feat: add internal cluster admin endpoints

2026-06-11 09:35:25 +02:00
parent 376f6249b2
commit fd9a99a6d8
15 changed files with 561 additions and 7 deletions
@@ -36,6 +36,7 @@ type StoredCluster struct {
 type Storage interface {
 	Get(ctx context.Context, id string) (StoredCluster, bool, error)
 	Upsert(ctx context.Context, cluster StoredCluster) (StoredCluster, error)
+	SetStatus(ctx context.Context, id string, status string) (StoredCluster, bool, error)
 }

 type Repository struct {
@@ -120,6 +121,23 @@ func (r Repository) UpsertCluster(ctx context.Context, cluster Cluster) (Cluster
 	}, nil
 }

+func (r Repository) SetClusterStatus(ctx context.Context, id string, status string) (Cluster, bool, error) {
+	stored, found, err := r.storage.SetStatus(ctx, strings.TrimSpace(id), strings.TrimSpace(status))
+	if err != nil || !found {
+		return Cluster{}, found, err
+	}
+
+	return Cluster{
+		ID:             stored.ID,
+		Name:           stored.Name,
+		APIEndpoint:    stored.APIEndpoint,
+		TLSFingerprint: stored.TLSFingerprint,
+		TokenID:        stored.TokenID,
+		Status:         stored.Status,
+		CreatedAt:      stored.CreatedAt,
+	}, true, nil
+}
+
 type SQLStorage struct {
 	db *sql.DB
 }
@@ -203,3 +221,30 @@ func (s SQLStorage) Upsert(ctx context.Context, cluster StoredCluster) (StoredCl

 	return stored, nil
 }
+
+func (s SQLStorage) SetStatus(ctx context.Context, id string, status string) (StoredCluster, bool, error) {
+	var stored StoredCluster
+	err := s.db.QueryRowContext(ctx, `
+		update public.clusters
+		set status = $2
+		where id = $1
+		returning id::text, name, api_endpoint, tls_fingerprint, encrypted_token, token_id, status, created_at
+	`, id, status).Scan(
+		&stored.ID,
+		&stored.Name,
+		&stored.APIEndpoint,
+		&stored.TLSFingerprint,
+		&stored.EncryptedToken,
+		&stored.TokenID,
+		&stored.Status,
+		&stored.CreatedAt,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return StoredCluster{}, false, nil
+	}
+	if err != nil {
+		return StoredCluster{}, false, err
+	}
+
+	return stored, true, nil
+}
@@ -83,6 +83,37 @@ func TestRepositoryReturnsErrorWhenStoredTokenUsesWrongKey(t *testing.T) {
 	}
 }

+func TestRepositorySetsClusterStatusWithoutDecryptingToken(t *testing.T) {
+	storage := newMemoryStorage()
+	repository := NewRepositoryWithStorage(storage, testCipher(t, 1))
+
+	_, err := repository.UpsertCluster(context.Background(), Cluster{
+		ID:             "cluster-1",
+		Name:           "Lab",
+		APIEndpoint:    "https://pve.example.test:8006",
+		TLSFingerprint: "AA:BB",
+		TokenID:        "root@pam!proxui",
+		TokenSecret:    "secret-token",
+	})
+	if err != nil {
+		t.Fatalf("UpsertCluster() error = %v", err)
+	}
+
+	updated, found, err := repository.SetClusterStatus(context.Background(), "cluster-1", "disabled")
+	if err != nil {
+		t.Fatalf("SetClusterStatus() error = %v", err)
+	}
+	if !found {
+		t.Fatal("SetClusterStatus() found = false, want true")
+	}
+	if updated.Status != "disabled" {
+		t.Fatalf("Status = %q, want disabled", updated.Status)
+	}
+	if updated.TokenSecret != "" {
+		t.Fatal("SetClusterStatus() returned token secret")
+	}
+}
+
 func testCipher(t *testing.T, value byte) encryption.Cipher {
 	t.Helper()

