4 files changed, 223 insertions, 6 deletions
diff --git a/system/api/analytics/init.go b/system/api/analytics/init.go
new file mode 100644
index 0000000..c351bed
--- /dev/null
+++ b/system/api/analytics/init.go
@@ -0,0 +1,101 @@
+// Package analytics provides the methods to run an analytics reporting system
+// for API requests which may be useful to users for measuring access and
+// possibly identifying bad actors abusing requests.
+package analytics
+
+import (
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/boltdb/bolt"
+)
+
+type apiRequest struct {
+	URL        string `json:"url"`
+	Method     string `json:"http_method"`
+	RemoteAddr string `json:"ip_address"`
+	Timestamp  int64  `json:"timestamp"`
+	External   bool   `json:"external"`
+}
+
+var (
+	store      *bolt.DB
+	recordChan chan apiRequest
+)
+
+// Record queues an apiRequest for metrics
+func Record(req *http.Request) {
+	external := strings.Contains(req.URL.Path, "/external/")
+
+	r := apiRequest{
+		URL:        req.URL.String(),
+		Method:     req.Method,
+		RemoteAddr: req.RemoteAddr,
+		Timestamp:  time.Now().Unix() * 1000,
+		External:   external,
+	}
+
+	// put r on buffered recordChan to take advantage of batch insertion in DB
+	recordChan <- r
+
+}
+
+// Close exports the abillity to close our db file. Should be called with defer
+// after call to Init() from the same place.
+func Close() {
+	err := store.Close()
+	if err != nil {
+		log.Println(err)
+	}
+}
+
+// Init creates a db connection, should run an initial prune of old data, and
+// sets up the queue/batching channel
+func Init() {
+	var err error
+	store, err = bolt.Open("analytics.db", 0666, nil)
+	if err != nil {
+		log.Fatalln(err)
+	}
+
+	recordChan = make(chan apiRequest, 1024*128)
+
+	go serve()
+
+	err = store.Update(func(tx *bolt.Tx) error {
+
+		return nil
+	})
+	if err != nil {
+		log.Fatalln(err)
+	}
+}
+
+func serve() {
+	// make timer to notify select to batch request insert from recordChan
+	// interval: 1 minute
+	apiRequestTimer := time.NewTicker(time.Minute * 1)
+
+	// make timer to notify select to remove old analytics
+	// interval: 2 weeks
+	// TODO: enable analytics backup service to cloud
+	pruneDBTimer := time.NewTicker(time.Hour * 24 * 14)
+
+	for {
+		select {
+		case <-apiRequestTimer.C:
+			var reqs []apiRequest
+			batchSize := len(recordChan)
+
+			for i := 0; i < batchSize; i++ {
+				reqs = append(reqs, <-recordChan)
+			}
+
+		case <-pruneDBTimer.C:
+
+		default:
+		}
+	}
+}
diff --git a/system/api/external.go b/system/api/external.go
new file mode 100644
index 0000000..4a42eb5
--- /dev/null
+++ b/system/api/external.go
@@ -0,0 +1,109 @@
+package api
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/bosssauce/ponzu/content"
+	"github.com/bosssauce/ponzu/system/admin/upload"
+	"github.com/bosssauce/ponzu/system/db"
+)
+
+// Externalable accepts or rejects external POST requests to endpoints such as:
+// /external/posts?type=Review
+type Externalable interface {
+	// Accepts determines whether a type will allow external submissions
+	Accepts() bool
+}
+
+// Mergeable allows external post content to be approved and published through
+// the public-facing API
+type Mergeable interface {
+	// Approve copies an external post to the internal collection and triggers
+	// a re-sort of its content type posts
+	Approve(req *http.Request) error
+}
+
+func externalPostsHandler(res http.ResponseWriter, req *http.Request) {
+	if req.Method != http.MethodPost {
+		res.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+
+	err := req.ParseMultipartForm(1024 * 1024 * 4) // maxMemory 4MB
+	if err != nil {
+		log.Println("[External] error:", err)
+		res.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	t := req.URL.Query().Get("type")
+	if t == "" {
+		res.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	p, found := content.Types[t]
+	if !found {
+		log.Println("[External] attempt to submit unknown type:", t, "from:", req.RemoteAddr)
+		res.WriteHeader(http.StatusNotFound)
+		return
+	}
+
+	post := p()
+
+	ext, ok := post.(Externalable)
+	if !ok {
+		log.Println("[External] rejected non-externalable type:", t, "from:", req.RemoteAddr)
+		res.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	if ext.Accepts() {
+		ts := fmt.Sprintf("%d", time.Now().Unix()*1000)
+		req.PostForm.Set("timestamp", ts)
+		req.PostForm.Set("updated", ts)
+
+		urlPaths, err := upload.StoreFiles(req)
+		if err != nil {
+			log.Println(err)
+			res.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		for name, urlPath := range urlPaths {
+			req.PostForm.Add(name, urlPath)
+		}
+
+		// check for any multi-value fields (ex. checkbox fields)
+		// and correctly format for db storage. Essentially, we need
+		// fieldX.0: value1, fieldX.1: value2 => fieldX: []string{value1, value2}
+		var discardKeys []string
+		for k, v := range req.PostForm {
+			if strings.Contains(k, ".") {
+				key := strings.Split(k, ".")[0]
+
+				if req.PostForm.Get(key) == "" {
+					req.PostForm.Set(key, v[0])
+					discardKeys = append(discardKeys, k)
+				} else {
+					req.PostForm.Add(key, v[0])
+				}
+			}
+		}
+
+		for _, discardKey := range discardKeys {
+			req.PostForm.Del(discardKey)
+		}
+
+		_, err = db.SetContent(t+"_pending:-1", req.PostForm)
+		if err != nil {
+			log.Println("[External] error:", err)
+			res.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+	}
+}
diff --git a/system/api/handlers.go b/system/api/handlers.go
index 2ec82bb..8356683 100644
--- a/system/api/handlers.go
+++ b/system/api/handlers.go
@@ -3,13 +3,13 @@ package api
 import (
 	"bytes"
 	"encoding/json"
-	"fmt"
 	"log"
 	"net/http"
 	"strconv"
 	"strings"
 
