Efremenko Arhip
3a1461315f
Let a signed-in user turn their own machine into a worker without the shared token. The coordinator already binds a JWT-authenticated registration to owner_id as untrusted; this adds the missing pieces. userservice: long-lived worker keys (scimesh_wk_live_*, hash-at-rest) with create/list/revoke and a public /worker-tokens/exchange that trades a key for a short-lived JWT carrying the owner current role/verified. python worker: SCIMESH_WORKER_KEY + SCIMESH_USERSERVICE_URL; a token provider exchanges the key and refreshes the JWT proactively and on 401, so a long-running worker survives token expiry. Static bearer token path is unchanged. coordinator UI: an "add your machine" page that mints a key and shows a ready-to-run command, proxying key management to the userservice; the dashboard gains an owner-scoped "my machines" section. docs: how to run a worker from your account, plus the untrusted/quorum/ verified trust model.
74 lines
3.1 KiB
Go
74 lines
3.1 KiB
Go
// Package http exposes the userservice over HTTP: registration, login, and a
|
|
// token-protected /me. It owns routing, request decoding, and error mapping;
|
|
// business rules live in the usecase layer.
|
|
package http
|
|
|
|
import (
|
|
"log/slog"
|
|
"net/http"
|
|
|
|
"github.com/emil28092005/SciMesh/users/internal/auth"
|
|
"github.com/emil28092005/SciMesh/users/internal/domain"
|
|
"github.com/emil28092005/SciMesh/users/internal/usecase"
|
|
)
|
|
|
|
// UseCases bundles the application services the handlers drive.
|
|
type UseCases struct {
|
|
Register *usecase.Register
|
|
Login *usecase.Login
|
|
SetVerified *usecase.SetVerified
|
|
SetRole *usecase.SetRole
|
|
CreateWorkerKey *usecase.CreateWorkerKey
|
|
ListWorkerKeys *usecase.ListWorkerKeys
|
|
RevokeWorkerKey *usecase.RevokeWorkerKey
|
|
ExchangeWorkerKey *usecase.ExchangeWorkerKey
|
|
Users usecase.UserRepository
|
|
}
|
|
|
|
// NewServer wires the routes and the middleware stack and returns the handler.
|
|
// The issuer verifies tokens for the JWT-protected routes.
|
|
func NewServer(log *slog.Logger, uc UseCases, issuer auth.Issuer) http.Handler {
|
|
h := &Handlers{
|
|
register: uc.Register,
|
|
login: uc.Login,
|
|
setVerified: uc.SetVerified,
|
|
setRole: uc.SetRole,
|
|
createWorkerKey: uc.CreateWorkerKey,
|
|
listWorkerKeys: uc.ListWorkerKeys,
|
|
revokeWorkerKey: uc.RevokeWorkerKey,
|
|
exchangeWorkerKey: uc.ExchangeWorkerKey,
|
|
users: uc.Users,
|
|
log: log,
|
|
}
|
|
|
|
mux := http.NewServeMux()
|
|
// Method-aware patterns (Go 1.22+): a GET to /register is a 405, not a match.
|
|
mux.HandleFunc("GET /health", h.handleHealth)
|
|
mux.HandleFunc("POST /register", h.handleRegister)
|
|
mux.HandleFunc("POST /login", h.handleLogin)
|
|
// /me proves a token round-trips; it sits behind JWT auth.
|
|
mux.Handle("GET /me", chain(http.HandlerFunc(h.handleMe), withJWT(issuer)))
|
|
|
|
// Worker keys: a user mints a long-lived key (JWT-protected), and a worker
|
|
// trades it for a short-lived JWT on the public exchange endpoint — the key
|
|
// itself is the credential there, so no prior token is required.
|
|
mux.HandleFunc("POST /worker-tokens/exchange", h.handleExchangeWorkerKey)
|
|
mux.Handle("POST /worker-keys", chain(http.HandlerFunc(h.handleCreateWorkerKey), withJWT(issuer)))
|
|
mux.Handle("GET /worker-keys", chain(http.HandlerFunc(h.handleListWorkerKeys), withJWT(issuer)))
|
|
mux.Handle("DELETE /worker-keys/{id}", chain(http.HandlerFunc(h.handleRevokeWorkerKey), withJWT(issuer)))
|
|
|
|
// Admin-only: grant or revoke the trusted-contributor badge. withAdmin sits
|
|
// inside withJWT so the role is available from the verified token.
|
|
mux.Handle("POST /users/{id}/verify",
|
|
chain(h.handleSetVerified(true), withJWT(issuer), withAdmin))
|
|
mux.Handle("POST /users/{id}/unverify",
|
|
chain(h.handleSetVerified(false), withJWT(issuer), withAdmin))
|
|
mux.Handle("POST /users/{id}/promote",
|
|
chain(h.handleSetRole(domain.RoleAdmin), withJWT(issuer), withAdmin))
|
|
mux.Handle("POST /users/{id}/demote",
|
|
chain(h.handleSetRole(domain.RoleUser), withJWT(issuer), withAdmin))
|
|
|
|
// Outermost first: every request gets an ID and an access-log line.
|
|
return chain(mux, withRequestID, withAccessLog(log))
|
|
}
|