jarl/internal/server/routes.go

package server

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"io/fs"
	"net/http"
	"strconv"
	"strings"
	"time"

	"jarl/internal/api"
	"jarl/internal/auth"
	"jarl/internal/engine"
	"jarl/internal/model"
)

func (s *Server) routes() {
	m := s.mux
	p := api.Prefix
	m.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "version": s.cfg.Version})
	})
	m.HandleFunc("GET /metrics", s.metrics)
	// Authentication
	m.HandleFunc("POST "+p+"/auth/login", s.public(s.login))
	m.HandleFunc("POST "+p+"/auth/login/totp", s.public(s.loginTOTP))
	m.HandleFunc("POST "+p+"/auth/logout", s.authed(s.logout))
	m.HandleFunc("GET "+p+"/auth/whoami", s.authed(s.whoami))
	m.HandleFunc("POST "+p+"/me/password", s.authed(s.changeOwnPassword))
	m.HandleFunc("GET "+p+"/me/totp", s.authed(s.getOwnTOTP))
	m.HandleFunc("POST "+p+"/me/totp/setup", s.authed(s.setupOwnTOTP))
	m.HandleFunc("POST "+p+"/me/totp/enable", s.authed(s.enableOwnTOTP))
	m.HandleFunc("POST "+p+"/me/totp/disable", s.authed(s.disableOwnTOTP))
	m.HandleFunc("POST "+p+"/me/totp/recovery-codes", s.authed(s.newRecoveryCodes))
	m.HandleFunc("GET "+p+"/me/tokens", s.authed(s.listOwnTokens))
	m.HandleFunc("POST "+p+"/me/tokens", s.authed(s.createOwnToken))
	m.HandleFunc("DELETE "+p+"/tokens/{id}", s.authed(s.revokeToken))
	m.HandleFunc("POST "+p+"/tokens/{id}/rotate", s.authed(s.rotateToken))
	m.HandleFunc("GET "+p+"/tokens", s.authed(s.listAllTokens))
	// Users (admin)
	m.HandleFunc("GET "+p+"/users", s.authed(s.listUsers))
	m.HandleFunc("POST "+p+"/users", s.authed(s.createUser))
	m.HandleFunc("GET "+p+"/users/{id}", s.authed(s.getUser))
	m.HandleFunc("PATCH "+p+"/users/{id}", s.authed(s.updateUser))
	m.HandleFunc("DELETE "+p+"/users/{id}", s.authed(s.deleteUser))
	m.HandleFunc("GET "+p+"/users/{id}/tokens", s.authed(s.listUserTokens))
	m.HandleFunc("POST "+p+"/users/{id}/tokens", s.authed(s.createUserToken))
	m.HandleFunc("DELETE "+p+"/users/{id}/totp", s.authed(s.resetUserTOTP))
	// Views
	m.HandleFunc("GET "+p+"/views", s.authed(s.listViews))
	m.HandleFunc("POST "+p+"/views", s.authed(s.createView))
	m.HandleFunc("POST "+p+"/views/order", s.authed(s.reorderViews))
	m.HandleFunc("GET "+p+"/views/{id}", s.authed(s.getView))
	m.HandleFunc("GET "+p+"/views/{id}/key", s.authed(s.viewKey))
	m.HandleFunc("PATCH "+p+"/views/{id}", s.authed(s.updateView))
	m.HandleFunc("DELETE "+p+"/views/{id}", s.authed(s.deleteView))
	m.HandleFunc("PUT "+p+"/views/{id}/color", s.authed(s.setViewColor))
	// ACLs
	// Blocking
	m.HandleFunc("GET "+p+"/blocking/lists", s.authed(s.listBlocklists))
	m.HandleFunc("POST "+p+"/blocking/lists", s.authed(s.createBlocklist))
	m.HandleFunc("GET "+p+"/blocking/lists/{id}", s.authed(s.getBlocklist))
	m.HandleFunc("PATCH "+p+"/blocking/lists/{id}", s.authed(s.updateBlocklist))
	m.HandleFunc("DELETE "+p+"/blocking/lists/{id}", s.authed(s.deleteBlocklist))
	m.HandleFunc("POST "+p+"/blocking/lists/{id}/refresh", s.authed(s.refreshBlocklist))
	m.HandleFunc("GET "+p+"/blocking/rules", s.authed(s.listBlockRules))
	m.HandleFunc("POST "+p+"/blocking/rules", s.authed(s.createBlockRule))
	m.HandleFunc("DELETE "+p+"/blocking/rules", s.authed(s.deleteBlockRulesByName))
