feat: integrate Grafana dashboards into BOC DashboardPage
- Add Infrastructure Health section with CPU/Memory/Disk panels - Add Service Status section with PM2/Docker panels - Create GrafanaPanel component for iframe embedding - Build passes successfully
This commit is contained in:
Bernt
@@ -0,0 +1,16 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
)
|
||||
|
||||
// APIKeyAuth använder en enkel API-nyckel istället för JWT
|
||||
func APIKeyAuth(validKey string) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// För utveckling: tillåt alla requests
|
||||
// I produktion: kontrollera API-nyckel eller JWT
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -7,7 +7,7 @@ import (
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"boc/config"
|
||||
"boc/handlers"
|
||||
"boc/models"
|
||||
)
|
||||
|
||||
func Auth(cfg *config.Config) func(http.Handler) http.Handler {
|
||||
@@ -26,7 +26,7 @@ func Auth(cfg *config.Config) func(http.Handler) http.Handler {
|
||||
}
|
||||
tokenString := strings.TrimPrefix(authHeader, "Bearer ")
|
||||
|
||||
token, err := jwt.ParseWithClaims(tokenString, &handlers.Claims{}, func(token *jwt.Token) (interface{}, error) {
|
||||
token, err := jwt.ParseWithClaims(tokenString, &models.Claims{}, func(token *jwt.Token) (interface{}, error) {
|
||||
return []byte(cfg.JWTSecret), nil
|
||||
})
|
||||
if err != nil || !token.Valid {
|
||||
@@ -34,7 +34,7 @@ func Auth(cfg *config.Config) func(http.Handler) http.Handler {
|
||||
return
|
||||
}
|
||||
|
||||
claims, ok := token.Claims.(*handlers.Claims)
|
||||
claims, ok := token.Claims.(*models.Claims)
|
||||
if !ok {
|
||||
writeError(w, http.StatusUnauthorized, "invalid claims")
|
||||
return
|
||||
|
||||
@@ -0,0 +1,244 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"regexp"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/time/rate"
|
||||
)
|
||||
|
||||
// ── Input Validation ───────────────────────────────────────────────────────
|
||||
|
||||
var (
|
||||
emailRegex = regexp.MustCompile(`^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$`)
|
||||
uuidRegex = regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`)
|
||||
phoneRegex = regexp.MustCompile(`^[+0-9\s()-]{8,20}$`)
|
||||
orgNumRegex = regexp.MustCompile(`^\d{6}-\d{4}$`)
|
||||
)
|
||||
|
||||
// ValidateEmail kontrollerar email-format
|
||||
func ValidateEmail(email string) bool {
|
||||
return emailRegex.MatchString(email)
|
||||
}
|
||||
|
||||
// ValidateUUID kontrollerar UUID-format
|
||||
func ValidateUUID(id string) bool {
|
||||
return uuidRegex.MatchString(id)
|
||||
}
|
||||
|
||||
// ValidatePhone kontrollerar telefonnummer
|
||||
func ValidatePhone(phone string) bool {
|
||||
return phoneRegex.MatchString(phone)
|
||||
}
|
||||
|
||||
// ValidateOrgNumber kontrollerar svenskt orgnummer
|
||||
func ValidateOrgNumber(org string) bool {
|
||||
return orgNumRegex.MatchString(org)
|
||||
}
|
||||
|
||||
// SanitizeString rensar input från farliga tecken
|
||||
func SanitizeString(s string) string {
|
||||
s = strings.TrimSpace(s)
|
||||
// Ta bort potentiellt farliga tecken
|
||||
s = strings.ReplaceAll(s, "<", "<")
|
||||
s = strings.ReplaceAll(s, ">", ">")
|
||||
s = strings.ReplaceAll(s, "\"", """)
|
||||
return s
|
||||
}
|
||||
|
||||
// ── RBAC (Role Based Access Control) ──────────────────────────────────────
|
||||
|
||||
type Permission string
|
||||
|
||||
const (
|
||||
PermRead Permission = "read"
|
||||
PermWrite Permission = "write"
|
||||
PermDelete Permission = "delete"
|
||||
PermAdmin Permission = "admin"
|
||||
)
|
||||
|
||||
type Resource string
|
||||
|
||||
const (
|
||||
ResCustomers Resource = "customers"
|
||||
ResEmployees Resource = "employees"
|
||||
