chore: auto-commit (23 archivos)
- app.md - backend/dist/assets/index-CFDWXN9Z.js - backend/dist/index.html - backend/handlers.go - backend/main.go - backend/users.go - e2e/smoke_live.sh - frontend/src/App.tsx - frontend/src/api.ts - frontend/src/components/CardChatPanel.tsx - ... Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
+166
-151
File diff suppressed because one or more lines are too long
Vendored
+1
-1
@@ -4,7 +4,7 @@
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<title>Kanban</title>
|
||||
<script type="module" crossorigin src="/assets/index-CFDWXN9Z.js"></script>
|
||||
<script type="module" crossorigin src="/assets/index-UVzY_37O.js"></script>
|
||||
<link rel="stylesheet" crossorigin href="/assets/index-b0xjFtx2.css">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
+7
-1
@@ -622,7 +622,7 @@ func handlePurgeCard(db *DB, hub *EventHub) http.HandlerFunc {
|
||||
}
|
||||
}
|
||||
|
||||
func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken string, flags *FeatureFlags, hub *EventHub) []infra.Route {
|
||||
func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken string, flags *FeatureFlags, hub *EventHub, dispatcher *Dispatcher) []infra.Route {
|
||||
return []infra.Route{
|
||||
{Method: "GET", Path: "/api/flags", Handler: handleListFlags(flags)},
|
||||
{Method: "GET", Path: "/api/version", Handler: handleVersion()},
|
||||
@@ -670,6 +670,12 @@ func apiRoutes(db *DB, chatWorkdir string, logger *ChatLogger, internalToken str
|
||||
{Method: "GET", Path: "/api/notifications/unread-count", Handler: handleUnreadCount(db)},
|
||||
{Method: "POST", Path: "/api/notifications/{id}/read", Handler: handleMarkNotificationRead(db, hub)},
|
||||
{Method: "POST", Path: "/api/notifications/read-all", Handler: handleMarkAllNotificationsRead(db, hub)},
|
||||
{Method: "GET", Path: "/api/modules", Handler: handleListModules(db)},
|
||||
{Method: "POST", Path: "/api/modules", Handler: handleCreateModule(db)},
|
||||
{Method: "PATCH", Path: "/api/modules/{id}", Handler: handleUpdateModule(db)},
|
||||
{Method: "DELETE", Path: "/api/modules/{id}", Handler: handleDeleteModule(db)},
|
||||
{Method: "GET", Path: "/api/modules/{id}/logs", Handler: handleModuleLogs(db)},
|
||||
{Method: "POST", Path: "/api/modules/{id}/test", Handler: handleTestModule(db, dispatcher)},
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+28
-2
@@ -69,7 +69,10 @@ func main() {
|
||||
logger := newChatLogger(filepath.Join(wd, "chat.log"))
|
||||
log.Printf("chat tool log: %s", logger.path)
|
||||
hub := NewEventHub()
|
||||
mux := infra.HTTPRouter(apiRoutes(db, wd, logger, internalToken, &featureFlags, hub))
|
||||
dispatcher := NewDispatcher(db, hub)
|
||||
dispatcher.Start()
|
||||
defer dispatcher.Stop()
|
||||
mux := infra.HTTPRouter(apiRoutes(db, wd, logger, internalToken, &featureFlags, hub, dispatcher))
|
||||
|
||||
feHandler := frontendHandler()
|
||||
if feHandler != nil {
|
||||
@@ -169,5 +172,28 @@ func frontendHandler() http.Handler {
|
||||
if len(entries) == 0 {
|
||||
return nil
|
||||
}
|
||||
return infra.SPAHandler(sub, "index.html")
|
||||
return cacheHeadersMiddleware(infra.SPAHandler(sub, "index.html"))
|
||||
}
|
||||
|
||||
// cacheHeadersMiddleware ensures the SPA shell is never cached while the
|
||||
// hashed assets (which are content-addressed by Vite) are cached for a long
|
||||
// time. Without this, browsers happily reuse an old index.html — pinned to a
|
||||
// stale /assets/index-<hash>.js URL — and never pick up new releases.
|
||||
//
|
||||
// Policy:
|
||||
//
|
||||
// /assets/* → public, max-age=1y, immutable (filename changes per build)
|
||||
// everything else → no-store, must-revalidate (forces revalidation on every
|
||||
// navigation so the latest hash is always discovered)
|
||||
func cacheHeadersMiddleware(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if strings.HasPrefix(r.URL.Path, "/assets/") {
|
||||
w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
|
||||
} else {
|
||||
w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate")
|
||||
w.Header().Set("Pragma", "no-cache")
|
||||
w.Header().Set("Expires", "0")
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
-- Outbound modules (integrations): kanban events → external systems.
|
||||
--
|
||||
-- A module is a configured subscription. The dispatcher (modules.go)
|
||||
-- subscribes to the EventHub and, for each event whose type matches the
|
||||
-- module's event_filter, calls the kind-specific handler with the
|
||||
-- decrypted config.
|
||||
--
|
||||
-- Tokens / secrets are encrypted with AES-GCM at rest. The key is derived
|
||||
-- from the KANBAN_MODULE_KEY environment variable (sha256 of the value).
|
||||
|
||||
CREATE TABLE IF NOT EXISTS modules (
|
||||
id TEXT PRIMARY KEY,
|
||||
name TEXT NOT NULL,
|
||||
kind TEXT NOT NULL, -- 'jira' | 'webhook' | …
|
||||
enabled INTEGER NOT NULL DEFAULT 1,
|
||||
event_filter TEXT NOT NULL, -- comma-separated event types
|
||||
config_cipher BLOB NOT NULL, -- AES-GCM ciphertext of JSON
|
||||
config_nonce BLOB NOT NULL,
|
||||
created_at TEXT NOT NULL,
|
||||
updated_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS module_logs (
|
||||
id TEXT PRIMARY KEY,
|
||||
module_id TEXT NOT NULL,
|
||||
event_type TEXT NOT NULL,
|
||||
card_id TEXT,
|
||||
status INTEGER, -- HTTP status or 0 if pre-flight
|
||||
duration_ms INTEGER,
|
||||
error TEXT,
|
||||
created_at TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_module_logs_module_created
|
||||
ON module_logs(module_id, created_at DESC);
|
||||
|
||||
-- jira_key: 1:1 link between a kanban card and its Jira issue. Empty
|
||||
-- string when the card has not yet been synced to Jira.
|
||||
ALTER TABLE cards ADD COLUMN jira_key TEXT NOT NULL DEFAULT '';
|
||||
|
||||
-- is_admin: gates /api/modules access and the Modulos menu item.
|
||||
-- Bootstrap: egutierrez (the initial admin) is marked admin so the
|
||||
-- feature is reachable on first deploy. Other users start as non-admin.