@@ -124,3 +155,13 @@ func (s *memoryStorage) Upsert(_ context.Context, cluster StoredCluster) (Stored
 	s.records[cluster.ID] = cluster
 	return cluster, nil
 }
+
+func (s *memoryStorage) SetStatus(_ context.Context, id string, status string) (StoredCluster, bool, error) {
+	cluster, ok := s.records[id]
+	if !ok {
+		return StoredCluster{}, false, nil
+	}
+	cluster.Status = status
+	s.records[id] = cluster
+	return cluster, true, nil
+}
@@ -0,0 +1,160 @@
+package clusteradmin
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	"proxui/backend/internal/cluster"
+)
+
+type Repository interface {
+	UpsertCluster(ctx context.Context, cluster cluster.Cluster) (cluster.Cluster, error)
+	SetClusterStatus(ctx context.Context, id string, status string) (cluster.Cluster, bool, error)
+}
+
+type Handler struct {
+	repository Repository
+}
+
+func NewHandler(repository Repository) Handler {
+	return Handler{repository: repository}
+}
+
+func (h Handler) CreateCluster(w http.ResponseWriter, r *http.Request) {
+	var request upsertClusterRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+
+	saved, err := h.repository.UpsertCluster(r.Context(), cluster.Cluster{
+		Name:           request.Name,
+		APIEndpoint:    request.APIEndpoint,
+		TLSFingerprint: request.TLSFingerprint,
+		TokenID:        request.TokenID,
+		TokenSecret:    request.TokenSecret,
+		Status:         request.Status,
+	})
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "cluster_upsert_failed")
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, clusterResponseFromCluster(saved))
+}
+
+func (h Handler) UpdateCluster(w http.ResponseWriter, r *http.Request) {
+	clusterID := r.PathValue("clusterID")
+	if clusterID == "" {
+		writeError(w, http.StatusBadRequest, "cluster_id_required")
+		return
+	}
+
+	var request upsertClusterRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+
+	saved, err := h.repository.UpsertCluster(r.Context(), cluster.Cluster{
+		ID:             clusterID,
+		Name:           request.Name,
+		APIEndpoint:    request.APIEndpoint,
+		TLSFingerprint: request.TLSFingerprint,
+		TokenID:        request.TokenID,
+		TokenSecret:    request.TokenSecret,
+		Status:         request.Status,
+	})
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "cluster_upsert_failed")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, clusterResponseFromCluster(saved))
+}
+
+func (h Handler) SetClusterStatus(w http.ResponseWriter, r *http.Request) {
+	clusterID := r.PathValue("clusterID")
+	if clusterID == "" {
+		writeError(w, http.StatusBadRequest, "cluster_id_required")
+		return
+	}
+
+	var request setStatusRequest
+	if !decodeJSON(w, r, &request) {
+		return
+	}
+	if strings.TrimSpace(request.Status) == "" {
+		writeError(w, http.StatusBadRequest, "status_required")
+		return
+	}
+
+	updated, found, err := h.repository.SetClusterStatus(r.Context(), clusterID, request.Status)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "cluster_status_update_failed")
+		return
+	}
+	if !found {
+		writeError(w, http.StatusNotFound, "cluster_not_found")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, clusterResponseFromCluster(updated))
+}
+
+type upsertClusterRequest struct {
+	Name           string `json:"name"`
+	APIEndpoint    string `json:"api_endpoint"`
+	TLSFingerprint string `json:"tls_fingerprint"`
+	TokenID        string `json:"token_id"`
+	TokenSecret    string `json:"token_secret"`
+	Status         string `json:"status"`
+}
+
+type setStatusRequest struct {
+	Status string `json:"status"`
+}
+
+type clusterResponse struct {
+	ID             string    `json:"id"`
+	Name           string    `json:"name"`
+	APIEndpoint    string    `json:"api_endpoint"`
+	TLSFingerprint string    `json:"tls_fingerprint"`
+	TokenID        string    `json:"token_id"`
+	Status         string    `json:"status"`
+	CreatedAt      time.Time `json:"created_at"`
+}
+
+func clusterResponseFromCluster(cluster cluster.Cluster) clusterResponse {
+	return clusterResponse{
+		ID:             cluster.ID,
+		Name:           cluster.Name,
+		APIEndpoint:    cluster.APIEndpoint,
+		TLSFingerprint: cluster.TLSFingerprint,
+		TokenID:        cluster.TokenID,
+		Status:         cluster.Status,
+		CreatedAt:      cluster.CreatedAt,
+	}
+}
+
+func decodeJSON(w http.ResponseWriter, r *http.Request, target any) bool {
+	defer r.Body.Close()
+	decoder := json.NewDecoder(r.Body)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_json")
+		return false
+	}
+	return true
+}
+
+func writeJSON(w http.ResponseWriter, status int, body any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(body)
+}
+
+func writeError(w http.ResponseWriter, status int, message string) {
+	writeJSON(w, status, map[string]string{"error": message})
+}
@@ -0,0 +1,157 @@
+package clusteradmin
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"net/http"
+	"net/http/httptest"
+
+	"proxui/backend/internal/cluster"
+)
+
+func TestCreateClusterDoesNotReturnTokenSecret(t *testing.T) {
+	repository := newStubRepository()
+	handler := NewHandler(repository)
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", strings.NewReader(`{
+		"name": "Lab",
+		"api_endpoint": "https://pve.example.test:8006/api2/json",
+		"tls_fingerprint": "AA:BB",
+		"token_id": "root@pam!proxui",
+		"token_secret": "secret-token"
+	}`))
+	rec := httptest.NewRecorder()
+
+	handler.CreateCluster(rec, req)
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusCreated)
+	}
+	if repository.saved.TokenSecret != "secret-token" {
+		t.Fatalf("saved token secret = %q", repository.saved.TokenSecret)
+	}
+	if bytes.Contains(rec.Body.Bytes(), []byte("secret-token")) {