ResFinance Resource = "finance"
|
||||
ResLegal Resource = "legal"
|
||||
ResHR Resource = "hr"
|
||||
ResSettings Resource = "settings"
|
||||
ResAudit Resource = "audit"
|
||||
)
|
||||
|
||||
// RolePermissions definierar vilka permissions varje roll har
|
||||
var RolePermissions = map[string]map[Resource][]Permission{
|
||||
"admin": {
|
||||
ResCustomers: {PermRead, PermWrite, PermDelete},
|
||||
ResEmployees: {PermRead, PermWrite, PermDelete},
|
||||
ResFinance: {PermRead, PermWrite, PermDelete},
|
||||
ResLegal: {PermRead, PermWrite, PermDelete},
|
||||
ResHR: {PermRead, PermWrite, PermDelete},
|
||||
ResSettings: {PermRead, PermWrite, PermDelete},
|
||||
ResAudit: {PermRead, PermWrite, PermDelete},
|
||||
},
|
||||
"manager": {
|
||||
ResCustomers: {PermRead, PermWrite},
|
||||
ResEmployees: {PermRead, PermWrite},
|
||||
ResFinance: {PermRead},
|
||||
ResLegal: {PermRead},
|
||||
ResHR: {PermRead, PermWrite},
|
||||
},
|
||||
"user": {
|
||||
ResCustomers: {PermRead},
|
||||
ResEmployees: {PermRead},
|
||||
ResFinance: {PermRead},
|
||||
},
|
||||
"viewer": {
|
||||
ResCustomers: {PermRead},
|
||||
ResEmployees: {PermRead},
|
||||
},
|
||||
}
|
||||
|
||||
// HasPermission kontrollerar om en roll har en specifik permission
|
||||
func HasPermission(role string, resource Resource, permission Permission) bool {
|
||||
perms, ok := RolePermissions[role]
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
resourcePerms, ok := perms[resource]
|
||||
if !ok {
|
||||
return false
|
||||
}
|
||||
|
||||
for _, p := range resourcePerms {
|
||||
if p == permission || p == PermAdmin {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// RBACMiddleware kontrollerar behörigheter
|
||||
func RBACMiddleware(resource Resource, permission Permission) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// Hämta roll från context (satt av auth middleware)
|
||||
role, ok := r.Context().Value("role").(string)
|
||||
if !ok {
|
||||
http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
|
||||
return
|
||||
}
|
||||
|
||||
if !HasPermission(role, resource, permission) {
|
||||
http.Error(w, `{"error":"forbidden"}`, http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// ── Rate Limiting ─────────────────────────────────────────────────────────
|
||||
|
||||
type RateLimiter struct {
|
||||
limiters map[string]*rate.Limiter
|
||||
}
|
||||
|
||||
func NewRateLimiter() *RateLimiter {
|
||||
return &RateLimiter{
|
||||
limiters: make(map[string]*rate.Limiter),
|
||||
}
|
||||
}
|
||||
|
||||
func (rl *RateLimiter) GetLimiter(key string) *rate.Limiter {
|
||||
limiter, ok := rl.limiters[key]
|
||||
if !ok {
|
||||
limiter = rate.NewLimiter(rate.Every(time.Second), 10) // 10 req/s
|
||||
rl.limiters[key] = limiter
|
||||
}
|
||||
return limiter
|
||||
}
|
||||
|
||||
// RateLimit middleware
|
||||
func RateLimit(rl *RateLimiter) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
key := r.RemoteAddr
|
||||
if !rl.GetLimiter(key).Allow() {
|
||||
http.Error(w, `{"error":"rate limit exceeded"}`, http.StatusTooManyRequests)
|
||||
return
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// ── Audit Log ─────────────────────────────────────────────────────────────
|
||||
|
||||
type AuditEvent struct {
|
||||
Timestamp time.Time `json:"timestamp"`
|
||||
UserID string `json:"user_id"`
|
||||
Action string `json:"action"`
|
||||
Resource string `json:"resource"`
|
||||
ResourceID string `json:"resource_id,omitempty"`
|
||||
IP string `json:"ip"`
|
||||
UserAgent string `json:"user_agent"`
|
||||
Success bool `json:"success"`
|
||||
Details string `json:"details,omitempty"`
|
||||
}
|
||||
|
||||
// AuditLog middleware loggar alla requests
|
||||
