refactor: refactoring framework

Makefile

@@ -377,4 +377,4 @@ package-linux-arm-platform:
 package-windows-platform:
 	@echo "Packaging Windows"
 	cd $(OUTPUT_DIR) && zip -r $(OUTPUT_DIR)/windows-amd64.zip   $(APP_NAME)-windows-amd64.exe $(APP_CONFIG)
-	cd $(OUTPUT_DIR) && zip -r $(OUTPUT_DIR)/windows-386.zip   $(APP_NAME)-windows-386.exe $(APP_CONFIG)
+	cd $(OUTPUT_DIR) && zip -r $(OUTPUT_DIR)/windows-386.zip   $(APP_NAME)-windows-386.exe $(APP_CONFIG)

cmd/vfs/main.go

@@ -304,7 +304,7 @@ func (vfs StaticFS) Open(name string) (http.File, error) {
 			}
 		}
 
-		log.Debug("local file not found,", localFile)
+		log.Trace("local file not found,", localFile)
 	}
 
 	if vfs.SkipVFS{

core/api/api.go

@@ -34,6 +34,7 @@ import (
 	"net"
 	"net/http"
 	"runtime"
+	"strings"
 	"sync"
 	"time"
 
@@ -120,7 +121,7 @@ func initializeAPI() {
 }
 
 // HandleAPIMethod register api handler
-func HandleAPIMethod(method Method, pattern string, handler func(w http.ResponseWriter, req *http.Request, ps httprouter.Params)) {
+func HandleAPIMethod(method Method, pattern string, handler func(w http.ResponseWriter, req *http.Request, ps httprouter.Params), options ...Option) {
 	l.Lock()
 	if registeredAPIMethodHandler == nil {
 		registeredAPIMethodHandler = map[string]map[string]func(w http.ResponseWriter, req *http.Request, ps httprouter.Params){}
@@ -132,8 +133,57 @@ func HandleAPIMethod(method Method, pattern string, handler func(w http.Response
 		registeredAPIMethodHandler[m] = map[string]func(w http.ResponseWriter, req *http.Request, ps httprouter.Params){}
 	}
 	registeredAPIMethodHandler[m][pattern] = handler
+	if len(options) > 0 {
+		opts := &HandlerOptions{}
+		for _, option := range options {
+			option(opts)
+		}
+		apiOptions.Register(method, pattern, opts)
+	}
+
+	l.Unlock()
+}
 
+func ServeRegisteredAPIRequest(w http.ResponseWriter, req *http.Request) {
+	localMux := http.NewServeMux()
+	localRouter := httprouter.New(localMux)
+	localRouter.NotFound = notfoundHandler
+
+	l.Lock()
+	funcHandlers := make(map[string]func(http.ResponseWriter, *http.Request), len(registeredAPIFuncHandler))
+	for pattern, handler := range registeredAPIFuncHandler {
+		funcHandlers[pattern] = handler
+	}
+	methodHandlers := make(map[string]map[string]func(w http.ResponseWriter, req *http.Request, ps httprouter.Params), len(registeredAPIMethodHandler))
+	for method, handlers := range registeredAPIMethodHandler {
+		cloned := make(map[string]func(w http.ResponseWriter, req *http.Request, ps httprouter.Params), len(handlers))
+		for pattern, handler := range handlers {
+			cloned[pattern] = handler
+		}
+		methodHandlers[method] = cloned
+	}
+	filterSnapshot := append([]filter.Filter(nil), filters...)
 	l.Unlock()
+
+	for pattern, handler := range funcHandlers {
+		wrapped := handler
+		for _, f := range filterSnapshot {
+			wrapped = f.FilterHttpHandlerFunc(pattern, wrapped)
+		}
+		localMux.HandleFunc(pattern, wrapped)
+	}
+
+	for method, handlers := range methodHandlers {
+		for pattern, handler := range handlers {
+			wrapped := handler
+			for _, f := range filterSnapshot {
+				wrapped = f.FilterHttpRouter(pattern, wrapped)
+			}
+			localRouter.Handle(method, pattern, wrapped)
+		}
+	}
+
+	localRouter.ServeHTTP(w, req)
 }
 
 var router = httprouter.New(mux)
@@ -145,8 +195,45 @@ var rootKey *rsa.PrivateKey
 var rootCertPEM []byte
 