|
||||
ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0;
|
||||
UPDATE users SET is_admin = 1 WHERE username = 'egutierrez';
|
||||
@@ -0,0 +1,725 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"database/sql"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// =============================================================================
|
||||
// Module model
|
||||
// =============================================================================
|
||||
|
||||
type Module struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
Kind string `json:"kind"`
|
||||
Enabled bool `json:"enabled"`
|
||||
EventFilter []string `json:"event_filter"`
|
||||
Config JSONValue `json:"config"`
|
||||
CreatedAt string `json:"created_at"`
|
||||
UpdatedAt string `json:"updated_at"`
|
||||
}
|
||||
|
||||
// JSONValue is an arbitrary JSON object decoded into a generic map. We do not
|
||||
// model per-kind config in Go types because the set of kinds grows over time
|
||||
// and the dispatcher only inspects fields it knows.
|
||||
type JSONValue map[string]interface{}
|
||||
|
||||
type ModuleLog struct {
|
||||
ID string `json:"id"`
|
||||
ModuleID string `json:"module_id"`
|
||||
EventType string `json:"event_type"`
|
||||
CardID string `json:"card_id"`
|
||||
Status int `json:"status"`
|
||||
DurationMs int `json:"duration_ms"`
|
||||
Error string `json:"error"`
|
||||
CreatedAt string `json:"created_at"`
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// DB helpers (modules + logs)
|
||||
// =============================================================================
|
||||
|
||||
// listModulesEnabled returns all enabled modules with their config decrypted.
|
||||
// Disabled modules are silently skipped — callers iterate the result without
|
||||
// further filtering.
|
||||
func (db *DB) listModulesEnabled() ([]Module, error) {
|
||||
return db.listModulesWhere("WHERE enabled = 1")
|
||||
}
|
||||
|
||||
func (db *DB) listModulesAll() ([]Module, error) {
|
||||
return db.listModulesWhere("")
|
||||
}
|
||||
|
||||
func (db *DB) listModulesWhere(filter string) ([]Module, error) {
|
||||
q := `SELECT id, name, kind, enabled, event_filter, config_cipher, config_nonce, created_at, updated_at FROM modules ` + filter + ` ORDER BY created_at`
|
||||
rows, err := db.conn.Query(q)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
out := []Module{}
|
||||
for rows.Next() {
|
||||
var m Module
|
||||
var enabled int
|
||||
var filter, createdAt, updatedAt string
|
||||
var cipherBlob, nonce []byte
|
||||
if err := rows.Scan(&m.ID, &m.Name, &m.Kind, &enabled, &filter, &cipherBlob, &nonce, &createdAt, &updatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
m.Enabled = enabled == 1
|
||||
m.EventFilter = splitCSV(filter)
|
||||
m.CreatedAt = createdAt
|
||||
m.UpdatedAt = updatedAt
|
||||
cfg, err := decryptConfig(cipherBlob, nonce)
|
||||
if err != nil {
|
||||
// Surface the decrypt failure so the operator notices but
|
||||
// avoid dropping the module from the list entirely.
|
||||
log.Printf("module %s: decrypt config: %v", m.ID, err)
|
||||
m.Config = JSONValue{"_decrypt_error": err.Error()}
|
||||
} else {
|
||||
_ = json.Unmarshal(cfg, &m.Config)
|
||||
}
|
||||
out = append(out, m)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
func (db *DB) getModule(id string) (*Module, error) {
|
||||
mods, err := db.listModulesWhere(`WHERE id = '` + escapeSQL(id) + `'`)
|
||||
if err != nil || len(mods) == 0 {
|
||||
if err == nil {
|
||||
err = sql.ErrNoRows
|
||||
}
|
||||
return nil, err
|
||||
}
|
||||
return &mods[0], nil
|
||||
}
|
||||
|
||||
func escapeSQL(s string) string {
|
||||
return strings.ReplaceAll(s, "'", "''")
|
||||
}
|
||||
|
||||
func (db *DB) saveModule(m *Module) error {
|
||||
cfgJSON, err := json.Marshal(m.Config)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
cipherBlob, nonce, err := encryptConfig(cfgJSON)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
now := nowRFC3339()
|
||||
if m.ID == "" {
|
||||
m.ID = newID()
|
||||
m.CreatedAt = now
|
||||
m.UpdatedAt = now
|
||||
_, err = db.conn.Exec(
|
||||
`INSERT INTO modules (id, name, kind, enabled, event_filter, config_cipher, config_nonce, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
m.ID, m.Name, m.Kind, boolInt(m.Enabled), strings.Join(m.EventFilter, ","),
|
||||
cipherBlob, nonce, m.CreatedAt, m.UpdatedAt,
|
||||
)
|
||||
return err
|
||||
}
|
||||
m.UpdatedAt = now
|
||||
_, err = db.conn.Exec(
|
||||
`UPDATE modules SET name=?, kind=?, enabled=?, event_filter=?, config_cipher=?, config_nonce=?, updated_at=? WHERE id=?`,
|
||||
m.Name, m.Kind, boolInt(m.Enabled), strings.Join(m.EventFilter, ","),
|
||||
cipherBlob, nonce, m.UpdatedAt, m.ID,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
func (db *DB) deleteModule(id string) error {
|
||||
_, err := db.conn.Exec(`DELETE FROM modules WHERE id=?`, id)
|
||||
return err
|
||||
}
|
||||
|
||||
func (db *DB) appendModuleLog(l ModuleLog) error {
|
||||
if l.ID == "" {
|
||||
l.ID = newID()
|
||||
}
|
||||
if l.CreatedAt == "" {
|
||||
l.CreatedAt = nowRFC3339()
|
||||
}
|
||||
_, err := db.conn.Exec(
|
||||
`INSERT INTO module_logs (id, module_id, event_type, card_id, status, duration_ms, error, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
l.ID, l.ModuleID, l.EventType, l.CardID, l.Status, l.DurationMs, l.Error, l.CreatedAt,
|
||||
)
|
||||
return err
|
||||
}
|
||||
|
||||
func (db *DB) listModuleLogs(moduleID string, limit int) ([]ModuleLog, error) {
|
||||
if limit <= 0 {
|
||||
limit = 100
|
||||
}
|
||||
rows, err := db.conn.Query(
|
||||
`SELECT id, module_id, event_type, card_id, status, duration_ms, error, created_at
|
||||
FROM module_logs WHERE module_id = ? ORDER BY created_at DESC LIMIT ?`,
|
||||
moduleID, limit,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
out := []ModuleLog{}
|
||||
for rows.Next() {
|
||||
var l ModuleLog
|
||||
var cardID sql.NullString
|
||||
if err := rows.Scan(&l.ID, &l.ModuleID, &l.EventType, &cardID, &l.Status, &l.DurationMs, &l.Error, &l.CreatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if cardID.Valid {
|
||||
l.CardID = cardID.String
|
||||
}
|
||||
out = append(out, l)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// setCardJiraKey stores the Jira issue key for a card after a successful
|
||||
// create call. We skip the regular UpdateCard path to avoid emitting a
|
||||
// `card.updated` event (which would loop us back through the dispatcher).
