bucketeer/internal/webui/webui.go

// Package webui serves a small read-only web UI over discovered cloud assets
// and their content index. It is dependency-free (stdlib + embedded HTML) and
// exposes no mutation endpoints.
package webui

import (
	"context"
	"embed"
	"encoding/json"
	"io/fs"
	"net/http"
	"strconv"
	"strings"

	"tea.karlcom.de/karl/bucketeer/internal/store"
)

//go:embed index.html
var indexHTML []byte

//go:embed assets
var assetsFS embed.FS

// Store is the read-only subset of the database the UI needs.
type Store interface {
	ListAssets(ctx context.Context, f store.AssetFilter) ([]store.Asset, error)
	CountAssets(ctx context.Context, f store.AssetFilter) (int, error)
	SearchEntries(ctx context.Context, query string, limit, offset int) ([]store.IndexEntry, int, error)
	Stats(ctx context.Context) (store.Stats, error)
}

type Config struct {
	User string // optional HTTP basic auth username
	Pass string // optional HTTP basic auth password
}

// New returns the UI handler. If Config.User is set, all routes require basic auth.
func New(s Store, cfg Config) http.Handler {
	mux := http.NewServeMux()
	assets, _ := fs.Sub(assetsFS, "assets")
	fileServer := http.FileServer(http.FS(assets))
	mux.Handle("/assets/", http.StripPrefix("/assets/", cacheForever(fileServer)))
	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path != "/" {
			http.NotFound(w, r)
			return
		}
		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		_, _ = w.Write(indexHTML)
	})
	mux.HandleFunc("/api/assets", func(w http.ResponseWriter, r *http.Request) {
		q := r.URL.Query()
		limit, _ := strconv.Atoi(q.Get("limit"))
		offset, _ := strconv.Atoi(q.Get("offset"))
		f := store.AssetFilter{
			Provider: strings.TrimSpace(q.Get("provider")),
			Service:  strings.TrimSpace(q.Get("service")),
			Exposure: strings.TrimSpace(q.Get("exposure")),
			Query:    strings.TrimSpace(q.Get("q")),
			Sort:     strings.TrimSpace(q.Get("sort")),
			Limit:    limit,
			Offset:   offset,
		}
		assets, err := s.ListAssets(r.Context(), f)
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		total, err := s.CountAssets(r.Context(), f)
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		writeJSON(w, map[string]any{"assets": assets, "total": total, "limit": limit, "offset": offset})
	})
	mux.HandleFunc("/api/entries", func(w http.ResponseWriter, r *http.Request) {
		q := r.URL.Query()
		limit, _ := strconv.Atoi(q.Get("limit"))
		offset, _ := strconv.Atoi(q.Get("offset"))
		entries, total, err := s.SearchEntries(r.Context(), strings.TrimSpace(q.Get("q")), limit, offset)
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		writeJSON(w, map[string]any{"entries": entries, "total": total, "limit": limit, "offset": offset})
	})
	mux.HandleFunc("/api/stats", func(w http.ResponseWriter, r *http.Request) {
		st, err := s.Stats(r.Context())
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		writeJSON(w, st)
	})

	if cfg.User != "" {
		return basicAuth(cfg.User, cfg.Pass, mux)
	}
	return mux
}

// cacheForever marks embedded, content-addressed-by-name assets as long-lived,
// since they only change with a new binary.
func cacheForever(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Cache-Control", "public, max-age=86400")
		next.ServeHTTP(w, r)
	})
}

func writeJSON(w http.ResponseWriter, v any) {
	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	_ = json.NewEncoder(w).Encode(v)
}

func basicAuth(user, pass string, next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		u, p, ok := r.BasicAuth()
		if !ok || u != user || p != pass {
			w.Header().Set("WWW-Authenticate", `Basic realm="bucketeer"`)
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		next.ServeHTTP(w, r)
	})
}