	m.HandleFunc("PATCH "+p+"/blocking/rules/{id}", s.authed(s.updateBlockRule))
	m.HandleFunc("DELETE "+p+"/blocking/rules/{id}", s.authed(s.deleteBlockRule))
	m.HandleFunc("GET "+p+"/blocking/steps", s.authed(s.listBlockSteps))
	m.HandleFunc("POST "+p+"/blocking/steps", s.authed(s.createBlockStep))
	m.HandleFunc("POST "+p+"/blocking/steps/order", s.authed(s.orderBlockSteps))
	m.HandleFunc("PATCH "+p+"/blocking/steps/{id}", s.authed(s.updateBlockStep))
	m.HandleFunc("DELETE "+p+"/blocking/steps/{id}", s.authed(s.deleteBlockStep))
	m.HandleFunc("GET "+p+"/blocking/groups", s.authed(s.listClientGroups))
	m.HandleFunc("POST "+p+"/blocking/groups", s.authed(s.createClientGroup))
	m.HandleFunc("PATCH "+p+"/blocking/groups/{id}", s.authed(s.updateClientGroup))
	m.HandleFunc("DELETE "+p+"/blocking/groups/{id}", s.authed(s.deleteClientGroup))
	m.HandleFunc("GET "+p+"/blocking/check", s.authed(s.checkBlocking))
	m.HandleFunc("GET "+p+"/blocking/status", s.authed(s.blockingStatus))
	m.HandleFunc("POST "+p+"/blocking/pause", s.authed(s.pauseBlocking(false)))
	m.HandleFunc("POST "+p+"/blocking/resume", s.authed(s.pauseBlocking(true)))
	m.HandleFunc("GET "+p+"/acls", s.authed(s.listACLs))
	m.HandleFunc("POST "+p+"/acls", s.authed(s.createACL))
	m.HandleFunc("GET "+p+"/acls/{id}", s.authed(s.getACL))
	m.HandleFunc("PATCH "+p+"/acls/{id}", s.authed(s.updateACL))
	m.HandleFunc("DELETE "+p+"/acls/{id}", s.authed(s.deleteACL))
	// TSIG keys
	m.HandleFunc("GET "+p+"/tsig-keys", s.authed(s.listKeys))
	m.HandleFunc("POST "+p+"/tsig-keys", s.authed(s.createKey))
	m.HandleFunc("GET "+p+"/tsig-keys/{id}", s.authed(s.getKey))
	m.HandleFunc("PATCH "+p+"/tsig-keys/{id}", s.authed(s.updateKey))
	m.HandleFunc("DELETE "+p+"/tsig-keys/{id}", s.authed(s.deleteKey))
	// Zones and records
	m.HandleFunc("GET "+p+"/zones", s.authed(s.listZones))
	m.HandleFunc("POST "+p+"/zones", s.authed(s.createZone))
	m.HandleFunc("GET "+p+"/zones/{zone}", s.authed(s.getZone))
	m.HandleFunc("PATCH "+p+"/zones/{zone}", s.authed(s.updateZone))
	m.HandleFunc("DELETE "+p+"/zones/{zone}", s.authed(s.deleteZone))
	m.HandleFunc("GET "+p+"/zones/{zone}/serials", s.authed(s.zoneSerials))
	m.HandleFunc("GET "+p+"/zones/{zone}/delegation", s.authed(s.zoneDelegation))
	m.HandleFunc("GET "+p+"/zones/{zone}/dnssec", s.authed(s.zoneDNSSEC))
	m.HandleFunc("POST "+p+"/zones/{zone}/dnssec/check-ds", s.authed(s.zoneCheckDS))
	m.HandleFunc("POST "+p+"/zones/{zone}/dnssec/wipe", s.authed(s.zoneDNSSECWipe))
	m.HandleFunc("GET "+p+"/zones/{zone}/registrar", s.authed(s.zoneRegistrar))
	m.HandleFunc("POST "+p+"/zones/{zone}/registrar/glue", s.authed(s.registrarSyncGlue))
	m.HandleFunc("POST "+p+"/zones/{zone}/registrar/ds", s.authed(s.registrarPublishDS))
	m.HandleFunc("DELETE "+p+"/zones/{zone}/registrar/ds/{keytag}", s.authed(s.registrarRemoveDS))
	m.HandleFunc("PUT "+p+"/zones/{zone}/registrar/ns", s.authed(s.registrarSetNS))
	m.HandleFunc("GET "+p+"/zones/{zone}/file", s.authed(s.zoneFile))
	m.HandleFunc("GET "+p+"/zones/{zone}/compare", s.authed(s.zoneCompare))
	m.HandleFunc("POST "+p+"/zones/{zone}/link", s.authed(s.zoneLink(true)))
	m.HandleFunc("POST "+p+"/zones/{zone}/unlink", s.authed(s.zoneLink(false)))
	m.HandleFunc("POST "+p+"/zones/{zone}/import", s.authed(s.importZoneFile))
