Phase 1: Compass/NHS skeleton (Go, SQLite, session login, Docker, Caddy)
Phase 1 of AGENTS.md §11: the app runs on .13 in its own container on port 8792, behind Caddy at school.lab.audasmedia.com.au, with its own session login and GET /health. - Go service (Go 1.25, modernc SQLite, no cgo) with its own image. - SQLite schema per AGENTS.md §7: children, items, scans, notifications, session (internal/store/migrations/001_init.sql). - Separate session login (signed cookie, CSRF double-submit), not SSO. - HTMX server-rendered shell using the Family Home Lab tokens.css: canvas #f6f5f4, action blue #0075de, Inter, 8px grid, hairline borders, pill CTAs, dark mode, phone-friendly. - Fail loudly (FR-12): a missing or failed scan shows as an explicit warning or error banner, never as an empty day. - Dockerfile + docker-compose.yml (own container, own port 8792; uses network_mode bridge because .13 has no free default Docker address pool). - Caddy snippet for .35 in deploy/caddy/, deployment notes, and deploy/verify-phase1.sh. No school scan in this phase; the Compass login and fetch are Phase 2. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
324
internal/web/server.go
Normal file
324
internal/web/server.go
Normal file
@@ -0,0 +1,324 @@
|
||||
// Package web is the HTTP surface of the Compass/NHS service: /health, the
|
||||
// service's own session login, and the server-rendered HTMX dashboard
|
||||
// (AGENTS.md §5, §9).
|
||||
package web
|
||||
|
||||
import (
|
||||
"context"
|
||||
"embed"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"html/template"
|
||||
"io/fs"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gitea.lab.audasmedia.com.au/sam/compass_teams_nhs/internal/auth"
|
||||
"gitea.lab.audasmedia.com.au/sam/compass_teams_nhs/internal/config"
|
||||
"gitea.lab.audasmedia.com.au/sam/compass_teams_nhs/internal/store"
|
||||
)
|
||||
|
||||
//go:embed templates/*.html templates/partials/*.html
|
||||
var templateFS embed.FS
|
||||
|
||||
//go:embed static
|
||||
var staticFS embed.FS
|
||||
|
||||
// Server holds the dependencies for the HTTP handlers.
|
||||
type Server struct {
|
||||
cfg *config.Config
|
||||
store *store.Store
|
||||
auth *auth.Manager
|
||||
tmpl *template.Template
|
||||
log *slog.Logger
|
||||
}
|
||||
|
||||
// New builds a Server and parses the embedded templates.
|
||||
func New(cfg *config.Config, st *store.Store, am *auth.Manager, log *slog.Logger) (*Server, error) {
|
||||
funcs := template.FuncMap{
|
||||
"year": func() int { return time.Now().Year() },
|
||||
"clock": func() string { return time.Now().Format("15:04:05 MST") },
|
||||
}
|
||||
tmpl, err := template.New("").Funcs(funcs).ParseFS(templateFS,
|
||||
"templates/*.html", "templates/partials/*.html")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parse templates: %w", err)
|
||||
}
|
||||
return &Server{cfg: cfg, store: st, auth: am, tmpl: tmpl, log: log}, nil
|
||||
}
|
||||
|
||||
// Handler returns the fully wrapped HTTP handler.
