Release:--: v0.0.6_2026-04-28_12:06:26_UTC

Author: 0xYeah

ac_config/ac_config.go

@@ -15,8 +15,9 @@ import (
 )
 
 const (
-	ProjectName    = "api_show"
-	ProjectVersion = "v0.0.5"
+	ProjectName     = "api_show"
+	ProjectVersion  = "v0.0.6"
+	ProjectBundleID = "com.0xYeah.api_show"
 
 	ListenPort     = 12110
 	DefaultDataDir = "./data"

ac_config/app.go

@@ -0,0 +1,21 @@
+package ac_config
+
+import (
+	"github.com/george012/gtbox"
+	"github.com/george012/gtbox/gtbox_app"
+)
+
+var (
+	CurrentApp *ExtendApp
+)
+
+type ExtendApp struct {
+	*gtbox_app.App
+	APIPort int
+}
+
+func NewApp(appName, bundleID, description string, runMode gtbox.RunMode) *ExtendApp {
+	return &ExtendApp{
+		App: gtbox_app.NewApp(appName, ProjectVersion, bundleID, description, runMode),
+	}
+}

api/api.go

@@ -0,0 +1,365 @@
+// Package api hosts the HTTP routing layer for api_show. main only sets up
+// config + signal handling and calls StartAPIServices.
+package api
+
+import (
+	"embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/0xYeah/api_show/auth"
+	"github.com/george012/gtbox/gtbox_log"
+)
+
+var (
+	identRe       = regexp.MustCompile(`^[a-z0-9_-]+$`)
+	versionRe     = regexp.MustCompile(`^v\d+\.\d+\.\d+$`)
+	specPathRe    = regexp.MustCompile(`^/data/([a-z0-9_-]+)/(v\d+\.\d+\.\d+)/openapi\.yaml$`)
+	maxUploadSize = int64(5 << 20)
+)
+
+// Options carries the runtime knobs main has resolved from config.
+type Options struct {
+	Deps        auth.HandlerDeps
+	DataDir     string
+	ListenPort  int
+	UploadToken string
+	OnlyLocal   bool
+	WebrootFS   embed.FS
+}
+
+var current *Options
+
+func StartAPIServices(opts *Options) {
+	current = opts
+
+	mux := buildMux(opts)
+	addr := fmt.Sprintf(":%d", opts.ListenPort)
+	gtbox_log.LogInfof("[api_show] listening on %s (data=%s)", addr, opts.DataDir)
+
+	srv := &http.Server{
+		Addr:              addr,
+		Handler:           logMiddleware(mux),
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      30 * time.Second,
+		IdleTimeout:       120 * time.Second,
+		MaxHeaderBytes:    1 << 16,
+	}
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			gtbox_log.LogErrorf("[api_show] server error: %v", err)
+		}
+	}()
+}
+
+func buildMux(opts *Options) *http.ServeMux {
+	mux := http.NewServeMux()
+
+	sub, err := fs.Sub(opts.WebrootFS, "webroot")
+	if err != nil {
+		gtbox_log.LogErrorf("[api_show] embed sub failed: %v", err)
+		return mux
+	}
+	publicAssets := http.FileServer(http.FS(sub))
+	mux.HandleFunc("/style.css", func(w http.ResponseWriter, r *http.Request) { publicAssets.ServeHTTP(w, r) })
+	mux.HandleFunc("/scalar.js", func(w http.ResponseWriter, r *http.Request) { publicAssets.ServeHTTP(w, r) })
+	mux.HandleFunc("/favicon.ico", func(w http.ResponseWriter, r *http.Request) { publicAssets.ServeHTTP(w, r) })
+
+	mux.HandleFunc("/login", auth.LoginHandler(opts.Deps))
+	mux.HandleFunc("/logout", auth.LogoutHandler())
+	mux.HandleFunc("/bind-totp", auth.BindTOTPHandler(opts.Deps))
+	mux.HandleFunc("/bind-totp/qr", auth.BindTOTPQRHandler(opts.Deps))
+
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte("ok"))
+	})
+	mux.HandleFunc("/upload", uploadHandler)
+
+	mux.Handle("/api/sources.json", auth.RequireAuth(opts.Deps.Secret, http.HandlerFunc(sourcesHandler)))
+	mux.Handle("/data/", auth.RequireAuth(opts.Deps.Secret, http.HandlerFunc(specYamlHandler)))
+
+	rootHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/" {
+			http.NotFound(w, r)
