api.spaceplanner.app

main.go (5281B)

---

 package main
 
 import (
 	"bytes"
 	"encoding/json"
 	"flag"
 	"io"
 	"io/ioutil"
 	"log"
 	"log/slog"
 	"net/http"
 	"net/http/fcgi"
 	"os"
 
 	"jacobedwards.org/spaceplanner.app/internal/backend"
 
 	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
 )
 
 /*
  * WARNING: This is just a temporary measure. In the future
  * this file will either be readable only by root (and have
  * privledge dropping in this server) or outside the chroot
  * (by figuring out a solution with kfcgi(8).
  */
 const configFile = "/etc/spaceplanner.app/api.config"
 
 func main() {
 	var config Config
 	var useStdin bool
 	var testing bool
 	var bindTo string
 	var logTo string
 
 	flag.BoolVar(&testing, "t", false, "Test mode")
 	flag.BoolVar(&useStdin, "s", false, "Read config from stdin")
 	flag.StringVar(&bindTo, "b", "", "Bind address and port")
 	flag.StringVar(&logTo, "l", "-", "Log file")
 	flag.Parse()
 
 	var logFile io.Writer
 	if logTo == "-" {
 		logFile = os.Stderr
 	} else {
 		var err error
 		logFile, err = os.Open(logTo)
 		if err != nil {
 			log.Fatalf("%s: Could not open log file: %s", logTo, err.Error())
 		}
 	}
 	slog.SetDefault(slog.New(slog.NewJSONHandler(logFile, nil)))
 
 	var f io.Reader
 	if useStdin {
 		f = os.Stdin
 	} else {
 		var err error
 		f, err = os.Open(configFile)
 		if err != nil {
 			log.Fatalf("%s: Could not load configuration: %s", configFile, err.Error())
 		}
 	}
 	if err := json.NewDecoder(f).Decode(&config); err != nil {
 		log.Fatalf("Unable to read config from stdin: %s", err.Error())
 	}
 
 	e, err := NewEnv(config)
 	if err != nil {
 		log.Fatalf("Unable to initialize environment: %s", err.Error())
 	}
 	defer e.Free()
 
 	e.backend.AddSetting("email", backend.SettingDef{
 		Primitive: "string",
 		Validator: validateEmail,
 		Memo: "Email address",
 	})
 	e.backend.AddSetting("email_strict", backend.SettingDef{
 		Primitive: "bool",
 		DefaultValue: false,
 		Memo: "Whether to only send necessary emails",
 	})
 
 	corsConfig := cors.DefaultConfig()
 	corsConfig.AllowAllOrigins = true
 	corsConfig.AddAllowHeaders("Authorization")
 
 	if !testing {
 		gin.SetMode(gin.ReleaseMode)
 	}
 	engine := gin.Default()
 	engine.NoRoute(noRoute)
 	engine.Use(RequestLoggerMiddleware())
 	engine.Use(cors.New(corsConfig))
 	engine.Use(AuthMiddleware(e.Auth))
 	setRoutes(e, engine.Group("/v0"))
 
 	// Update subscriptions in another thread
 	go e.backend.StripeUpdateSubs()
 
 	if len(bindTo) > 0 {
 		engine.Run(bindTo)
 	} else {
 		fcgi.Serve(nil, engine)
 	}
 }
 
 func setRoutes(env *Env, r  *gin.RouterGroup) {
 	// This endpoint uses a separate authorization scheme
 	// enforced within stripeEventHandler
 	r.POST("/stripe", env.StripeEventHandler)
 
 	r.POST("/tokens", env.Auth.LoginHandler)
 	r.GET("/tokens", env.Auth.RefreshHandler)
 	r.GET("/settings", env.GetSettings)
 	r.GET("/services", env.GetServices)
 	r.GET("/furniture", env.FurnitureTypes)
 	r.GET("/pointmaps", env.PointmapTypes)
 
 	users := r.Group("/users")
 	users.GET("/:user", env.GetUser)
 	users.POST("", env.CreateUser)
 
 	setAuthenticatedRoutes(env, r.Group("", env.Auth.MiddlewareFunc()))
 }
 
 func setAuthenticatedRoutes(env *Env, r *gin.RouterGroup) {
 	r.DELETE("/users/:user", env.DeleteUser)
 
 	user := r.Group("/users/:user/")
 	user.PATCH("/settings", env.UpdateUserSettings)
 	user.GET("/settings", env.GetUserSettings)
 	user.POST("/services/checkout", env.CreateCheckout)
 	user.POST("/services/billingportal", env.CreatePortal)
 	user.GET("/services/subscribed", env.UserService)
 
 	email := user.Group("/email")
 	email.GET("/code", env.SendUserEmailCode)
 	email.POST("/code", env.VerifyUserEmailCode)
 	email.GET("/verified", env.VerifiedUserEmail)
 
 	payed := r.Group("", env.VerifyPayment)
 	setPayedRoutes(env, payed)
 }
 
 func setPayedRoutes(env *Env, r *gin.RouterGroup) {
 	fp := r.Group("/floorplans/:user")
 	fp.GET("", env.GetFloorplans)
 	fp.POST("", env.CreateFloorplan)
 
 	fp = fp.Group("/:floorplan")
 	fp.PUT("", env.UpdateFloorplan)
 	fp.DELETE("", env.DeleteFloorplan)
 	fp.GET("", env.GetFloorplan)
 
 	fpdata := fp.Group("/data")
 	fpdata.GET("", env.GetFloorplanData)
 	fpdata.PUT("", env.ReplaceFloorplanData)
 	fpdata.PATCH("", env.PatchFloorplanData)
 }
 
 func (e *Env) VerifyPayment(c *gin.Context) {
 	service, err := e.backend.UserService(c.Param("user"))
 	if err != nil {
 		RespondError(c, 500, "Unable to get subscription status")
 	} else if service == nil {
 		RespondError(c, 401, "You must be subscribed to access this resource")
 	} else {
 		c.Set("service_id", service)
 		c.Next()
 	}
 }
 
 func noRoute(c *gin.Context) {
 	RespondError(c, http.StatusNotFound, "Endpoint does not exist")
 }
 
 func RequestLoggerMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var buf bytes.Buffer
 
 		tee := io.TeeReader(c.Request.Body, &buf)
 		req, _ := ioutil.ReadAll(tee)
 		c.Request.Body = ioutil.NopCloser(&buf)
 
 		c.Next()
 
 		s := c.Writer.Status()
 		if s >= 200 && s < 300 {
 			slog.Info("Request", "endpoint", c.Request.URL.Path, slog.Group("response", slog.Int("code", s)))
 			return
 		}
 
 		log := slog.Warn
 		if s >= 500 && s < 600 {
 			log = slog.Error
 		}
 
 		resp, _ := c.Get("error")
 		if resp == nil {
 			resp = ""
 		}
 		log("Request",
 			slog.String("endpoint", c.Request.URL.Path),
 			slog.Group("response",
 				slog.Int("code", s),
 				slog.String("message", resp.(string)),
 			),
 			slog.String("body", string(req)),
 		)
 	}
 }