	m.HandleFunc("GET "+p+"/zones/{zone}/records", s.authed(s.listRecords))
	m.HandleFunc("POST "+p+"/zones/{zone}/records", s.authed(s.createRecord))
	m.HandleFunc("DELETE "+p+"/zones/{zone}/records", s.authed(s.deleteRecordsByMatch))
	m.HandleFunc("POST "+p+"/zones/{zone}/records/disable", s.authed(s.setRecordsDisabled(true)))
	m.HandleFunc("POST "+p+"/zones/{zone}/records/enable", s.authed(s.setRecordsDisabled(false)))
	m.HandleFunc("PUT "+p+"/zones/{zone}/rrsets/{name}/{type}", s.authed(s.putRRSet))
	m.HandleFunc("DELETE "+p+"/zones/{zone}/rrsets/{name}/{type}", s.authed(s.deleteRRSet))
	m.HandleFunc("GET "+p+"/records/{id}", s.authed(s.getRecord))
	m.HandleFunc("PATCH "+p+"/records/{id}", s.authed(s.updateRecord))
	m.HandleFunc("DELETE "+p+"/records/{id}", s.authed(s.deleteRecord))
	m.HandleFunc("POST "+p+"/records/{id}/disable", s.authed(s.setRecordDisabled(true)))
	m.HandleFunc("POST "+p+"/records/{id}/enable", s.authed(s.setRecordDisabled(false)))
	// Options and settings
	m.HandleFunc("GET "+p+"/options", s.authed(s.listOptions))
	m.HandleFunc("GET "+p+"/options/generated", s.authed(s.generatedOptions))
	m.HandleFunc("POST "+p+"/options", s.authed(s.createOption))
	m.HandleFunc("GET "+p+"/options/{id}", s.authed(s.getOption))
	m.HandleFunc("PATCH "+p+"/options/{id}", s.authed(s.updateOption))
	m.HandleFunc("DELETE "+p+"/options/{id}", s.authed(s.deleteOption))
	m.HandleFunc("GET "+p+"/settings", s.authed(s.getSettings))
	m.HandleFunc("PATCH "+p+"/settings", s.authed(s.updateSettings))
	// Catalogs
	m.HandleFunc("GET "+p+"/catalog/options", s.authed(s.catalogOptions))
	m.HandleFunc("GET "+p+"/catalog/rrtypes", s.authed(s.catalogRRTypes))
	m.HandleFunc("GET "+p+"/catalog/grants", s.authed(s.catalogGrants))
	m.HandleFunc("GET "+p+"/catalog/ranges", s.authed(s.catalogRanges))
	m.HandleFunc("GET "+p+"/search", s.authed(s.search))
	// Changesets
	m.HandleFunc("POST "+p+"/apply", s.authed(s.applyBatch))
	m.HandleFunc("GET "+p+"/changesets", s.authed(s.listChangesets))
	m.HandleFunc("POST "+p+"/changesets", s.authed(s.createChangeset))
	m.HandleFunc("GET "+p+"/changesets/{id}", s.authed(s.getChangeset))
	m.HandleFunc("PATCH "+p+"/changesets/{id}", s.authed(s.updateChangeset))
	m.HandleFunc("POST "+p+"/changesets/{id}/ops", s.authed(s.stageOps))
	m.HandleFunc("DELETE "+p+"/changesets/{id}/ops/{seq}", s.authed(s.unstageOp))
	m.HandleFunc("GET "+p+"/changesets/{id}/preview", s.authed(s.previewChangeset))
	m.HandleFunc("POST "+p+"/changesets/{id}/apply", s.authed(s.applyChangeset))
	m.HandleFunc("POST "+p+"/changesets/{id}/discard", s.authed(s.discardChangeset))
	m.HandleFunc("POST "+p+"/changesets/{id}/revert", s.authed(s.revertChangeset))
	// Status, system and audit
	m.HandleFunc("GET "+p+"/status", s.authed(s.status))
	m.HandleFunc("POST "+p+"/system/check", s.authed(s.systemCheck))
	m.HandleFunc("POST "+p+"/system/resync", s.authed(s.systemResync))
	m.HandleFunc("GET "+p+"/audit", s.authed(s.listAudit))
	// lego's httpreq DNS provider (h_acme.go)
	m.HandleFunc("GET "+p+"/acme/httpreq", s.public(s.httpreqStatus))
	m.HandleFunc("POST "+p+"/acme/httpreq/present", s.httpreq(true))
	m.HandleFunc("POST "+p+"/acme/httpreq/cleanup", s.httpreq(false))
