summaryrefslogtreecommitdiff
path: root/system/api
diff options
context:
space:
mode:
Diffstat (limited to 'system/api')
-rw-r--r--system/api/analytics/init.go101
-rw-r--r--system/api/external.go109
-rw-r--r--system/api/handlers.go80
-rw-r--r--system/api/server.go2
4 files changed, 281 insertions, 11 deletions
diff --git a/system/api/analytics/init.go b/system/api/analytics/init.go
new file mode 100644
index 0000000..c351bed
--- /dev/null
+++ b/system/api/analytics/init.go
@@ -0,0 +1,101 @@
+// Package analytics provides the methods to run an analytics reporting system
+// for API requests which may be useful to users for measuring access and
+// possibly identifying bad actors abusing requests.
+package analytics
+
+import (
+ "log"
+ "net/http"
+ "strings"
+ "time"
+
+ "github.com/boltdb/bolt"
+)
+
+type apiRequest struct {
+ URL string `json:"url"`
+ Method string `json:"http_method"`
+ RemoteAddr string `json:"ip_address"`
+ Timestamp int64 `json:"timestamp"`
+ External bool `json:"external"`
+}
+
+var (
+ store *bolt.DB
+ recordChan chan apiRequest
+)
+
+// Record queues an apiRequest for metrics
+func Record(req *http.Request) {
+ external := strings.Contains(req.URL.Path, "/external/")
+
+ r := apiRequest{
+ URL: req.URL.String(),
+ Method: req.Method,
+ RemoteAddr: req.RemoteAddr,
+ Timestamp: time.Now().Unix() * 1000,
+ External: external,
+ }
+
+ // put r on buffered recordChan to take advantage of batch insertion in DB
+ recordChan <- r
+
+}
+
+// Close exports the abillity to close our db file. Should be called with defer
+// after call to Init() from the same place.
+func Close() {
+ err := store.Close()
+ if err != nil {
+ log.Println(err)
+ }
+}
+
+// Init creates a db connection, should run an initial prune of old data, and
+// sets up the queue/batching channel
+func Init() {
+ var err error
+ store, err = bolt.Open("analytics.db", 0666, nil)
+ if err != nil {
+ log.Fatalln(err)
+ }
+
+ recordChan = make(chan apiRequest, 1024*128)
+
+ go serve()
+
+ err = store.Update(func(tx *bolt.Tx) error {
+
+ return nil
+ })
+ if err != nil {
+ log.Fatalln(err)
+ }
+}
+
+func serve() {
+ // make timer to notify select to batch request insert from recordChan
+ // interval: 1 minute
+ apiRequestTimer := time.NewTicker(time.Minute * 1)
+
+ // make timer to notify select to remove old analytics
+ // interval: 2 weeks
+ // TODO: enable analytics backup service to cloud
+ pruneDBTimer := time.NewTicker(time.Hour * 24 * 14)
+
+ for {
+ select {
+ case <-apiRequestTimer.C:
+ var reqs []apiRequest
+ batchSize := len(recordChan)
+
+ for i := 0; i < batchSize; i++ {
+ reqs = append(reqs, <-recordChan)
+ }
+
+ case <-pruneDBTimer.C:
+
+ default:
+ }
+ }
+}
diff --git a/system/api/external.go b/system/api/external.go
new file mode 100644
index 0000000..4a42eb5
--- /dev/null
+++ b/system/api/external.go
@@ -0,0 +1,109 @@
+package api
+
+import (
+ "fmt"
+ "log"
+ "net/http"
+ "strings"
+ "time"
+
+ "github.com/bosssauce/ponzu/content"
+ "github.com/bosssauce/ponzu/system/admin/upload"
+ "github.com/bosssauce/ponzu/system/db"
+)
+
+// Externalable accepts or rejects external POST requests to endpoints such as:
+// /external/posts?type=Review
+type Externalable interface {
+ // Accepts determines whether a type will allow external submissions
+ Accepts() bool
+}
+
+// Mergeable allows external post content to be approved and published through
+// the public-facing API
+type Mergeable interface {
+ // Approve copies an external post to the internal collection and triggers
+ // a re-sort of its content type posts
+ Approve(req *http.Request) error
+}
+
+func externalPostsHandler(res http.ResponseWriter, req *http.Request) {
+ if req.Method != http.MethodPost {
+ res.WriteHeader(http.StatusMethodNotAllowed)
+ return
+ }
+
+ err := req.ParseMultipartForm(1024 * 1024 * 4) // maxMemory 4MB
+ if err != nil {
+ log.Println("[External] error:", err)
+ res.WriteHeader(http.StatusInternalServerError)
+ return
+ }
+
+ t := req.URL.Query().Get("type")
+ if t == "" {
+ res.WriteHeader(http.StatusBadRequest)
+ return
+ }
+
+ p, found := content.Types[t]
+ if !found {
+ log.Println("[External] attempt to submit unknown type:", t, "from:", req.RemoteAddr)
+ res.WriteHeader(http.StatusNotFound)
+ return
+ }
+
+ post := p()
+
+ ext, ok := post.(Externalable)
+ if !ok {
+ log.Println("[External] rejected non-externalable type:", t, "from:", req.RemoteAddr)
+ res.WriteHeader(http.StatusBadRequest)
+ return
+ }
+
+ if ext.Accepts() {
+ ts := fmt.Sprintf("%d", time.Now().Unix()*1000)
+ req.PostForm.Set("timestamp", ts)
+ req.PostForm.Set("updated", ts)
+
+ urlPaths, err := upload.StoreFiles(req)
