mk6i-open-oscar-server/server/webapi/server.go

package webapi

import (
	"context"
	"errors"
	"fmt"
	"log/slog"
	"net/http"

	"golang.org/x/sync/errgroup"

	"github.com/mk6i/open-oscar-server/server/webapi/handlers"
	"github.com/mk6i/open-oscar-server/server/webapi/middleware"
	"github.com/mk6i/open-oscar-server/state"
)

func NewServer(listeners []string, logger *slog.Logger, handler Handler, apiKeyValidator middleware.APIKeyValidator, sessionManager *state.WebAPISessionManager) *Server {
	servers := make([]*http.Server, 0, len(listeners))

	authMiddleware := middleware.NewAuthMiddleware(apiKeyValidator, logger)

	authHandler := &handlers.AuthHandler{
		AuthService: handler.AuthService,
		CookieBaker: handler.CookieBaker,
		Logger:      logger,
	}

	sessionHandler := &handlers.SessionHandler{
		SessionManager:      sessionManager,
		OSCARSessionManager: handler.SessionRetriever.(handlers.SessionManager),
		OSCARAuthService:    handler.AuthService,
		BuddyListRegistry:   handler.BuddyListRegistry,
		BuddyBroadcaster:    handler.BuddyBroadcaster,
		FeedbagService:      handler.FeedbagService,
		BuddyListManager:    handler.BuddyListManager.(*handlers.BuddyListManager),
		Logger:              logger,
		OServiceService:     handler.OServiceService,
		RecalcWarning:       handler.RecalcWarning,
		LowerWarnLevel:      handler.LowerWarnLevel,
		ChatSessionManager:  handler.ChatSessionManager,
	}

	eventsHandler := &handlers.EventsHandler{
		SessionManager: sessionManager,
		Logger:         logger,
	}

	presenceHandler := &handlers.PresenceHandler{
		SessionManager:   sessionManager,
		FeedbagService:   handler.FeedbagService,
		BuddyBroadcaster: handler.BuddyBroadcaster,
		LocateService:    handler.LocateService,
		Logger:           logger,
	}

	buddyListHandler := &handlers.BuddyListHandler{
		BuddyListManager: handler.BuddyListManager.(*handlers.BuddyListManager),
		Logger:           logger,
		FeedbagService:   handler.FeedbagService,
	}

	messagingHandler := &handlers.MessagingHandler{
		SessionManager: sessionManager,
		ICBMService:    handler.ICBMService,
		Logger:         logger,
	}

	preferenceHandler := &handlers.PreferenceHandler{
		SessionManager: sessionManager,
		FeedbagService: handler.FeedbagService,
		Logger:         logger,
	}

	oscarBridgeHandler := &handlers.OSCARBridgeHandler{
		SessionManager:   sessionManager,
		OSCARAuthService: handler.AuthService,
		CookieBaker:      handler.CookieBaker,
		Config:           handler.OSCARConfig,
		Logger:           logger,
	}

	for _, l := range listeners {
		mux := http.NewServeMux()

		// Exact root only. Pattern "GET /" matches every GET path in Go 1.22+ (prefix /), which
		// would steal /getAggregated and other lifestream URLs before stubs/404.
		mux.HandleFunc("GET /{$}", handler.GetHelloWorldHandler)

		// Authentication endpoint (public - no API key required for user login)
		// Using pattern with explicit method for Go 1.22+ routing
		mux.HandleFunc("POST /auth/clientLogin", func(w http.ResponseWriter, r *http.Request) {
			// Set CORS headers for public endpoint
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")

			authHandler.ClientLogin(w, r)
		})

		// Handle OPTIONS for CORS preflight
		mux.HandleFunc("OPTIONS /auth/clientLogin", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
			w.WriteHeader(http.StatusNoContent)
		})

		mux.HandleFunc("GET /auth/getToken", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
			authHandler.GetToken(w, r)
		})

		mux.HandleFunc("OPTIONS /auth/getToken", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Access-Control-Allow-Origin", "*")
			w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
			w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
			w.WriteHeader(http.StatusNoContent)
		})

