first commit

2025-01-25 14:53:59 +03:00
commit 0f14bd9635
24 changed files with 3015 additions and 0 deletions
--- a/internal/builtins/http.go
+++ b/internal/builtins/http.go
@@ -0,0 +1,361 @@
+/*
+ * LURE Updater - Automated updater bot for LURE packages
+ * Copyright (C) 2023 Elara Musayelyan
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package builtins
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"go.elara.ws/logger/log"
+	"lure.sh/lure-updater/internal/config"
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarkstruct"
+	"golang.org/x/crypto/bcrypt"
+)
+
+const maxBodySize = 16384
+
+var (
+	ErrInvalidBodyType   = errors.New("invalid body type")
+	ErrInvalidHdrKeyType = errors.New("invalid header key type")
+	ErrInvalidHdrVal     = errors.New("invalid header value type")
+	ErrInvalidType       = errors.New("invalid type")
+	ErrInsecureWebhook   = errors.New("secure webhook missing authorization")
+	ErrIncorrectPassword = errors.New("incorrect password")
+)
+
+var httpModule = &starlarkstruct.Module{
+	Name: "http",
+	Members: starlark.StringDict{
+		"get":  starlark.NewBuiltin("http.get", httpGet),
+		"post": starlark.NewBuiltin("http.post", httpPost),
+		"put":  starlark.NewBuiltin("http.put", httpPut),
+		"head": starlark.NewBuiltin("http.head", httpHead),
+	},
+}
+
+func httpGet(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	return makeRequest("http.get", http.MethodGet, args, kwargs, thread)
+}
+
+func httpPost(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	return makeRequest("http.post", http.MethodPost, args, kwargs, thread)
+}
+
+func httpPut(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	return makeRequest("http.put", http.MethodPut, args, kwargs, thread)
+}
+
+func httpHead(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+	return makeRequest("http.head", http.MethodHead, args, kwargs, thread)
+}
+
+type starlarkBodyReader struct {
+	io.Reader
+}
+
+func (sbr *starlarkBodyReader) Unpack(v starlark.Value) error {
+	switch v := v.(type) {
+	case starlark.String:
+		sbr.Reader = strings.NewReader(string(v))
+	case starlark.Bytes:
+		sbr.Reader = strings.NewReader(string(v))
+	case starlarkReader:
+		sbr.Reader = v
+	default:
+		return fmt.Errorf("%w: %s", ErrInvalidBodyType, v.Type())
+	}
+	return nil
+}
+
+func newBodyReader() *starlarkBodyReader {
+	return &starlarkBodyReader{
+		Reader: bytes.NewReader(nil),
+	}
+}
+
+type starlarkHeaders struct {
+	http.Header
+}
+
+func (sh *starlarkHeaders) Unpack(v starlark.Value) error {
+	dict, ok := v.(*starlark.Dict)
+	if !ok {
+		return fmt.Errorf("%w: %s", ErrInvalidType, v.Type())
+	}
+
+	sh.Header = make(http.Header, dict.Len())
+	for _, key := range dict.Keys() {
+		keyStr, ok := key.(starlark.String)
+		if !ok {
+			return fmt.Errorf("%w: %s", ErrInvalidHdrKeyType, key.Type())
+		}
+
+		val, _, _ := dict.Get(key)
+		list, ok := val.(*starlark.List)
+		if !ok {
+			return fmt.Errorf("%w: %s", ErrInvalidHdrVal, val.Type())
+		}
+
+		hdrVals := make([]string, list.Len())
+		for i := 0; i < list.Len(); i++ {
+			hdrVal, ok := list.Index(i).(starlark.String)
+			if !ok {
+				return fmt.Errorf("%w: %s", ErrInvalidHdrVal, list.Index(i).Type())
+			}
+
+			hdrVals[i] = string(hdrVal)
+		}
+
+		sh.Header[string(keyStr)] = hdrVals
+	}
+
+	return nil
+}
+