|
||||
func (s *Server) Handler() http.Handler {
|
||||
mux := http.NewServeMux()
|
||||
|
||||
mux.HandleFunc("GET /health", s.handleHealth)
|
||||
mux.HandleFunc("GET /login", s.handleLoginPage)
|
||||
mux.HandleFunc("POST /login", s.handleLoginSubmit)
|
||||
mux.HandleFunc("POST /logout", s.handleLogout)
|
||||
mux.HandleFunc("GET /{$}", s.requireAuth(s.handleDashboard))
|
||||
mux.HandleFunc("GET /partials/scan-status", s.requireAuth(s.handleScanStatusPartial))
|
||||
|
||||
staticSub, err := fs.Sub(staticFS, "static")
|
||||
if err != nil {
|
||||
panic("web: embedded static dir missing: " + err.Error())
|
||||
}
|
||||
mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.FS(staticSub))))
|
||||
|
||||
return s.recoverer(s.securityHeaders(s.requestLogger(mux)))
|
||||
}
|
||||
|
||||
// ---------- middleware ----------
|
||||
|
||||
type statusRecorder struct {
|
||||
http.ResponseWriter
|
||||
status int
|
||||
}
|
||||
|
||||
func (r *statusRecorder) WriteHeader(code int) {
|
||||
r.status = code
|
||||
r.ResponseWriter.WriteHeader(code)
|
||||
}
|
||||
|
||||
func (s *Server) requestLogger(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
start := time.Now()
|
||||
rec := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
|
||||
next.ServeHTTP(rec, r)
|
||||
s.log.Info("http",
|
||||
"method", r.Method,
|
||||
"path", r.URL.Path,
|
||||
"status", rec.status,
|
||||
"remote", r.RemoteAddr,
|
||||
"duration", time.Since(start).String(),
|
||||
)
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Server) securityHeaders(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
h := w.Header()
|
||||
h.Set("X-Content-Type-Options", "nosniff")
|
||||
h.Set("X-Frame-Options", "DENY")
|
||||
h.Set("Referrer-Policy", "same-origin")
|
||||
h.Set("Content-Security-Policy",
|
||||
"default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; form-action 'self'; frame-ancestors 'none'")
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Server) recoverer(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
defer func() {
|
||||
if rec := recover(); rec != nil {
|
||||
s.log.Error("panic", "err", rec, "path", r.URL.Path)
|
||||
http.Error(w, "internal server error", http.StatusInternalServerError)
|
||||
}
|
||||
}()
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Server) requireAuth(next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
if !s.auth.Authenticated(r) {
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
next(w, r)
|
||||
}
|
||||
}
|
||||
|
||||
// ---------- handlers ----------
|
||||
|
||||
type healthResponse struct {
|
||||
Status string `json:"status"`
|
||||
Service string `json:"service"`
|
||||
Version string `json:"version"`
|
||||
Database string `json:"database"`
|
||||
Scans store.ScanStatus `json:"scans"`
|
||||
Time string `json:"time"`
|
||||
}
|
||||
|
||||
func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
|
||||
resp := healthResponse{
|
||||
Status: "ok",
|
||||
Service: "compass-teams-nhs",
|
||||
Version: s.cfg.Version,
|
||||
Database: "ok",
|
||||
Time: time.Now().UTC().Format(time.RFC3339),
|
||||
}
|
||||
code := http.StatusOK
|
||||
if err := s.store.Ping(r.Context()); err != nil {
|
||||
resp.Status = "error"
|
||||
resp.Database = "error"
|
||||
code = http.StatusServiceUnavailable
|
||||
}
|
||||
if st, err := s.store.ScanSummary(r.Context()); err == nil {
|
||||
resp.Scans = st
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
||||
w.WriteHeader(code)
|
||||
_ = json.NewEncoder(w).Encode(resp)
|
||||
}
|
||||
|
||||
type loginData struct {
|
||||
CSRF string
|
||||
Error string
|
||||
Username string
|
||||
}
|
||||
|
||||
func (s *Server) handleLoginPage(w http.ResponseWriter, r *http.Request) {
|
||||
if s.auth.Authenticated(r) {
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
return
|
||||
}
|
||||
s.render(w, r, "login.html", loginData{CSRF: s.auth.EnsureCSRF(w, r)})
|
||||
}
|
||||
|
||||
func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
http.Error(w, "bad request", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
username := strings.TrimSpace(r.PostFormValue("username"))
|
||||
|
||||
if !s.auth.CheckCSRF(r) {
|
||||
s.log.Warn("login rejected: bad csrf token", "remote", r.RemoteAddr)
|
||||
s.render(w, r, "login.html", loginData{
|
||||
CSRF: s.auth.EnsureCSRF(w, r),
|
||||
Error: "Session expired. Please try again.",
|
||||
Username: username,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if !s.auth.CheckCredentials(username, r.PostFormValue("password")) {
|
||||
s.log.Warn("login failed", "user", username, "remote", r.RemoteAddr)
|
||||
w.WriteHeader(http.StatusUnauthorized)
|
||||
s.render(w, r, "login.html", loginData{
|
||||
CSRF: s.auth.EnsureCSRF(w, r),
|
||||
Error: "Incorrect username or password.",
|
||||
Username: username,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
s.auth.Issue(w)
|
||||
s.log.Info("login success", "user", username, "remote", r.RemoteAddr)
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
|
||||
if err := r.ParseForm(); err != nil {
|
||||
http.Error(w, "bad request", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
s.auth.Clear(w)
|
||||
http.Redirect(w, r, "/login", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// scanStatusView is the fail-loudly view of scan health (FR-12). It is shared
|
||||
// by the dashboard and the HTMX partial.
