mk6i-open-oscar-server/server/webapi/server.go

package webapi

import (
	"context"
	"errors"
	"fmt"
	"log/slog"
	"net/http"

	"golang.org/x/sync/errgroup"

	"github.com/mk6i/open-oscar-server/server/webapi/handlers"
	"github.com/mk6i/open-oscar-server/server/webapi/middleware"
	"github.com/mk6i/open-oscar-server/state"
)

func NewServer(listeners []string, logger *slog.Logger, handler Handler, apiKeyValidator middleware.APIKeyValidator, sessionManager *state.WebAPISessionManager) *Server {
	servers := make([]*http.Server, 0, len(listeners))

	// Create authentication middleware
	authMiddleware := middleware.NewAuthMiddleware(apiKeyValidator, logger)

	// Create handlers
	authHandler := &handlers.AuthHandler{
		AuthService: handler.AuthService,
		CookieBaker: handler.CookieBaker,
		UserManager: handler.TOCConfigStore,
		Logger:      logger,
	}

	sessionHandler := &handlers.SessionHandler{
		SessionManager:      sessionManager,
		OSCARSessionManager: handler.SessionRetriever.(handlers.SessionManager),
		OSCARAuthService:    handler.AuthService,
		BuddyListService:    nil,
		BuddyListRegistry:   handler.BuddyListRegistry,
		BuddyBroadcaster:    handler.BuddyBroadcaster,
		FeedbagRetriever:    handler.FeedbagRetriever,
		OSCARBuddyService:   handler.BuddyService,
		BuddyListManager:    handler.BuddyListManager.(*handlers.BuddyListManager),
		Logger:              logger,
		OServiceService:     handler.OServiceService,
		RecalcWarning:       handler.RecalcWarning,
		LowerWarnLevel:      handler.LowerWarnLevel,
		ChatSessionManager:  handler.ChatSessionManager,
	}

	eventsHandler := &handlers.EventsHandler{
		SessionManager: sessionManager,
		Logger:         logger,
	}

	presenceHandler := &handlers.PresenceHandler{
		SessionManager:      sessionManager,
		SessionRetriever:    handler.SessionRetriever,
		FeedbagRetriever:    handler.FeedbagRetriever,
		BuddyBroadcaster:    handler.BuddyBroadcaster,
		ProfileManager:      handler.ProfileManager,
		RelationshipFetcher: handler.RelationshipFetcher,
		Logger:              logger,
	}

	buddyListHandler := handlers.NewBuddyListHandler(
		sessionManager,
		handler.BuddyListManager.(*handlers.BuddyListManager),
		logger,
		handler.FeedbagService,
	)

	// Phase 2: Messaging handler
	messagingHandler := &handlers.MessagingHandler{
		SessionManager:        sessionManager,
		MessageRelayer:        handler.MessageRelayer,
		OfflineMessageManager: handler.OfflineMessageManager,
		SessionRetriever:      handler.SessionRetriever,
		RelationshipFetcher:   handler.RelationshipFetcher,
		Logger:                logger,
	}

	// Phase 3: Preference handler
	preferenceHandler := &handlers.PreferenceHandler{
		SessionManager:    sessionManager,
		PreferenceManager: handler.PreferenceManager,
		PermitDenyManager: handler.PermitDenyManager,
		Logger:            logger,
	}

	// Phase 4: OSCAR Bridge handler
	oscarBridgeHandler := &handlers.OSCARBridgeHandler{
		SessionManager:   sessionManager,
		OSCARAuthService: handler.AuthService,
		CookieBaker:      handler.CookieBaker,
		BridgeStore:      handler.OSCARBridgeStore,
		Config:           handler.OSCARConfig,
		Logger:           logger,
	}

	// Phase 5: Chat handler
	chatHandler := &handlers.ChatHandler{
		SessionManager: sessionManager,
		ChatManager:    handler.ChatManager,
		Logger:         logger,
	}

	for _, l := range listeners {
		mux := http.NewServeMux()

		// Exact root only. Pattern "GET /" matches every GET path in Go 1.22+ (prefix /), which
		// would steal /getAggregated and other lifestream URLs before stubs/404.
		mux.HandleFunc("GET /{$}", handler.GetHelloWorldHandler)