|
||||
func (db *DB) setCardJiraKey(cardID, jiraKey string) error {
|
||||
_, err := db.conn.Exec(`UPDATE cards SET jira_key=? WHERE id=?`, jiraKey, cardID)
|
||||
return err
|
||||
}
|
||||
|
||||
func (db *DB) getCardForJira(cardID string) (*cardForJira, error) {
|
||||
var c cardForJira
|
||||
var assignee, deadline, jiraKey sql.NullString
|
||||
var tagsJSON string
|
||||
err := db.conn.QueryRow(
|
||||
`SELECT c.id, c.title, c.description, c.requester, c.column_id, c.assignee_id,
|
||||
c.deadline, c.tags, c.jira_key, c.created_at, col.name
|
||||
FROM cards c JOIN columns col ON col.id = c.column_id WHERE c.id = ?`,
|
||||
cardID,
|
||||
).Scan(&c.ID, &c.Title, &c.Description, &c.Requester, &c.ColumnID, &assignee,
|
||||
&deadline, &tagsJSON, &jiraKey, &c.CreatedAt, &c.ColumnName)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if assignee.Valid {
|
||||
c.AssigneeID = assignee.String
|
||||
}
|
||||
if deadline.Valid {
|
||||
c.Deadline = deadline.String
|
||||
}
|
||||
if jiraKey.Valid {
|
||||
c.JiraKey = jiraKey.String
|
||||
}
|
||||
_ = json.Unmarshal([]byte(tagsJSON), &c.Tags)
|
||||
return &c, nil
|
||||
}
|
||||
|
||||
type cardForJira struct {
|
||||
ID string
|
||||
Title string
|
||||
Description string
|
||||
Requester string
|
||||
ColumnID string
|
||||
ColumnName string
|
||||
AssigneeID string
|
||||
Deadline string
|
||||
Tags []string
|
||||
JiraKey string
|
||||
CreatedAt string
|
||||
}
|
||||
|
||||
func (c *cardForJira) hasTag(name string) bool {
|
||||
name = strings.ToLower(name)
|
||||
for _, t := range c.Tags {
|
||||
if strings.ToLower(t) == name {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func splitCSV(s string) []string {
|
||||
if s == "" {
|
||||
return nil
|
||||
}
|
||||
parts := strings.Split(s, ",")
|
||||
out := make([]string, 0, len(parts))
|
||||
for _, p := range parts {
|
||||
p = strings.TrimSpace(p)
|
||||
if p != "" {
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func boolInt(b bool) int {
|
||||
if b {
|
||||
return 1
|
||||
}
|
||||
return 0
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// Dispatcher
|
||||
// =============================================================================
|
||||
|
||||
const (
|
||||
moduleRetries = 3
|
||||
moduleRetryDelay1 = 1 * time.Second
|
||||
moduleRetryDelay2 = 5 * time.Second
|
||||
moduleRetryDelay3 = 30 * time.Second
|
||||
moduleHTTPTimeout = 15 * time.Second
|
||||
moduleOptOutTag = "nojira"
|
||||
moduleDispatchQueue = 256
|
||||
)
|
||||
|
||||
// Dispatcher fans events from the EventHub into per-module handlers.
|
||||
//
|
||||
// Lifecycle:
|
||||
// - Start() spawns a single subscriber goroutine on the hub plus a
|
||||
// bounded worker pool.
|
||||
// - Stop() cancels the context and waits for in-flight requests to drain.
|
||||
//
|
||||
// Handlers receive a decrypted Module copy + the Event; they own the HTTP
|
||||
// call to the target system. The dispatcher logs every attempt.
|
||||
type Dispatcher struct {
|
||||
db *DB
|
||||
hub *EventHub
|
||||
handlers map[string]Handler
|
||||
queue chan dispatchTask
|
||||
ctx context.Context
|
||||
cancel context.CancelFunc
|
||||
enabled bool
|
||||
}
|
||||
|
||||
type dispatchTask struct {
|
||||
module Module
|
||||
event Event
|
||||
}
|
||||
|
||||
type Handler interface {
|
||||
Handle(ctx context.Context, db *DB, m Module, ev Event) (status int, err error)
|
||||
TestConnection(ctx context.Context, m Module) (status int, err error)
|
||||
}
|
||||
|
||||
func NewDispatcher(db *DB, hub *EventHub) *Dispatcher {
|
||||
_, hasKey := moduleKey()
|
||||
return &Dispatcher{
|
||||
db: db,
|
||||
hub: hub,
|
||||
handlers: map[string]Handler{"jira": &jiraHandler{}},
|
||||
queue: make(chan dispatchTask, moduleDispatchQueue),
|
||||
enabled: hasKey,
|
||||
}
|
||||
}
|
||||
|
||||
func (d *Dispatcher) Start() {
|
||||
if !d.enabled {
|
||||
log.Printf("module dispatcher disabled (%s not set)", moduleKeyEnv)
|
||||
return
|
||||
}
|
||||
d.ctx, d.cancel = context.WithCancel(context.Background())
|
||||
// Subscribe under a synthetic user so the hub treats us as a normal
|
||||
// recipient of broadcast events. Private user-targeted events are
|
||||
// uninteresting for outbound sync.
|
||||
go d.run()
|
||||
for i := 0; i < 4; i++ {
|
||||
go d.worker(i)
|
||||
}
|
||||
log.Printf("module dispatcher started")
|
||||
}
|
||||
|
||||
func (d *Dispatcher) Stop() {
|
||||
if d.cancel != nil {
|
||||
d.cancel()
|
||||
}
|
||||
}
|
||||
|
||||
func (d *Dispatcher) run() {
|
||||
ch := d.hub.SubscribeUser("__module_dispatcher__")
|
||||
defer d.hub.UnsubscribeUser("__module_dispatcher__", ch)
|
||||
for {
|
||||
select {
|
||||
case <-d.ctx.Done():
|
||||
return
|
||||
case ev, ok := <-ch:
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
d.fanout(ev)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (d *Dispatcher) fanout(ev Event) {
|
||||
mods, err := d.db.listModulesEnabled()
|
||||
if err != nil {
|
||||
log.Printf("dispatcher: listModulesEnabled: %v", err)
|
||||
return
|
||||
}
|
||||
for _, m := range mods {
|
||||
if !filterMatches(m.EventFilter, ev.Type) {
|
||||
continue
|
||||
}
|
||||
if !cutoffOK(d.db, m, ev) {
|
||||
continue
|
||||
}
|
||||
if ev.CardID != "" {
|
||||
c, err := d.db.getCardForJira(ev.CardID)
|
||||
if err == nil && c.hasTag(moduleOptOutTag) {
|
||||
continue
|
||||
}
|
||||
}
|
||||
select {
|
||||
case d.queue <- dispatchTask{module: m, event: ev}:
|
||||
default:
|
||||
log.Printf("dispatcher: queue full, dropping event %s for module %s", ev.Type, m.ID)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (d *Dispatcher) worker(id int) {
|
||||
for {
|
||||
select {
|
||||
case <-d.ctx.Done():
|
||||
return
|
||||
case task, ok := <-d.queue:
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
d.dispatch(task)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// dispatch runs the handler with up to moduleRetries attempts using a
|
||||
// fixed back-off schedule (1s, 5s, 30s). Each attempt creates a log row;
|
||||
// the final outcome is the one returned to the caller.