	m.HandleFunc("POST "+p+"/acme/httpreq/view/{view}/present", s.httpreq(true))
	m.HandleFunc("POST "+p+"/acme/httpreq/view/{view}/cleanup", s.httpreq(false))
	// Query statistics
	m.HandleFunc("GET "+p+"/certificates", s.authed(s.certList))
	m.HandleFunc("POST "+p+"/certificates", s.authed(s.certCreate))
	m.HandleFunc("POST "+p+"/certificates/check", s.authed(s.certCheck))
	m.HandleFunc("GET "+p+"/certificates/{name}", s.authed(s.certGet))
	m.HandleFunc("PATCH "+p+"/certificates/{name}", s.authed(s.certUpdate))
	m.HandleFunc("DELETE "+p+"/certificates/{name}", s.authed(s.certDelete))
	m.HandleFunc("POST "+p+"/certificates/{name}/issue", s.authed(s.certIssue))
	m.HandleFunc("POST "+p+"/certificates/{name}/check", s.authed(s.certCheck))
	m.HandleFunc("GET "+p+"/encrypted-dns", s.authed(s.encryptedDNS))
	m.HandleFunc("POST "+p+"/encrypted-dns", s.authed(s.encryptedDNSSetup))
	m.HandleFunc("DELETE "+p+"/encrypted-dns", s.authed(s.encryptedDNSDisable))
	m.HandleFunc("POST "+p+"/encrypted-dns/check", s.authed(s.encryptedDNSCheck))
	m.HandleFunc("POST "+p+"/encrypted-dns/health", s.authed(s.encryptedDNSCheckNow))
	m.HandleFunc("GET "+p+"/exposure", s.authed(s.exposure))
	m.HandleFunc("POST "+p+"/exposure/fix", s.authed(s.exposureFix))
	m.HandleFunc("POST "+p+"/exposure/mail", s.authed(s.mailCheckNow))
	m.HandleFunc("POST "+p+"/exposure/ack", s.authed(s.exposureAck(true)))
	m.HandleFunc("POST "+p+"/exposure/unack", s.authed(s.exposureAck(false)))
	m.HandleFunc("GET "+p+"/stats/status", s.authed(s.statsStatus))
	m.HandleFunc("GET "+p+"/stats/summary", s.authed(s.statsSummary))
	m.HandleFunc("GET "+p+"/stats/top", s.authed(s.statsTop))
	m.HandleFunc("GET "+p+"/stats/timeline", s.authed(s.statsTimeline))
	m.HandleFunc("GET "+p+"/stats/heatmap", s.authed(s.statsHeatmap))
	m.HandleFunc("GET "+p+"/stats/breakdown", s.authed(s.statsBreakdown))
	m.HandleFunc("GET "+p+"/stats/server", s.authed(s.statsServer))
	m.HandleFunc(p+"/", func(w http.ResponseWriter, r *http.Request) {
		writeError(w, http.StatusNotFound, "not_found", "no such API endpoint: "+r.Method+" "+r.URL.Path)
	})
	// Web UI
	if s.web != nil {
		files := http.FileServer(http.FS(s.web))
		etags := contentETags(s.web)
		m.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
			if r.Method != http.MethodGet && r.Method != http.MethodHead {
				w.Header().Set("Allow", "GET, HEAD")
				http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
				return
			}
			if r.URL.Path == "/" || r.URL.Path == "/index.html" {
				b, err := fs.ReadFile(s.web, "index.html")
				if err != nil {
					http.NotFound(w, r)
					return
				}
				w.Header().Set("Content-Type", "text/html; charset=utf-8")
				w.Header().Set("Cache-Control", "no-cache")
				w.Header().Set("ETag", etags["index.html"])
				http.ServeContent(w, r, "index.html", time.Time{}, bytes.NewReader(b))
				return
			}
			if strings.HasPrefix(r.URL.Path, "/assets/") {
				// no-cache: the browser asks again each time, but with
				// the ETag an unchanged file costs a 304 and no body.
				w.Header().Set("Cache-Control", "no-cache")
				if tag, ok := etags[strings.TrimPrefix(r.URL.Path, "/")]; ok {
					w.Header().Set("ETag", tag)
				}
				files.ServeHTTP(w, r)
				return
			}
			http.NotFound(w, r)
		})
	}
}

