v9.3.1

internal/httpapi/httpapi.go

@@ -95,6 +95,10 @@ func New(c config.Config, a *auth.Service, ss *stacks.Service, n *nodes.Manager,
 	api.HandleFunc("GET /api/docker/{kind}", s.dockerInventory)
 	api.Handle("POST /api/docker/{kind}/actions/{action}", auth.RequireRole("operator", http.HandlerFunc(s.dockerAction)))
 	api.Handle("GET /api/docker/{kind}/{id}/inspect", auth.RequireRole("operator", http.HandlerFunc(s.dockerInspect)))
+	api.Handle("GET /api/docker/containers/{id}/identity", auth.RequireRole("operator", http.HandlerFunc(s.containerIdentity)))
+	api.Handle("POST /api/docker/containers/{id}/bind-permissions/preview", auth.RequireRole("operator", http.HandlerFunc(s.bindPermissionPreview)))
+	api.Handle("POST /api/host/bind-permissions/repair", auth.RequireRole("admin", http.HandlerFunc(s.repairBindPermissions)))
+	api.Handle("POST /api/host/users", auth.RequireRole("admin", http.HandlerFunc(s.createHostUser)))
 	api.HandleFunc("GET /api/stacks", s.listStacks)
 	api.Handle("GET /api/stacks/{name}", auth.RequireRole("operator", http.HandlerFunc(s.getStack)))
 	api.HandleFunc("POST /api/compose/parse", s.composeParse)
@@ -105,6 +109,7 @@ func New(c config.Config, a *auth.Service, ss *stacks.Service, n *nodes.Manager,
 	api.Handle("GET /api/stacks/{name}/logs", auth.RequireRole("operator", http.HandlerFunc(s.logs)))
 	api.Handle("DELETE /api/stacks/{name}", auth.RequireRole("operator", http.HandlerFunc(s.deleteStack)))
 	api.HandleFunc("GET /api/stacks/{name}/graph", s.stackGraph)
+	api.Handle("GET /api/stacks/{name}/bind-permissions", auth.RequireRole("operator", http.HandlerFunc(s.stackBindPermissions)))
 	api.HandleFunc("GET /api/stacks/{name}/image-updates", s.stackImageUpdates)
 	api.Handle("GET /api/stacks/{name}/terminal", auth.RequireRole("operator", http.HandlerFunc(s.stackTerminal)))
 	api.Handle("GET /api/activity", auth.RequireRole("admin", http.HandlerFunc(s.activity)))
@@ -140,6 +145,10 @@ func (s *Server) agent(m *http.ServeMux) {
 	a.HandleFunc("GET /agent/v1/docker/{kind}", s.localDockerInventory)
 	a.HandleFunc("POST /agent/v1/docker/{kind}/actions/{action}", s.localDockerAction)
 	a.HandleFunc("GET /agent/v1/docker/{kind}/{id}/inspect", s.localDockerInspect)
+	a.HandleFunc("GET /agent/v1/docker/containers/{id}/identity", s.localContainerIdentity)
+	a.HandleFunc("POST /agent/v1/docker/containers/{id}/bind-permissions/preview", s.localBindPermissionPreview)
+	a.HandleFunc("POST /agent/v1/host/bind-permissions/repair", s.localRepairBindPermissions)
+	a.HandleFunc("POST /agent/v1/host/users", s.localCreateHostUser)
 	a.HandleFunc("GET /agent/v1/stacks", s.localList)
 	a.HandleFunc("GET /agent/v1/stacks/{name}", s.localGet)
 	a.HandleFunc("PUT /agent/v1/stacks/{name}", s.localSave)
@@ -149,6 +158,7 @@ func (s *Server) agent(m *http.ServeMux) {
 	a.HandleFunc("POST /agent/v1/git/sync", s.localGitSync)
 	a.HandleFunc("DELETE /agent/v1/stacks/{name}", s.localDelete)
 	a.HandleFunc("GET /agent/v1/stacks/{name}/graph", s.localGraph)
+	a.HandleFunc("GET /agent/v1/stacks/{name}/bind-permissions", s.localStackBindPermissions)
 	a.HandleFunc("GET /agent/v1/stacks/{name}/image-updates", s.localImageUpdates)
 	a.HandleFunc("GET /agent/v1/stacks/{name}/terminal", s.localTerminal)
 	a.HandleFunc("POST /agent/v1/probe", func(w http.ResponseWriter, r *http.Request) {
@@ -612,6 +622,137 @@ func (s *Server) localDockerInspect(w http.ResponseWriter, r *http.Request) {
 	jsonOut(w, 200, v)
 }
 