|
||||
func (d *Dispatcher) dispatch(t dispatchTask) {
|
||||
h, ok := d.handlers[t.module.Kind]
|
||||
if !ok {
|
||||
_ = d.db.appendModuleLog(ModuleLog{
|
||||
ModuleID: t.module.ID, EventType: t.event.Type, CardID: t.event.CardID,
|
||||
Error: "unknown module kind: " + t.module.Kind,
|
||||
})
|
||||
return
|
||||
}
|
||||
delays := []time.Duration{0, moduleRetryDelay1, moduleRetryDelay2, moduleRetryDelay3}
|
||||
for attempt := 0; attempt < moduleRetries; attempt++ {
|
||||
if delays[attempt] > 0 {
|
||||
select {
|
||||
case <-d.ctx.Done():
|
||||
return
|
||||
case <-time.After(delays[attempt]):
|
||||
}
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(d.ctx, moduleHTTPTimeout)
|
||||
start := time.Now()
|
||||
status, err := h.Handle(ctx, d.db, t.module, t.event)
|
||||
cancel()
|
||||
ml := ModuleLog{
|
||||
ModuleID: t.module.ID, EventType: t.event.Type, CardID: t.event.CardID,
|
||||
Status: status, DurationMs: int(time.Since(start).Milliseconds()),
|
||||
}
|
||||
if err != nil {
|
||||
ml.Error = err.Error()
|
||||
}
|
||||
_ = d.db.appendModuleLog(ml)
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
// 4xx client errors are not worth retrying.
|
||||
if status >= 400 && status < 500 {
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// Helpers
|
||||
// =============================================================================
|
||||
|
||||
func filterMatches(filter []string, eventType string) bool {
|
||||
for _, f := range filter {
|
||||
if f == eventType || f == "*" {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// cutoffOK applies the "module only sees events posterior to its creation"
|
||||
// rule. Cards that were already linked to Jira (jira_key != "") are always
|
||||
// eligible regardless of timestamps.
|
||||
func cutoffOK(db *DB, m Module, ev Event) bool {
|
||||
if ev.CardID == "" {
|
||||
return true
|
||||
}
|
||||
c, err := db.getCardForJira(ev.CardID)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
if c.JiraKey != "" {
|
||||
return true
|
||||
}
|
||||
return c.CreatedAt >= m.CreatedAt
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// Jira handler
|
||||
// =============================================================================
|
||||
|
||||
type jiraHandler struct{}
|
||||
|
||||
type jiraConfig struct {
|
||||
BaseURL string `json:"base_url"`
|
||||
Email string `json:"email"`
|
||||
APIToken string `json:"api_token"`
|
||||
ProjectKey string `json:"project_key"`
|
||||
StatusMap map[string]string `json:"status_map"`
|
||||
}
|
||||
|
||||
func parseJiraConfig(m Module) (jiraConfig, error) {
|
||||
b, err := json.Marshal(m.Config)
|
||||
if err != nil {
|
||||
return jiraConfig{}, err
|
||||
}
|
||||
var c jiraConfig
|
||||
if err := json.Unmarshal(b, &c); err != nil {
|
||||
return jiraConfig{}, err
|
||||
}
|
||||
c.BaseURL = strings.TrimRight(c.BaseURL, "/")
|
||||
if c.BaseURL == "" {
|
||||
return c, fmt.Errorf("base_url required")
|
||||
}
|
||||
return c, nil
|
||||
}
|
||||
|
||||
func (h *jiraHandler) jiraRequest(ctx context.Context, c jiraConfig, method, path string, body interface{}) (int, []byte, error) {
|
||||
var rdr io.Reader
|
||||
if body != nil {
|
||||
b, err := json.Marshal(body)
|
||||
if err != nil {
|
||||
return 0, nil, err
|
||||
}
|
||||
rdr = bytes.NewReader(b)
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, method, c.BaseURL+path, rdr)
|
||||
if err != nil {
|
||||
return 0, nil, err
|
||||
}
|
||||
req.Header.Set("Accept", "application/json")
|
||||
if body != nil {
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
}
|
||||
if c.Email != "" && c.APIToken != "" {
|
||||
basic := base64.StdEncoding.EncodeToString([]byte(c.Email + ":" + c.APIToken))
|
||||
req.Header.Set("Authorization", "Basic "+basic)
|
||||
}
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
return 0, nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||
if resp.StatusCode >= 400 {
|
||||
return resp.StatusCode, respBody, fmt.Errorf("jira %s %s: %d %s", method, path, resp.StatusCode, truncate(respBody, 240))
|
||||
}
|
||||
return resp.StatusCode, respBody, nil
|
||||
}
|
||||
|
||||
func truncate(b []byte, n int) string {
|
||||
if len(b) <= n {
|
||||
return string(b)
|
||||
}
|
||||
return string(b[:n]) + "…"
|
||||
}
|
||||
|
||||
func (h *jiraHandler) TestConnection(ctx context.Context, m Module) (int, error) {
|
||||
c, err := parseJiraConfig(m)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
status, _, err := h.jiraRequest(ctx, c, http.MethodGet, "/rest/api/3/myself", nil)
|
||||
return status, err
|
||||
}
|
||||
|
||||
func (h *jiraHandler) Handle(ctx context.Context, db *DB, m Module, ev Event) (int, error) {
|
||||
c, err := parseJiraConfig(m)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
switch ev.Type {
|
||||
case "card.created":
|
||||
return h.create(ctx, db, c, ev)
|
||||
case "card.updated", "board.invalidated":
|
||||
return h.update(ctx, db, c, ev)
|
||||
case "card.moved":
|
||||
return h.transition(ctx, db, c, ev)
|
||||
case "message.created":
|
||||
return h.comment(ctx, db, c, ev)
|
||||
default:
|
||||
// Silently ignore unhandled event types so the dispatcher does not
|
||||
// retry on irrelevant traffic.
|
||||
return 200, nil
|
||||
}
|
||||
}
|
||||
|
||||
func (h *jiraHandler) create(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
|
||||
if ev.CardID == "" {
|
||||
return 0, nil
|
||||
}
|
||||
card, err := db.getCardForJira(ev.CardID)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if card.JiraKey != "" {
|
||||
// Idempotent: card already linked to Jira; treat as update.
