`+errMsg+`
`, 1) + } + w.Write([]byte(html)) +} diff --git a/pkg/dashboard/auth_test.go b/pkg/dashboard/auth_test.go new file mode 100644 index 000000000..361daeca2 --- /dev/null +++ b/pkg/dashboard/auth_test.go @@ -0,0 +1,213 @@ +package dashboard + +import ( + "net/http" + "net/http/httptest" + "net/url" + "strings" + "testing" +) + +func TestGeneratePassword(t *testing.T) { + pw := GeneratePassword() + if len(pw) != 16 { + t.Fatalf("expected 16 chars, got %d: %q", len(pw), pw) + } + for _, c := range pw { + if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9')) { + t.Fatalf("non-alphanumeric char in password: %c", c) + } + } + // Two passwords should differ + pw2 := GeneratePassword() + if pw == pw2 { + t.Error("two generated passwords should not be identical") + } +} + +func TestSignVerifySession(t *testing.T) { + password := "testpassword123" + cookie, _ := signSession(password) + if !verifySession(cookie, password) { + t.Error("valid session should verify") + } +} + +func TestVerifyExpiredSession(t *testing.T) { + password := "testpassword123" + // Sign normally then replace expiry with a past timestamp (0 = epoch) + cookie, _ := signSession(password) + parts := strings.SplitN(cookie, ".", 2) + pastCookie := parts[0] + ".0" + if verifySession(pastCookie, password) { + t.Error("expired session should not verify") + } +} + +func TestVerifyTamperedSession(t *testing.T) { + password := "testpassword123" + cookie, _ := signSession(password) + + // Tamper with signature + tampered := "deadbeef" + cookie[8:] + if verifySession(tampered, password) { + t.Error("tampered session should not verify") + } +} + +func TestVerifyWrongPassword(t *testing.T) { + cookie, _ := signSession("correct") + if verifySession(cookie, "wrong") { + t.Error("session signed with different password should not verify") + } +} + +func TestVerifyInvalidFormats(t *testing.T) { + tests := []string{ + "", + "noseparator", + "abc.", + ".abc", + "abc.notahexnumber", + } + for _, cookie := range tests { + if verifySession(cookie, "password") { + t.Errorf("invalid cookie %q should not verify", cookie) + } + } +} + +func TestAuthMiddlewareRedirect(t *testing.T) { + called := false + handler := authMiddleware("secret", func(w http.ResponseWriter, r *http.Request) { + called = true + w.WriteHeader(http.StatusOK) + }) + + req := httptest.NewRequest(http.MethodGet, "/dashboard", nil) + w := httptest.NewRecorder() + handler(w, req) + + if called { + t.Error("handler should not be called without auth cookie") + } + if w.Code != http.StatusFound { + t.Fatalf("expected 302, got %d", w.Code) + } + if loc := w.Header().Get("Location"); loc != "/dashboard/login" { + t.Fatalf("expected redirect to /dashboard/login, got %q", loc) + } +} + +func TestAuthMiddlewareValid(t *testing.T) { + password := "secret" + called := false + handler := authMiddleware(password, func(w http.ResponseWriter, r *http.Request) { + called = true + w.WriteHeader(http.StatusOK) + }) + + cookie, expiry := signSession(password) + req := httptest.NewRequest(http.MethodGet, "/dashboard", nil) + req.AddCookie(&http.Cookie{ + Name: cookieName, + Value: cookie, + Expires: expiry, + }) + w := httptest.NewRecorder() + handler(w, req) + + if !called { + t.Error("handler should be called with valid auth cookie") + } + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d", w.Code) + } +} + +func TestNoAuthWhenNoPassword(t *testing.T) { + called := false + handler := authMiddleware("", func(w http.ResponseWriter, r *http.Request) { + called = true + w.WriteHeader(http.StatusOK) + }) + + req := httptest.NewRequest(http.MethodGet, "/dashboard", nil) + w := httptest.NewRecorder() + handler(w, req) + + if !called { + t.Error("handler should be called when password is empty (no auth)") + } + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d", w.Code) + } +} + +func TestLoginHandler(t *testing.T) { + password := "mypassword" + handler := loginHandler(password) + + form := url.Values{"password": {password}} + req := httptest.NewRequest(http.MethodPost, "/dashboard/login", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + handler(w, req) + + if w.Code != http.StatusFound { + t.Fatalf("expected 302, got %d", w.Code) + } + if loc := w.Header().Get("Location"); loc != "/dashboard" { + t.Fatalf("expected redirect to /dashboard, got %q", loc) + } + cookies := w.Result().Cookies() + found := false + for _, c := range cookies { + if c.Name == cookieName && c.Value != "" { + found = true + } + } + if !found { + t.Error("login should set session cookie") + } +} + +func TestLoginHandlerWrong(t *testing.T) { + password := "mypassword" + handler := loginHandler(password) + + form := url.Values{"password": {"wrongpassword"}} + req := httptest.NewRequest(http.MethodPost, "/dashboard/login", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200 (re-serve login), got %d", w.Code) + } + body := w.Body.String() + if !strings.Contains(body, "Invalid