path: root/server/main.go

// Command server publishes claude-logbook sessions at /share/<id>.
//
// Anyone may create a share (that is what `claude-logbook --share` does);
// only whoever holds the secret returned on creation may replace or delete
// it. Abuse is held back by size limits, payload validation and a rate limit
// per client IP.
package main

import (
	_ "embed"
	"encoding/json"
	"errors"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

//go:generate cp ../claude_logbook/template.html template.html

//go:embed template.html
var templateHTML string

//go:embed home.html
var homeHTML string

// TTLs the client may ask for; the first is the default.
var ttls = map[string]time.Duration{
	"1d": 24 * time.Hour, "7d": 7 * 24 * time.Hour,
	"30d": 30 * 24 * time.Hour, "90d": 90 * 24 * time.Hour,
}

const defaultTTL = "30d"

type Config struct {
	Addr         string
	DataDir      string
	PublicURL    string
	MaxBytes     int64
	MaxSessions  int
	TrustedProxy string
	CreatesPerH  int
	WritesPerH   int
}

func env(key, def string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return def
}

func envInt(key string, def int64) int64 {
	if v := os.Getenv(key); v != "" {
		if n, err := strconv.ParseInt(v, 10, 64); err == nil {
			return n
		}
		log.Fatalf("%s: not a number: %q", key, v)
	}
	return def
}

type Server struct {
	cfg     Config
	store   *Store
	page    *Page
	ip      *ClientIP
	creates *Limiter
	writes  *Limiter
	home    []byte
}

func NewServer(cfg Config) (*Server, error) {
	store, err := NewStore(cfg.DataDir)
	if err != nil {
		return nil, err
	}
	page, err := NewPage(templateHTML)
	if err != nil {
		return nil, err
	}
	ip, err := NewClientIP(cfg.TrustedProxy)
	if err != nil {
		return nil, fmt.Errorf("TRUSTED_PROXY: %v", err)
	}
	home := strings.ReplaceAll(homeHTML, "{{PUBLIC_URL}}", cfg.PublicURL)
	return &Server{cfg: cfg, store: store, page: page, ip: ip,
		creates: NewLimiter(cfg.CreatesPerH, time.Hour),
		writes:  NewLimiter(cfg.WritesPerH, time.Hour),
		home:    []byte(home)}, nil
}

func (s *Server) Routes() http.Handler {
	mux := http.NewServeMux()
	mux.HandleFunc("GET /{$}", s.handleHome)
	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
		w.Write([]byte("ok\n"))
	})
	mux.HandleFunc("GET /share/{name}", s.handleShare)
	mux.HandleFunc("POST /api/shares", s.handleCreate)
	mux.HandleFunc("PUT /api/shares/{id}", s.handleUpdate)
	mux.HandleFunc("DELETE /api/shares/{id}", s.handleDelete)
	return logRequests(securityHeaders(mux))
}

// ──────────────────────────────── pages ──────────────────────────────────

func (s *Server) handleHome(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.Header().Set("Content-Security-Policy",
		"default-src 'none'; style-src 'unsafe-inline'; img-src data:; "+
			"base-uri 'none'; form-action 'none'; frame-ancestors 'none'")
	w.Header().Set("Cache-Control", "public, max-age=300")
	w.Write(s.home)
}

func (s *Server) handleShare(w http.ResponseWriter, r *http.Request) {
	name := r.PathValue("name")
	id, ext, _ := strings.Cut(name, ".")
	raw, _, err := s.store.Get(id)
	if errors.Is(err, ErrNotFound) {
		http.Error(w, "share not found (it may have expired or been deleted)", http.StatusNotFound)
		return
	}
	if err != nil {
		s.fail(w, err)
		return
	}
	h := w.Header()
	h.Set("Cache-Control", "private, no-cache")
	h.Set("X-Robots-Tag", "noindex, nofollow")
	switch ext {
	case "":
		h.Set("Content-Type", "text/html; charset=utf-8")
		h.Set("Content-Security-Policy", s.page.csp)
		w.Write(s.page.Render(raw))
	case "json":
		h.Set("Content-Type", "application/json; charset=utf-8")
		w.Write(raw)
	case "txt":
		p, _, err := ParsePayload(raw, 1<<30)
		if err != nil {
			s.fail(w, err)
			return
		}
		h.Set("Content-Type", "text/plain; charset=utf-8")
		w.Write(RenderText(p))
	default:
		http.NotFound(w, r)
	}
}

// ──────────────────────────────── api ────────────────────────────────────

type writeReq struct {
	Payload json.RawMessage `json:"payload"`
	Expire  string          `json:"expire"`
}

type shareResp struct {
	ID      string    `json:"id"`
	URL     string    `json:"url"`
	Secret  string    `json:"secret,omitempty"`
	Expires time.Time `json:"expires"`
}

func jsonError(w http.ResponseWriter, code int, msg string) {
	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	w.WriteHeader(code)
	json.NewEncoder(w).Encode(map[string]string{"error": msg})
}

func (s *Server) fail(w http.ResponseWriter, err error) {
	log.Printf("error: %v", err)
	jsonError(w, http.StatusInternalServerError, "internal error")
}

// readWrite decodes and validates a POST/PUT body. ok=false means the error
// response was already written.
func (s *Server) readWrite(w http.ResponseWriter, r *http.Request, needPayload bool) (clean []byte, ttl time.Duration, ok bool) {
	r.Body = http.MaxBytesReader(w, r.Body, s.cfg.MaxBytes)
	var req writeReq
	dec := json.NewDecoder(r.Body)
	dec.DisallowUnknownFields()
	if err := dec.Decode(&req); err != nil {
		var tooBig *http.MaxBytesError
		if errors.As(err, &tooBig) {
			jsonError(w, http.StatusRequestEntityTooLarge,
				fmt.Sprintf("payload larger than %d bytes", s.cfg.MaxBytes))
			return nil, 0, false
		}
		jsonError(w, http.StatusBadRequest, "body: "+err.Error())
		return nil, 0, false
	}
	if req.Expire != "" {
		var known bool
		if ttl, known = ttls[req.Expire]; !known {
			jsonError(w, http.StatusBadRequest, "expire: one of 1d, 7d, 30d, 90d")
			return nil, 0, false
		}
	}
	if len(req.Payload) == 0 {
		if needPayload {
			jsonError(w, http.StatusBadRequest, "payload: missing")
			return nil, 0, false
		}
		return nil, ttl, true
	}
	_, clean, err := ParsePayload(req.Payload, s.cfg.MaxSessions)
	if err != nil {
		jsonError(w, http.StatusBadRequest, err.Error())
		return nil, 0, false
	}
	return clean, ttl, true
}

func bearer(r *http.Request) string {
	h := r.Header.Get("Authorization")
	if t, ok := strings.CutPrefix(h, "Bearer "); ok {
		return strings.TrimSpace(t)
	}
	return ""