|
||||
return h.update(ctx, db, c, ev)
|
||||
}
|
||||
if c.ProjectKey == "" {
|
||||
return 0, fmt.Errorf("project_key required for create")
|
||||
}
|
||||
body := map[string]interface{}{
|
||||
"fields": map[string]interface{}{
|
||||
"project": map[string]string{"key": c.ProjectKey},
|
||||
"summary": card.Title,
|
||||
"description": adfText(card.Description),
|
||||
"issuetype": map[string]string{"name": "Task"},
|
||||
},
|
||||
}
|
||||
status, resp, err := h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue", body)
|
||||
if err != nil {
|
||||
return status, err
|
||||
}
|
||||
var parsed struct {
|
||||
Key string `json:"key"`
|
||||
}
|
||||
_ = json.Unmarshal(resp, &parsed)
|
||||
if parsed.Key != "" {
|
||||
if err := db.setCardJiraKey(card.ID, parsed.Key); err != nil {
|
||||
return status, fmt.Errorf("link jira key: %w", err)
|
||||
}
|
||||
}
|
||||
return status, nil
|
||||
}
|
||||
|
||||
func (h *jiraHandler) update(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
|
||||
if ev.CardID == "" {
|
||||
return 0, nil
|
||||
}
|
||||
card, err := db.getCardForJira(ev.CardID)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if card.JiraKey == "" {
|
||||
// Card not yet linked — bootstrap by creating it.
|
||||
return h.create(ctx, db, c, ev)
|
||||
}
|
||||
body := map[string]interface{}{
|
||||
"fields": map[string]interface{}{
|
||||
"summary": card.Title,
|
||||
"description": adfText(card.Description),
|
||||
},
|
||||
}
|
||||
status, _, err := h.jiraRequest(ctx, c, http.MethodPut, "/rest/api/3/issue/"+card.JiraKey, body)
|
||||
return status, err
|
||||
}
|
||||
|
||||
// transition uses the configured status_map to translate the kanban column
|
||||
// to a Jira transition name. We list available transitions, find the one
|
||||
// whose target status name matches, and POST it. Kanban remains the source
|
||||
// of truth even if Jira's current state differs.
|
||||
func (h *jiraHandler) transition(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
|
||||
if ev.CardID == "" {
|
||||
return 0, nil
|
||||
}
|
||||
card, err := db.getCardForJira(ev.CardID)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if card.JiraKey == "" {
|
||||
return h.create(ctx, db, c, ev)
|
||||
}
|
||||
target, ok := c.StatusMap[card.ColumnName]
|
||||
if !ok || target == "" {
|
||||
return 0, fmt.Errorf("no status_map entry for column %q", card.ColumnName)
|
||||
}
|
||||
status, body, err := h.jiraRequest(ctx, c, http.MethodGet, "/rest/api/3/issue/"+card.JiraKey+"/transitions", nil)
|
||||
if err != nil {
|
||||
return status, err
|
||||
}
|
||||
var available struct {
|
||||
Transitions []struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
To struct {
|
||||
Name string `json:"name"`
|
||||
} `json:"to"`
|
||||
} `json:"transitions"`
|
||||
}
|
||||
if err := json.Unmarshal(body, &available); err != nil {
|
||||
return status, fmt.Errorf("decode transitions: %w", err)
|
||||
}
|
||||
var tID string
|
||||
for _, t := range available.Transitions {
|
||||
if strings.EqualFold(t.To.Name, target) || strings.EqualFold(t.Name, target) {
|
||||
tID = t.ID
|
||||
break
|
||||
}
|
||||
}
|
||||
if tID == "" {
|
||||
return 0, fmt.Errorf("transition %q not available for %s", target, card.JiraKey)
|
||||
}
|
||||
req := map[string]interface{}{"transition": map[string]string{"id": tID}}
|
||||
status, _, err = h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue/"+card.JiraKey+"/transitions", req)
|
||||
return status, err
|
||||
}
|
||||
|
||||
func (h *jiraHandler) comment(ctx context.Context, db *DB, c jiraConfig, ev Event) (int, error) {
|
||||
if ev.CardID == "" {
|
||||
return 0, nil
|
||||
}
|
||||
card, err := db.getCardForJira(ev.CardID)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
if card.JiraKey == "" {
|
||||
// Cannot comment on a card not yet synced; skip.
|
||||
return 0, nil
|
||||
}
|
||||
var payload struct {
|
||||
Body string `json:"body"`
|
||||
}
|
||||
_ = json.Unmarshal(ev.Payload, &payload)
|
||||
if payload.Body == "" {
|
||||
return 0, nil
|
||||
}
|
||||
body := map[string]interface{}{"body": adfText(payload.Body)}
|
||||
status, _, err := h.jiraRequest(ctx, c, http.MethodPost, "/rest/api/3/issue/"+card.JiraKey+"/comment", body)
|
||||
return status, err
|
||||
}
|
||||
|
||||
// adfText wraps a plain string into the minimal Atlassian Document Format
|
||||
// fragment Jira Cloud requires for description / comment bodies.
|
||||
func adfText(s string) map[string]interface{} {
|
||||
return map[string]interface{}{
|
||||
"type": "doc",
|
||||
"version": 1,
|
||||
"content": []map[string]interface{}{{
|
||||
"type": "paragraph",
|
||||
"content": []map[string]interface{}{{
|
||||
"type": "text",
|
||||
"text": s,
|
||||
}},
|
||||
}},
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/aes"
|
||||
"crypto/cipher"
|
||||
"crypto/rand"
|
||||
"crypto/sha256"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
)
|
||||
|
||||
const moduleKeyEnv = "KANBAN_MODULE_KEY"
|
||||
|
||||
// moduleKey derives a 32-byte AES key from the KANBAN_MODULE_KEY env var.
|
||||
// Returns (key, true) when present; (zero, false) when missing — callers
|
||||
// must treat that as "module dispatcher disabled".
|
||||
func moduleKey() ([32]byte, bool) {
|
||||
v := os.Getenv(moduleKeyEnv)
|
||||
if v == "" {
|
||||
return [32]byte{}, false
|
||||
}
|
||||
return sha256.Sum256([]byte(v)), true
|
||||
}
|
||||
|
||||
// encryptConfig encrypts a JSON config blob with AES-GCM. Returns the
|
||||
// ciphertext and the 12-byte nonce. Caller persists both columns.
|
||||
func encryptConfig(plain []byte) (cipherOut, nonce []byte, err error) {
|
||||
key, ok := moduleKey()
|
||||
if !ok {
|
||||
return nil, nil, fmt.Errorf("%s not set; cannot encrypt module config", moduleKeyEnv)
|
||||
}
|
||||
block, err := aes.NewCipher(key[:])
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
nonce = make([]byte, gcm.NonceSize())
|
||||
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
cipherOut = gcm.Seal(nil, nonce, plain, nil)
|
||||
return cipherOut, nonce, nil
|
||||
}
|
||||
|
||||
// decryptConfig is the inverse of encryptConfig.
|
||||
func decryptConfig(cipherIn, nonce []byte) ([]byte, error) {
|
||||
key, ok := moduleKey()
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("%s not set; cannot decrypt module config", moduleKeyEnv)
|
||||
}
|
||||
if len(nonce) == 0 {
|
||||
return nil, errors.New("nonce empty")
|
||||
}
|
||||
block, err := aes.NewCipher(key[:])
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
gcm, err := cipher.NewGCM(block)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return gcm.Open(nil, nonce, cipherIn, nil)
|
||||
}
|
||||
@@ -0,0 +1,226 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"fn-registry/functions/infra"
|
||||
)
|
||||
|
||||
// requireAdmin gates a handler so only users with users.is_admin = 1 can
|
||||
// reach it. Non-admins get a 403. Anonymous callers get a 401.