		// Web AIM navigates the browser here on File > Logout; clear SSO state
		// and redirect to the login screen.
		mux.HandleFunc("GET /auth/logout", authHandler.Logout)

		mux.HandleFunc("GET /_cqr/login/login.psp", authHandler.LoginPSP)
		mux.HandleFunc("POST /_cqr/login/login.psp", authHandler.LoginPSP)

		// Authenticated Web AIM API endpoints
		// SessionInstance management - supports multiple auth methods (k, a, ts+sig_sha256)
		mux.Handle("GET /aim/startSession", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(sessionHandler.StartSession))))

		// End session - uses aimsid for auth, no k required
		mux.Handle("GET /aim/endSession", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, sessionHandler.EndSession))))

		// Event fetching - uses aimsid for auth, no k required
		mux.Handle("GET /aim/fetchEvents", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, eventsHandler.FetchEvents))))

		// Add temp buddy - uses aimsid for auth
		mux.Handle("GET /aim/addTempBuddy", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, buddyListHandler.AddTempBuddy))))

		mux.Handle("GET /aim/removeTempBuddy", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, buddyListHandler.RemoveTempBuddy))))

		aimStub := &handlers.AimStubHandler{Logger: logger}
		aimRoute := func(h http.HandlerFunc) http.Handler {
			return authMiddleware.AuthenticateFlexible(
				authMiddleware.CORSMiddleware(http.HandlerFunc(h)))
		}
		mux.Handle("GET /aim/setForwardDomain", aimRoute(aimStub.SetForwardDomain))
		mux.Handle("GET /aim/getData", aimRoute(aimStub.GetData))

		conversationStub := &handlers.ConversationStubHandler{
			SessionManager: sessionManager,
			Logger:         logger,
		}
		mux.Handle("GET /conversation/update", aimRoute(conversationStub.Update))
		mux.Handle("GET /conversation/close", aimRoute(conversationStub.Close))
		mux.Handle("GET /imlog/markRead", aimRoute(conversationStub.MarkRead))
		mux.Handle("GET /imlog/fetchStoredIMs", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, conversationStub.FetchStoredIMs))))

		// Presence and buddy list
		// GetPresence supports aimsid-based auth, so we use flexible auth
		mux.Handle("GET /presence/get", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, presenceHandler.GetPresence))))

		buddyListRoute := func(h func(http.ResponseWriter, *http.Request, *state.WebAPISession)) http.Handler {
			return authMiddleware.AuthenticateFlexible(
				authMiddleware.CORSMiddleware(
					authMiddleware.RequireSession(sessionManager, h)))
		}
		mux.Handle("GET /buddylist/addBuddy", buddyListRoute(buddyListHandler.AddBuddy))
		mux.Handle("GET /buddylist/addGroup", buddyListRoute(buddyListHandler.AddGroup))
		mux.Handle("GET /buddylist/removeBuddy", buddyListRoute(buddyListHandler.RemoveBuddy))
		mux.Handle("GET /buddylist/removeGroup", buddyListRoute(buddyListHandler.RemoveGroup))
		mux.Handle("GET /buddylist/renameGroup", buddyListRoute(buddyListHandler.RenameGroup))
		mux.Handle("GET /buddylist/moveBuddy", buddyListRoute(buddyListHandler.MoveBuddy))
		mux.Handle("GET /buddylist/setBuddyAttribute", buddyListRoute(buddyListHandler.SetBuddyAttribute))
		mux.Handle("GET /buddylist/setGroupAttribute", buddyListRoute(buddyListHandler.SetGroupAttribute))

		// sendIM supports aimsid-based auth, so we use flexible auth.
		// The Web AIM client POSTs the message body (non-IE browsers); IE uses GET.
		sendIMHandler := authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, messagingHandler.SendIM)))
		mux.Handle("GET /im/sendIM", sendIMHandler)
		mux.Handle("POST /im/sendIM", sendIMHandler)

		mux.Handle("GET /im/setTyping", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, messagingHandler.SetTyping))))