password") { + t.Error("wrong password should show error message") + } +} + +func TestLogoutHandler(t *testing.T) { + handler := logoutHandler() + + req := httptest.NewRequest(http.MethodGet, "/dashboard/logout", nil) + w := httptest.NewRecorder() + handler(w, req) + + if w.Code != http.StatusFound { + t.Fatalf("expected 302, got %d", w.Code) + } + if loc := w.Header().Get("Location"); loc != "/dashboard/login" { + t.Fatalf("expected redirect to /dashboard/login, got %q", loc) + } + cookies := w.Result().Cookies() + for _, c := range cookies { + if c.Name == cookieName && c.MaxAge != -1 { + t.Error("logout should set cookie MaxAge to -1") + } + } +} diff --git a/pkg/dashboard/crud_agents.go b/pkg/dashboard/crud_agents.go new file mode 100644 index 000000000..1422fce67 --- /dev/null +++ b/pkg/dashboard/crud_agents.go @@ -0,0 +1,457 @@ +package dashboard + +import ( + "fmt" + "html/template" + "net/http" + "os" + "path/filepath" + "strconv" + "strings" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/health" +) + +func registerAgentsCRUD(srv *health.Server, cfg *config.Config, configPath string, auth func(http.HandlerFunc) http.HandlerFunc) { + srv.HandleFunc("/dashboard/fragments/agent-edit", auth(fragmentAgentEdit(cfg))) + srv.HandleFunc("/dashboard/fragments/agent-add", auth(fragmentAgentAdd())) + srv.HandleFunc("/dashboard/crud/agents/create", auth(agentCreateHandler(cfg, configPath))) + srv.HandleFunc("/dashboard/crud/agents/update", auth(agentUpdateHandler(cfg, configPath))) + srv.HandleFunc("/dashboard/crud/agents/delete", auth(agentDeleteHandler(cfg, configPath))) + srv.HandleFunc("/dashboard/fragments/defaults-edit", auth(fragmentDefaultsEdit(cfg))) + srv.HandleFunc("/dashboard/crud/agents/defaults", auth(defaultsUpdateHandler(cfg, configPath))) +} + +const agentFormCSS = `` + +func fragmentAgentEdit(cfg *config.Config) http.HandlerFunc { + const tmpl = `{{.CSS}} +Agent %q not found
`, template.HTMLEscapeString(agentID)) + return + } + + model := "" + if found.Model != nil { + model = found.Model.Primary + } + + ws := resolveAgentWorkspace(cfg, found) + instructions := readAgentInstructions(ws) + + data := map[string]any{ + "CSS": template.HTML(agentFormCSS), + "ID": found.ID, + "Name": found.Name, + "Model": model, + "Skills": strings.Join(found.Skills, ", "), + "Workspace": found.Workspace, + "Default": found.Default, + "Instructions": instructions, + } + w.Header().Set("Content-Type", "text/html; charset=utf-8") + t.Execute(w, data) + } +} + +func fragmentAgentAdd() http.HandlerFunc { + const tmpl = `{{.CSS}} +Unknown channel: %s
`, template.HTMLEscapeString(name)) + return + } + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.Write([]byte(html)) + } +} + +func parseAllowFrom(s string) config.FlexibleStringSlice { + if strings.TrimSpace(s) == "" { + return nil + } + parts := strings.Split(s, ",") + result := make(config.FlexibleStringSlice, 0, len(parts)) + for _, p := range parts { + p = strings.TrimSpace(p) + if p != "" { + result = append(result, p) + } + } + return result +} + +func channelUpdateHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + name := r.FormValue("name") + enabled := r.FormValue("enabled") == "true" + allowFrom := parseAllowFrom(r.FormValue("allow_from")) + + configMu.Lock() + switch name { + case "telegram": + cfg.Channels.Telegram.Enabled = enabled + cfg.Channels.Telegram.Token = r.FormValue("token") + cfg.Channels.Telegram.Proxy = r.FormValue("proxy") + cfg.Channels.Telegram.AllowFrom = allowFrom + case "discord": + cfg.Channels.Discord.Enabled = enabled + cfg.Channels.Discord.Token = r.FormValue("token") + cfg.Channels.Discord.MentionOnly = r.FormValue("mention_only") == "true" + cfg.Channels.Discord.AllowFrom = allowFrom + case "slack": + cfg.Channels.Slack.Enabled = enabled + cfg.Channels.Slack.BotToken = r.FormValue("bot_token") + cfg.Channels.Slack.AppToken = r.FormValue("app_token") + cfg.Channels.Slack.AllowFrom = allowFrom + case "whatsapp": + cfg.Channels.WhatsApp.Enabled = enabled + cfg.Channels.WhatsApp.BridgeURL = r.FormValue("bridge_url") + cfg.Channels.WhatsApp.AllowFrom = allowFrom + case "feishu": + cfg.Channels.Feishu.Enabled = enabled + cfg.Channels.Feishu.AppID = r.FormValue("app_id") + cfg.Channels.Feishu.AppSecret = r.FormValue("app_secret") + cfg.Channels.Feishu.EncryptKey = r.FormValue("encrypt_key") + cfg.Channels.Feishu.VerificationToken = r.FormValue("verification_token") + cfg.Channels.Feishu.AllowFrom = allowFrom + case "dingtalk": + cfg.Channels.DingTalk.Enabled = enabled + cfg.Channels.DingTalk.ClientID = r.FormValue("client_id") + cfg.Channels.DingTalk.ClientSecret = r.FormValue("client_secret") + cfg.Channels.DingTalk.AllowFrom = allowFrom + case "qq": + cfg.Channels.QQ.Enabled = enabled + cfg.Channels.QQ.AppID = r.FormValue("app_id") + cfg.Channels.QQ.AppSecret = r.FormValue("app_secret") + cfg.Channels.QQ.AllowFrom = allowFrom + case "line": + cfg.Channels.LINE.Enabled = enabled + cfg.Channels.LINE.ChannelSecret = r.FormValue("channel_secret") + cfg.Channels.LINE.ChannelAccessToken = r.FormValue("channel_access_token") + cfg.Channels.LINE.WebhookHost = r.FormValue("webhook_host") + if p, err := strconv.Atoi(r.FormValue("webhook_port")); err == nil { + cfg.Channels.LINE.WebhookPort = p + } + cfg.Channels.LINE.WebhookPath = r.FormValue("webhook_path") + cfg.Channels.LINE.AllowFrom = allowFrom + case "maixcam": + cfg.Channels.MaixCam.Enabled = enabled + cfg.Channels.MaixCam.Host = r.FormValue("host") + if p, err := strconv.Atoi(r.FormValue("port")); err == nil { + cfg.Channels.MaixCam.Port = p + } + cfg.Channels.MaixCam.AllowFrom = allowFrom + case "onebot": + cfg.Channels.OneBot.Enabled = enabled + cfg.Channels.OneBot.WSUrl = r.FormValue("ws_url") + cfg.Channels.OneBot.AccessToken = r.FormValue("access_token") + if ri, err := strconv.Atoi(r.FormValue("reconnect_interval")); err == nil { + cfg.Channels.OneBot.ReconnectInterval = ri + } + cfg.Channels.OneBot.AllowFrom = allowFrom + default: + configMu.Unlock() + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprintf(w, `Unknown channel: %s
`, template.HTMLEscapeString(name)) + return + } + configMu.Unlock() + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprintf(w, `Failed to save: %s
`, template.HTMLEscapeString(err.Error())) + return + } + } + + w.Header().Set("HX-Trigger", "refreshChannels, closeModal") + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Channel updated
`) + } +} + +func channelToggleHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + name := r.FormValue("name") + enabled := r.FormValue("enabled") == "true" + + configMu.Lock() + switch name { + case "telegram": + cfg.Channels.Telegram.Enabled = enabled + case "discord": + cfg.Channels.Discord.Enabled = enabled + case "slack": + cfg.Channels.Slack.Enabled = enabled + case "whatsapp": + cfg.Channels.WhatsApp.Enabled = enabled + case "feishu": + cfg.Channels.Feishu.Enabled = enabled + case "dingtalk": + cfg.Channels.DingTalk.Enabled = enabled + case "qq": + cfg.Channels.QQ.Enabled = enabled + case "line": + cfg.Channels.LINE.Enabled = enabled + case "maixcam": + cfg.Channels.MaixCam.Enabled = enabled + case "onebot": + cfg.Channels.OneBot.Enabled = enabled + default: + configMu.Unlock() + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprintf(w, `Unknown channel: %s
`, template.HTMLEscapeString(name)) + return + } + configMu.Unlock() + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprintf(w, `Failed to save: %s
`, template.HTMLEscapeString(err.Error())) + return + } + } + + w.Header().Set("HX-Trigger", "refreshChannels") + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Channel toggled
`) + } +} diff --git a/pkg/dashboard/crud_channels_test.go b/pkg/dashboard/crud_channels_test.go new file mode 100644 index 000000000..035de967e --- /dev/null +++ b/pkg/dashboard/crud_channels_test.go @@ -0,0 +1,215 @@ +package dashboard + +import ( + "net/http" + "net/http/httptest" + "net/url" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestChannelToggle(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Channels.Telegram.Enabled = false + + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + handler := channelToggleHandler(cfg, configPath) + + form := url.Values{} + form.Set("name", "telegram") + form.Set("enabled", "true") + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/channels/toggle", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if !cfg.Channels.Telegram.Enabled { + t.Error("expected Telegram to be enabled after toggle") + } + + if _, err := os.Stat(configPath); os.IsNotExist(err) { + t.Error("config file should have been saved") + } +} + +func TestChannelUpdateTelegram(t *testing.T) { + cfg := config.DefaultConfig() + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + handler := channelUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("name", "telegram") + form.Set("enabled", "true") + form.Set("token", "bot123456:ABC-DEF") + form.Set("proxy", "socks5://proxy:1080") + form.Set("allow_from", "user1, user2, user3") + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/channels/update", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if !cfg.Channels.Telegram.Enabled { + t.Error("expected Telegram enabled") + } + if cfg.Channels.Telegram.Token != "bot123456:ABC-DEF" { + t.Errorf("expected token 'bot123456:ABC-DEF', got %q", cfg.Channels.Telegram.Token) + } + if cfg.Channels.Telegram.Proxy != "socks5://proxy:1080" { + t.Errorf("expected proxy 'socks5://proxy:1080', got %q", cfg.Channels.Telegram.Proxy) + } + if len(cfg.Channels.Telegram.AllowFrom) != 3 { + t.Fatalf("expected 3 allow_from entries, got %d", len(cfg.Channels.Telegram.AllowFrom)) + } + if cfg.Channels.Telegram.AllowFrom[0] != "user1" { + t.Errorf("expected allow_from[0] = 'user1', got %q", cfg.Channels.Telegram.AllowFrom[0]) + } +} + +func TestChannelUpdateDiscord(t *testing.T) { + cfg := config.DefaultConfig() + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + handler := channelUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("name", "discord") + form.Set("enabled", "true") + form.Set("token", "discord-bot-token-xyz") + form.Set("mention_only", "true") + form.Set("allow_from", "guild1") + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/channels/update", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if cfg.Channels.Discord.Token != "discord-bot-token-xyz" { + t.Errorf("expected discord token, got %q", cfg.Channels.Discord.Token) + } + if !cfg.Channels.Discord.MentionOnly { + t.Error("expected MentionOnly to be true") + } +} + +func TestChannelUpdateUnknown(t *testing.T) { + cfg := config.DefaultConfig() + + handler := channelUpdateHandler(cfg, "") + + form := url.Values{} + form.Set("name", "nonexistent") + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/channels/update", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400 for unknown channel, got %d", w.Code) + } + + body := w.Body.String() + if !strings.Contains(body, "Unknown channel") { + t.Error("expected 'Unknown channel' error message") + } +} + +func TestChannelEditFragment(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Channels.Telegram.Token = "test-token-123" + cfg.Channels.Telegram.Enabled = true + + handler := fragmentChannelEdit(cfg) + + req := httptest.NewRequest(http.MethodGet, "/dashboard/fragments/channel-edit?name=telegram", nil) + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + body := w.Body.String() + if !strings.Contains(body, "Invalid model index
`) + return + } + + m := cfg.ModelList[idx] + data := map[string]any{ + "Idx": idx, + "ModelName": m.ModelName, + "Model": m.Model, + "APIBase": m.APIBase, + "APIKey": m.APIKey, + "Proxy": m.Proxy, + } + w.Header().Set("Content-Type", "text/html; charset=utf-8") + t.Execute(w, data) + } +} + +func fragmentModelAdd() http.HandlerFunc { + t := template.Must(template.New("model-add").Parse(modelAddTmpl)) + + return func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + t.Execute(w, nil) + } +} + +func modelCreateHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + modelName := r.FormValue("model_name") + model := r.FormValue("model") + if modelName == "" || model == "" { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprint(w, `model_name and model are required
`) + return + } + + configMu.Lock() + cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + ModelName: modelName, + Model: model, + APIBase: r.FormValue("api_base"), + APIKey: r.FormValue("api_key"), + Proxy: r.FormValue("proxy"), + }) + configMu.Unlock() + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprintf(w, `Failed to save: %s
`, template.HTMLEscapeString(err.Error())) + return + } + } + + w.Header().Set("HX-Trigger", "refreshModels, closeModal") + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Model added
`) + } +} + +func modelUpdateHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + idxStr := r.FormValue("idx") + idx, err := strconv.Atoi(idxStr) + if err != nil || idx < 0 || idx >= len(cfg.ModelList) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprint(w, `Invalid model index
`) + return + } + + configMu.Lock() + cfg.ModelList[idx].ModelName = r.FormValue("model_name") + cfg.ModelList[idx].Model = r.FormValue("model") + cfg.ModelList[idx].APIBase = r.FormValue("api_base") + cfg.ModelList[idx].APIKey = r.FormValue("api_key") + cfg.ModelList[idx].Proxy = r.FormValue("proxy") + configMu.Unlock() + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprintf(w, `Failed to save: %s
`, template.HTMLEscapeString(err.Error())) + return + } + } + + w.Header().Set("HX-Trigger", "refreshModels, closeModal") + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Model updated
`) + } +} + +func modelDeleteHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + idxStr := r.FormValue("idx") + idx, err := strconv.Atoi(idxStr) + if err != nil || idx < 0 || idx >= len(cfg.ModelList) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprint(w, `Invalid model index
`) + return + } + + configMu.Lock() + cfg.ModelList = append(cfg.ModelList[:idx], cfg.ModelList[idx+1:]...) + configMu.Unlock() + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprintf(w, `Failed to save: %s
`, template.HTMLEscapeString(err.Error())) + return + } + } + + w.Header().Set("HX-Trigger", "refreshModels, closeModal") + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Model deleted