+			return
+		}
+		publicAssets.ServeHTTP(w, r)
+	})
+	mux.Handle("/", auth.RequireAuth(opts.Deps.Secret, rootHandler))
+
+	return mux
+}
+
+type version struct {
+	Version  string `json:"version"`
+	URL      string `json:"url"`
+	Released string `json:"released"`
+}
+
+type project struct {
+	ID       string    `json:"id"`
+	Name     string    `json:"name"`
+	Latest   string    `json:"latest"`
+	Versions []version `json:"versions"`
+}
+
+type latestMeta struct {
+	Version  string `json:"version"`
+	Released string `json:"released"`
+}
+
+func sourcesHandler(w http.ResponseWriter, r *http.Request) {
+	user := auth.UserFromCtx(r.Context())
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+
+	entries, err := os.ReadDir(current.DataDir)
+	if err != nil {
+		writeJSON(w, map[string]any{"projects": []any{}})
+		return
+	}
+
+	out := []project{}
+	for _, e := range entries {
+		if !e.IsDir() || !identRe.MatchString(e.Name()) {
+			continue
+		}
+		if !auth.CanSeeProject(user, e.Name()) {
+			continue
+		}
+		pdir := filepath.Join(current.DataDir, e.Name())
+		versions := scanVersions(pdir, e.Name())
+		if len(versions) == 0 {
+			continue
+		}
+		latest := readLatest(pdir)
+		if latest == "" {
+			latest = versions[0].Version
+		}
+		out = append(out, project{
+			ID:       e.Name(),
+			Name:     e.Name(),
+			Latest:   latest,
+			Versions: versions,
+		})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].ID < out[j].ID })
+	writeJSON(w, map[string]any{"projects": out, "user": user})
+}
+
+func scanVersions(projDir, projID string) []version {
+	subs, err := os.ReadDir(projDir)
+	if err != nil {
+		return nil
+	}
+	out := []version{}
+	for _, s := range subs {
+		if !s.IsDir() || !versionRe.MatchString(s.Name()) {
+			continue
+		}
+		spec := filepath.Join(projDir, s.Name(), "openapi.yaml")
+		info, err := os.Stat(spec)
+		if err != nil {
+			continue
+		}
+		out = append(out, version{
+			Version:  s.Name(),
+			URL:      fmt.Sprintf("/data/%s/%s/openapi.yaml", projID, s.Name()),
+			Released: info.ModTime().UTC().Format("2006-01-02"),
+		})
+	}
+	sort.Slice(out, func(i, j int) bool { return semverLess(out[j].Version, out[i].Version) })
+	return out
+}
+
+func readLatest(projDir string) string {
+	b, err := os.ReadFile(filepath.Join(projDir, "latest.json"))
+	if err != nil {
+		return ""
+	}
+	var m latestMeta
+	if json.Unmarshal(b, &m) != nil {
+		return ""
+	}
+	return m.Version
+}
+
+func semverLess(a, b string) bool {
+	pa := parseSemver(a)
+	pb := parseSemver(b)
+	for i := range 3 {
+		if pa[i] != pb[i] {
+			return pa[i] < pb[i]
+		}
+	}
+	return false
+}
+
+func parseSemver(v string) [3]int {
+	out := [3]int{}
+	parts := strings.Split(strings.TrimPrefix(v, "v"), ".")
+	for i := 0; i < 3 && i < len(parts); i++ {
+		n, _ := strconv.Atoi(parts[i])
+		out[i] = n
+	}
+	return out
+}
+
+func specYamlHandler(w http.ResponseWriter, r *http.Request) {
+	m := specPathRe.FindStringSubmatch(r.URL.Path)
+	if m == nil {
+		http.NotFound(w, r)
+		return
+	}
+	proj, ver := m[1], m[2]
+	user := auth.UserFromCtx(r.Context())
+
+	if !auth.CanSeeProject(user, proj) {
+		http.Error(w, "forbidden", http.StatusForbidden)
+		return
+	}
+
+	specPath := filepath.Join(current.DataDir, proj, ver, "openapi.yaml")
+	info, err := os.Stat(specPath)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	mtimeUnix := info.ModTime().Unix()
+
+	if cached, ok := auth.GetCachedFiltered(user, proj, ver, mtimeUnix); ok {