|
||||
func requireAdmin(db *DB, next http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
uid, _ := infra.UserIDFromContext(r.Context(), userCtxKey)
|
||||
if uid == "" {
|
||||
infra.HTTPErrorResponse(w, infra.HTTPError{Status: http.StatusUnauthorized, Code: "unauthorized", Message: "session required"})
|
||||
return
|
||||
}
|
||||
ok, err := db.IsAdmin(uid)
|
||||
if err != nil {
|
||||
serverError(w, err)
|
||||
return
|
||||
}
|
||||
if !ok {
|
||||
infra.HTTPErrorResponse(w, infra.HTTPError{Status: http.StatusForbidden, Code: "forbidden", Message: "admin required"})
|
||||
return
|
||||
}
|
||||
next(w, r)
|
||||
}
|
||||
}
|
||||
|
||||
// publicModule strips secrets out of the config before responding. The
|
||||
// API token is never returned to the client after it has been stored.
|
||||
func publicModule(m Module) Module {
|
||||
clone := m
|
||||
if clone.Config != nil {
|
||||
cleaned := JSONValue{}
|
||||
for k, v := range clone.Config {
|
||||
if strings.Contains(strings.ToLower(k), "token") || strings.Contains(strings.ToLower(k), "password") || strings.Contains(strings.ToLower(k), "secret") {
|
||||
cleaned[k] = "***"
|
||||
} else {
|
||||
cleaned[k] = v
|
||||
}
|
||||
}
|
||||
clone.Config = cleaned
|
||||
}
|
||||
return clone
|
||||
}
|
||||
|
||||
func handleListModules(db *DB) http.HandlerFunc {
|
||||
return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
|
||||
mods, err := db.listModulesAll()
|
||||
if err != nil {
|
||||
serverError(w, err)
|
||||
return
|
||||
}
|
||||
out := make([]Module, 0, len(mods))
|
||||
for _, m := range mods {
|
||||
out = append(out, publicModule(m))
|
||||
}
|
||||
infra.HTTPJSONResponse(w, http.StatusOK, out)
|
||||
})
|
||||
}
|
||||
|
||||
type modulePayload struct {
|
||||
Name string `json:"name"`
|
||||
Kind string `json:"kind"`
|
||||
Enabled bool `json:"enabled"`
|
||||
EventFilter []string `json:"event_filter"`
|
||||
Config JSONValue `json:"config"`
|
||||
}
|
||||
|
||||
func handleCreateModule(db *DB) http.HandlerFunc {
|
||||
return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
|
||||
var body modulePayload
|
||||
if err := infra.HTTPParseBody(r, &body, maxBodyBytes); err != nil {
|
||||
badRequest(w, err.Error())
|
||||
return
|
||||
}
|
||||
if body.Name == "" || body.Kind == "" {
|
||||
badRequest(w, "name and kind required")
|
||||
return
|
||||
}
|
||||
m := &Module{
|
||||
Name: body.Name, Kind: body.Kind, Enabled: body.Enabled,
|
||||
EventFilter: body.EventFilter, Config: body.Config,
|
||||
}
|
||||
if err := db.saveModule(m); err != nil {
|
||||
serverError(w, err)
|
||||
return
|
||||
}
|
||||
infra.HTTPJSONResponse(w, http.StatusCreated, publicModule(*m))
|
||||
})
|
||||
}
|
||||
|
||||
func handleUpdateModule(db *DB) http.HandlerFunc {
|
||||
return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
existing, err := db.getModule(id)
|
||||
if err != nil {
|
||||
notFound(w, "module not found")
|
||||
return
|
||||
}
|
||||
// Partial body: preserve fields the client did not include. We rely
|
||||
// on a generic map to detect omitted vs explicit-null because PATCH
|
||||
// callers do not always send the full record.
|
||||
var raw map[string]json.RawMessage
|
||||
if err := infra.HTTPParseBody(r, &raw, maxBodyBytes); err != nil {
|
||||
badRequest(w, err.Error())
|
||||
return
|
||||
}
|
||||
decode := func(key string, into interface{}) {
|
||||
if v, ok := raw[key]; ok {
|
||||
_ = json.Unmarshal(v, into)
|
||||
}
|
||||
}
|
||||
decode("name", &existing.Name)
|
||||
decode("kind", &existing.Kind)
|
||||
decode("enabled", &existing.Enabled)
|
||||
if v, ok := raw["event_filter"]; ok {
|
||||
_ = json.Unmarshal(v, &existing.EventFilter)
|
||||
}
|
||||
if v, ok := raw["config"]; ok {
|
||||
var cfg JSONValue
|
||||
_ = json.Unmarshal(v, &cfg)
|
||||
// Re-inject masked fields the UI left as "***" so a partial
|
||||
// edit does not nuke stored secrets.
|
||||
merged := JSONValue{}
|
||||
for k, val := range existing.Config {
|
||||
merged[k] = val
|
||||
}
|
||||
for k, val := range cfg {
|
||||
if s, isStr := val.(string); isStr && s == "***" {
|
||||
continue
|
||||
}
|
||||
merged[k] = val
|
||||
}
|
||||
existing.Config = merged
|
||||
}
|
||||
if err := db.saveModule(existing); err != nil {
|
||||
serverError(w, err)
|
||||
return
|
||||
}
|
||||
infra.HTTPJSONResponse(w, http.StatusOK, publicModule(*existing))
|
||||
})
|
||||
}
|
||||
|
||||
func handleDeleteModule(db *DB) http.HandlerFunc {
|
||||
return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
if err := db.deleteModule(id); err != nil {
|
||||
serverError(w, err)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusNoContent)
|
||||
})
|
||||
}
|
||||
|
||||
func handleModuleLogs(db *DB) http.HandlerFunc {
|
||||
return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
limit := 100
|
||||
if v := r.URL.Query().Get("limit"); v != "" {
|
||||
if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 1000 {
|
||||
limit = n
|
||||
}
|
||||
}
|
||||
out, err := db.listModuleLogs(id, limit)
|
||||
if err != nil {
|
||||
serverError(w, err)
|
||||
return
|
||||
}
|
||||
infra.HTTPJSONResponse(w, http.StatusOK, out)
|
||||
})
|
||||
}
|
||||
|
||||
// handleTestModule executes the kind-specific test_connection probe with
|
||||
// the *current stored config* (or with an incoming config payload, for
|
||||
// pre-save validation). Returns {ok, status, error} regardless of outcome
|
||||
// so the UI can show a useful message.
|
||||
func handleTestModule(db *DB, dispatcher *Dispatcher) http.HandlerFunc {
|
||||
return requireAdmin(db, func(w http.ResponseWriter, r *http.Request) {
|
||||
id := r.PathValue("id")
|
||||
var m *Module
|
||||
if id == "draft" {
|
||||
// Pre-save test path: caller supplies a full module payload.