// via names the interface a request came through.
func via(r *http.Request, p *auth.Principal) string {
	if strings.Contains(r.UserAgent(), "jarl-cli") {
		return "cli"
	}
	if p.Method == "session" {
		return "web"
	}
	return "api"
}

// changesetTarget returns the changeset to stage into, if any.
func changesetTarget(r *http.Request) (int64, error) {
	v := r.URL.Query().Get("changeset")
	if v == "" {
		v = r.Header.Get("X-Jarl-Changeset")
	}
	if v == "" {
		return 0, nil
	}
	id, err := strconv.ParseInt(v, 10, 64)
	if err != nil || id <= 0 {
		return 0, badRequest("invalid changeset %q", v)
	}
	return id, nil
}

// mutate applies (or stages, or previews) requests and writes the
// response. object, if set, returns the resulting object to include.
func (s *Server) mutate(w http.ResponseWriter, r *http.Request, p *auth.Principal, description string, reqs []engine.Request, object func(st *model.State, created int64) any) error {
	return s.mutateNotes(w, r, p, description, reqs, object, nil)
}

// mutateNotes is mutate with notes for the user, shown as warnings.
func (s *Server) mutateNotes(w http.ResponseWriter, r *http.Request, p *auth.Principal, description string, reqs []engine.Request, object func(st *model.State, created int64) any, notes []string) error {
	csID, err := changesetTarget(r)
	if err != nil {
		return err
	}
	if csID != 0 {
		res, err := s.eng.Stage(r.Context(), csID, reqs, p)
		if err != nil {
			return err
		}
		res.Changeset.Ops = engine.RedactOps(res.Changeset.Ops)
		writeJSON(w, http.StatusAccepted, api.MutationResponse{Staged: true, ChangesetID: csID, Changeset: raw(res.Changeset), Added: engine.RedactOps(res.Added), Warnings: append(notes, res.Warnings...), Problems: raw(res.Problems)})
		return nil
	}
	opts := engine.ApplyOptions{DryRun: queryBool(r, "dry_run"), Force: queryBool(r, "force"), AcceptRisk: queryBool(r, "accept_risk")}
	res, err := s.eng.Submit(r.Context(), reqs, p, via(r, p), description, opts)
	if err != nil {
		s.writeErr(w, r, err, res)
		return nil
	}
	out := api.MutationResponse{Applied: res.Applied, DryRun: res.DryRun, ChangesetID: res.ChangesetID, Result: raw(res), Warnings: append(notes, res.Warnings...)}
	if object != nil && res.Applied {
		st, err := s.store.LoadState(r.Context())
		if err == nil {
			var created int64
			if len(res.Ops) > 0 {
				created = res.Ops[0].ID
			}
			out.Object = raw(object(st, created))
		}
	}
	status := http.StatusOK
	if res.Applied && r.Method == http.MethodPost {
		status = http.StatusCreated
	}
	writeJSON(w, status, out)
	return nil
}

// request builds an engine request from a raw JSON body.
func request(op string, id int64, body []byte) engine.Request {
	return engine.Request{Op: op, ID: id, Data: body}
}

func requireAdmin(p *auth.Principal) error {
	if !p.IsAdmin() {
		return forbidden("this needs an administrator (and not a restricted token)")
	}
	return nil
}

func require(p *auth.Principal, a auth.Action) error {
	if !p.Can(a) {
		return forbidden("permission denied: this needs %s", a)
	}
	return nil
}

// contentETags returns an ETag for every file of the embedded web UI,
// from its content (embedded files have no modification time).
func contentETags(fsys fs.FS) map[string]string {
	tags := map[string]string{}
	fs.WalkDir(fsys, ".", func(path string, d fs.DirEntry, err error) error {
		if err != nil || d.IsDir() {
			return nil
		}
		b, err := fs.ReadFile(fsys, path)
		if err != nil {
			return nil
		}
		sum := sha256.Sum256(b)
		tags[path] = `"` + hex.EncodeToString(sum[:12]) + `"`
		return nil
	})
	return tags
}