		// Authentication endpoint (public - no API key required for user login)
		// Using pattern with explicit method for Go 1.22+ routing
		mux.HandleFunc("POST /auth/clientLogin", func(w http.ResponseWriter, r *http.Request) {
			// Set CORS headers for public endpoint
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")

			authHandler.ClientLogin(w, r)
		})

		// Handle OPTIONS for CORS preflight
		mux.HandleFunc("OPTIONS /auth/clientLogin", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
			w.WriteHeader(http.StatusNoContent)
		})

		mux.HandleFunc("GET /auth/getToken", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
			authHandler.GetToken(w, r)
		})

		mux.HandleFunc("OPTIONS /auth/getToken", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
			w.WriteHeader(http.StatusNoContent)
		})

		mux.HandleFunc("GET /_cqr/login/login.psp", authHandler.LoginPSP)
		mux.HandleFunc("POST /_cqr/login/login.psp", authHandler.LoginPSP)

		// Authenticated Web AIM API endpoints
		// SessionInstance management - supports multiple auth methods (k, a, ts+sig_sha256)
		mux.Handle("GET /aim/startSession", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(sessionHandler.StartSession))))

		// End session - uses aimsid for auth, no k required
		mux.Handle("GET /aim/endSession", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(sessionHandler.EndSession))))

		// Event fetching - uses aimsid for auth, no k required
		mux.Handle("GET /aim/fetchEvents", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(eventsHandler.FetchEvents))))

		// Add temp buddy - uses aimsid for auth
		mux.Handle("GET /aim/addTempBuddy", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				buddyListHandler.SessionMiddleware(buddyListHandler.AddTempBuddy))))

		mux.Handle("GET /aim/removeTempBuddy", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				buddyListHandler.SessionMiddleware(buddyListHandler.RemoveTempBuddy))))

		aimStub := &handlers.AimStubHandler{Logger: logger}
		aimRoute := func(h http.HandlerFunc) http.Handler {
			return authMiddleware.AuthenticateFlexible(
				authMiddleware.CORSMiddleware(http.HandlerFunc(h)))
		}
		mux.Handle("GET /aim/setForwardDomain", aimRoute(aimStub.SetForwardDomain))
		mux.Handle("GET /aim/getData", aimRoute(aimStub.GetData))

		conversationStub := &handlers.ConversationStubHandler{
			SessionManager: sessionManager,
			Logger:         logger,
		}
		mux.Handle("GET /conversation/update", aimRoute(conversationStub.Update))
		mux.Handle("GET /conversation/close", aimRoute(conversationStub.Close))
		mux.Handle("GET /imlog/markRead", aimRoute(conversationStub.MarkRead))
		mux.Handle("GET /imlog/fetchStoredIMs", aimRoute(conversationStub.FetchStoredIMs))

		// Presence and buddy list
		// GetPresence supports aimsid-based auth, so we use flexible auth
		mux.Handle("GET /presence/get", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(presenceHandler.GetPresence))))

		mux.Handle("/buddylist/", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(buddyListHandler)))

		// Phase 2: Messaging endpoints
		// sendIM supports aimsid-based auth, so we use flexible auth.
		// The Web AIM client POSTs the message body (non-IE browsers); IE uses GET.
		sendIMHandler := authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(messagingHandler.SendIM)))
		mux.Handle("GET /im/sendIM", sendIMHandler)
		mux.Handle("POST /im/sendIM", sendIMHandler)

		mux.Handle("GET /im/setTyping", authMiddleware.Authenticate(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(messagingHandler.SetTyping))))

		// Phase 2: Presence management endpoints
		// SetState only requires aimsid, no k parameter needed
		mux.Handle("GET /presence/setState", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(presenceHandler.SetState))))

		// These presence endpoints support aimsid-based auth where k is not required
		mux.Handle("GET /presence/setStatus", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(presenceHandler.SetStatus))))

		mux.Handle("GET /presence/setProfile", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(presenceHandler.SetProfile))))

		mux.Handle("GET /presence/getProfile", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(presenceHandler.GetProfile))))

		// Phase 2: Presence icon endpoint (no auth required)
		mux.HandleFunc("GET /presence/icon", presenceHandler.Icon)

