|
| 1 | +package api |
| 2 | + |
| 3 | +import ( |
| 4 | + "encoding/json" |
| 5 | + "fmt" |
| 6 | + "html/template" |
| 7 | + "mime" |
| 8 | + "net/http" |
| 9 | + "sync" |
| 10 | + "time" |
| 11 | + |
| 12 | + "github.com/Gaardsholt/pass-along/config" |
| 13 | + "github.com/Gaardsholt/pass-along/datastore" |
| 14 | + "github.com/Gaardsholt/pass-along/memory" |
| 15 | + "github.com/Gaardsholt/pass-along/metrics" |
| 16 | + "github.com/Gaardsholt/pass-along/redis" |
| 17 | + "github.com/Gaardsholt/pass-along/types" |
| 18 | + "github.com/gorilla/mux" |
| 19 | + "github.com/prometheus/client_golang/prometheus" |
| 20 | + "github.com/prometheus/client_golang/prometheus/promhttp" |
| 21 | + "github.com/rs/zerolog/log" |
| 22 | +) |
| 23 | + |
| 24 | +const ( |
| 25 | + ErrServerShuttingDown = "http: Server closed" |
| 26 | +) |
| 27 | + |
| 28 | +var pr *prometheus.Registry |
| 29 | +var secretStore datastore.SecretStore |
| 30 | +var startupTime time.Time |
| 31 | +var templates map[string]*template.Template |
| 32 | +var lock = sync.RWMutex{} |
| 33 | + |
| 34 | +// StartServer starts the internal and external http server and initiates the secrets store |
| 35 | +func StartServer() (internalServer *http.Server, externalServer *http.Server) { |
| 36 | + startupTime = time.Now() |
| 37 | + |
| 38 | + databaseType, err := config.Config.GetDatabaseType() |
| 39 | + if err != nil { |
| 40 | + log.Fatal().Err(err).Msgf("%s", err) |
| 41 | + } |
| 42 | + |
| 43 | + switch databaseType { |
| 44 | + case "in-memory": |
| 45 | + secretStore, err = memory.New(&lock) |
| 46 | + case "redis": |
| 47 | + secretStore, err = redis.New() |
| 48 | + } |
| 49 | + |
| 50 | + if err != nil { |
| 51 | + log.Fatal().Err(err).Msgf("%s", err) |
| 52 | + } |
| 53 | + |
| 54 | + registerPrometheusMetrics() |
| 55 | + createTemplates() |
| 56 | + |
| 57 | + internal := mux.NewRouter() |
| 58 | + external := mux.NewRouter() |
| 59 | + // Start of static stuff |
| 60 | + fs := http.FileServer(http.Dir("./static")) |
| 61 | + external.PathPrefix("/assets").Handler(http.StripPrefix("/assets", fs)) |
| 62 | + external.PathPrefix("/robots.txt").Handler(fs) |
| 63 | + external.PathPrefix("/favicon.ico").Handler(fs) |
| 64 | + // End of static stuff |
| 65 | + |
| 66 | + external.HandleFunc("/", IndexHandler).Methods("GET") |
| 67 | + external.HandleFunc("/", NewHandler).Methods("POST") |
| 68 | + external.HandleFunc("/{id}", GetHandler).Methods("GET") |
| 69 | + |
| 70 | + internal.HandleFunc("/healthz", healthz) |
| 71 | + internal.Handle("/metrics", promhttp.HandlerFor(pr, promhttp.HandlerOpts{})).Methods("GET") |
| 72 | + |
| 73 | + internalPort := 8888 |
| 74 | + internalServer = &http.Server{ |
| 75 | + Addr: fmt.Sprintf(":%d", internalPort), |
| 76 | + Handler: internal, |
| 77 | + } |
| 78 | + |
| 79 | + go func() { |
| 80 | + err := internalServer.ListenAndServe() |
| 81 | + if err != nil && err.Error() != ErrServerShuttingDown { |
| 82 | + log.Fatal().Err(err).Msgf("Unable to run the internal server at port %d", internalPort) |
