Steward 0.1.0 (in development): a DHCPv4 server with a web UI, API and CLI

Subnets served per interface, pools, reservations, options at three
levels, leases in SQLite saved before the ACK, ping and decline conflict
checks, validated changes with history and undo, users and tokens, an
audit log, a Kea importer, a sandboxed systemd unit and Debian packages.
Tested with real udhcpc and dhcpcd clients in Docker (scripts/e2e.sh).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -0,0 +1,119 @@
+package server
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"io/fs"
+	"net/http"
+	"strings"
+	"time"
+
+	"steward/internal/api"
+	"steward/internal/version"
+)
+
+func (s *Server) routes() {
+	m := s.mux
+	p := api.Prefix
+	m.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "version": version.String()})
+	})
+	// Authentication, users and tokens
+	m.HandleFunc("POST "+p+"/auth/login", s.public(s.login))
+	m.HandleFunc("POST "+p+"/auth/logout", s.authed(s.logout))
+	m.HandleFunc("GET "+p+"/auth/whoami", s.authed(s.whoami))
+	m.HandleFunc("POST "+p+"/me/password", s.authed(s.changeOwnPassword))
+	m.HandleFunc("GET "+p+"/me/tokens", s.authed(s.listOwnTokens))
+	m.HandleFunc("POST "+p+"/me/tokens", s.authed(s.createOwnToken))
+	m.HandleFunc("GET "+p+"/tokens", s.authed(s.listAllTokens))
+	m.HandleFunc("DELETE "+p+"/tokens/{id}", s.authed(s.revokeToken))
+	m.HandleFunc("GET "+p+"/users", s.authed(s.listUsers))
+	m.HandleFunc("POST "+p+"/users", s.authed(s.createUser))
+	m.HandleFunc("PATCH "+p+"/users/{id}", s.authed(s.updateUser))
+	m.HandleFunc("DELETE "+p+"/users/{id}", s.authed(s.deleteUser))
+	m.HandleFunc("GET "+p+"/users/{id}/tokens", s.authed(s.listUserTokens))
+	m.HandleFunc("POST "+p+"/users/{id}/tokens", s.authed(s.createUserToken))
+	// Configuration
+	m.HandleFunc("GET "+p+"/settings", s.authed(s.getSettings))
+	m.HandleFunc("PATCH "+p+"/settings", s.authed(s.updateSettings))
+	m.HandleFunc("GET "+p+"/subnets", s.authed(s.listSubnets))
+	m.HandleFunc("POST "+p+"/subnets", s.authed(s.createSubnet))
+	m.HandleFunc("GET "+p+"/subnets/{ref}", s.authed(s.getSubnet))
+	m.HandleFunc("PATCH "+p+"/subnets/{ref}", s.authed(s.updateSubnet))
+	m.HandleFunc("DELETE "+p+"/subnets/{ref}", s.authed(s.deleteSubnet))
+	m.HandleFunc("GET "+p+"/reservations", s.authed(s.listReservations))
+	m.HandleFunc("POST "+p+"/reservations", s.authed(s.createReservation))
+	m.HandleFunc("GET "+p+"/reservations/{ref}", s.authed(s.getReservation))
+	m.HandleFunc("PATCH "+p+"/reservations/{ref}", s.authed(s.updateReservation))
+	m.HandleFunc("DELETE "+p+"/reservations/{ref}", s.authed(s.deleteReservation))
+	m.HandleFunc("GET "+p+"/history", s.authed(s.listHistory))
+	m.HandleFunc("GET "+p+"/history/{id}", s.authed(s.getHistory))
+	m.HandleFunc("POST "+p+"/history/{id}/revert", s.authed(s.revertHistory))
+	m.HandleFunc("POST "+p+"/import/kea", s.authed(s.importKea))
+	m.HandleFunc("GET "+p+"/catalog", s.authed(s.catalog))
+	m.HandleFunc("GET "+p+"/interfaces", s.authed(s.interfaces))
+	// Leases and activity
+	m.HandleFunc("GET "+p+"/leases", s.authed(s.listLeases))
+	m.HandleFunc("GET "+p+"/leases/{ip}", s.authed(s.getLease))
+	m.HandleFunc("DELETE "+p+"/leases/{ip}", s.authed(s.deleteLease))
+	m.HandleFunc("POST "+p+"/leases/{ip}/reserve", s.authed(s.reserveLease))
+	m.HandleFunc("GET "+p+"/events", s.authed(s.listEvents))
+	// Status and audit
+	m.HandleFunc("GET "+p+"/status", s.authed(s.status))
+	m.HandleFunc("GET "+p+"/audit", s.authed(s.listAudit))
+	m.HandleFunc(p+"/", func(w http.ResponseWriter, r *http.Request) {
+		writeError(w, http.StatusNotFound, "not_found", "no such API endpoint: "+r.Method+" "+r.URL.Path)
+	})
+	// Web UI
+	if s.web != nil {
+		files := http.FileServer(http.FS(s.web))
+		etags := contentETags(s.web)
+		m.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+			if r.Method != http.MethodGet && r.Method != http.MethodHead {
+				w.Header().Set("Allow", "GET, HEAD")
+				http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+				return
+			}
+			if r.URL.Path == "/" || r.URL.Path == "/index.html" {
+				b, err := fs.ReadFile(s.web, "index.html")
+				if err != nil {
+					http.NotFound(w, r)
+					return
+				}
+				w.Header().Set("Content-Type", "text/html; charset=utf-8")
+				w.Header().Set("Cache-Control", "no-cache")
+				w.Header().Set("ETag", etags["index.html"])
+				http.ServeContent(w, r, "index.html", time.Time{}, bytes.NewReader(b))
+				return
+			}
+			if strings.HasPrefix(r.URL.Path, "/assets/") {
+				w.Header().Set("Cache-Control", "no-cache")
+				if tag, ok := etags[strings.TrimPrefix(r.URL.Path, "/")]; ok {
+					w.Header().Set("ETag", tag)
+				}
+				files.ServeHTTP(w, r)
+				return
+			}
+			http.NotFound(w, r)
+		})
+	}
+}
+
+// contentETags gives every embedded file an ETag from its content.
+func contentETags(fsys fs.FS) map[string]string {
+	tags := map[string]string{}
+	fs.WalkDir(fsys, ".", func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return nil
+		}
+		b, err := fs.ReadFile(fsys, path)
+		if err != nil {
+			return nil
+		}
+		sum := sha256.Sum256(b)
+		tags[path] = `"` + hex.EncodeToString(sum[:12]) + `"`
+		return nil
+	})
+	return tags
+}