|
||||
var body modulePayload
|
||||
if err := infra.HTTPParseBody(r, &body, maxBodyBytes); err != nil {
|
||||
badRequest(w, err.Error())
|
||||
return
|
||||
}
|
||||
m = &Module{Kind: body.Kind, Config: body.Config}
|
||||
} else {
|
||||
got, err := db.getModule(id)
|
||||
if err != nil {
|
||||
notFound(w, "module not found")
|
||||
return
|
||||
}
|
||||
m = got
|
||||
}
|
||||
h, ok := dispatcher.handlers[m.Kind]
|
||||
if !ok {
|
||||
infra.HTTPJSONResponse(w, http.StatusOK, map[string]interface{}{
|
||||
"ok": false, "status": 0, "error": "unknown kind: " + m.Kind,
|
||||
})
|
||||
return
|
||||
}
|
||||
ctx, cancel := context.WithTimeout(r.Context(), moduleHTTPTimeout)
|
||||
defer cancel()
|
||||
start := time.Now()
|
||||
status, err := h.TestConnection(ctx, *m)
|
||||
resp := map[string]interface{}{
|
||||
"ok": err == nil,
|
||||
"status": status,
|
||||
"duration_ms": int(time.Since(start).Milliseconds()),
|
||||
}
|
||||
if err != nil {
|
||||
resp["error"] = err.Error()
|
||||
}
|
||||
infra.HTTPJSONResponse(w, http.StatusOK, resp)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,227 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// withModuleKey sets KANBAN_MODULE_KEY for the duration of a test and
|
||||
// restores the previous value afterwards.
|
||||
func withModuleKey(t *testing.T, value string) {
|
||||
t.Helper()
|
||||
prev := os.Getenv(moduleKeyEnv)
|
||||
t.Setenv(moduleKeyEnv, value)
|
||||
t.Cleanup(func() { _ = os.Setenv(moduleKeyEnv, prev) })
|
||||
}
|
||||
|
||||
func TestCryptoRoundTrip(t *testing.T) {
|
||||
withModuleKey(t, "test-passphrase")
|
||||
plain := []byte(`{"hello":"world"}`)
|
||||
cipherBlob, nonce, err := encryptConfig(plain)
|
||||
if err != nil {
|
||||
t.Fatalf("encrypt: %v", err)
|
||||
}
|
||||
got, err := decryptConfig(cipherBlob, nonce)
|
||||
if err != nil {
|
||||
t.Fatalf("decrypt: %v", err)
|
||||
}
|
||||
if string(got) != string(plain) {
|
||||
t.Fatalf("roundtrip mismatch: got %q want %q", got, plain)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCryptoMissingKey(t *testing.T) {
|
||||
t.Setenv(moduleKeyEnv, "")
|
||||
if _, _, err := encryptConfig([]byte("x")); err == nil {
|
||||
t.Fatal("expected error when KANBAN_MODULE_KEY unset")
|
||||
}
|
||||
}
|
||||
|
||||
func TestSaveAndLoadModule(t *testing.T) {
|
||||
withModuleKey(t, "test-passphrase")
|
||||
db := setupTestDB(t)
|
||||
m := &Module{
|
||||
Name: "jira-test", Kind: "jira", Enabled: true,
|
||||
EventFilter: []string{"card.created", "card.moved"},
|
||||
Config: JSONValue{
|
||||
"base_url": "https://example.atlassian.net",
|
||||
"email": "x@y.z",
|
||||
"api_token": "secret-123",
|
||||
},
|
||||
}
|
||||
if err := db.saveModule(m); err != nil {
|
||||
t.Fatalf("save: %v", err)
|
||||
}
|
||||
if m.ID == "" {
|
||||
t.Fatal("ID not assigned on insert")
|
||||
}
|
||||
got, err := db.getModule(m.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
if got.Config["api_token"] != "secret-123" {
|
||||
t.Fatalf("token roundtrip failed: %v", got.Config["api_token"])
|
||||
}
|
||||
}
|
||||
|
||||
func TestFilterMatches(t *testing.T) {
|
||||
if !filterMatches([]string{"card.created"}, "card.created") {
|
||||
t.Fatal("exact match")
|
||||
}
|
||||
if !filterMatches([]string{"*"}, "anything") {
|
||||
t.Fatal("wildcard")
|
||||
}
|
||||
if filterMatches([]string{"card.created"}, "card.moved") {
|
||||
t.Fatal("non-match should be false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCardOptOutTag(t *testing.T) {
|
||||
c := cardForJira{Tags: []string{"foo", "NoJira", "bar"}}
|
||||
if !c.hasTag("nojira") {
|
||||
t.Fatal("nojira (case-insensitive) not detected")
|
||||
}
|
||||
if c.hasTag("missing") {
|
||||
t.Fatal("missing tag returned true")
|
||||
}
|
||||
}
|
||||
|
||||
func TestJiraHandler_TransitionMappingMissing(t *testing.T) {
|
||||
withModuleKey(t, "k")
|
||||
db := setupTestDB(t)
|
||||
col, _ := db.CreateColumn("Backlog")
|
||||
card, _ := db.CreateCard(col.ID, "req", "t", "d", "")
|
||||
// Link the card so the create-fallback path is skipped.
