idsync/internal/server/server.go

// Package server 提供 WebUI 所需的 HTTP 接口、静态资源，以及一次性离职确认端点。
//
// 认证只保护管理界面本身（单管理员会话），与 LDAP 用户无关。离职确认端点
// **不经 Auth 中间件**——token 即凭证，点击飞书卡片跳到它，校验通过才置
// confirmed_leave。

package server

import (
	"context"
	"encoding/json"
	"fmt"
	"html"
	"log/slog"
	"net/http"
	"strings"
	"time"

	"idsync/internal/config"
	"idsync/internal/ldaplib"
	"idsync/internal/store"
	"idsync/internal/syncer"
	"idsync/internal/webui"
)

// Deps 是服务器依赖。
type Deps struct {
	Cfg    *config.Config
	Auth   *Auth
	Store  *store.Store
	Runner *syncer.Runner
	LDAP   *ldaplib.Client
	// FeishuTest 检查飞书连通性
	FeishuTest func(ctx context.Context) error
	Log        *slog.Logger
}

// Server 装配路由。
type Server struct {
	deps *Deps
	mux  *http.ServeMux
	// syncMu 保证同一时刻只跑一次同步，避免两次点击互相踩踏。
	syncMu chan struct{}
}

// New 构造服务器。
func New(d *Deps) *Server {
	s := &Server{
		deps:   d,
		mux:    http.NewServeMux(),
		syncMu: make(chan struct{}, 1),
	}
	s.routes()
	return s
}

// Handler 返回可挂载到 http.Server 的处理器。
func (s *Server) Handler() http.Handler { return s.mux }

func (s *Server) routes() {
	// 静态资源与登录页不需要认证。
	s.mux.HandleFunc("/", s.handleIndex)
	s.mux.HandleFunc("/static/", webui.AssetHandler())

	s.mux.HandleFunc("/api/login", s.handleLogin)
	s.mux.HandleFunc("/api/logout", s.handleLogout)

	// 离职确认端点：token 即凭证，不经 Auth 中间件。
	s.mux.HandleFunc(config.ResignConfirmRoute, s.handleResignConfirm)

	// 以下接口需要登录。
	s.mux.HandleFunc("/api/status", s.deps.Auth.Middleware(s.handleStatus))
	s.mux.HandleFunc("/api/users", s.deps.Auth.Middleware(s.handleUsers))
	s.mux.HandleFunc("/api/groups", s.deps.Auth.Middleware(s.handleGroups))
	s.mux.HandleFunc("/api/plan", s.deps.Auth.Middleware(s.handlePlan))
	s.mux.HandleFunc("/api/sync", s.deps.Auth.Middleware(s.handleSync))
	s.mux.HandleFunc("/api/snapshot", s.deps.Auth.Middleware(s.handleSnapshot))
	s.mux.HandleFunc("/api/resign/pending", s.deps.Auth.Middleware(s.handleResignPending))
	s.mux.HandleFunc("/api/runs", s.deps.Auth.Middleware(s.handleRuns))
}

// handleIndex 返回内嵌的前端页面；未知的 /api/ 路径返回 404 而非首页。
func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
	if strings.HasPrefix(r.URL.Path, "/api/") {
		writeJSON(w, http.StatusNotFound, map[string]string{"error": "接口不存在"})
		return
	}
	webui.IndexHandler()(w, r)
}

func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		writeJSON(w, http.StatusMethodNotAllowed, map[string]string{"error": "方法不允许"})
		return
	}
	if err := s.deps.Auth.Login(w, r); err != nil {
		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
}

func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
	s.deps.Auth.Logout(w)
	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
}