+func makeRequest(name, method string, args starlark.Tuple, kwargs []starlark.Tuple, thread *starlark.Thread) (starlark.Value, error) {
+	var (
+		url      string
+		redirect = true
+		headers  = &starlarkHeaders{}
+		body     = newBodyReader()
+	)
+	err := starlark.UnpackArgs(name, args, kwargs, "url", &url, "redirect??", &redirect, "headers??", headers, "body??", body)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest(method, url, body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header = headers.Header
+
+	client := http.DefaultClient
+	if !redirect {
+		client = &http.Client{
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				return http.ErrUseLastResponse
+			},
+		}
+	}
+
+	log.Debug("Making HTTP request").Str("url", url).Str("method", req.Method).Bool("redirect", redirect).Stringer("pos", thread.CallFrame(1).Pos).Send()
+
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debug("Got HTTP response").Str("host", res.Request.URL.Host).Int("code", res.StatusCode).Stringer("pos", thread.CallFrame(1).Pos).Send()
+
+	return starlarkResponse(res), nil
+}
+
+func starlarkResponse(res *http.Response) *starlarkstruct.Struct {
+	return starlarkstruct.FromStringDict(starlarkstruct.Default, starlark.StringDict{
+		"code":    starlark.MakeInt(res.StatusCode),
+		"headers": starlarkStringSliceMap(res.Header),
+		"body":    newStarlarkReader(res.Body),
+	})
+}
+
+func starlarkRequest(req *http.Request) *starlarkstruct.Struct {
+	return starlarkstruct.FromStringDict(starlarkstruct.Default, starlark.StringDict{
+		"method":      starlark.String(req.Method),
+		"remote_addr": starlark.String(req.RemoteAddr),
+		"headers":     starlarkStringSliceMap(req.Header),
+		"query":       starlarkStringSliceMap(req.URL.Query()),
+		"body":        newStarlarkReader(req.Body),
+	})
+}
+
+func starlarkStringSliceMap(ssm map[string][]string) *starlark.Dict {
+	dict := starlark.NewDict(len(ssm))
+	for key, vals := range ssm {
+		sVals := make([]starlark.Value, len(vals))
+		for i, val := range vals {
+			sVals[i] = starlark.String(val)
+		}
+		dict.SetKey(starlark.String(key), starlark.NewList(sVals))
+	}
+	return dict
+}
+
+func registerWebhook(mux *http.ServeMux, cfg *config.Config, pluginName string) *starlark.Builtin {
+	return starlark.NewBuiltin("register_webhook", func(thread *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+		var fn *starlark.Function
+		secure := true
+		err := starlark.UnpackArgs("register_webhook", args, kwargs, "function", &fn, "secure??", &secure)
+		if err != nil {
+			return nil, err
+		}
+
+		if !secure {
+			log.Warn("Plugin is registering an insecure webhook").Str("plugin", pluginName).Send()
+		}
+
+		path := "/webhook/" + pluginName + "/" + fn.Name()
+		mux.HandleFunc(path, webhookHandler(pluginName, secure, cfg, thread, fn))
+		log.Debug("Registered webhook").Str("path", path).Str("function", fn.Name()).Stringer("pos", thread.CallFrame(1).Pos).Send()
+		return starlark.None, nil
+	})
+}
+
+func webhookHandler(pluginName string, secure bool, cfg *config.Config, thread *starlark.Thread, fn *starlark.Function) http.HandlerFunc {
+	return handleError(func(res http.ResponseWriter, req *http.Request) *HTTPError {
+		defer req.Body.Close()
+
+		res.Header().Add("X-Updater-Plugin", pluginName)
+
+		if secure {
+			err := verifySecure(cfg.Webhook.PasswordHash, pluginName, req)