 var apiConfig *config.APIConfig
-
 var listenAddress string
+var resolveRuntimePublishIPv4 = util.GetIntranetIP
+
+func normalizeRuntimePublishAddress(actualAddr string) string {
+	actualAddr = strings.TrimSpace(actualAddr)
+	if actualAddr == "" {
+		return actualAddr
+	}
+
+	host, port, err := net.SplitHostPort(actualAddr)
+	if err != nil {
+		return actualAddr
+	}
+
+	normalizedHost := strings.Trim(strings.TrimSpace(host), "[]")
+	if normalizedHost != "" {
+		ip := net.ParseIP(normalizedHost)
+		if normalizedHost != util.AnyAddress && (ip == nil || !ip.IsUnspecified()) {
+			return actualAddr
+		}
+	}
+
+	ipv4, err := resolveRuntimePublishIPv4()
+	if err != nil || strings.TrimSpace(ipv4) == "" {
+		return actualAddr
+	}
+
+	return net.JoinHostPort(ipv4, port)
+}
+
+func syncRuntimePublishAddress(networkConfig *config.NetworkConfig, actualAddr string) {
+	if networkConfig == nil || strings.TrimSpace(actualAddr) == "" {
+		return
+	}
+	if strings.TrimSpace(networkConfig.Publish) != "" {
+		return
+	}
+	networkConfig.Publish = normalizeRuntimePublishAddress(actualAddr)
+}
 
 var notfoundHandler = http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 	rw.Write([]byte("{\"message\":\"not_found\"}"))
@@ -219,6 +306,7 @@ func StartAPI() {
 	if err != nil {
 		panic(err)
 	}
+	syncRuntimePublishAddress(&apiConfig.NetworkConfig, l.Addr().String())
 
 	router.NotFound = notfoundHandler
 

core/api/api_test.go

@@ -27,9 +27,14 @@
 package api
 
 import (
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
+
+	httprouter "infini.sh/framework/core/api/router"
+	"infini.sh/framework/core/config"
 )
 
 func TestStripPrefix(t *testing.T) {
@@ -111,3 +116,126 @@ func TestStripPrefix(t *testing.T) {
 		})
 	}
 }
+
+func TestServeRegisteredAPIRequest(t *testing.T) {
+	path := fmt.Sprintf("/__copilot_test__/api/%s/:id", t.Name())
+	HandleAPIMethod(GET, path, func(w http.ResponseWriter, req *http.Request, ps httprouter.Params) {
+		w.WriteHeader(http.StatusAccepted)
+		_, _ = w.Write([]byte(ps.MustGetParameter("id") + ":" + req.URL.Query().Get("q")))
+	})
+
+	req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("%s/value?q=ok", fmt.Sprintf("/__copilot_test__/api/%s", t.Name())), nil)
+	recorder := httptest.NewRecorder()
+
+	ServeRegisteredAPIRequest(recorder, req)
+
+	if recorder.Code != http.StatusAccepted {
+		t.Fatalf("unexpected status: %d", recorder.Code)
+	}
+	if recorder.Body.String() != "value:ok" {
+		t.Fatalf("unexpected body: %s", recorder.Body.String())
+	}
+}
+
+func TestServeRegisteredAPIRequestAllowsNestedDispatch(t *testing.T) {
+	innerPath := fmt.Sprintf("/__copilot_test__/api/%s/inner", t.Name())
+	outerPath := fmt.Sprintf("/__copilot_test__/api/%s/outer", t.Name())
+
+	HandleAPIMethod(GET, innerPath, func(w http.ResponseWriter, req *http.Request, ps httprouter.Params) {
+		w.WriteHeader(http.StatusAccepted)
+		_, _ = w.Write([]byte("inner-ok"))
+	})
+	HandleAPIMethod(GET, outerPath, func(w http.ResponseWriter, req *http.Request, ps httprouter.Params) {
+		innerReq := httptest.NewRequest(http.MethodGet, innerPath, nil)
+		innerRecorder := httptest.NewRecorder()
+		ServeRegisteredAPIRequest(innerRecorder, innerReq)
+		w.WriteHeader(innerRecorder.Code)
+		_, _ = w.Write(innerRecorder.Body.Bytes())
+	})
+
+	req := httptest.NewRequest(http.MethodGet, outerPath, nil)
+	recorder := httptest.NewRecorder()
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		ServeRegisteredAPIRequest(recorder, req)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("nested dispatch timed out")
+	}
+
+	if recorder.Code != http.StatusAccepted {
+		t.Fatalf("unexpected status: %d", recorder.Code)
+	}
+	if recorder.Body.String() != "inner-ok" {
+		t.Fatalf("unexpected body: %s", recorder.Body.String())
+	}
+}
+
+func TestSyncRuntimePublishAddressUsesActualListenAddressWhenUnset(t *testing.T) {
+	oldResolver := resolveRuntimePublishIPv4
+	resolveRuntimePublishIPv4 = func() (string, error) {
+		return "192.168.3.185", nil
+	}
+	t.Cleanup(func() {
+		resolveRuntimePublishIPv4 = oldResolver
+	})
+
+	cfg := config.NetworkConfig{}
+
+	syncRuntimePublishAddress(&cfg, "0.0.0.0:2901")
+
+	if cfg.Publish != "192.168.3.185:2901" {
+		t.Fatalf("expected runtime publish address to be updated, got %q", cfg.Publish)
+	}
+}
+
+func TestSyncRuntimePublishAddressNormalizesIPv6UnspecifiedHost(t *testing.T) {
+	oldResolver := resolveRuntimePublishIPv4
+	resolveRuntimePublishIPv4 = func() (string, error) {
+		return "192.168.3.185", nil
+	}
+	t.Cleanup(func() {
+		resolveRuntimePublishIPv4 = oldResolver
+	})
+
+	cfg := config.NetworkConfig{}
+
+	syncRuntimePublishAddress(&cfg, "[::]:2901")
+
+	if cfg.Publish != "192.168.3.185:2901" {
+		t.Fatalf("expected ipv6 unspecified runtime publish address to use ipv4, got %q", cfg.Publish)
+	}
+}
+
+func TestSyncRuntimePublishAddressPreservesExplicitPublishAddress(t *testing.T) {
+	cfg := config.NetworkConfig{Publish: "gateway.example:8443"}
+
+	syncRuntimePublishAddress(&cfg, "0.0.0.0:2901")
+
+	if cfg.Publish != "gateway.example:8443" {
+		t.Fatalf("expected explicit publish address to be preserved, got %q", cfg.Publish)
+	}
+}
+
+func TestSyncRuntimePublishAddressPreservesConcreteListenAddress(t *testing.T) {
+	oldResolver := resolveRuntimePublishIPv4
+	resolveRuntimePublishIPv4 = func() (string, error) {
+		return "192.168.3.185", nil
+	}
+	t.Cleanup(func() {
+		resolveRuntimePublishIPv4 = oldResolver
+	})
+
+	cfg := config.NetworkConfig{}
+
+	syncRuntimePublishAddress(&cfg, "10.0.0.8:2901")
+
+	if cfg.Publish != "10.0.0.8:2901" {
+		t.Fatalf("expected concrete runtime publish address to be preserved, got %q", cfg.Publish)
+	}
+}

