proxui/backend/internal/proxmox/client.go

package proxmox

import (
	"bytes"
	"context"
	"crypto/sha256"
	"crypto/subtle"
	"crypto/tls"
	"crypto/x509"
	"encoding/hex"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"
	"time"

	"proxui/backend/internal/cluster"
)

const defaultTimeout = 15 * time.Second

type Client struct {
	baseURL     *url.URL
	tokenID     string
	tokenSecret string
	httpClient  *http.Client
	retries     int
}

type Option func(*clientConfig)

type clientConfig struct {
	timeout time.Duration
	retries int
	rootCAs *x509.CertPool
}

func WithTimeout(timeout time.Duration) Option {
	return func(cfg *clientConfig) {
		cfg.timeout = timeout
	}
}

func WithRetries(retries int) Option {
	return func(cfg *clientConfig) {
		cfg.retries = retries
	}
}

func WithRootCAs(rootCAs *x509.CertPool) Option {
	return func(cfg *clientConfig) {
		cfg.rootCAs = rootCAs
	}
}

func NewClient(cluster cluster.Cluster, opts ...Option) (*Client, error) {
	baseURL, err := url.Parse(strings.TrimRight(cluster.APIEndpoint, "/"))
	if err != nil {
		return nil, fmt.Errorf("parse proxmox api endpoint: %w", err)
	}
	if baseURL.Scheme != "https" || baseURL.Host == "" {
		return nil, fmt.Errorf("proxmox api endpoint must be an https url")
	}
	if strings.TrimSpace(cluster.TokenID) == "" {
		return nil, fmt.Errorf("proxmox token id is required")
	}
	if strings.TrimSpace(cluster.TokenSecret) == "" {
		return nil, fmt.Errorf("proxmox token secret is required")
	}

	fingerprint, err := normalizeFingerprint(cluster.TLSFingerprint)
	if err != nil {
		return nil, err
	}

	cfg := clientConfig{
		timeout: defaultTimeout,
		retries: 2,
	}
	for _, opt := range opts {
		opt(&cfg)
	}
	if cfg.timeout <= 0 {
		return nil, fmt.Errorf("timeout must be greater than 0")
	}
	if cfg.retries < 0 {
		return nil, fmt.Errorf("retries must not be negative")
	}

	return &Client{
		baseURL:     baseURL,
		tokenID:     cluster.TokenID,
		tokenSecret: cluster.TokenSecret,
		httpClient: &http.Client{
			Timeout: cfg.timeout,
			Transport: &http.Transport{
				Proxy: http.ProxyFromEnvironment,
				TLSClientConfig: &tls.Config{
					MinVersion: tls.VersionTLS12,
					RootCAs:    cfg.rootCAs,
					VerifyConnection: func(state tls.ConnectionState) error {
						return verifyFingerprint(state, fingerprint)
					},
				},
			},
		},
		retries: cfg.retries,
	}, nil
}

func (c *Client) Get(ctx context.Context, path string) (*http.Response, error) {
	return c.Do(ctx, http.MethodGet, path, nil)
}

func (c *Client) Post(ctx context.Context, path string, body []byte) (*http.Response, error) {
	return c.Do(ctx, http.MethodPost, path, body)
}

func (c *Client) Put(ctx context.Context, path string, body []byte) (*http.Response, error) {
	return c.Do(ctx, http.MethodPut, path, body)
}

func (c *Client) Delete(ctx context.Context, path string) (*http.Response, error) {
	return c.Do(ctx, http.MethodDelete, path, nil)
}

func (c *Client) Do(ctx context.Context, method string, path string, body []byte) (*http.Response, error) {
	var lastErr error
	attempts := c.retries + 1
	for attempt := 0; attempt < attempts; attempt++ {
		response, err := c.doOnce(ctx, method, path, body)
		if err == nil && response.StatusCode < http.StatusInternalServerError {
			return response, nil
		}
		if err == nil {
			_, _ = io.Copy(io.Discard, response.Body)
			_ = response.Body.Close()
			lastErr = fmt.Errorf("proxmox returned %s", response.Status)
		} else {
			lastErr = err
		}

		if ctx.Err() != nil {
			return nil, ctx.Err()
		}
	}

	return nil, lastErr
}

func (c *Client) doOnce(ctx context.Context, method string, path string, body []byte) (*http.Response, error) {
	requestURL := c.resolvePath(path)
	request, err := http.NewRequestWithContext(ctx, method, requestURL, bytes.NewReader(body))
	if err != nil {
		return nil, err
	}
	request.Header.Set("Authorization", fmt.Sprintf("PVEAPIToken=%s=%s", c.tokenID, c.tokenSecret))
	if body != nil {
		request.Header.Set("Content-Type", "application/json")
	}

	return c.httpClient.Do(request)
}

func (c *Client) resolvePath(path string) string {
	resolved := *c.baseURL
	resolved.Path = joinURLPath(c.baseURL.Path, path)
	return resolved.String()
}

func joinURLPath(basePath string, path string) string {
	basePath = strings.TrimRight(basePath, "/")
	path = strings.TrimLeft(path, "/")
	if path == "" {
		return basePath
	}
	return basePath + "/" + path
}

func normalizeFingerprint(fingerprint string) (string, error) {
	normalized := strings.NewReplacer(":", "", " ", "", "-", "").Replace(strings.TrimSpace(fingerprint))
	normalized = strings.ToLower(normalized)
	if len(normalized) != sha256.Size*2 {
		return "", fmt.Errorf("tls fingerprint must be a sha256 hex digest")
	}
	if _, err := hex.DecodeString(normalized); err != nil {
		return "", fmt.Errorf("tls fingerprint must be hex encoded: %w", err)
	}
	return normalized, nil
}

func verifyFingerprint(state tls.ConnectionState, expected string) error {
	if len(state.PeerCertificates) == 0 {
		return fmt.Errorf("server certificate missing")
	}

	sum := sha256.Sum256(state.PeerCertificates[0].Raw)
	actual := hex.EncodeToString(sum[:])
	if subtle.ConstantTimeCompare([]byte(actual), []byte(expected)) != 1 {
		return fmt.Errorf("server certificate fingerprint mismatch")
	}
	return nil
}