+			if err != nil {
+				return &HTTPError{
+					Message: "Error verifying webhook",
+					Code:    http.StatusForbidden,
+					Err:     err,
+				}
+			}
+		}
+
+		log.Debug("Calling webhook function").Str("name", fn.Name()).Stringer("pos", fn.Position()).Send()
+		val, err := starlark.Call(thread, fn, starlark.Tuple{starlarkRequest(req)}, nil)
+		if err != nil {
+			return &HTTPError{
+				Message: "Error while executing webhook",
+				Code:    http.StatusInternalServerError,
+				Err:     err,
+			}
+		}
+
+		switch val := val.(type) {
+		case starlark.NoneType:
+			res.WriteHeader(http.StatusOK)
+		case starlark.Int:
+			var code int
+			err = starlark.AsInt(val, &code)
+			if err == nil {
+				res.WriteHeader(code)
+			} else {
+				res.WriteHeader(http.StatusOK)
+			}
+		case starlark.String, starlark.Bytes:
+			body := newBodyReader()
+			err = body.Unpack(val)
+			if err != nil {
+				return &HTTPError{
+					Message: "Error unpacking returned body",
+					Code:    http.StatusInternalServerError,
+					Err:     err,
+				}
+			}
+			_, err = io.Copy(res, body)
+			if err != nil {
+				log.Error("Error writing body").Err(err).Send()
+				return &HTTPError{
+					Message: "Error writing body",
+					Code:    http.StatusInternalServerError,
+					Err:     err,
+				}
+			}
+		case *starlark.Dict:
+			code := http.StatusOK
+			codeVal, ok, _ := val.Get(starlark.String("code"))
+			if ok {
+				err = starlark.AsInt(codeVal, &code)
+				if err != nil {
+					return &HTTPError{
+						Message: "Error decoding returned status code",
+						Code:    http.StatusInternalServerError,
+						Err:     err,
+					}
+				}
+				res.WriteHeader(code)
+			}
+
+			body := newBodyReader()
+			bodyVal, ok, _ := val.Get(starlark.String("body"))
+			if ok {
+				err = body.Unpack(bodyVal)
+				if err != nil {
+					return &HTTPError{
+						Message: "Error unpacking returned body",
+						Code:    http.StatusInternalServerError,
+						Err:     err,
+					}
+				}
+				_, err = io.Copy(res, body)
+				if err != nil {
+					return &HTTPError{
+						Message: "Error writing body",
+						Code:    http.StatusInternalServerError,
+						Err:     err,
+					}
+				}
+			}
+		}
+		return nil
+	})
+}
+
+type HTTPError struct {
+	Code    int
+	Message string
+	Err     error
+}
+
+func handleError(h func(res http.ResponseWriter, req *http.Request) *HTTPError) http.HandlerFunc {
+	return func(res http.ResponseWriter, req *http.Request) {
+		httpErr := h(res, req)
+		if httpErr != nil {
+			log.Error(httpErr.Message).Err(httpErr.Err).Send()
+			res.WriteHeader(httpErr.Code)
+			fmt.Sprintf("%s: %s", httpErr.Message, httpErr.Err)
+		}
+	}
+}
+
+func verifySecure(pwdHash, pluginName string, req *http.Request) error {
+	var pwd []byte
+	if _, pwdStr, ok := req.BasicAuth(); ok {
+		pwdStr = strings.TrimSpace(pwdStr)
+		pwd = []byte(pwdStr)
+	} else if hdrStr := req.Header.Get("Authorization"); hdrStr != "" {
+		hdrStr = strings.TrimPrefix(hdrStr, "Bearer")
+		hdrStr = strings.TrimSpace(hdrStr)
+		pwd = []byte(hdrStr)
+	} else {
+		log.Warn("Insecure webhook request").
+			Str("from", req.RemoteAddr).
+			Str("plugin", pluginName).
+			Send()
+		return ErrInsecureWebhook
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(pwdHash), pwd); err != nil {
+		return ErrIncorrectPassword
+	}
+
+	return nil
+}