// handleStatus 返回概览信息。
func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
	defer cancel()

	cfg := s.deps.Cfg

	ldapOK, ldapErr := true, ""
	if err := s.deps.LDAP.Ping(); err != nil {
		ldapOK, ldapErr = false, err.Error()
	}
	feishuOK, feishuErr := true, ""
	if s.deps.FeishuTest != nil {
		if err := s.deps.FeishuTest(ctx); err != nil {
			feishuOK, feishuErr = false, err.Error()
		}
	}

	users, err := s.deps.Store.ActiveUsers()
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	depts, err := s.deps.Store.ActiveDepartments()
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	skipped, _ := s.deps.Store.SkippedUsers()
	pending, _ := s.deps.Store.PendingConfirm()

	lastRun, err := s.deps.Store.LastRun()
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}

	writeJSON(w, http.StatusOK, map[string]any{
		"ldap": map[string]any{
			"ok": ldapOK, "error": ldapErr,
			"url": cfg.Ldap.URL, "baseDn": cfg.Ldap.BaseDN, "userOu": cfg.UserOUDN(),
		},
		"feishu": map[string]any{
			"ok": feishuOK, "error": feishuErr,
			"appId": maskSecret(cfg.Feishu.AppID), "deptList": cfg.Feishu.DeptList,
		},
		"lldap": map[string]any{
			"baseUrl": cfg.Lldap.BaseURL,
		},
		"counts": map[string]any{
			"activeUsers": len(users), "departments": len(depts),
			"pendingConfirm": len(pending), "skipped": len(skipped),
		},
		"lastRun": lastRun,
		"schedule": map[string]any{
			"enabled": cfg.Schedule.Enable, "snapshot": cfg.Schedule.Snapshot,
			"sync": cfg.Schedule.Sync, "syncDryRun": cfg.Schedule.SyncDryRun,
		},
	})
}

// handleUsers 返回镜像用户视图（含在职与离职流程中的用户）。
func (s *Server) handleUsers(w http.ResponseWriter, r *http.Request) {
	all, err := s.deps.Store.AllMirrorUsers()
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	type row struct {
		UID         string `json:"uid"`
		Name        string `json:"name"`
		Email       string `json:"email"`
		State       string `json:"state"`
		Skipped     bool   `json:"skipped"`
		SkipReason  string `json:"skipReason,omitempty"`
		DeptIDs     []string `json:"deptIds"`
		LastSync    string `json:"lastSyncedAt"`
	}
	rows := make([]row, 0, len(all))
	for _, u := range all {
		deptIDs, _ := s.deps.Store.UserDeptIDs(u.UID)
		rows = append(rows, row{
			UID: u.UID, Name: u.DisplayName, Email: u.Email, State: u.State,
			Skipped: u.Skipped, SkipReason: u.SkipReason,
			DeptIDs: deptIDs, LastSync: timeOrZero(u.LastSyncedAt),
		})
	}
	writeJSON(w, http.StatusOK, map[string]any{"users": rows})
}

// handleGroups 返回部门镜像。
func (s *Server) handleGroups(w http.ResponseWriter, r *http.Request) {
	depts, err := s.deps.Store.AllDepartments()
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"groups": depts})
}

// handlePlan 计算并返回 dry-run 物化计划，不产生任何写入。
func (s *Server) handlePlan(w http.ResponseWriter, r *http.Request) {
	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Minute)
	defer cancel()
	plan, err := s.deps.Runner.Preview(ctx)
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, plan)
}

// handleSync 执行物化。默认 dry-run，只有显式传 dryRun=false 才真正写入。
func (s *Server) handleSync(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		writeJSON(w, http.StatusMethodNotAllowed, map[string]string{"error": "方法不允许"})
		return
	}
	var req struct {
		DryRun *bool `json:"dryRun"`
		Force  bool  `json:"force"`
	}
	if r.Body != nil {
		_ = json.NewDecoder(r.Body).Decode(&req)
	}
	dryRun := true
	if req.DryRun != nil {
		dryRun = *req.DryRun
	}

	if err := s.lockSync(); err != nil {
		writeJSON(w, http.StatusConflict, map[string]string{"error": err.Error()})
		return
	}
	defer s.unlockSync()

	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Minute)
	defer cancel()
	plan, res, err := s.deps.Runner.Run(ctx, dryRun, req.Force, "manual")
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]any{"error": err.Error(), "plan": plan})
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"dryRun": dryRun, "plan": plan, "result": res})
}

// handleSnapshot 触发一轮快照。
func (s *Server) handleSnapshot(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		writeJSON(w, http.StatusMethodNotAllowed, map[string]string{"error": "方法不允许"})
		return
	}
	if err := s.lockSync(); err != nil {
		writeJSON(w, http.StatusConflict, map[string]string{"error": err.Error()})
		return
	}
	defer s.unlockSync()