core/api/basic_auth.go

@@ -28,18 +28,31 @@
 package api
 
 import (
+	"crypto/subtle"
 	httprouter "infini.sh/framework/core/api/router"
 	"net/http"
+	"strings"
+
+	"infini.sh/framework/core/model"
+	configcommon "infini.sh/framework/modules/configs/common"
 )
 
 type BasicAuthFilter struct {
 	Username string
 	Password string
 }
 
+var loadManagedAccessTokenFromKeystore = func() (string, error) {
+	return configcommon.LoadTokenFromKeystore(configcommon.AgentAccessTokenKeystoreKey)
+}
+
 // BasicAuth register api with basic auth
 func BasicAuth(h httprouter.Handle, requiredUser, requiredPassword string) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		if validateManagedAccessToken(r) {
+			h(w, r, ps)
+			return
+		}
 		// Get the Basic Authentication credentials
 		user, password, hasAuth := r.BasicAuth()
 
@@ -60,6 +73,10 @@ func (filter *BasicAuthFilter) FilterHttpRouter(pattern string, h httprouter.Han
 
 func (filter *BasicAuthFilter) FilterHttpHandlerFunc(pattern string, handler func(http.ResponseWriter, *http.Request)) func(http.ResponseWriter, *http.Request) {
 	return func(w http.ResponseWriter, request *http.Request) {
+		if validateManagedAccessToken(request) {
+			handler(w, request)
+			return
+		}
 		// Get the Basic Authentication credentials
 		user, password, hasAuth := request.BasicAuth()
 		if hasAuth && user == filter.Username && password == filter.Password {
@@ -72,3 +89,34 @@ func (filter *BasicAuthFilter) FilterHttpHandlerFunc(pattern string, handler fun
 		http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
 	}
 }
+
+func validateManagedAccessToken(req *http.Request) bool {
+	tokenValue := ExtractBearerOrAPIToken(req)
+	if tokenValue == "" {
+		return false
+	}
+	expectedToken, err := loadManagedAccessTokenFromKeystore()
+	if err != nil || expectedToken == "" {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(expectedToken), []byte(tokenValue)) == 1
+}
+
+func ValidateManagedAccessTokenRequest(req *http.Request) bool {
+	return validateManagedAccessToken(req)
+}
+
+func ExtractBearerOrAPIToken(req *http.Request) string {
+	if req == nil {
+		return ""
+	}
+	tokenValue := strings.TrimSpace(req.Header.Get(model.API_TOKEN))
+	if tokenValue != "" {
+		return tokenValue
+	}
+	authHeader := strings.TrimSpace(req.Header.Get("Authorization"))
+	if len(authHeader) < len("Bearer ")+1 || !strings.EqualFold(authHeader[:len("Bearer ")], "Bearer ") {
+		return ""
+	}
+	return strings.TrimSpace(authHeader[len("Bearer "):])
+}