compass_teams_nhs/internal/web/server.go

// Package web is the HTTP surface of the Compass/NHS service: /health, the
// service's own session login, and the server-rendered HTMX dashboard
// (AGENTS.md §5, §9).
package web

import (
	"context"
	"embed"
	"encoding/json"
	"fmt"
	"html/template"
	"io/fs"
	"log/slog"
	"net/http"
	"strings"
	"time"

	"gitea.lab.audasmedia.com.au/sam/compass_teams_nhs/internal/auth"
	"gitea.lab.audasmedia.com.au/sam/compass_teams_nhs/internal/config"
	"gitea.lab.audasmedia.com.au/sam/compass_teams_nhs/internal/store"
)

//go:embed templates/*.html templates/partials/*.html
var templateFS embed.FS

//go:embed static
var staticFS embed.FS

// Server holds the dependencies for the HTTP handlers.
type Server struct {
	cfg   *config.Config
	store *store.Store
	auth  *auth.Manager
	tmpl  *template.Template
	log   *slog.Logger
}

// New builds a Server and parses the embedded templates.
func New(cfg *config.Config, st *store.Store, am *auth.Manager, log *slog.Logger) (*Server, error) {
	funcs := template.FuncMap{
		"year":  func() int { return time.Now().Year() },
		"clock": func() string { return time.Now().Format("15:04:05 MST") },
	}
	tmpl, err := template.New("").Funcs(funcs).ParseFS(templateFS,
		"templates/*.html", "templates/partials/*.html")
	if err != nil {
		return nil, fmt.Errorf("parse templates: %w", err)
	}
	return &Server{cfg: cfg, store: st, auth: am, tmpl: tmpl, log: log}, nil
}

// Handler returns the fully wrapped HTTP handler.
func (s *Server) Handler() http.Handler {
	mux := http.NewServeMux()

	mux.HandleFunc("GET /health", s.handleHealth)
	mux.HandleFunc("GET /login", s.handleLoginPage)
	mux.HandleFunc("POST /login", s.handleLoginSubmit)
	mux.HandleFunc("POST /logout", s.handleLogout)
	mux.HandleFunc("GET /{$}", s.requireAuth(s.handleDashboard))
	mux.HandleFunc("GET /partials/scan-status", s.requireAuth(s.handleScanStatusPartial))

	staticSub, err := fs.Sub(staticFS, "static")
	if err != nil {
		panic("web: embedded static dir missing: " + err.Error())
	}
	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.FS(staticSub))))

	return s.recoverer(s.securityHeaders(s.requestLogger(mux)))
}

// ---------- middleware ----------

type statusRecorder struct {
	http.ResponseWriter
	status int
}

func (r *statusRecorder) WriteHeader(code int) {
	r.status = code
	r.ResponseWriter.WriteHeader(code)
}

func (s *Server) requestLogger(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		start := time.Now()
		rec := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
		next.ServeHTTP(rec, r)
		s.log.Info("http",
			"method", r.Method,
			"path", r.URL.Path,
			"status", rec.status,
			"remote", r.RemoteAddr,
			"duration", time.Since(start).String(),
		)
	})
}

func (s *Server) securityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		h := w.Header()
		h.Set("X-Content-Type-Options", "nosniff")
		h.Set("X-Frame-Options", "DENY")
		h.Set("Referrer-Policy", "same-origin")
		h.Set("Content-Security-Policy",
			"default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; form-action 'self'; frame-ancestors 'none'")
		next.ServeHTTP(w, r)
	})
}

func (s *Server) recoverer(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		defer func() {
			if rec := recover(); rec != nil {
				s.log.Error("panic", "err", rec, "path", r.URL.Path)
				http.Error(w, "internal server error", http.StatusInternalServerError)
			}
		}()
		next.ServeHTTP(w, r)
	})
}

func (s *Server) requireAuth(next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if !s.auth.Authenticated(r) {
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return
		}
		next(w, r)
	}
}

// ---------- handlers ----------

type healthResponse struct {
	Status   string           `json:"status"`
	Service  string           `json:"service"`
	Version  string           `json:"version"`
	Database string           `json:"database"`
	Scans    store.ScanStatus `json:"scans"`
	Time     string           `json:"time"`
}

func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
	resp := healthResponse{
		Status:   "ok",
		Service:  "compass-teams-nhs",
		Version:  s.cfg.Version,
		Database: "ok",
		Time:     time.Now().UTC().Format(time.RFC3339),
	}
	code := http.StatusOK
	if err := s.store.Ping(r.Context()); err != nil {
		resp.Status = "error"
		resp.Database = "error"
		code = http.StatusServiceUnavailable
	}
	if st, err := s.store.ScanSummary(r.Context()); err == nil {
		resp.Scans = st
	}