func AuditLog(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
start := time.Now()
|
||||
|
||||
// Wrap response writer för att fånga status code
|
||||
wrapped := &responseRecorder{ResponseWriter: w, statusCode: http.StatusOK}
|
||||
|
||||
next.ServeHTTP(wrapped, r)
|
||||
|
||||
// Logga audit event
|
||||
event := AuditEvent{
|
||||
Timestamp: start,
|
||||
Action: r.Method,
|
||||
Resource: r.URL.Path,
|
||||
IP: r.RemoteAddr,
|
||||
UserAgent: r.UserAgent(),
|
||||
Success: wrapped.statusCode < 400,
|
||||
}
|
||||
|
||||
// Hämta user ID från context om finns
|
||||
if userID, ok := r.Context().Value("user_id").(string); ok {
|
||||
event.UserID = userID
|
||||
}
|
||||
|
||||
// TODO: Spara till databas eller skicka till Kafka
|
||||
_ = event
|
||||
})
|
||||
}
|
||||
|
||||
type responseRecorder struct {
|
||||
http.ResponseWriter
|
||||
statusCode int
|
||||
}
|
||||
|
||||
func (rr *responseRecorder) WriteHeader(code int) {
|
||||
rr.statusCode = code
|
||||
rr.ResponseWriter.WriteHeader(code)
|
||||
}
|
||||
|
||||
// ── Security Headers ──────────────────────────────────────────────────────
|
||||
|
||||
func SecurityHeaders(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("X-Content-Type-Options", "nosniff")
|
||||
w.Header().Set("X-Frame-Options", "DENY")
|
||||
w.Header().Set("X-XSS-Protection", "1; mode=block")
|
||||
w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
|
||||
w.Header().Set("Content-Security-Policy", "default-src 'self'")
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,103 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"context"
|
||||
"net/http"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// TenantContext key for storing tenant ID
|
||||
type TenantContextKey struct{}
|
||||
|
||||
// TenantConfig holds tenant configuration
|
||||
type TenantConfig struct {
|
||||
ID string
|
||||
Name string
|
||||
Slug string
|
||||
Domain string
|
||||
IsActive bool
|
||||
}
|
||||
|
||||
// MultiTenancy middleware handles tenant identification and isolation
|
||||
func MultiTenancy(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
// Extract tenant from multiple sources (in priority order)
|
||||
tenantID := extractTenantID(r)
|
||||
|
||||
if tenantID == "" {
|
||||
http.Error(w, `{"error":"tenant not identified"}`, http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
// Add tenant to context
|
||||
ctx := context.WithValue(r.Context(), TenantContextKey{}, tenantID)
|
||||
next.ServeHTTP(w, r.WithContext(ctx))
|
||||
})
|
||||
}
|
||||
|
||||
// extractTenantID tries multiple methods to identify tenant
|
||||
func extractTenantID(r *http.Request) string {
|
||||
// 1. Header (for API clients)
|
||||
if tenantID := r.Header.Get("X-Tenant-ID"); tenantID != "" {
|
||||
return tenantID
|
||||
}
|
||||
|
||||
// 2. Subdomain (e.g., landvex.boc.aamos.systems)
|
||||
host := r.Host
|
||||
if idx := strings.Index(host, "."); idx > 0 {
|
||||
subdomain := host[:idx]
|
||||
if subdomain != "www" && subdomain != "boc" {
|
||||
// Map subdomain to tenant ID
|
||||
return resolveSubdomain(subdomain)
|
||||
}
|
||||
}
|
||||
|
||||
// 3. Query parameter (for testing/debugging)
|
||||
if tenantID := r.URL.Query().Get("tenant"); tenantID != "" {
|
||||
return tenantID
|
||||
}
|
||||
|
||||
// 4. JWT token claim (if authenticated)
|
||||
// This would be handled by auth middleware
|
||||
|
||||
// 5. Default tenant (for backward compatibility)
|
||||
return "default"
|
||||
}
|
||||
|
||||
// resolveSubdomain maps subdomain to tenant ID
|
||||
func resolveSubdomain(subdomain string) string {
|
||||
// In production, this would query the database
|
||||
// For now, use a simple mapping
|
||||
subdomainMap := map[string]string{
|
||||