| 83 | + } |
| 84 | + }() |
| 85 | + |
| 86 | + externalPort := 8080 |
| 87 | + externalServer = &http.Server{ |
| 88 | + Addr: fmt.Sprintf(":%d", externalPort), |
| 89 | + Handler: external, |
| 90 | + } |
| 91 | + go func() { |
| 92 | + err := externalServer.ListenAndServe() |
| 93 | + if err != nil && err.Error() != ErrServerShuttingDown { |
| 94 | + log.Fatal().Err(err).Msgf("Unable to run the external server at port %d", externalPort) |
| 95 | + } |
| 96 | + }() |
| 97 | + log.Info().Msgf("Starting server at port %d with %s as datastore", externalPort, databaseType) |
| 98 | + |
| 99 | + go secretStore.DeleteExpiredSecrets() |
| 100 | + |
| 101 | + return |
| 102 | +} |
| 103 | + |
| 104 | +func IndexHandler(w http.ResponseWriter, r *http.Request) { |
| 105 | + templates["index"].Execute(w, types.Page{Startup: startupTime}) |
| 106 | +} |
| 107 | + |
| 108 | +// NewHandler creates a new secret in the secretstore |
| 109 | +func NewHandler(w http.ResponseWriter, r *http.Request) { |
| 110 | + var entry types.Entry |
| 111 | + err := json.NewDecoder(r.Body).Decode(&entry) |
| 112 | + if err != nil { |
| 113 | + w.WriteHeader(http.StatusBadRequest) |
| 114 | + return |
| 115 | + } |
| 116 | + |
| 117 | + log.Debug().Msg("Creating a new secret") |
| 118 | + |
| 119 | + expires := time.Now().Add( |
| 120 | + time.Hour*time.Duration(0) + |
| 121 | + time.Minute*time.Duration(0) + |
| 122 | + time.Second*time.Duration(entry.ExpiresIn), |
| 123 | + ) |
| 124 | + |
| 125 | + mySecret := types.Secret{ |
| 126 | + Content: entry.Content, |
| 127 | + Expires: expires, |
| 128 | + TimeAdded: time.Now(), |
| 129 | + UnlimitedViews: entry.UnlimitedViews, |
| 130 | + } |
| 131 | + mySecret.UnlimitedViews = entry.UnlimitedViews |
| 132 | + id := mySecret.GenerateID() |
| 133 | + |
| 134 | + encryptedSecret, err := mySecret.Encrypt(id) |
| 135 | + if err != nil { |
| 136 | + go metrics.SecretsCreatedWithError.Inc() |
| 137 | + return |
| 138 | + } |
| 139 | + |
| 140 | + err = secretStore.Add(id, encryptedSecret, entry.ExpiresIn) |
| 141 | + if err != nil { |
| 142 | + http.Error(w, "failed to add secret, please try again", http.StatusInternalServerError) |
| 143 | + log.Error().Err(err).Msg("Unable to add secret") |
| 144 | + return |
| 145 | + } |
| 146 | + |
| 147 | + w.WriteHeader(http.StatusCreated) |
| 148 | + fmt.Fprintf(w, "%s", id) |
| 149 | +} |
| 150 | + |
| 151 | +// GetHandler retrieves a secret in the secret store |
| 152 | +func GetHandler(w http.ResponseWriter, r *http.Request) { |
| 153 | + vars := mux.Vars(r) |
| 154 | + |
| 155 | + useHtml := false |
| 156 | + ctHeader := r.Header.Get("Content-Type") |
| 157 | + contentType, _, err := mime.ParseMediaType(ctHeader) |
| 158 | + if err != nil || contentType != "application/json" { |
| 159 | + useHtml = true |
| 160 | + } |
| 161 | + |
| 162 | + if useHtml { |
| 163 | + newError := templates["read"].Execute(w, types.Page{Startup: startupTime}) |
| 164 | + if newError != nil { |