	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Minute)
	defer cancel()
	res, err := s.deps.Runner.RunSnapshot(ctx)
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, res)
}

// handleResignPending 返回待人工确认的离职候选（等价于卡片按钮，可在界面操作）。
func (s *Server) handleResignPending(w http.ResponseWriter, r *http.Request) {
	list, err := s.deps.Store.PendingConfirm()
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	type row struct {
		UID      string `json:"uid"`
		Name     string `json:"name"`
		Email    string `json:"email"`
		LastSync string `json:"lastSyncedAt"`
	}
	rows := make([]row, 0, len(list))
	for _, u := range list {
		rows = append(rows, row{UID: u.UID, Name: u.DisplayName, Email: u.Email, LastSync: timeOrZero(u.LastSyncedAt)})
	}
	writeJSON(w, http.StatusOK, map[string]any{"pending": rows})
}

// handleResignConfirm 处理一次性离职确认：校验 token 并通过后置 confirmed_leave。
//
// token 即凭证，因此本项目路由不经 Auth 中间件。成功后渲染极简确认页，不回显
// 用户敏感信息；无效/过期/已用分别给出对应提示。
func (s *Server) handleResignConfirm(w http.ResponseWriter, r *http.Request) {
	uid := r.URL.Query().Get("uid")
	token := r.URL.Query().Get("token")

	rec, err := s.deps.Store.ConsumeToken(token)
	if err != nil {
		s.renderConfirmPage(w, "确认链接无效", "该确认链接暂不可用，可能是已失效、已使用或已过期。请向管理员重新发起离职确认。")
		return
	}
	// token 与请求里携带的 uid 必须一致，防串用。
	if rec.UID != uid {
		s.renderConfirmPage(w, "确认链接无效", "该确认链接与请求的用户不一致，已拒绝。")
		return
	}
	if err := s.deps.Store.ConfirmLeave(uid); err != nil {
		s.log().Warn("确认离职失败", "uid", uid, "err", err)
		s.renderConfirmPage(w, "操作失败", "处理确认时出错，请稍后重试或联系管理员。")
		return
	}
	s.log().Info("用户已人工确认离职", "uid", uid)
	s.renderConfirmPage(w, "已确认离职", "该员工已标记为离职，将在下一轮同步中从目录移除。")
}

// renderConfirmPage 渲染极简确认页，不展示任何用户敏感信息。
func (s *Server) renderConfirmPage(w http.ResponseWriter, title, body string) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.Header().Set("Cache-Control", "no-store")
	_, _ = fmt.Fprintf(w, `<!doctype html><html lang="zh"><meta charset="utf-8">
<title>%s</title><body style="font-family:sans-serif;padding:2rem">
<h1>%s</h1><p>%s</p></body></html>`,
		html.EscapeString(title), html.EscapeString(title), html.EscapeString(body))
}

// handleRuns 返回物化历史。
func (s *Server) handleRuns(w http.ResponseWriter, r *http.Request) {
	runs, err := s.deps.Store.RecentRuns(100)
	if err != nil {
		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
		return
	}
	writeJSON(w, http.StatusOK, map[string]any{"runs": runs})
}

func (s *Server) lockSync() error {
	select {
	case s.syncMu <- struct{}{}:
		return nil
	default:
		return fmt.Errorf("已有快照或物化任务在执行")
	}
}

func (s *Server) unlockSync() { <-s.syncMu }

func (s *Server) log() *slog.Logger {
	if s.deps.Log != nil {
		return s.deps.Log
	}
	return slog.Default()
}

// writeJSON 输出 JSON 响应。
func writeJSON(w http.ResponseWriter, code int, body any) {
	w.Header().Set("Content-Type", "application/json; charset=utf-8")
	w.WriteHeader(code)
	_ = json.NewEncoder(w).Encode(body)
}

// maskSecret 只保留标识的前后几位。
func maskSecret(s string) string {
	if len(s) <= 8 {
		if len(s) == 0 {
			return "未配置"
		}
		return "****"
	}
	return s[:4] + "****" + s[len(s)-4:]
}

func timeOrZero(t time.Time) string {
	if t.IsZero() {
		return ""
	}
	return t.Format(time.RFC3339)
}