picoclaw/web/backend/api/passphrase.go

80 lines
2.5 KiB
Go

package api
import (
"encoding/json"
"log"
"net/http"
)
// registerPassphraseRoutes binds the passphrase management endpoints.
func (h *Handler) registerPassphraseRoutes(mux *http.ServeMux) {
mux.HandleFunc("POST /api/credential/passphrase", h.handleSetPassphrase)
mux.HandleFunc("GET /api/credential/passphrase/status", h.handlePassphraseStatus)
}
// handleSetPassphrase stores the supplied passphrase in the in-memory
// SecureStore, then attempts to auto-start the gateway if it is not running.
//
// POST /api/credential/passphrase
// Body: {"passphrase": "..."}
func (h *Handler) handleSetPassphrase(w http.ResponseWriter, r *http.Request) {
var body struct {
Passphrase string `json:"passphrase"`
}
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
http.Error(w, "invalid JSON body", http.StatusBadRequest)
return
}
if body.Passphrase == "" {
http.Error(w, "passphrase must not be empty", http.StatusBadRequest)
return
}
h.passphraseStore.SetString(body.Passphrase)
// Mark state as pending before launching gateway
h.passphraseMu.Lock()
h.passphraseLastState = passphraseStatePending
h.passphraseMu.Unlock()
// Try to start the gateway now that the passphrase is available.
// credential.PassphraseProvider points to passphraseStore.Get, so
// gatewayStartReady() (and all LoadConfig calls) will resolve enc://
// credentials correctly using the newly stored passphrase.
go func() {
gateway.mu.Lock()
defer gateway.mu.Unlock()
if isGatewayProcessAliveLocked() {
return
}
pid, err := h.startGatewayLocked("starting")
if err != nil {
log.Printf("Failed to start gateway after passphrase unlock: %v", err)
// startGatewayLocked failed before spawning the process, so the exit
// goroutine will never run. Transition pending → failed manually.
h.passphraseMu.Lock()
if h.passphraseLastState == passphraseStatePending {
h.passphraseLastState = passphraseStateFailed
h.passphraseStore.Clear()
}
h.passphraseMu.Unlock()
return
}
log.Printf("Gateway started after passphrase unlock (PID: %d)", pid)
}()
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]any{
"status": "ok",
})
}
// handlePassphraseStatus reports whether a passphrase is currently stored.
//
// GET /api/credential/passphrase/status
func (h *Handler) handlePassphraseStatus(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
json.NewEncoder(w).Encode(map[string]any{
"passphrase_set": h.passphraseStore.IsSet(),
})
}