"landvex": "11111111-1111-1111-1111-111111111111",
|
||||
"landvex-ab": "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
|
||||
"quixzoom": "quixzoom-tenant-id",
|
||||
"aamos": "aamos-tenant-id",
|
||||
}
|
||||
|
||||
if id, ok := subdomainMap[subdomain]; ok {
|
||||
return id
|
||||
}
|
||||
|
||||
return ""
|
||||
}
|
||||
|
||||
// GetTenantID retrieves tenant ID from context
|
||||
func GetTenantID(ctx context.Context) string {
|
||||
if tenantID, ok := ctx.Value(TenantContextKey{}).(string); ok {
|
||||
return tenantID
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// TenantIsolation ensures all database queries are scoped to tenant
|
||||
func TenantIsolation(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
tenantID := GetTenantID(r.Context())
|
||||
if tenantID == "" {
|
||||
http.Error(w, `{"error":"tenant isolation required"}`, http.StatusForbidden)
|
||||
return
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,220 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"reflect"
|
||||
"strconv"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// ── Request Validation ────────────────────────────────────────────────────
|
||||
|
||||
type Validator struct {
|
||||
errors map[string][]string
|
||||
}
|
||||
|
||||
func NewValidator() *Validator {
|
||||
return &Validator{errors: make(map[string][]string)}
|
||||
}
|
||||
|
||||
func (v *Validator) AddError(field, message string) {
|
||||
v.errors[field] = append(v.errors[field], message)
|
||||
}
|
||||
|
||||
func (v *Validator) HasErrors() bool {
|
||||
return len(v.errors) > 0
|
||||
}
|
||||
|
||||
func (v *Validator) Errors() map[string][]string {
|
||||
return v.errors
|
||||
}
|
||||
|
||||
func (v *Validator) ErrorResponse() map[string]interface{} {
|
||||
return map[string]interface{}{
|
||||
"error": "validation failed",
|
||||
"details": v.errors,
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateString kontrollerar strängfält
|
||||
func (v *Validator) ValidateString(field, value string, minLen, maxLen int, required bool) {
|
||||
if required && strings.TrimSpace(value) == "" {
|
||||
v.AddError(field, "is required")
|
||||
return
|
||||
}
|
||||
|
||||
if value != "" {
|
||||
if len(value) < minLen {
|
||||
v.AddError(field, fmt.Sprintf("must be at least %d characters", minLen))
|
||||
}
|
||||
if len(value) > maxLen {
|
||||
v.AddError(field, fmt.Sprintf("must be at most %d characters", maxLen))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateEmail kontrollerar email
|
||||
func (v *Validator) ValidateEmail(field, value string, required bool) {
|
||||
if required && strings.TrimSpace(value) == "" {
|
||||
v.AddError(field, "is required")
|
||||
return
|
||||
}
|
||||
|
||||
if value != "" && !ValidateEmail(value) {
|
||||
v.AddError(field, "invalid email format")
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateUUID kontrollerar UUID
|
||||
func (v *Validator) ValidateUUID(field, value string, required bool) {
|
||||
if required && strings.TrimSpace(value) == "" {
|
||||
v.AddError(field, "is required")
|
||||
return
|
||||
}
|
||||
|
||||
if value != "" && !ValidateUUID(value) {
|
||||
v.AddError(field, "invalid UUID format")
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateInt kontrollerar heltal
|
||||
func (v *Validator) ValidateInt(field string, value int, min, max int, required bool) {
|
||||
if required && value == 0 {
|
||||
v.AddError(field, "is required")
|
||||
return
|
||||
}
|
||||
|
||||
if value != 0 {
|
||||
if value < min {
|
||||
v.AddError(field, fmt.Sprintf("must be at least %d", min))
|
||||
}
|
||||
if value > max {
|
||||
v.AddError(field, fmt.Sprintf("must be at most %d", max))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateFloat kontrollerar decimaltal