	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	w.WriteHeader(code)
	_ = json.NewEncoder(w).Encode(resp)
}

type loginData struct {
	CSRF     string
	Error    string
	Username string
}

func (s *Server) handleLoginPage(w http.ResponseWriter, r *http.Request) {
	if s.auth.Authenticated(r) {
		http.Redirect(w, r, "/", http.StatusSeeOther)
		return
	}
	s.render(w, r, "login.html", loginData{CSRF: s.auth.EnsureCSRF(w, r)})
}

func (s *Server) handleLoginSubmit(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseForm(); err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	username := strings.TrimSpace(r.PostFormValue("username"))

	if !s.auth.CheckCSRF(r) {
		s.log.Warn("login rejected: bad csrf token", "remote", r.RemoteAddr)
		s.render(w, r, "login.html", loginData{
			CSRF:     s.auth.EnsureCSRF(w, r),
			Error:    "Session expired. Please try again.",
			Username: username,
		})
		return
	}

	if !s.auth.CheckCredentials(username, r.PostFormValue("password")) {
		s.log.Warn("login failed", "user", username, "remote", r.RemoteAddr)
		w.WriteHeader(http.StatusUnauthorized)
		s.render(w, r, "login.html", loginData{
			CSRF:     s.auth.EnsureCSRF(w, r),
			Error:    "Incorrect username or password.",
			Username: username,
		})
		return
	}

	s.auth.Issue(w)
	s.log.Info("login success", "user", username, "remote", r.RemoteAddr)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseForm(); err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}
	s.auth.Clear(w)
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}

// scanStatusView is the fail-loudly view of scan health (FR-12). It is shared
// by the dashboard and the HTMX partial.
type scanStatusView struct {
	store.ScanStatus
	// Level is "none", "error", "ok" or "warn". The template never renders an
	// empty day as "nothing due".
	Level   string
	Message string
	LastAt  string
}

func (s *Server) scanStatus(ctx context.Context) scanStatusView {
	st, err := s.store.ScanSummary(ctx)
	if err != nil {
		s.log.Error("scan summary", "err", err)
		return scanStatusView{Level: "error", Message: "Could not read the scan log: " + err.Error()}
	}
	v := scanStatusView{ScanStatus: st}
	if !st.EverRun {
		v.Level = "warn"
		v.Message = "NO SCAN HAS RUN YET — do not read this as “nothing due”."
		return v
	}
	if st.Last != nil && !st.Last.OK {
		v.Level = "error"
		v.Message = "SCAN FAILED — the last scan did not complete, so due work is UNKNOWN."
		v.LastAt = st.Last.StartedAt.Format("Mon 02 Jan 2006 15:04")
		return v
	}
	v.Level = "ok"
	v.Message = "Last scan completed."
	if st.Last != nil {
		v.LastAt = st.Last.StartedAt.Format("Mon 02 Jan 2006 15:04")
	}
	return v
}

type childView struct {
	store.Child
}

type dashboardData struct {
	Title    string
	Username string
	CSRF     string
	Version  string
	AppEnv   string
	Children []childView
	Scan     scanStatusView
	ServerUp string
	ErrMsg   string
}

var serverStarted = time.Now()

func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
	defer cancel()

	children, err := s.store.ListChildren(ctx)
	if err != nil {
		s.log.Error("list children", "err", err)
	}
	views := make([]childView, 0, len(children))
	for _, c := range children {
		views = append(views, childView{Child: c})
	}

	s.render(w, r, "dashboard.html", dashboardData{
		Title:    "Dashboard",
		Username: s.cfg.AdminUsername,
		CSRF:     s.auth.EnsureCSRF(w, r),
		Version:  s.cfg.Version,
		AppEnv:   s.cfg.AppEnv,
		Children: views,
		Scan:     s.scanStatus(ctx),
		ServerUp: time.Since(serverStarted).Round(time.Second).String(),
		ErrMsg:   strings.TrimSpace(r.URL.Query().Get("err")),
	})
}

func (s *Server) handleScanStatusPartial(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
	defer cancel()
	s.renderFragment(w, r, "scan-status.html", s.scanStatus(ctx))
}

func (s *Server) render(w http.ResponseWriter, _ *http.Request, name string, data any) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	if err := s.tmpl.ExecuteTemplate(w, name, data); err != nil {
		s.log.Error("render", "template", name, "err", err)
		http.Error(w, "template error", http.StatusInternalServerError)
	}
}

func (s *Server) renderFragment(w http.ResponseWriter, _ *http.Request, name string, data any) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	if err := s.tmpl.ExecuteTemplate(w, name, data); err != nil {
		s.log.Error("render fragment", "template", name, "err", err)
		http.Error(w, "template error", http.StatusInternalServerError)
	}
}