`) + } +} diff --git a/pkg/dashboard/crud_models_test.go b/pkg/dashboard/crud_models_test.go new file mode 100644 index 000000000..be8513ec3 --- /dev/null +++ b/pkg/dashboard/crud_models_test.go @@ -0,0 +1,216 @@ +package dashboard + +import ( + "net/http" + "net/http/httptest" + "net/url" + "path/filepath" + "strings" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestModelCreateHandler(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + initialLen := len(cfg.ModelList) + + handler := modelCreateHandler(cfg, configPath) + + form := url.Values{} + form.Set("model_name", "test-model") + form.Set("model", "openai/gpt-4o") + form.Set("api_base", "https://api.openai.com/v1") + form.Set("api_key", "sk-test-key") + form.Set("proxy", "") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/models/create", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if len(cfg.ModelList) != initialLen+1 { + t.Fatalf("expected ModelList to grow by 1, got %d (was %d)", len(cfg.ModelList), initialLen) + } + + added := cfg.ModelList[len(cfg.ModelList)-1] + if added.ModelName != "test-model" { + t.Errorf("expected model_name 'test-model', got %q", added.ModelName) + } + if added.Model != "openai/gpt-4o" { + t.Errorf("expected model 'openai/gpt-4o', got %q", added.Model) + } + + body := w.Body.String() + if !strings.Contains(body, "Model added") { + t.Error("response should contain success message") + } + if w.Header().Get("HX-Trigger") == "" { + t.Error("response should have HX-Trigger header") + } +} + +func TestModelCreateHandlerMissing(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := modelCreateHandler(cfg, configPath) + + form := url.Values{} + form.Set("model", "openai/gpt-4o") + // model_name is missing + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/models/create", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400, got %d", w.Code) + } + + body := w.Body.String() + if !strings.Contains(body, "required") { + t.Error("response should mention required fields") + } +} + +func TestModelUpdateHandler(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + // Ensure at least one model exists + if len(cfg.ModelList) == 0 { + cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + ModelName: "original", + Model: "openai/gpt-3.5", + }) + } + + handler := modelUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("idx", "0") + form.Set("model_name", "updated-name") + form.Set("model", "openai/gpt-4o") + form.Set("api_base", "https://new-base.com/v1") + form.Set("api_key", "sk-new-key") + form.Set("proxy", "http://proxy:8080") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/models/update", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if cfg.ModelList[0].ModelName != "updated-name" { + t.Errorf("expected model_name 'updated-name', got %q", cfg.ModelList[0].ModelName) + } + if cfg.ModelList[0].Model != "openai/gpt-4o" { + t.Errorf("expected model 'openai/gpt-4o', got %q", cfg.ModelList[0].Model) + } + if cfg.ModelList[0].Proxy != "http://proxy:8080" { + t.Errorf("expected proxy 'http://proxy:8080', got %q", cfg.ModelList[0].Proxy) + } +} + +func TestModelUpdateHandlerBadIdx(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := modelUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("idx", "999") + form.Set("model_name", "test") + form.Set("model", "test") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/models/update", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400, got %d", w.Code) + } + + body := w.Body.String() + if !strings.Contains(body, "Invalid model index") { + t.Error("response should mention invalid index") + } +} + +func TestModelDeleteHandler(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + // Ensure at least one model exists + if len(cfg.ModelList) == 0 { + cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + ModelName: "to-delete", + Model: "openai/gpt-3.5", + }) + } + initialLen := len(cfg.ModelList) + + handler := modelDeleteHandler(cfg, configPath) + + form := url.Values{} + form.Set("idx", "0") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/models/delete", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if len(cfg.ModelList) != initialLen-1 { + t.Fatalf("expected ModelList to shrink by 1, got %d (was %d)", len(cfg.ModelList), initialLen) + } + + body := w.Body.String() + if !strings.Contains(body, "Model deleted") { + t.Error("response should contain success message") + } +} + +func TestModelDeleteHandlerBadIdx(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := modelDeleteHandler(cfg, configPath) + + form := url.Values{} + form.Set("idx", "-1") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/models/delete", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400, got %d", w.Code) + } + + body := w.Body.String() + if !strings.Contains(body, "Invalid model index") { + t.Error("response should mention invalid index") + } +} diff --git a/pkg/dashboard/crud_settings.go b/pkg/dashboard/crud_settings.go new file mode 100644 index 000000000..aed5924b9 --- /dev/null +++ b/pkg/dashboard/crud_settings.go @@ -0,0 +1,266 @@ +package dashboard + +import ( + "crypto/hmac" + "fmt" + "net/http" + "strconv" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/health" +) + +func registerSettingsCRUD(srv *health.Server, cfg *config.Config, configPath string, currentPassword string, auth