+		t.Fatal("response contains token secret")
+	}
+
+	var response clusterResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if response.TokenID != "root@pam!proxui" {
+		t.Fatalf("TokenID = %q, want root@pam!proxui", response.TokenID)
+	}
+}
+
+func TestUpdateClusterUsesPathIDAndRotatesToken(t *testing.T) {
+	repository := newStubRepository()
+	handler := NewHandler(repository)
+
+	req := httptest.NewRequest(http.MethodPut, "/internal/clusters/cluster-1", strings.NewReader(`{
+		"name": "Lab",
+		"api_endpoint": "https://pve.example.test:8006/api2/json",
+		"tls_fingerprint": "AA:BB",
+		"token_id": "root@pam!proxui",
+		"token_secret": "rotated-token",
+		"status": "active"
+	}`))
+	req.SetPathValue("clusterID", "cluster-1")
+	rec := httptest.NewRecorder()
+
+	handler.UpdateCluster(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	if repository.saved.ID != "cluster-1" {
+		t.Fatalf("saved ID = %q, want cluster-1", repository.saved.ID)
+	}
+	if repository.saved.TokenSecret != "rotated-token" {
+		t.Fatalf("saved token secret = %q", repository.saved.TokenSecret)
+	}
+	if bytes.Contains(rec.Body.Bytes(), []byte("rotated-token")) {
+		t.Fatal("response contains rotated token secret")
+	}
+}
+
+func TestSetClusterStatus(t *testing.T) {
+	repository := newStubRepository()
+	handler := NewHandler(repository)
+
+	req := httptest.NewRequest(http.MethodPatch, "/internal/clusters/cluster-1/status", strings.NewReader(`{"status":"disabled"}`))
+	req.SetPathValue("clusterID", "cluster-1")
+	rec := httptest.NewRecorder()
+
+	handler.SetClusterStatus(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	if repository.statusID != "cluster-1" {
+		t.Fatalf("status ID = %q, want cluster-1", repository.statusID)
+	}
+	if repository.status != "disabled" {
+		t.Fatalf("status = %q, want disabled", repository.status)
+	}
+}
+
+func TestSetClusterStatusReturnsNotFound(t *testing.T) {
+	repository := newStubRepository()
+	repository.statusFound = false
+	handler := NewHandler(repository)
+
+	req := httptest.NewRequest(http.MethodPatch, "/internal/clusters/missing/status", strings.NewReader(`{"status":"disabled"}`))
+	req.SetPathValue("clusterID", "missing")
+	rec := httptest.NewRecorder()
+
+	handler.SetClusterStatus(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNotFound)
+	}
+}
+
+type stubRepository struct {
+	saved       cluster.Cluster
+	statusID    string
+	status      string
+	statusFound bool
+}
+
+func newStubRepository() *stubRepository {
+	return &stubRepository{statusFound: true}
+}
+
+func (s *stubRepository) UpsertCluster(_ context.Context, cluster cluster.Cluster) (cluster.Cluster, error) {
+	s.saved = cluster
+	if cluster.ID == "" {
+		cluster.ID = "cluster-1"
+	}
+	if cluster.Status == "" {
+		cluster.Status = "active"
+	}
+	cluster.CreatedAt = time.Date(2026, 6, 11, 12, 0, 0, 0, time.UTC)
+	return cluster, nil
+}
+
+func (s *stubRepository) SetClusterStatus(_ context.Context, id string, status string) (cluster.Cluster, bool, error) {
+	s.statusID = id
+	s.status = status
+	if !s.statusFound {
+		return cluster.Cluster{}, false, nil
+	}
+	return cluster.Cluster{
+		ID:             id,
+		Name:           "Lab",
+		APIEndpoint:    "https://pve.example.test:8006/api2/json",
+		TLSFingerprint: "AA:BB",
+		TokenID:        "root@pam!proxui",
+		Status:         status,
+		CreatedAt:      time.Date(2026, 6, 11, 12, 0, 0, 0, time.UTC),
+	}, true, nil
+}
@@ -0,0 +1,46 @@
+package operator
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"net/http"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+const HeaderName = "X-ProxUI-Operator-Token"
+
+type Middleware struct {
+	token string
+}
+
+func NewMiddleware(token string) Middleware {
+	return Middleware{token: token}
+}
+
+func (m Middleware) RequireOperator(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if m.token == "" {
+			writeError(w, http.StatusServiceUnavailable, "operator_auth_not_configured")
+			return
+		}
+
+		provided := r.Header.Get(HeaderName)
+		if subtle.ConstantTimeCompare([]byte(provided), []byte(m.token)) != 1 {
+			writeError(w, http.StatusForbidden, "operator_forbidden")
+			return
+		}
+
+		operatorContext := membership.ContextWithMembership(r.Context(), membership.Membership{
+			Role: rbac.RoleOperator,
+		})
+		next.ServeHTTP(w, r.WithContext(operatorContext))
+	})
+}
+
+func writeError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+}
@@ -0,0 +1,68 @@
+package operator
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+func TestRequireOperatorAcceptsConfiguredToken(t *testing.T) {
+	middleware := NewMiddleware("operator-secret")
+	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		operator, ok := membership.FromRequest(r)
+		if !ok {
+			t.Fatal("operator role missing from request")
+		}
+		if operator.Role != rbac.RoleOperator {
+			t.Fatalf("role = %q, want %q", operator.Role, rbac.RoleOperator)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
+	req.Header.Set(HeaderName, "operator-secret")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
+	}
+}
+
+func TestRequireOperatorRejectsWrongToken(t *testing.T) {
+	middleware := NewMiddleware("operator-secret")
+	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
+	req.Header.Set(HeaderName, "wrong")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func TestRequireOperatorRejectsMissingConfiguredToken(t *testing.T) {
+	middleware := NewMiddleware("")
+	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
+	req.Header.Set(HeaderName, "operator-secret")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusServiceUnavailable)
+	}
+}
@@ -3,10 +3,11 @@ package rbac
 type Role string

