dev_agentandClaude Opus 5.5
a10b24c86c
internal/auth discovers the provider at MEALQUEST_OIDC_ISSUER with coreos/go-oidc/v3 and runs a confidential-client authorization code flow with golang.org/x/oauth2 (client_secret_basic). GET /auth/login stores state, nonce and a PKCE S256 verifier in a 10-minute HMAC-signed HttpOnly __Host- cookie and redirects with scopes "openid profile email groups offline_access". An optional "return" path must be same-origin; anything else fails the login with 400. GET /auth/callback clears the single-use cookie, checks state, exchanges the code with the verifier, verifies the ID token (RS256 only, issuer, audience, expiry) and nonce, then hands the claims to a SessionStarter. cmd/server wires a placeholder that refuses every login until the session layer lands. Config gains required MEALQUEST_OIDC_ISSUER, MEALQUEST_OIDC_CLIENT_ID, MEALQUEST_OIDC_CLIENT_SECRET_FILE and MEALQUEST_OIDC_ALLOWED_GROUPS. Pins go-oidc v3.21.0 and oauth2 v0.36.0, the newest releases that support Go 1.25 (oauth2 v0.37.0 requires Go 1.26). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
100 lines
3.0 KiB
Go
100 lines
3.0 KiB
Go
// Package server builds the MealQuest HTTP router.
|
|
package server
|
|
|
|
import (
|
|
"encoding/json"
|
|
"io/fs"
|
|
"log/slog"
|
|
"net/http"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
|
|
"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/frontend"
|
|
)
|
|
|
|
// reservedPrefixes are owned by the API router and are never answered with the
|
|
// SPA's index.html.
|
|
var reservedPrefixes = []string{"/api", "/auth", "/media", "/health"}
|
|
|
|
// RouteMounter registers its own routes on the router.
|
|
type RouteMounter interface {
|
|
Mount(r chi.Router)
|
|
}
|
|
|
|
// NewRouter returns the HTTP handler for the service. version is reported by
|
|
// GET /health; auth mounts the /auth routes; assets is the web build served
|
|
// for every other GET.
|
|
func NewRouter(logger *slog.Logger, version string, auth RouteMounter, assets fs.FS) (http.Handler, error) {
|
|
notFound := apiErrorHandler(logger, http.StatusNotFound, "not_found", "not found")
|
|
methodNotAllowed := apiErrorHandler(logger, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
|
|
|
|
web, err := frontend.NewHandler(assets, logger, notFound, reservedPrefixes...)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
r := chi.NewRouter()
|
|
r.MethodNotAllowed(methodNotAllowed)
|
|
r.NotFound(notFound)
|
|
|
|
r.Get("/health", health(logger, version))
|
|
auth.Mount(r)
|
|
r.Route("/api", func(r chi.Router) {
|
|
r.MethodNotAllowed(methodNotAllowed)
|
|
r.NotFound(notFound)
|
|
})
|
|
// Catch-all for the PWA. Unknown /auth paths and /media (no routes yet)
|
|
// reach the frontend handler, which passes them to notFound rather than
|
|
// the SPA fallback.
|
|
r.Method(http.MethodGet, "/*", web)
|
|
r.Method(http.MethodHead, "/*", web)
|
|
return r, nil
|
|
}
|
|
|
|
type errorBody struct {
|
|
Error apiError `json:"error"`
|
|
}
|
|
|
|
type apiError struct {
|
|
Code string `json:"code"`
|
|
Message string `json:"message"`
|
|
Retryable bool `json:"retryable"`
|
|
}
|
|
|
|
// apiErrorHandler responds with status and a fixed, non-retryable API error.
|
|
func apiErrorHandler(logger *slog.Logger, status int, code, message string) http.HandlerFunc {
|
|
body, err := json.Marshal(errorBody{Error: apiError{
|
|
Code: code,
|
|
Message: message,
|
|
}})
|
|
if err != nil {
|
|
panic(err) // fixed string and bool fields cannot fail to marshal
|
|
}
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(status)
|
|
if _, err := w.Write(body); err != nil {
|
|
logger.WarnContext(r.Context(), "write error response", "code", code, "error", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
type healthResponse struct {
|
|
Status string `json:"status"`
|
|
Version string `json:"version"`
|
|
}
|
|
|
|
func health(logger *slog.Logger, version string) http.HandlerFunc {
|
|
body, err := json.Marshal(healthResponse{Status: "ok", Version: version})
|
|
if err != nil {
|
|
panic(err) // two string fields cannot fail to marshal
|
|
}
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusOK)
|
|
if _, err := w.Write(body); err != nil {
|
|
logger.WarnContext(r.Context(), "write health response", "error", err)
|
|
}
|
|
}
|
|
}
|