npc0-hue
a822e9250a
Run pushes typed SCUM facts through POST /api/v1/run/scum/facts, but the production router rejected that path before the signature middleware because runServiceRequest listed individual Run channel prefixes, and MySQL kept SCUM rows inside the whole metadata snapshot instead of platform tables. - /api/v1/run/ is now the signed machine channel space while /api/v1/run/endpoints keeps normal bearer/admin authorization. - MySQL gets real scum_user, scum_user_trajectory, scum_vehicle, scum_vehicle_trajectory and scum_vehicle_lock tables with parameterized per-row repositories instead of full snapshot rewrites. Snapshot-shaped tables from the unreleased interim build are replaced, and SCUM rows still inside a metadata snapshot are migrated once. - Facts ingest verifies the target server plugin type and converges stale online users to offline after SCUMUserOfflineAfter. - The plugin page and browser read one bounded /scum/surface response instead of five list calls per refresh. Call-count budget for one server: per 5s facts batch, one SELECT plus one INSERT/UPDATE per reported user and vehicle, one INSERT per moved trajectory sample or new lock row, one bounded stale-user SELECT, and a trajectory retention DELETE at most once per hour. One browser refresh issues one surface request every 15s instead of five list requests.
79 lines
2.6 KiB
Go
79 lines
2.6 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"browser.local/platform/domain"
|
|
"browser.local/platform/service"
|
|
)
|
|
|
|
func (h *coreHandlers) requireAuthorizedAPI(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if !strings.HasPrefix(r.URL.Path, "/api/v1/") || publicAPIRequest(r) || runServiceRequest(r) {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
user, err := h.core.GetCurrentUser(bearerToken(r))
|
|
if err != nil {
|
|
writeServiceError(w, err)
|
|
return
|
|
}
|
|
if platformAdminRequest(r) && !apiPlatformAdmin(user) {
|
|
writeServiceError(w, service.ErrForbidden)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func publicAPIRequest(r *http.Request) bool {
|
|
path := r.URL.Path
|
|
if path == "/api/v1/auth/login" || path == "/api/v1/auth/register" {
|
|
return true
|
|
}
|
|
if r.Method != http.MethodGet {
|
|
return false
|
|
}
|
|
return path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") ||
|
|
path == "/api/v1/plugin-marketplace/plugins" || strings.HasPrefix(path, "/api/v1/plugin-marketplace/plugins/")
|
|
}
|
|
|
|
func runServiceRequest(r *http.Request) bool {
|
|
// Run owns the authenticated machine channels under /run/. Keep the
|
|
// browser's endpoint-management API on the normal bearer/admin path, but do
|
|
// not maintain a list of individual Run channel prefixes here. New typed
|
|
// plugin channels (for example /run/scum/facts) must reach their own
|
|
// signature/session middleware instead of being rejected by this router.
|
|
path := strings.TrimSuffix(r.URL.Path, "/")
|
|
return strings.HasPrefix(path, "/api/v1/run/") &&
|
|
path != "/api/v1/run/endpoints" &&
|
|
!strings.HasPrefix(path, "/api/v1/run/endpoints/")
|
|
}
|
|
|
|
func platformAdminRequest(r *http.Request) bool {
|
|
path := r.URL.Path
|
|
if path == "/api/v1/users/current" || strings.HasPrefix(path, "/api/v1/users/current/") {
|
|
return false
|
|
}
|
|
if path == "/api/v1/users" || strings.HasPrefix(path, "/api/v1/users/") ||
|
|
path == "/api/v1/ai-providers" || strings.HasPrefix(path, "/api/v1/ai-providers/") ||
|
|
path == "/api/v1/metrics/platform" ||
|
|
path == "/api/v1/run/endpoints" || strings.HasPrefix(path, "/api/v1/run/endpoints/") {
|
|
return true
|
|
}
|
|
if r.Method != http.MethodGet && (path == "/api/v1/game-plugins" || strings.HasPrefix(path, "/api/v1/game-plugins/") || strings.Contains(path, "/plugin-marketplace/plugins/")) {
|
|
return true
|
|
}
|
|
return r.Method == http.MethodPost && (path == "/api/v1/jobs" || path == "/api/v1/artifacts" || path == "/api/v1/log-streams")
|
|
}
|
|
|
|
func apiPlatformAdmin(user domain.User) bool {
|
|
for _, role := range user.Roles {
|
|
if role == "platform-admin" || role == "admin" || role == "platformadmin" {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|