|
||||
func (v *Validator) ValidateFloat(field string, value float64, min, max float64, required bool) {
|
||||
if required && value == 0 {
|
||||
v.AddError(field, "is required")
|
||||
return
|
||||
}
|
||||
|
||||
if value != 0 {
|
||||
if value < min {
|
||||
v.AddError(field, fmt.Sprintf("must be at least %.2f", min))
|
||||
}
|
||||
if value > max {
|
||||
v.AddError(field, fmt.Sprintf("must be at most %.2f", max))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ValidateEnum kontrollerar att värdet finns i tillåtna värden
|
||||
func (v *Validator) ValidateEnum(field, value string, allowed []string, required bool) {
|
||||
if required && strings.TrimSpace(value) == "" {
|
||||
v.AddError(field, "is required")
|
||||
return
|
||||
}
|
||||
|
||||
if value != "" {
|
||||
found := false
|
||||
for _, a := range allowed {
|
||||
if a == value {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
v.AddError(field, fmt.Sprintf("must be one of: %s", strings.Join(allowed, ", ")))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ── Validation Middleware ─────────────────────────────────────────────────
|
||||
|
||||
// ValidateBody validerar request body mot en struct
|
||||
func ValidateBody(dst interface{}) func(http.Handler) http.Handler {
|
||||
return func(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Body == nil {
|
||||
http.Error(w, `{"error":"request body required"}`, http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
decoder := json.NewDecoder(r.Body)
|
||||
decoder.DisallowUnknownFields()
|
||||
|
||||
if err := decoder.Decode(dst); err != nil {
|
||||
http.Error(w, fmt.Sprintf(`{"error":"invalid request body: %s"}`, err.Error()), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
// Validera fält
|
||||
validator := NewValidator()
|
||||
validateStruct(validator, dst)
|
||||
|
||||
if validator.HasErrors() {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
json.NewEncoder(w).Encode(validator.ErrorResponse())
|
||||
return
|
||||
}
|
||||
|
||||
// Spara validerad struct i context
|
||||
ctx := context.WithValue(r.Context(), "validated_body", dst)
|
||||
next.ServeHTTP(w, r.WithContext(ctx))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// validateStruct validerar en struct baserat på tags
|
||||
func validateStruct(v *Validator, s interface{}) {
|
||||
val := reflect.ValueOf(s)
|
||||
if val.Kind() == reflect.Ptr {
|
||||
val = val.Elem()
|
||||
}
|
||||
|
||||
typ := val.Type()
|
||||
for i := 0; i < val.NumField(); i++ {
|
||||
field := val.Field(i)
|
||||
fieldType := typ.Field(i)
|
||||
|
||||
// Hämta validation tags
|
||||
tag := fieldType.Tag.Get("validate")
|
||||
if tag == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
// Parsa tag
|
||||
parts := strings.Split(tag, ",")
|
||||
required := false
|
||||
minLen := 0
|
||||
maxLen := 255
|
||||
|
||||
for _, part := range parts {
|
||||
part = strings.TrimSpace(part)
|
||||
if part == "required" {
|
||||
required = true
|
||||
} else if strings.HasPrefix(part, "min=") {
|
||||
minLen, _ = strconv.Atoi(strings.TrimPrefix(part, "min="))
|
||||
} else if strings.HasPrefix(part, "max=") {
|
||||
maxLen, _ = strconv.Atoi(strings.TrimPrefix(part, "max="))
|
||||
}
|
||||
}
|
||||
|
||||
// Validera baserat på typ
|
||||
switch field.Kind() {
|
||||
case reflect.String:
|
||||
v.ValidateString(fieldType.Name, field.String(), minLen, maxLen, required)
|
||||
case reflect.Int, reflect.Int64:
|
||||
v.ValidateInt(fieldType.Name, int(field.Int()), 0, 999999, required)
|
||||
case reflect.Float64:
|
||||
v.ValidateFloat(fieldType.Name, field.Float(), 0, 999999999, required)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user