func(http.HandlerFunc) http.HandlerFunc) { + srv.HandleFunc("/dashboard/fragments/settings", auth(fragmentSettings(cfg, currentPassword))) + srv.HandleFunc("/dashboard/crud/settings/password", auth(passwordChangeHandler(cfg, configPath))) + srv.HandleFunc("/dashboard/crud/settings/gateway", auth(gatewayUpdateHandler(cfg, configPath))) + srv.HandleFunc("/dashboard/crud/settings/heartbeat", auth(heartbeatUpdateHandler(cfg, configPath))) + srv.HandleFunc("/dashboard/crud/settings/devices", auth(devicesUpdateHandler(cfg, configPath))) +} + +const settingsCSS = `` + +func fragmentSettings(cfg *config.Config, currentPassword string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + + checkedAttr := func(b bool) string { + if b { + return " checked" + } + return "" + } + + html := settingsCSS + `Method not allowed
`) + return + } + + currentPassword := r.FormValue("current_password") + newPassword := r.FormValue("new_password") + + if !hmac.Equal([]byte(currentPassword), []byte(cfg.Dashboard.Password)) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprint(w, `Current password is incorrect
`) + return + } + + if len(newPassword) < 8 { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprint(w, `New password must be at least 8 characters
`) + return + } + + cfg.Dashboard.Password = newPassword + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprint(w, `Failed to save config
`) + return + } + } + + value, expiry := signSession(newPassword) + http.SetCookie(w, &http.Cookie{ + Name: cookieName, + Value: value, + Path: "/dashboard", + Expires: expiry, + HttpOnly: true, + SameSite: http.SameSiteLaxMode, + }) + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Password changed successfully
`) + } +} + +func gatewayUpdateHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + host := r.FormValue("host") + portStr := r.FormValue("port") + port, err := strconv.Atoi(portStr) + if err != nil || port <= 0 || port >= 65536 { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusBadRequest) + fmt.Fprint(w, `Port must be between 1 and 65535
`) + return + } + + cfg.Gateway.Host = host + cfg.Gateway.Port = port + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprint(w, `Failed to save config
`) + return + } + } + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Gateway settings saved (restart required)
`) + } +} + +func heartbeatUpdateHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + enabled := r.FormValue("enabled") == "on" + intervalStr := r.FormValue("interval") + interval, err := strconv.Atoi(intervalStr) + if err != nil || interval < 1 { + interval = cfg.Heartbeat.Interval + } + + cfg.Heartbeat.Enabled = enabled + cfg.Heartbeat.Interval = interval + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprint(w, `Failed to save config
`) + return + } + } + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Heartbeat settings saved
`) + } +} + +func devicesUpdateHandler(cfg *config.Config, configPath string) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusMethodNotAllowed) + fmt.Fprint(w, `Method not allowed
`) + return + } + + cfg.Devices.Enabled = r.FormValue("enabled") == "on" + cfg.Devices.MonitorUSB = r.FormValue("monitor_usb") == "on" + + if configPath != "" { + if err := saveConfig(configPath, cfg); err != nil { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusInternalServerError) + fmt.Fprint(w, `Failed to save config
`) + return + } + } + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + fmt.Fprint(w, `Devices settings saved
`) + } +} diff --git a/pkg/dashboard/crud_settings_test.go b/pkg/dashboard/crud_settings_test.go new file mode 100644 index 000000000..3f7ffd041 --- /dev/null +++ b/pkg/dashboard/crud_settings_test.go @@ -0,0 +1,254 @@ +package dashboard + +import ( + "net/http" + "net/http/httptest" + "net/url" + "path/filepath" + "strings" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestPasswordChange(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Dashboard.Password = "oldpassword" + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := passwordChangeHandler(cfg, configPath) + + form := url.Values{} + form.Set("current_password", "oldpassword") + form.Set("new_password", "newpassword123") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/password", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if cfg.Dashboard.Password != "newpassword123" { + t.Errorf("expected password to be updated, got %q", cfg.Dashboard.Password) + } + + body := w.Body.String() + if !strings.Contains(body, "Password changed successfully") { + t.Error("response should contain success message") + } + + cookies := w.Result().Cookies() + found := false + for _, c := range cookies { + if c.Name == cookieName { + found = true + if c.Value == "" { + t.Error("session cookie should not be empty") + } + break + } + } + if !found { + t.Error("response should set a new session cookie") + } +} + +func