feat: add internal cluster admin endpoints

backend/internal/operator/middleware.go

@@ -0,0 +1,46 @@
+package operator
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"net/http"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+const HeaderName = "X-ProxUI-Operator-Token"
+
+type Middleware struct {
+	token string
+}
+
+func NewMiddleware(token string) Middleware {
+	return Middleware{token: token}
+}
+
+func (m Middleware) RequireOperator(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if m.token == "" {
+			writeError(w, http.StatusServiceUnavailable, "operator_auth_not_configured")
+			return
+		}
+
+		provided := r.Header.Get(HeaderName)
+		if subtle.ConstantTimeCompare([]byte(provided), []byte(m.token)) != 1 {
+			writeError(w, http.StatusForbidden, "operator_forbidden")
+			return
+		}
+
+		operatorContext := membership.ContextWithMembership(r.Context(), membership.Membership{
+			Role: rbac.RoleOperator,
+		})
+		next.ServeHTTP(w, r.WithContext(operatorContext))
+	})
+}
+
+func writeError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+}

backend/internal/operator/middleware_test.go

@@ -0,0 +1,68 @@
+package operator
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+func TestRequireOperatorAcceptsConfiguredToken(t *testing.T) {
+	middleware := NewMiddleware("operator-secret")
+	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		operator, ok := membership.FromRequest(r)
+		if !ok {
+			t.Fatal("operator role missing from request")
+		}
+		if operator.Role != rbac.RoleOperator {
+			t.Fatalf("role = %q, want %q", operator.Role, rbac.RoleOperator)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
+	req.Header.Set(HeaderName, "operator-secret")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
+	}
+}
+
+func TestRequireOperatorRejectsWrongToken(t *testing.T) {
+	middleware := NewMiddleware("operator-secret")
+	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
+	req.Header.Set(HeaderName, "wrong")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func TestRequireOperatorRejectsMissingConfiguredToken(t *testing.T) {
+	middleware := NewMiddleware("")
+	handler := middleware.RequireOperator(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/internal/clusters", nil)
+	req.Header.Set(HeaderName, "operator-secret")
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusServiceUnavailable)
+	}
+}