|
||||
_ = db.setCardJiraKey(card.ID, "KAN-1")
|
||||
h := &jiraHandler{}
|
||||
_, err := h.transition(context.Background(), db, jiraConfig{BaseURL: "http://x"}, Event{Type: "card.moved", CardID: card.ID})
|
||||
if err == nil || !strings.Contains(err.Error(), "status_map") {
|
||||
t.Fatalf("expected status_map error, got %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestJiraHandler_TestConnectionHitsMyself(t *testing.T) {
|
||||
var path string
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
path = r.URL.Path
|
||||
w.WriteHeader(http.StatusOK)
|
||||
_, _ = io.WriteString(w, `{"accountId":"abc"}`)
|
||||
}))
|
||||
defer srv.Close()
|
||||
h := &jiraHandler{}
|
||||
m := Module{Kind: "jira", Config: JSONValue{
|
||||
"base_url": srv.URL,
|
||||
"email": "x@y.z",
|
||||
"api_token": "tok",
|
||||
}}
|
||||
status, err := h.TestConnection(context.Background(), m)
|
||||
if err != nil {
|
||||
t.Fatalf("TestConnection: %v", err)
|
||||
}
|
||||
if status != 200 {
|
||||
t.Fatalf("status = %d, want 200", status)
|
||||
}
|
||||
if path != "/rest/api/3/myself" {
|
||||
t.Fatalf("path = %q, want /rest/api/3/myself", path)
|
||||
}
|
||||
}
|
||||
|
||||
func TestJiraHandler_CreateLinksCardKey(t *testing.T) {
|
||||
withModuleKey(t, "test-passphrase")
|
||||
db := setupTestDB(t)
|
||||
user, _ := db.CreateUser("alice", "passw", "Alice")
|
||||
col, _ := db.CreateColumn("Todo")
|
||||
card, _ := db.CreateCard(col.ID, "req", "Buy bread", "desc", user.ID)
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Method == http.MethodPost && r.URL.Path == "/rest/api/3/issue" {
|
||||
b, _ := io.ReadAll(r.Body)
|
||||
var p struct {
|
||||
Fields struct {
|
||||
Summary string `json:"summary"`
|
||||
} `json:"fields"`
|
||||
}
|
||||
_ = json.Unmarshal(b, &p)
|
||||
if p.Fields.Summary != "Buy bread" {
|
||||
t.Errorf("summary = %q", p.Fields.Summary)
|
||||
}
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
_, _ = io.WriteString(w, `{"id":"10000","key":"KAN-1"}`)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusNotFound)
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
h := &jiraHandler{}
|
||||
mod := Module{Kind: "jira", Config: JSONValue{
|
||||
"base_url": srv.URL,
|
||||
"email": "x@y.z",
|
||||
"api_token": "tok",
|
||||
"project_key": "KAN",
|
||||
"status_map": map[string]interface{}{"Todo": "To Do"},
|
||||
}}
|
||||
status, err := h.Handle(context.Background(), db, mod, Event{Type: "card.created", CardID: card.ID})
|
||||
if err != nil {
|
||||
t.Fatalf("Handle: %v", err)
|
||||
}
|
||||
if status != http.StatusCreated {
|
||||
t.Fatalf("status = %d, want 201", status)
|
||||
}
|
||||
again, err := db.getCardForJira(card.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("get card: %v", err)
|
||||
}
|
||||
if again.JiraKey != "KAN-1" {
|
||||
t.Fatalf("jira_key = %q, want KAN-1", again.JiraKey)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDispatcher_Cutoff(t *testing.T) {
|
||||
withModuleKey(t, "k")
|
||||
db := setupTestDB(t)
|
||||
col, _ := db.CreateColumn("Todo")
|
||||
// Create card BEFORE the module so cutoffOK rejects it.
|
||||
card, _ := db.CreateCard(col.ID, "req", "t", "d", "")
|
||||
time.Sleep(20 * time.Millisecond)
|
||||
mod := Module{ID: "m", CreatedAt: nowRFC3339()}
|
||||
if cutoffOK(db, mod, Event{CardID: card.ID}) {
|
||||
t.Fatal("card pre-dating module should be filtered out")
|
||||
}
|
||||
// Once linked, cutoff should allow it.
|
||||
_ = db.setCardJiraKey(card.ID, "KAN-9")
|
||||
if !cutoffOK(db, mod, Event{CardID: card.ID}) {
|
||||
t.Fatal("linked card must pass cutoff even if older")
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsAdmin(t *testing.T) {
|
||||
db := setupTestDB(t)
|
||||
u, _ := db.CreateUser("egutierrez", "passw", "Egu")
|
||||
// Migration 015 marks egutierrez admin via UPDATE WHERE username, but
|
||||
// that only takes effect when the row already exists. In production
|
||||
// the migration runs against an existing user list; in tests we create
|
||||
// users after migration, so simulate the same outcome explicitly.
|
||||
if _, err := db.conn.Exec(`UPDATE users SET is_admin = 1 WHERE username = ?`, "egutierrez"); err != nil {
|
||||
t.Fatalf("seed admin: %v", err)
|
||||
}
|
||||
ok, err := db.IsAdmin(u.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("IsAdmin: %v", err)
|
||||
}
|
||||
if !ok {
|
||||
t.Fatal("egutierrez must be admin after seed")
|
||||
}
|
||||
other, _ := db.CreateUser("alice", "passw", "Alice")
|
||||
ok, _ = db.IsAdmin(other.ID)
|
||||
if ok {
|
||||
t.Fatal("alice must not be admin by default")
|
||||
}
|
||||
}
|
||||
+25
-6
@@ -14,6 +14,7 @@ type User struct {
|
||||
Username string `json:"username"`
|
||||
DisplayName string `json:"display_name"`
|
||||
Color string `json:"color"`
|
||||
IsAdmin bool `json:"is_admin"`
|
||||
CreatedAt string `json:"created_at"`
|
||||
}
|
||||
|
||||
@@ -51,36 +52,52 @@ func (db *DB) CreateUser(username, password, displayName string) (*User, error)
|
||||
|
||||
func (db *DB) GetUserByID(id string) (*User, error) {
|
||||
var u User
|
||||
var isAdmin int
|
||||
err := db.conn.QueryRow(
|
||||
`SELECT id, username, display_name, color, created_at FROM users WHERE id=?`, id,
|
||||
).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt)
|
||||
`SELECT id, username, display_name, color, is_admin, created_at FROM users WHERE id=?`, id,
|
||||
).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, errUserNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
u.IsAdmin = isAdmin == 1
|
||||
return &u, nil
|
||||
}
|
||||
|
||||
func (db *DB) IsAdmin(userID string) (bool, error) {
|
||||
if userID == "" {
|
||||
return false, nil
|
||||
}
|
||||
var n int
|
||||
err := db.conn.QueryRow(`SELECT COALESCE(is_admin, 0) FROM users WHERE id=?`, userID).Scan(&n)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return false, nil
|
||||
}
|
||||
return n == 1, err
|
||||
}
|
||||
|
||||
func (db *DB) GetUserByUsername(username string) (*User, string, error) {
|
||||
username = strings.TrimSpace(strings.ToLower(username))
|
||||
var u User
|
||||
var hash string
|
||||
var isAdmin int
|
||||
err := db.conn.QueryRow(
|
||||
`SELECT id, username, display_name, color, created_at, password_hash FROM users WHERE username=?`, username,
|
||||
).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt, &hash)
|
||||
`SELECT id, username, display_name, color, is_admin, created_at, password_hash FROM users WHERE username=?`, username,
|
||||
).Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt, &hash)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return nil, "", errUserNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
u.IsAdmin = isAdmin == 1
|
||||
return &u, hash, nil
|
||||
}
|
||||
|
||||
func (db *DB) ListUsers() ([]User, error) {
|
||||
rows, err := db.conn.Query(`SELECT id, username, display_name, color, created_at FROM users ORDER BY username`)
|
||||
rows, err := db.conn.Query(`SELECT id, username, display_name, color, is_admin, created_at FROM users ORDER BY username`)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -88,9 +105,11 @@ func (db *DB) ListUsers() ([]User, error) {
|
||||
out := []User{}
|
||||
for rows.Next() {
|
||||
var u User
|
||||
if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &u.CreatedAt); err != nil {
|
||||
var isAdmin int
|
||||
if err := rows.Scan(&u.ID, &u.Username, &u.DisplayName, &u.Color, &isAdmin, &u.CreatedAt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
u.IsAdmin = isAdmin == 1
|
||||
out = append(out, u)
|
||||
}
|
||||
return out, rows.Err()
|
||||
|
||||
Reference in New Issue
Block a user