nexarch/connect/internal/statusapi/statusapi.go

// Package statusapi is the HTTP binding for the connector status overview
// (API-02). User identity comes, transitionally until a central Core-JWT
// wiring exists for Connect (pattern from workflow/internal/approvalapi),
// from the X-User-Id header; the tenant comes from X-Tenant-Slug, set by
// the deployment's auth layer, never from an unauthenticated body/query
// value.
package statusapi

import (
	"encoding/json"
	"net/http"
	"time"

	"gitea.perlbach24.de/scripte/nexarch/common/policyclient"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/syncjob"
)

type Server struct {
	jobs   *syncjob.Store
	policy *policyclient.Client
}

// WithPolicy aktiviert RBAC-12: echte Rechtepruefung gegen Core (POST
// /authorize), zusaetzlich zur bestehenden X-User-Id/X-Tenant-Slug-Pruefung.
// Die Rolle kommt aus X-User-Role (setzt bearerauth aus dem Token), sonst "user".
func (s *Server) WithPolicy(client *policyclient.Client) *Server {
	s.policy = client
	return s
}

func NewServer(jobs *syncjob.Store) *Server {
	return &Server{jobs: jobs}
}

func (s *Server) RegisterRoutes(mux *http.ServeMux) {
	mux.HandleFunc("GET /connectors/status", s.requireIdentity(s.requirePermission("connect.status.read", s.handleList)))
}

func (s *Server) requirePermission(permission string, next func(w http.ResponseWriter, r *http.Request, tenantSlug string)) func(w http.ResponseWriter, r *http.Request, tenantSlug string) {
	return func(w http.ResponseWriter, r *http.Request, tenantSlug string) {
		if s.policy != nil {
			allowed, err := s.policy.Allowed(r.Context(), tenantSlug, roleOf(r), permission)
			if err != nil {
				writeError(w, http.StatusServiceUnavailable, "berechtigungsdienst nicht erreichbar")
				return
			}
			if !allowed {
				writeError(w, http.StatusForbidden, "keine berechtigung")
				return
			}
		}
		next(w, r, tenantSlug)
	}
}

func roleOf(r *http.Request) string {
	if role := r.Header.Get("X-User-Role"); role != "" {
		return role
	}
	return "user"
}

func (s *Server) requireIdentity(next func(w http.ResponseWriter, r *http.Request, tenantSlug string)) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		if r.Header.Get("X-User-Id") == "" {
			writeError(w, http.StatusUnauthorized, "X-User-Id fehlt")
			return
		}
		tenant := r.Header.Get("X-Tenant-Slug")
		if tenant == "" {
			writeError(w, http.StatusUnauthorized, "X-Tenant-Slug fehlt")
			return
		}
		next(w, r, tenant)
	}
}

type connectorStatus struct {
	JobID           string     `json:"job_id"`
	ConnectorName   string     `json:"connector_name"`
	ConnectorInst   string     `json:"connector_instance_id"`
	IntervalSeconds int        `json:"interval_seconds"`
	NextRunAt       time.Time  `json:"next_run_at"`
	LastRunID       *string    `json:"last_run_id,omitempty"`
	LastRunStatus   *string    `json:"last_run_status,omitempty"`
	LastRunTrigger  *string    `json:"last_run_trigger,omitempty"`
	LastRunStarted  *time.Time `json:"last_run_started_at,omitempty"`
	LastRunFinished *time.Time `json:"last_run_finished_at,omitempty"`
	LastError       *string    `json:"last_error,omitempty"`
}

func (s *Server) handleList(w http.ResponseWriter, r *http.Request, tenantSlug string) {
	statuses, err := s.jobs.ListForTenant(r.Context(), tenantSlug)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "verbindungsstatus konnte nicht gelesen werden")
		return
	}
	out := make([]connectorStatus, 0, len(statuses))
	for _, js := range statuses {
		cs := connectorStatus{
			JobID:           js.Job.ID,
			ConnectorName:   js.Job.Ref.ConnectorName,
			ConnectorInst:   js.Job.Ref.ConnectorInstanceID,
			IntervalSeconds: js.Job.IntervalSeconds,
			NextRunAt:       js.Job.NextRunAt,
		}
		if js.LastRun != nil {
			id, status, trig := js.LastRun.ID, string(js.LastRun.Status), string(js.LastRun.Trigger)
			cs.LastRunID, cs.LastRunStatus, cs.LastRunTrigger = &id, &status, &trig
			cs.LastRunStarted = &js.LastRun.StartedAt
			cs.LastRunFinished = js.LastRun.FinishedAt
			cs.LastError = js.LastRun.LastError
		}
		out = append(out, cs)
	}
	writeJSON(w, http.StatusOK, out)
}

func writeJSON(w http.ResponseWriter, status int, v any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(v)
}

func writeError(w http.ResponseWriter, status int, msg string) {
	writeJSON(w, status, map[string]string{"error": msg})
}