| 165 | + fmt.Fprintf(w, "%s", newError) |
| 166 | + } |
| 167 | + return |
| 168 | + } |
| 169 | + |
| 170 | + id := vars["id"] |
| 171 | + secretData, gotData := secretStore.Get(id) |
| 172 | + if !gotData { |
| 173 | + w.WriteHeader(http.StatusGone) |
| 174 | + fmt.Fprint(w, "secret not found") |
| 175 | + return |
| 176 | + } |
| 177 | + |
| 178 | + s, err := types.Decrypt(secretData, id) |
| 179 | + if err != nil { |
| 180 | + log.Fatal().Err(err).Msg("Unable to decrypt secret") |
| 181 | + w.WriteHeader(http.StatusInternalServerError) |
| 182 | + fmt.Fprint(w, err) |
| 183 | + return |
| 184 | + } |
| 185 | + |
| 186 | + decryptedSecret := "" |
| 187 | + |
| 188 | + isNotExpired := s.Expires.UTC().After(time.Now().UTC()) |
| 189 | + if isNotExpired { |
| 190 | + decryptedSecret = s.Content |
| 191 | + go metrics.SecretsRead.Inc() |
| 192 | + } else { |
| 193 | + gotData = false |
| 194 | + go metrics.ExpiredSecretsRead.Inc() |
| 195 | + } |
| 196 | + |
| 197 | + if !isNotExpired || !s.UnlimitedViews { |
| 198 | + secretStore.Delete(id) |
| 199 | + } |
| 200 | + |
| 201 | + log.Debug().Msg("Fetching a secret") |
| 202 | + |
| 203 | + w.WriteHeader(http.StatusOK) |
| 204 | + fmt.Fprintf(w, "%s", decryptedSecret) |
| 205 | +} |
| 206 | + |
| 207 | +// healthz is a liveness probe. |
| 208 | +func healthz(w http.ResponseWriter, _ *http.Request) { |
| 209 | + w.WriteHeader(http.StatusOK) |
| 210 | +} |
| 211 | + |
| 212 | +func registerPrometheusMetrics() { |
| 213 | + pr = prometheus.NewRegistry() |
| 214 | + // pr.MustRegister(types.NewSecretsInCache(&secretStore)) |
| 215 | + pr.MustRegister(metrics.SecretsRead) |
| 216 | + pr.MustRegister(metrics.ExpiredSecretsRead) |
| 217 | + pr.MustRegister(metrics.NonExistentSecretsRead) |
| 218 | + pr.MustRegister(metrics.SecretsCreated) |
| 219 | + pr.MustRegister(metrics.SecretsCreatedWithError) |
| 220 | + pr.MustRegister(metrics.SecretsDeleted) |
| 221 | +} |
| 222 | + |
| 223 | +func createTemplates() { |
| 224 | + templates = make(map[string]*template.Template) |
| 225 | + templates["index"] = template.Must(template.ParseFiles("templates/base.html", "templates/index.html")) |
| 226 | + templates["read"] = template.Must(template.ParseFiles("templates/base.html", "templates/read.html")) |
| 227 | +} |
| 228 | + |
| 229 | +// func secretCleaner() { |
| 230 | +// for { |
| 231 | +// time.Sleep(5 * time.Minute) |
| 232 | +// secretStore.Lock.RLock() |
| 233 | +// for k, v := range secretStore.Data { |
| 234 | +// s, err := types.Decrypt(v, k) |
| 235 | +// if err != nil { |
| 236 | +// continue |
| 237 | +// } |
| 238 | + |
| 239 | +// isNotExpired := s.Expires.UTC().After(time.Now().UTC()) |
| 240 | +// if !isNotExpired { |
| 241 | +// log.Debug().Msg("Found expired secret, deleting...") |
| 242 | +// secretStore.Lock.RUnlock() |
| 243 | +// secretStore.Delete(k) |
| 244 | +// secretStore.Lock.RLock() |
| 245 | +// } |
| 246 | +// } |
| 247 | +// secretStore.Lock.RUnlock() |
| 248 | +// } |
| 249 | +// } |
0 commit comments