StasonJatham
8fce55f8c9
Web UI (internal/webui): - dependency-free embedded HTML/JS served on the loopback listener - /api/assets (provider/service/exposure/q filters) and /api/stats - optional HTTP basic auth via UI_USER/UI_PASS Prober (internal/probe): - vendor-specific, unauthenticated, non-destructive checks: S3/R2/Spaces ListObjectsV2, GCS JSON object list, Azure ?comp=list, Firebase /.json?shallow=true, Supabase REST, and bare TCP connect for database endpoints (never reported readable, no auth attempted) - exposure_detail records the factual reason (status code, region, tcp port) - bounded random-sample queue instead of FIFO: one high-volume hostname template (mrap) no longer starves every other asset type - schema: cloud_assets.exposure_detail + probed_at (idempotent ALTER) Live: stable ~450MiB under 1GiB, no restarts, UI and probe states (private/reachable/auth_required) flowing, 0 db errors.
91 lines
2.5 KiB
Go
91 lines
2.5 KiB
Go
// Package webui serves a small read-only web UI over the discovered cloud
|
|
// assets. It is intentionally dependency-free (stdlib + embedded HTML) and
|
|
// exposes no mutation endpoints.
|
|
package webui
|
|
|
|
import (
|
|
"context"
|
|
_ "embed"
|
|
"encoding/json"
|
|
"net/http"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"tea.karlcom.de/karl/bucketeer/internal/store"
|
|
)
|
|
|
|
//go:embed index.html
|
|
var indexHTML []byte
|
|
|
|
// Store is the read-only subset of the database the UI needs.
|
|
type Store interface {
|
|
ListAssets(ctx context.Context, f store.AssetFilter) ([]store.Asset, error)
|
|
Stats(ctx context.Context) (store.Stats, error)
|
|
}
|
|
|
|
type Config struct {
|
|
User string // optional HTTP basic auth username
|
|
Pass string // optional HTTP basic auth password
|
|
}
|
|
|
|
// New returns the UI handler. If Config.User is set, all routes require basic auth.
|
|
func New(s Store, cfg Config) http.Handler {
|
|
mux := http.NewServeMux()
|
|
mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != "/" {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
_, _ = w.Write(indexHTML)
|
|
})
|
|
mux.HandleFunc("/api/assets", func(w http.ResponseWriter, r *http.Request) {
|
|
q := r.URL.Query()
|
|
limit, _ := strconv.Atoi(q.Get("limit"))
|
|
offset, _ := strconv.Atoi(q.Get("offset"))
|
|
assets, err := s.ListAssets(r.Context(), store.AssetFilter{
|
|
Provider: strings.TrimSpace(q.Get("provider")),
|
|
Service: strings.TrimSpace(q.Get("service")),
|
|
Exposure: strings.TrimSpace(q.Get("exposure")),
|
|
Query: strings.TrimSpace(q.Get("q")),
|
|
Limit: limit,
|
|
Offset: offset,
|
|
})
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
writeJSON(w, assets)
|
|
})
|
|
mux.HandleFunc("/api/stats", func(w http.ResponseWriter, r *http.Request) {
|
|
st, err := s.Stats(r.Context())
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
return
|
|
}
|
|
writeJSON(w, st)
|
|
})
|
|
|
|
if cfg.User != "" {
|
|
return basicAuth(cfg.User, cfg.Pass, mux)
|
|
}
|
|
return mux
|
|
}
|
|
|
|
func writeJSON(w http.ResponseWriter, v any) {
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
_ = json.NewEncoder(w).Encode(v)
|
|
}
|
|
|
|
func basicAuth(user, pass string, next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
u, p, ok := r.BasicAuth()
|
|
if !ok || u != user || p != pass {
|
|
w.Header().Set("WWW-Authenticate", `Basic realm="ctcloud"`)
|
|
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|