+		writeYAML(w, cached)
+		return
+	}
+
+	raw, err := os.ReadFile(specPath)
+	if err != nil {
+		http.Error(w, "read spec: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	filtered, err := auth.FilterSpec(raw, user, proj)
+	if err != nil {
+		http.Error(w, "filter spec: "+err.Error(), http.StatusForbidden)
+		return
+	}
+	auth.PutCachedFiltered(user, proj, ver, mtimeUnix, filtered)
+	writeYAML(w, filtered)
+}
+
+func writeYAML(w http.ResponseWriter, b []byte) {
+	w.Header().Set("Content-Type", "application/yaml; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	_, _ = w.Write(b)
+}
+
+func uploadHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	if current.OnlyLocal && !remoteIsLocal(r) {
+		gtbox_log.LogWarnf("[api_show] /upload rejected: only_local=true, remote=%s", r.RemoteAddr)
+		http.Error(w, "forbidden (LAN-only mode)", http.StatusForbidden)
+		return
+	}
+	if current.UploadToken == "" {
+		http.Error(w, "uploads disabled (upload_token unset)", http.StatusServiceUnavailable)
+		return
+	}
+	tok := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+	if tok == "" || tok != current.UploadToken {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	proj := r.URL.Query().Get("project")
+	ver := r.URL.Query().Get("version")
+	setLatest := r.URL.Query().Get("latest") == "true"
+	if !identRe.MatchString(proj) {
+		http.Error(w, "bad project (need [a-z0-9_-]+)", http.StatusBadRequest)
+		return
+	}
+	if !versionRe.MatchString(ver) {
+		http.Error(w, "bad version (need vX.Y.Z)", http.StatusBadRequest)
+		return
+	}
+
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxUploadSize))
+	if err != nil {
+		http.Error(w, "body too large or unreadable", http.StatusRequestEntityTooLarge)
+		return
+	}
+	if len(body) == 0 {
+		http.Error(w, "empty body", http.StatusBadRequest)
+		return
+	}
+
+	targetDir := filepath.Join(current.DataDir, proj, ver)
+	if err := os.MkdirAll(targetDir, 0o755); err != nil {
+		http.Error(w, "mkdir failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	finalPath := filepath.Join(targetDir, "openapi.yaml")
+	tmpPath := finalPath + ".tmp"
+	if err := os.WriteFile(tmpPath, body, 0o644); err != nil {
+		http.Error(w, "write failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if err := os.Rename(tmpPath, finalPath); err != nil {
+		http.Error(w, "rename failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	if setLatest {
+		meta := latestMeta{Version: ver, Released: time.Now().UTC().Format("2006-01-02")}
+		mb, _ := json.Marshal(meta)
+		latestPath := filepath.Join(current.DataDir, proj, "latest.json")
+		_ = os.WriteFile(latestPath+".tmp", mb, 0o644)
+		_ = os.Rename(latestPath+".tmp", latestPath)
+	}
+
+	gtbox_log.LogInfof("[api_show] upload ok project=%s version=%s latest=%v bytes=%d", proj, ver, setLatest, len(body))
+	writeJSON(w, map[string]any{
+		"ok":      true,
+		"project": proj,
+		"version": ver,
+		"latest":  setLatest,
+		"bytes":   len(body),
+	})
+}
+
+func writeJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(v)
+}
+
+func logMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		next.ServeHTTP(w, r)
+		gtbox_log.LogInfof("[api_show] %s %s %s %s", r.Method, r.URL.Path, r.RemoteAddr, time.Since(start))
+	})
+}
+
+func remoteIsLocal(r *http.Request) bool {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return false
+	}
+	return ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast()
+}