|
||||
type scanStatusView struct {
|
||||
store.ScanStatus
|
||||
// Level is "none", "error", "ok" or "warn". The template never renders an
|
||||
// empty day as "nothing due".
|
||||
Level string
|
||||
Message string
|
||||
LastAt string
|
||||
}
|
||||
|
||||
func (s *Server) scanStatus(ctx context.Context) scanStatusView {
|
||||
st, err := s.store.ScanSummary(ctx)
|
||||
if err != nil {
|
||||
s.log.Error("scan summary", "err", err)
|
||||
return scanStatusView{Level: "error", Message: "Could not read the scan log: " + err.Error()}
|
||||
}
|
||||
v := scanStatusView{ScanStatus: st}
|
||||
if !st.EverRun {
|
||||
v.Level = "warn"
|
||||
v.Message = "NO SCAN HAS RUN YET — do not read this as “nothing due”."
|
||||
return v
|
||||
}
|
||||
if st.Last != nil && !st.Last.OK {
|
||||
v.Level = "error"
|
||||
v.Message = "SCAN FAILED — the last scan did not complete, so due work is UNKNOWN."
|
||||
v.LastAt = st.Last.StartedAt.Format("Mon 02 Jan 2006 15:04")
|
||||
return v
|
||||
}
|
||||
v.Level = "ok"
|
||||
v.Message = "Last scan completed."
|
||||
if st.Last != nil {
|
||||
v.LastAt = st.Last.StartedAt.Format("Mon 02 Jan 2006 15:04")
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
type childView struct {
|
||||
store.Child
|
||||
}
|
||||
|
||||
type dashboardData struct {
|
||||
Title string
|
||||
Username string
|
||||
CSRF string
|
||||
Version string
|
||||
AppEnv string
|
||||
Children []childView
|
||||
Scan scanStatusView
|
||||
ServerUp string
|
||||
ErrMsg string
|
||||
}
|
||||
|
||||
var serverStarted = time.Now()
|
||||
|
||||
func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
|
||||
ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
|
||||
defer cancel()
|
||||
|
||||
children, err := s.store.ListChildren(ctx)
|
||||
if err != nil {
|
||||
s.log.Error("list children", "err", err)
|
||||
}
|
||||
views := make([]childView, 0, len(children))
|
||||
for _, c := range children {
|
||||
views = append(views, childView{Child: c})
|
||||
}
|
||||
|
||||
s.render(w, r, "dashboard.html", dashboardData{
|
||||
Title: "Dashboard",
|
||||
Username: s.cfg.AdminUsername,
|
||||
CSRF: s.auth.EnsureCSRF(w, r),
|
||||
Version: s.cfg.Version,
|
||||
AppEnv: s.cfg.AppEnv,
|
||||
Children: views,
|
||||
Scan: s.scanStatus(ctx),
|
||||
ServerUp: time.Since(serverStarted).Round(time.Second).String(),
|
||||
ErrMsg: strings.TrimSpace(r.URL.Query().Get("err")),
|
||||
})
|
||||
}
|
||||
|
||||
func (s *Server) handleScanStatusPartial(w http.ResponseWriter, r *http.Request) {
|
||||
ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
|
||||
defer cancel()
|
||||
s.renderFragment(w, r, "scan-status.html", s.scanStatus(ctx))
|
||||
}
|
||||
|
||||
func (s *Server) render(w http.ResponseWriter, _ *http.Request, name string, data any) {
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
if err := s.tmpl.ExecuteTemplate(w, name, data); err != nil {
|
||||
s.log.Error("render", "template", name, "err", err)
|
||||
http.Error(w, "template error", http.StatusInternalServerError)
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Server) renderFragment(w http.ResponseWriter, _ *http.Request, name string, data any) {
|
||||
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||
if err := s.tmpl.ExecuteTemplate(w, name, data); err != nil {
|
||||
s.log.Error("render fragment", "template", name, "err", err)
|
||||
http.Error(w, "template error", http.StatusInternalServerError)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user