		// SetState only requires aimsid, no k parameter needed
		mux.Handle("GET /presence/setState", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, presenceHandler.SetState))))

		// These presence endpoints support aimsid-based auth where k is not required
		mux.Handle("GET /presence/setStatus", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, presenceHandler.SetStatus))))

		mux.Handle("GET /presence/setProfile", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, presenceHandler.SetProfile))))

		mux.Handle("GET /presence/getProfile", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, presenceHandler.GetProfile))))

		mux.HandleFunc("GET /presence/icon", presenceHandler.Icon)

		// These endpoints support aimsid-based auth, so we use a flexible auth approach
		mux.Handle("GET /preference/set", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, preferenceHandler.SetPreferences))))

		mux.Handle("GET /preference/get", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, preferenceHandler.GetPreferences))))

		mux.Handle("GET /preference/setPermitDeny", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, preferenceHandler.SetPermitDeny))))

		mux.Handle("GET /preference/getPermitDeny", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				authMiddleware.RequireSession(sessionManager, preferenceHandler.GetPermitDeny))))

		// OSCAR Bridge endpoint
		mux.Handle("GET /aim/startOSCARSession", authMiddleware.Authenticate(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(oscarBridgeHandler.StartOSCARSession))))

		// Expressions endpoint (for buddy icons, etc.)
		expressionsHandler := handlers.NewExpressionsHandler(logger)
		mux.Handle("GET /expressions/get", authMiddleware.AuthenticateFlexible(
			authMiddleware.CORSMiddleware(
				http.HandlerFunc(expressionsHandler.Get))))

		// Web AIM calls lifestream/* on the API host (e.g. /lifestream/getUserDetails).
		lifestreamStub := &handlers.UserInfoStubHandler{Logger: logger}
		lifestreamRoute := func(h http.HandlerFunc) http.Handler {
			return authMiddleware.AuthenticateFlexible(
				authMiddleware.CORSMiddleware(http.HandlerFunc(h)))
		}
		// getUserDetails returns a minimal AIM identity. Every other lifestream/*
		// method is an unimplemented social-feed feature; the subtree catch-all
		// acknowledges them with an empty 200 so the client doesn't error.
		mux.Handle("GET /lifestream/getUserDetails", lifestreamRoute(lifestreamStub.GetUserDetails))
		mux.Handle("GET /lifestream/", lifestreamRoute(lifestreamStub.EmptyOK))

		// Unmatched paths (pattern "/" matches anything not covered by routes above).
		mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
			logger.Debug("webapi 404", "method", r.Method, "path", r.URL.Path)
			handlers.SendError(w, http.StatusNotFound, "not found")
		})

		servers = append(servers, &http.Server{
			Addr:    l,
			Handler: middleware.RequestLogger(logger, mux),
		})
	}

	return &Server{
		servers: servers,
		logger:  logger,
	}
}

// Server hosts an HTTP endpoint capable of handling AIM-style Kerberos
// authentication. The messages are structured as SNACs transmitted over HTTP.
type Server struct {
	servers []*http.Server
	logger  *slog.Logger
}

func (s *Server) ListenAndServe() error {
	if len(s.servers) == 0 {
		s.logger.Debug("no webapi listeners defined")
		return nil
	}

	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	g, _ := errgroup.WithContext(ctx)
	for _, server := range s.servers {
		g.Go(func() error {
			s.logger.Info("starting server", "addr", server.Addr)
			if err := server.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
				cancel()
				return fmt.Errorf("unable to start webapi server: %w", err)
			}
			return nil
		})
	}

	return g.Wait()
}

func (s *Server) Shutdown(ctx context.Context) error {
	if len(s.servers) > 0 {
		for _, srv := range s.servers {
			_ = srv.Shutdown(ctx)
		}
		s.logger.Info("shutdown complete")
	}
	return nil
}