+func (s *Server) containerIdentity(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if node := nodeID(r); node > 0 {
+		s.relay(w, r, node, "GET", "/agent/v1/docker/containers/"+url.PathEscape(id)+"/identity", nil)
+		return
+	}
+	s.localContainerIdentity(w, r)
+}
+
+func (s *Server) localContainerIdentity(w http.ResponseWriter, r *http.Request) {
+	v, e := s.stacks.ContainerIdentity(r.Context(), r.PathValue("id"))
+	if e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	jsonOut(w, 200, v)
+}
+
+func (s *Server) bindPermissionPreview(w http.ResponseWriter, r *http.Request) {
+	var in stacks.BindPermissionPreviewInput
+	if e := read(r, &in); e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	in.ContainerID = r.PathValue("id")
+	if node := nodeID(r); node > 0 {
+		s.relay(w, r, node, "POST", "/agent/v1/docker/containers/"+url.PathEscape(in.ContainerID)+"/bind-permissions/preview", in)
+		return
+	}
+	s.bindPermissionPreviewLocal(w, r, in)
+}
+
+func (s *Server) localBindPermissionPreview(w http.ResponseWriter, r *http.Request) {
+	var in stacks.BindPermissionPreviewInput
+	if e := read(r, &in); e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	in.ContainerID = r.PathValue("id")
+	s.bindPermissionPreviewLocal(w, r, in)
+}
+
+func (s *Server) bindPermissionPreviewLocal(w http.ResponseWriter, r *http.Request, in stacks.BindPermissionPreviewInput) {
+	v, e := s.stacks.BindPermissionPreview(r.Context(), in)
+	if e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	jsonOut(w, 200, v)
+}
+
+func (s *Server) repairBindPermissions(w http.ResponseWriter, r *http.Request) {
+	var in stacks.RepairBindPermissionsInput
+	if e := read(r, &in); e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	if node := nodeID(r); node > 0 {
+		s.relay(w, r, node, "POST", "/agent/v1/host/bind-permissions/repair", in)
+		return
+	}
+	s.repairBindPermissionsLocal(w, r, in)
+}
+
+func (s *Server) localRepairBindPermissions(w http.ResponseWriter, r *http.Request) {
+	var in stacks.RepairBindPermissionsInput
+	if e := read(r, &in); e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	s.repairBindPermissionsLocal(w, r, in)
+}
+
+func (s *Server) repairBindPermissionsLocal(w http.ResponseWriter, r *http.Request, in stacks.RepairBindPermissionsInput) {
+	v, e := s.stacks.RepairBindPermissions(r.Context(), in)
+	if e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	jsonOut(w, 200, v)
+}
+
+func (s *Server) stackBindPermissions(w http.ResponseWriter, r *http.Request) {
+	name := r.PathValue("name")
+	if node := nodeID(r); node > 0 {
+		s.relay(w, r, node, "GET", "/agent/v1/stacks/"+url.PathEscape(name)+"/bind-permissions", nil)
+		return
+	}
+	s.localStackBindPermissions(w, r)
+}
+
+func (s *Server) localStackBindPermissions(w http.ResponseWriter, r *http.Request) {
+	v, e := s.stacks.StackBindPermissions(r.Context(), r.PathValue("name"))
+	if e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	jsonOut(w, 200, v)
+}
+
+func (s *Server) createHostUser(w http.ResponseWriter, r *http.Request) {
+	var in stacks.CreateHostUserInput
+	if e := read(r, &in); e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	if node := nodeID(r); node > 0 {
+		s.relay(w, r, node, "POST", "/agent/v1/host/users", in)
+		return
+	}
+	s.createHostUserLocal(w, r, in)
+}
+
+func (s *Server) localCreateHostUser(w http.ResponseWriter, r *http.Request) {
+	var in stacks.CreateHostUserInput
+	if e := read(r, &in); e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	s.createHostUserLocal(w, r, in)
+}
+
+func (s *Server) createHostUserLocal(w http.ResponseWriter, r *http.Request, in stacks.CreateHostUserInput) {
+	v, e := s.stacks.CreateHostUser(r.Context(), in)
+	if e != nil {
+		http.Error(w, e.Error(), 400)
+		return
+	}
+	jsonOut(w, 200, v)
+}
+
 func (s *Server) listStacks(w http.ResponseWriter, r *http.Request) {
 	if id := nodeID(r); id > 0 {
 		s.relay(w, r, id, "GET", "/agent/v1/stacks", nil)