "/CAs").To(wsClusterCAs).
			Doc("Get cluster CAs"),
		cluster(GET, "/CAs/{ca-name}/certificate").To(wsClusterCACert).
			Produces(mime.CACERT).
			Doc("Get cluster CA's certificate"),
		cluster(GET, "/CAs/{ca-name}/signed").To(wsClusterSignedCert).
			Produces(mime.CERT).
			Param(ws.QueryParameter("name", "signed reference name").Required(true)).
			Doc("Get cluster's certificate signed by the CA"),
	} {
		ws.Route(builder)
	}

	ws.Route(ws.GET("/hosts").To(wsListHosts).
		Doc("List hosts"))

	(&wsHost{
		prefix:  "/hosts/{host-name}",
		hostDoc: "given host",
		getHost: func(req *restful.Request) string {
			return req.PathParameter("host-name")
		},
	}).register(ws, func(rb *restful.RouteBuilder) {
	})

	ws.Route(ws.GET("/ssh-acls").To(wsSSH_ACL_List))
	ws.Route(ws.GET("/ssh-acls/{acl-name}").To(wsSSH_ACL_Get))
	ws.Route(ws.PUT("/ssh-acls/{acl-name}").To(wsSSH_ACL_Set))

	rest.Add(ws)

	// Hosts API
	ws = &restful.WebService{}
	ws.Produces("application/json")
	ws.Path("/me")
	ws.Filter(hostsAuth).
		HeaderParameter("Authorization", "Host or admin bearer token")

	(&wsHost{
		hostDoc: "detected host",
		getHost: detectHost,
	}).register(ws, func(rb *restful.RouteBuilder) {
		rb.Notes("In this case, the host is detected from the remote IP")
	})

	rest.Add(ws)
}

func detectHost(req *restful.Request) string {
	r := req.Request
	remoteAddr := r.RemoteAddr

	if *trustXFF {
		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
			remoteAddr = strings.Split(xff, ",")[0]
		}
	}

	hostIP, _, err := net.SplitHostPort(remoteAddr)

	if err != nil {
		hostIP = remoteAddr
	}

	cfg, err := readConfig()
	if err != nil {
		return ""
	}

	host := cfg.HostByIP(hostIP)

	if host == nil {
		log.Print("no host found for IP ", hostIP)
		return ""
	}

	return host.Name
}

func wsReadConfig(resp *restful.Response) *localconfig.Config {
	cfg, err := readConfig()
	if err != nil {
		log.Print("failed to read config: ", err)
		resp.WriteErrorString(http.StatusServiceUnavailable, "failed to read config")
		return nil
	}

	return cfg
}

func wsNotFound(req *restful.Request, resp *restful.Response) {
	http.NotFound(resp.ResponseWriter, req.Request)
}

func wsBadRequest(resp *restful.Response, err string) {
	httperr.New(http.StatusBadRequest, errors.New(err)).WriteJSON(resp.ResponseWriter)
}

func wsError(resp *restful.Response, err error) {
	log.Output(2, fmt.Sprint("request failed: ", err))

	switch err := err.(type) {
	case httperr.Error:
		err.WriteJSON(resp.ResponseWriter)

	default:
		httperr.Internal(err).WriteJSON(resp.ResponseWriter)
	}
}

func wsRender(resp *restful.Response, sslCfg *cfsslconfig.Config, tmplStr string, value interface{}) {
	tmpl, err := template.New("wsRender").Funcs(templateFuncs(sslCfg)).Parse(tmplStr)
	if err != nil {
		wsError(resp, err)
		return
	}

	err = tmpl.Execute(resp, value)
	if err != nil {
		wsError(resp, err)
		return
	}
}