+ if err != nil {
+ log.Println(err)
+ res.WriteHeader(http.StatusInternalServerError)
+ return
+ }
+
+ for name, urlPath := range urlPaths {
+ req.PostForm.Add(name, urlPath)
+ }
+
+ // check for any multi-value fields (ex. checkbox fields)
+ // and correctly format for db storage. Essentially, we need
+ // fieldX.0: value1, fieldX.1: value2 => fieldX: []string{value1, value2}
+ var discardKeys []string
+ for k, v := range req.PostForm {
+ if strings.Contains(k, ".") {
+ key := strings.Split(k, ".")[0]
+
+ if req.PostForm.Get(key) == "" {
+ req.PostForm.Set(key, v[0])
+ discardKeys = append(discardKeys, k)
+ } else {
+ req.PostForm.Add(key, v[0])
+ }
+ }
+ }
+
+ for _, discardKey := range discardKeys {
+ req.PostForm.Del(discardKey)
+ }
+
+ _, err = db.SetContent(t+"_pending:-1", req.PostForm)
+ if err != nil {
+ log.Println("[External] error:", err)
+ res.WriteHeader(http.StatusInternalServerError)
+ return
+ }
+ }
+}
diff --git a/system/api/handlers.go b/system/api/handlers.go
index 0c9139f..8356683 100644
--- a/system/api/handlers.go
+++ b/system/api/handlers.go
@@ -5,8 +5,11 @@ import (
"encoding/json"
"log"
"net/http"
+ "strconv"
+ "strings"
"github.com/bosssauce/ponzu/content"
+ "github.com/bosssauce/ponzu/system/api/analytics"
"github.com/bosssauce/ponzu/system/db"
)
@@ -28,24 +31,72 @@ func typesHandler(res http.ResponseWriter, req *http.Request) {
func postsHandler(res http.ResponseWriter, req *http.Request) {
q := req.URL.Query()
t := q.Get("type")
- // TODO: implement pagination
- // num := q.Get("num")
- // page := q.Get("page")
-
- // TODO: inplement time-based ?after=time.Time, ?before=time.Time between=time.Time|time.Time
-
if t == "" {
res.WriteHeader(http.StatusBadRequest)
return
}
- posts := db.ContentAll(t)
+ count, err := strconv.Atoi(q.Get("count")) // int: determines number of posts to return (10 default, -1 is all)
+ if err != nil {
+ if q.Get("count") == "" {
+ count = 10
+ } else {
+ res.WriteHeader(http.StatusInternalServerError)
+ return
+ }
+ }
+
+ offset, err := strconv.Atoi(q.Get("offset")) // int: multiplier of count for pagination (0 default)
+ if err != nil {
+ if q.Get("offset") == "" {
+ offset = 0
+ } else {
+ res.WriteHeader(http.StatusInternalServerError)
+ return
+ }
+ }
+
+ order := strings.ToLower(q.Get("order")) // string: sort order of posts by timestamp ASC / DESC (DESC default)
+ if order != "asc" || order == "" {
+ order = "desc"
+ }
+
+ // TODO: time-based ?after=time.Time, ?before=time.Time between=time.Time|time.Time
+
+ posts := db.ContentAll(t + "_sorted")
var all = []json.RawMessage{}
for _, post := range posts {
all = append(all, post)
}
- j, err := fmtJSON(all...)
+ var start, end int
+ switch count {
+ case -1:
+ start = 0
+ end = len(posts)
+
+ default:
+ start = count * offset
+ end = start + count
+ }
+
+ // bounds check on posts given the start & end count
+ if start > len(posts) {
+ start = len(posts) - count
+ }
+ if end > len(posts) {
+ end = len(posts)
+ }
+
+ // reverse the sorted order if ASC
+ if order == "asc" {
+ all = []json.RawMessage{}
+ for i := len(posts) - 1; i >= 0; i-- {
+ all = append(all, posts[i])
+ }
+ }
+
+ j, err := fmtJSON(all[start:end]...)
if err != nil {
res.WriteHeader(http.StatusInternalServerError)
return
@@ -150,6 +201,7 @@ func SendJSON(res http.ResponseWriter, j map[string]interface{}) {
data, err = json.Marshal(j)
if err != nil {
+ log.Println(err)
data, _ = json.Marshal(map[string]interface{}{
"status": "fail",
"message": err.Error(),
@@ -159,9 +211,6 @@ func SendJSON(res http.ResponseWriter, j map[string]interface{}) {
sendData(res, data, 200)
}
-// ResponseFunc ...
-type ResponseFunc func(http.ResponseWriter, *http.Request)
-
// CORS wraps a HandleFunc to response to OPTIONS requests properly
func CORS(next http.HandlerFunc) http.HandlerFunc {
return http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
@@ -173,3 +222,12 @@ func CORS(next http.HandlerFunc) http.HandlerFunc {
next.ServeHTTP(res, req)
})
}
+
+// Record wraps a HandleFunc to record API requests for analytical purposes
+func Record(next http.HandlerFunc) http.HandlerFunc {
+ return http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
+ go analytics.Record(req)
+
+ next.ServeHTTP(res, req)
+ })
+}
diff --git a/system/api/server.go b/system/api/server.go
index da73382..816bc21 100644
--- a/system/api/server.go
+++ b/system/api/server.go
@@ -9,4 +9,6 @@ func Run() {
http.HandleFunc("/api/posts", CORS(postsHandler))
http.HandleFunc("/api/post", CORS(postHandler))
+
+ http.HandleFunc("/api/external/posts", CORS(externalPostsHandler))
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-05 10:35:23 +0000