 const (
-	RoleOwner  Role = "owner"
-	RoleAdmin  Role = "admin"
-	RoleMember Role = "member"
-	RoleViewer Role = "viewer"
+	RoleOwner    Role = "owner"
+	RoleAdmin    Role = "admin"
+	RoleMember   Role = "member"
+	RoleViewer   Role = "viewer"
+	RoleOperator Role = "operator"
 )

 type Action string
@@ -72,6 +73,9 @@ var permissions = map[Role]map[Action]bool{
 		ActionProjectRead,
 		ActionSSHKeyRead,
 	),
+	RoleOperator: allow(
+		ActionClusterManage,
+	),
 }

 func allow(actions ...Action) map[Action]bool {
@@ -21,6 +21,8 @@ func TestCan(t *testing.T) {
 		{name: "viewer cannot power vm", role: RoleViewer, action: ActionVMPower, want: false},
 		{name: "viewer cannot create vm", role: RoleViewer, action: ActionVMCreate, want: false},
 		{name: "tenant roles cannot manage cluster", role: RoleOwner, action: ActionClusterManage, want: false},
+		{name: "operator can manage cluster", role: RoleOperator, action: ActionClusterManage, want: true},
+		{name: "operator cannot read tenant vms", role: RoleOperator, action: ActionVMRead, want: false},
 		{name: "unknown role denied", role: Role("unknown"), action: ActionVMRead, want: false},
 		{name: "unknown action denied", role: RoleOwner, action: Action("unknown.action"), want: false},
 	}
@@ -35,7 +37,7 @@ func TestCan(t *testing.T) {
 }

 func TestPolicyMatrix(t *testing.T) {
-	roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer}
+	roles := []Role{RoleOwner, RoleAdmin, RoleMember, RoleViewer, RoleOperator}
 	actions := []Action{
 		ActionVMRead,
 		ActionVMPower,