 	"github.com/bosssauce/ponzu/content"
+	"github.com/bosssauce/ponzu/system/api/analytics"
 	"github.com/bosssauce/ponzu/system/db"
 )
 
@@ -69,8 +69,6 @@ func postsHandler(res http.ResponseWriter, req *http.Request) {
 		all = append(all, post)
 	}
 
-	fmt.Println(len(posts))
-
 	var start, end int
 	switch count {
 	case -1:
@@ -203,6 +201,7 @@ func SendJSON(res http.ResponseWriter, j map[string]interface{}) {
 
 	data, err = json.Marshal(j)
 	if err != nil {
+		log.Println(err)
 		data, _ = json.Marshal(map[string]interface{}{
 			"status":  "fail",
 			"message": err.Error(),
@@ -212,9 +211,6 @@ func SendJSON(res http.ResponseWriter, j map[string]interface{}) {
 	sendData(res, data, 200)
 }
 
-// ResponseFunc ...
-type ResponseFunc func(http.ResponseWriter, *http.Request)
-
 // CORS wraps a HandleFunc to response to OPTIONS requests properly
 func CORS(next http.HandlerFunc) http.HandlerFunc {
 	return http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
@@ -226,3 +222,12 @@ func CORS(next http.HandlerFunc) http.HandlerFunc {
 		next.ServeHTTP(res, req)
 	})
 }
+
+// Record wraps a HandleFunc to record API requests for analytical purposes
+func Record(next http.HandlerFunc) http.HandlerFunc {
+	return http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+		go analytics.Record(req)
+
+		next.ServeHTTP(res, req)
+	})
+}
diff --git a/system/api/server.go b/system/api/server.go
index da73382..816bc21 100644
--- a/system/api/server.go
+++ b/system/api/server.go
@@ -9,4 +9,6 @@ func Run() {
 	http.HandleFunc("/api/posts", CORS(postsHandler))
 
 	http.HandleFunc("/api/post", CORS(postHandler))
+
+	http.HandleFunc("/api/external/posts", CORS(externalPostsHandler))
 }