Ilia Denisov
aafdd46a4b
Server-rendered admin console in the backend at /_gm (internal/adminconsole), fronted on the gateway's public listener by Basic-Auth + a verbatim reverse proxy (mounted on the edge mux below the h2c wrap). A same-origin check guards its POSTs; no operator identity is tracked. This supersedes the Stage 6 gateway-fronts- /api/v1/admin model: GATEWAY_ADMIN_ADDR and the backend /api/v1/admin ping are dropped and gateway/internal/admin is repurposed to the verbatim proxy. - Complaints: migration 00008 (+ jetgen) adds disposition/resolution_note/ resolved_at/applied_in_version + the deferred status CHECK; resolution feeds a query-derived pending dictionary-change pipeline (marked applied after a reload). - Dictionary hot-reload: per-version subdir BACKEND_DICT_DIR/<version>/ via the new Registry.LoadAvailable; engine.OpenWithVersions restores resident versions on restart. Partially addresses TODO-2. - Broadcasts: a backend Telegram-connector client (internal/connector, BACKEND_CONNECTOR_ADDR) for SendToUser / SendToGameChannel (discharges the Stage 9 forward-note). - Admin reads: account.ListAccounts/CountAccounts/Identities and game.ListGames/CountGames/GameByID/ListComplaints/GetComplaint/CountComplaints/ ResolveComplaint/DictionaryChanges/MarkChangesApplied. - Tests: adminconsole render, engine reload, same-origin guard, gateway verbatim proxy + h2c console mount, inttest complaint pipeline + list/count + /_gm console. - Docs: PLAN (Stage 10 done + refinements + TODO-2), ARCHITECTURE §1/§5/§6/§12/§13, FUNCTIONAL (+_ru), TESTING, backend/gateway READMEs.
63 lines
2.3 KiB
Go
63 lines
2.3 KiB
Go
// Package admin is the gateway's admin edge: HTTP Basic-Auth in front of a reverse
|
|
// proxy that forwards the operator's browser to the backend's server-rendered admin
|
|
// console under /_gm. The proxy is mounted at /_gm/ on the gateway's public listener
|
|
// (below the h2c wrap, see internal/connectsrv) and forwards verbatim — an inbound
|
|
// /_gm/<rest> reaches <backendURL>/_gm/<rest>, preserving the inbound Host so the
|
|
// backend's same-origin check sees the public origin. The backend trusts the gateway
|
|
// on this segment and adds the console's same-origin CSRF guard
|
|
// (docs/ARCHITECTURE.md §12).
|
|
package admin
|
|
|
|
import (
|
|
"crypto/subtle"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
// NewProxy returns a handler that checks Basic-Auth against user/password and
|
|
// reverse-proxies the request verbatim to the backend: the inbound path is
|
|
// preserved, so /_gm/<rest> reaches <backendURL>/_gm/<rest>. It is mounted at /_gm/
|
|
// on the gateway's public listener.
|
|
func NewProxy(backendURL, user, password string, log *zap.Logger) (http.Handler, error) {
|
|
target, err := url.Parse(backendURL)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("admin: parse backend url %q: %w", backendURL, err)
|
|
}
|
|
if log == nil {
|
|
log = zap.NewNop()
|
|
}
|
|
proxy := &httputil.ReverseProxy{
|
|
Rewrite: func(pr *httputil.ProxyRequest) {
|
|
pr.SetURL(target) // backend scheme+host; the inbound /_gm path is preserved
|
|
pr.Out.Host = pr.In.Host // keep the public Host for the backend same-origin check
|
|
},
|
|
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
|
|
log.Warn("admin proxy upstream error", zap.String("path", r.URL.Path), zap.Error(err))
|
|
w.WriteHeader(http.StatusBadGateway)
|
|
},
|
|
}
|
|
return basicAuth(user, password, proxy), nil
|
|
}
|
|
|
|
// basicAuth wraps next with a constant-time Basic-Auth check.
|
|
func basicAuth(user, password string, next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
u, p, ok := r.BasicAuth()
|
|
if !ok || !equal(u, user) || !equal(p, password) {
|
|
w.Header().Set("WWW-Authenticate", `Basic realm="scrabble-admin"`)
|
|
http.Error(w, "unauthorized", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// equal compares two strings in constant time.
|
|
func equal(a, b string) bool {
|
|
return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
|
|
}
|