		// Phase 3: Preference management endpoints
		// These endpoints support aimsid-based auth, so we use a flexible auth approach
		mux.Handle("GET /preference/set", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(preferenceHandler.SetPreferences))))

		mux.Handle("GET /preference/get", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(preferenceHandler.GetPreferences))))

		mux.Handle("GET /preference/setPermitDeny", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(preferenceHandler.SetPermitDeny))))

		mux.Handle("GET /preference/getPermitDeny", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(preferenceHandler.GetPermitDeny))))

		// Phase 4: Advanced Features
		// OSCAR Bridge endpoint
		mux.Handle("GET /aim/startOSCARSession", authMiddleware.Authenticate(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(oscarBridgeHandler.StartOSCARSession))))

		// Expressions endpoint (for buddy icons, etc.)
		expressionsHandler := handlers.NewExpressionsHandler(logger)
		mux.Handle("GET /expressions/get", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(expressionsHandler.Get))))

		// Web AIM calls lifestream/* on the API host (e.g. /lifestream/getUserDetails).
		lifestreamStub := &handlers.UserInfoStubHandler{Logger: logger}
		lifestreamRoute := func(h http.HandlerFunc) http.Handler {
			return authMiddleware.AuthenticateFlexible(
				authMiddleware.CORSMiddleware(http.HandlerFunc(h)))
		}
		mux.Handle("GET /lifestream/getUserDetails", lifestreamRoute(lifestreamStub.GetUserDetails))
		mux.Handle("GET /lifestream/getLocationsFollowing", lifestreamRoute(lifestreamStub.GetLocationsFollowing))
		for _, p := range []string{
			"getAggregated",
			"getNotifications",
			"getSingle",
			"getNotificationFilter",
			"heyGetNotifications",
			"heyMarkNotifications",
			"deleteNotification",
			"commonsFollow",
			"commonsUnfollow",
			"tdAddService",
			"tdRemoveService",
			"setUserPreference",
			"getActivity",
			"addComment",
			"deleteComment",
			"deleteActivity",
			"addLike",
			"deleteLike",
			"setNotificationFilter",
			"heyTakeAction",
		} {
			mux.Handle("GET /lifestream/"+p, lifestreamRoute(lifestreamStub.EmptyOK))
		}

		// Phase 5: Chat room endpoints
		// All chat endpoints use aimsid for authentication
		mux.Handle("GET /chat/createAndJoinChat", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(chatHandler.CreateAndJoinChat))))

		mux.Handle("GET /chat/sendMessage", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(chatHandler.SendMessage))))

		mux.Handle("GET /chat/setTyping", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(chatHandler.SetTyping))))

		mux.Handle("GET /chat/leaveChat", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(chatHandler.LeaveChat))))

		// Unmatched paths (pattern "/" matches anything not covered by routes above).
		mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
			logger.Debug("webapi 404", "method", r.Method, "path", r.URL.Path)
			handlers.SendError(w, http.StatusNotFound, "not found")
		})

		servers = append(servers, &http.Server{
			Addr:    l,
			Handler: middleware.RequestLogger(logger, mux),
		})
	}

	return &Server{
		servers: servers,
		logger:  logger,
	}
}

// Server hosts an HTTP endpoint capable of handling AIM-style Kerberos
// authentication. The messages are structured as SNACs transmitted over HTTP.
type Server struct {
	servers []*http.Server
	logger  *slog.Logger
}

func (s *Server) ListenAndServe() error {
	if len(s.servers) == 0 {
		s.logger.Debug("no webapi listeners defined")
		return nil
	}

	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	g, _ := errgroup.WithContext(ctx)
	for _, server := range s.servers {
		g.Go(func() error {
			s.logger.Info("starting server", "addr", server.Addr)
			if err := server.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
				cancel()
				return fmt.Errorf("unable to start webapi server: %w", err)
			}
			return nil
		})
	}

	return g.Wait()
}

func (s *Server) Shutdown(ctx context.Context) error {
	if len(s.servers) > 0 {
		for _, srv := range s.servers {
			_ = srv.Shutdown(ctx)
		}
		s.logger.Info("shutdown complete")
	}
	return nil
}