TestPasswordChangeWrongCurrent(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Dashboard.Password = "oldpassword" + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := passwordChangeHandler(cfg, configPath) + + form := url.Values{} + form.Set("current_password", "wrongpassword") + form.Set("new_password", "newpassword123") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/password", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String()) + } + + body := w.Body.String() + if !strings.Contains(body, "incorrect") { + t.Error("response should mention incorrect password") + } + + if cfg.Dashboard.Password != "oldpassword" { + t.Error("password should not have changed") + } +} + +func TestPasswordChangeTooShort(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Dashboard.Password = "oldpassword" + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := passwordChangeHandler(cfg, configPath) + + form := url.Values{} + form.Set("current_password", "oldpassword") + form.Set("new_password", "short") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/password", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String()) + } + + body := w.Body.String() + if !strings.Contains(body, "at least 8") { + t.Error("response should mention minimum length") + } + + if cfg.Dashboard.Password != "oldpassword" { + t.Error("password should not have changed") + } +} + +func TestGatewayUpdate(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := gatewayUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("host", "127.0.0.1") + form.Set("port", "9090") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/gateway", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if cfg.Gateway.Host != "127.0.0.1" { + t.Errorf("expected host '127.0.0.1', got %q", cfg.Gateway.Host) + } + if cfg.Gateway.Port != 9090 { + t.Errorf("expected port 9090, got %d", cfg.Gateway.Port) + } + + body := w.Body.String() + if !strings.Contains(body, "Gateway settings saved") { + t.Error("response should contain success message") + } +} + +func TestGatewayUpdateBadPort(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := gatewayUpdateHandler(cfg, configPath) + + tests := []struct { + name string + port string + }{ + {"zero", "0"}, + {"too_high", "99999"}, + {"negative", "-1"}, + {"not_a_number", "abc"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + form := url.Values{} + form.Set("host", "localhost") + form.Set("port", tt.port) + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/gateway", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusBadRequest { + t.Fatalf("expected 400 for port=%s, got %d: %s", tt.port, w.Code, w.Body.String()) + } + }) + } +} + +func TestHeartbeatUpdate(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := heartbeatUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("enabled", "on") + form.Set("interval", "15") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/heartbeat", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if !cfg.Heartbeat.Enabled { + t.Error("expected heartbeat enabled") + } + if cfg.Heartbeat.Interval != 15 { + t.Errorf("expected interval 15, got %d", cfg.Heartbeat.Interval) + } + + body := w.Body.String() + if !strings.Contains(body, "Heartbeat settings saved") { + t.Error("response should contain success message") + } +} + +func TestDevicesUpdate(t *testing.T) { + cfg := config.DefaultConfig() + configPath := filepath.Join(t.TempDir(), "config.json") + + handler := devicesUpdateHandler(cfg, configPath) + + form := url.Values{} + form.Set("enabled", "on") + form.Set("monitor_usb", "on") + + req := httptest.NewRequest(http.MethodPost, "/dashboard/crud/settings/devices", strings.NewReader(form.Encode())) + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + w := httptest.NewRecorder() + + handler(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String()) + } + + if !cfg.Devices.Enabled { + t.Error("expected devices enabled") + } + if !cfg.Devices.MonitorUSB { + t.Error("expected monitor_usb enabled") + } + + body := w.Body.String() + if !strings.Contains(body, "Devices settings saved") { + t.Error("response should contain success message") + } +} diff --git a/pkg/dashboard/dashboard.go b/pkg/dashboard/dashboard.go new file mode 100644 index 000000000..5b5e40b2a --- /dev/null +++ b/pkg/dashboard/dashboard.go @@ -0,0 +1,402 @@ +package dashboard + +import ( + "encoding/json" + "fmt" + "html/template" + "io/fs" + "net/http" + "time" + + "github.com/sipeed/picoclaw/pkg/agent" + "github.com/sipeed/picoclaw/pkg/channels" + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/health" + "github.com/sipeed/picoclaw/pkg/logger" +) + +func Mount(srv *health.Server, cfg *config.Config, al *agent.AgentLoop, cm *channels.Manager, configPath ...string) { + startTime := time.Now() + broker := NewBroker() + password := cfg.Dashboard.Password + + cfgPath := "" + if len(configPath) > 0 { + cfgPath = configPath[0] + } + + // Start background polling for SSE events + go pollStatus(broker, cfg, al, cm) + + // Static files (public — needed for login page) + staticFS, err := fs.Sub(staticFiles, "static") + if err != nil { + logger.ErrorCF("dashboard", "Failed to create sub FS", map[string]any{"error": err.Error()}) + return + } + srv.Handle("/dashboard/static/", http.StripPrefix("/dashboard/static/", http.FileServer(http.FS(staticFS)))) + + // Auth routes (public) + srv.HandleFunc("/dashboard/login", func(w http.ResponseWriter, r *http.Request) { + if r.Method == http.MethodPost { + loginHandler(password)(w, r) + return + } + loginPage(password)(w, r) + }) + srv.HandleFunc("/dashboard/logout", logoutHandler()) + + // Protected: wrap with authMiddleware + auth := func(h http.HandlerFunc) http.HandlerFunc { + return authMiddleware(password, h) + } + + // Main page + srv.HandleFunc("/dashboard", auth(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + indexHTML, err := staticFiles.ReadFile("static/index.html") + if err != nil { + http.Error(w, "index.html not found", http.StatusInternalServerError) + return + } + w.Write(indexHTML) + })) + + // SSE endpoint + srv.HandleFunc("/dashboard/events", auth(broker.Subscribe)) + + // JSON API + srv.HandleFunc("/dashboard/api/status", auth(statusHandler(cfg, al, cm, startTime))) + srv.HandleFunc("/dashboard/api/config", auth(configGetHandler(cfg))) + srv.HandleFunc("/dashboard/api/agents", auth(agentsHandler(cfg))) + srv.HandleFunc("/dashboard/api/models", auth(modelsHandler(cfg))) + + // HTMX fragments + srv.HandleFunc("/dashboard/fragments/status", auth(fragmentStatus(cfg, al, cm, startTime))) + srv.HandleFunc("/dashboard/fragments/agents", auth(fragmentAgents(cfg, al))) + srv.HandleFunc("/dashboard/fragments/agent-detail", auth(fragmentAgentDetail(cfg))) + srv.HandleFunc("/dashboard/fragments/tools", auth(fragmentTools(al))) + srv.HandleFunc("/dashboard/fragments/channels", auth(fragmentChannels(cm))) + srv.HandleFunc("/dashboard/fragments/models", auth(fragmentModels(cfg))) + + // CRUD routes (require configPath for saving) + registerModelsCRUD(srv, cfg, cfgPath, auth) + registerAgentsCRUD(srv, cfg, cfgPath, auth) + registerChannelsCRUD(srv, cfg, cfgPath, auth) + registerSettingsCRUD(srv, cfg, cfgPath, password, auth) + + logger.InfoC("dashboard", "Dashboard mounted at /dashboard") +} + +func pollStatus(broker *SSEBroker, cfg *config.Config, al *agent.AgentLoop, cm *channels.Manager) { + ticker := time.NewTicker(5 * time.Second) + defer ticker.Stop() + for range ticker.C { + if broker.ClientCount() == 0 { + continue + } + info := al.GetStartupInfo() + channelStatus := cm.GetStatus() + data := map[string]any{ + "tools": info["tools"], + "agents": info["agents"], + "channels": channelStatus, + "model": cfg.Agents.Defaults.Model, + } + jsonData, err := json.Marshal(data) + if err == nil { + broker.Publish("status", string(jsonData)) + } + } +} + +var funcMap = template.FuncMap{ + "maskKey": maskKey, + "extractProvider": extractProvider, +} + +func fragmentStatus(cfg *config.Config, al *agent.AgentLoop, cm *channels.Manager, startTime time.Time) http.HandlerFunc { + const tmpl = `` + t := template.Must(template.New("status").Parse(tmpl)) + + return func(w http.ResponseWriter, r *http.Request) { + info := al.GetStartupInfo() + toolsInfo, _ := info["tools"].(map[string]any) + agentsInfo, _ := info["agents"].(map[string]any) + channelStatus := cm.GetStatus() + + toolCount := 0 + if tc, ok := toolsInfo["count"]; ok { + toolCount, _ = tc.(int) + } + agentCount := 0 + if ac, ok := agentsInfo["count"]; ok { + agentCount, _ = ac.(int) + } + + data := map[string]any{ + "Running": true, + "Model": cfg.Agents.Defaults.Model, + "Uptime": formatUptime(time.Since(startTime)), + "ToolCount": toolCount, + "AgentCount": agentCount, + "ChannelCount": len(channelStatus), + } + w.Header().Set("Content-Type", "text/html; charset=utf-8") + t.Execute(w, data) + } +} + +func fragmentAgents(cfg *config.Config, al *agent.AgentLoop) http.HandlerFunc { + const tmpl = `| ID | Name | Model | Default | Skills | Actions |
|---|---|---|---|---|---|
| {{.ID}} | +{{.Name}} | +{{if .Model}}{{.Model.Primary}}{{else}}default{{end}} | +{{if .Default}}✓{{end}} | +{{range .Skills}}{{.}} {{end}} | ++ + + | +
| No agents configured (using defaults) | |||||
Default model: {{.DefaultModel}} | Max tokens: {{.MaxTokens}} | Click a row for details
+No agent with ID "%s"
| Channel | Enabled | Running | Actions |
|---|---|---|---|
| {{$name}} | +{{if index $status "enabled"}}✓{{else}}✗{{end}} | ++ {{if index $status "running"}} + Running + {{else}} + Stopped + {{end}} + | ++ + | +
| No channels configured | |||
| Name | Provider | Model | API Base | API Key | Actions |
|---|---|---|---|---|---|
| {{$m.ModelName}} | +{{extractProvider $m.Model}} | +{{$m.Model}} | +{{if $m.APIBase}}{{$m.APIBase}}{{else}}default{{end}} | +{{maskKey $m.APIKey}} | ++ + + | +
| No models configured | |||||
Authentication required
+ + +