package glance import ( "fmt" "log" "net/http" "os" "strconv" "strings" "gopkg.in/yaml.v3" ) // configEditor manipulates glance.yml as a yaml.Node tree, preserving // comments, ordering, and unresolved ${env:X}/${secret:X} tokens that // would be destroyed by round-tripping through the parsed config struct. type configEditor struct { path string root yaml.Node } func loadConfigEditor(path string) (*configEditor, error) { _, includes, err := parseYAMLIncludes(path) if err != nil { return nil, fmt.Errorf("parsing config: %w", err) } if len(includes) > 0 { return nil, fmt.Errorf("admin editing is not supported when the config uses include directives — edit included files manually for now") } raw, err := os.ReadFile(path) if err != nil { return nil, fmt.Errorf("reading config: %w", err) } e := &configEditor{path: path} if err := yaml.Unmarshal(raw, &e.root); err != nil { return nil, fmt.Errorf("parsing config yaml: %w", err) } if e.root.Kind != yaml.DocumentNode || len(e.root.Content) == 0 { return nil, fmt.Errorf("config has no document content") } if e.root.Content[0].Kind != yaml.MappingNode { return nil, fmt.Errorf("config top-level is not a mapping") } return e, nil } // save validates the edited tree against newConfigFromYAML, writes a // .bak of the previous file, then writes via temp+rename for atomicity. func (e *configEditor) save() error { out, err := yaml.Marshal(&e.root) if err != nil { return fmt.Errorf("marshaling config: %w", err) } if _, err := newConfigFromYAML(out); err != nil { return fmt.Errorf("edited config is invalid: %w", err) } if existing, err := os.ReadFile(e.path); err == nil { if werr := os.WriteFile(e.path+".bak", existing, 0644); werr != nil { log.Printf("admin: failed to write backup: %v", werr) } } tmpPath := e.path + ".tmp" if err := os.WriteFile(tmpPath, out, 0644); err != nil { return fmt.Errorf("writing temp file: %w", err) } if err := os.Rename(tmpPath, e.path); err != nil { os.Remove(tmpPath) return fmt.Errorf("renaming temp file into place: %w", err) } return nil } func (e *configEditor) topMapping() *yaml.Node { return e.root.Content[0] } // findOrCreateKey returns the value node for the given key under a mapping. // If create is true and the key does not exist, it is appended with a fresh // value node of the given kind. func findOrCreateKey(m *yaml.Node, key string, create bool, valueKind yaml.Kind) (*yaml.Node, error) { if m.Kind != yaml.MappingNode { return nil, fmt.Errorf("node is not a mapping") } for i := 0; i+1 < len(m.Content); i += 2 { if m.Content[i].Value == key { return m.Content[i+1], nil } } if !create { return nil, fmt.Errorf("key %q not found", key) } keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key} valNode := &yaml.Node{Kind: valueKind} m.Content = append(m.Content, keyNode, valNode) return valNode, nil } func (e *configEditor) pagesNode(create bool) (*yaml.Node, error) { return findOrCreateKey(e.topMapping(), "pages", create, yaml.SequenceNode) } // widgetSlot returns the sequence node holding the widget and the widget's // position within it. Caller can read via seq.Content[pos] or replace by // assigning to seq.Content[pos]. Use colIdx = -1 for head widgets. func (e *configEditor) widgetSlot(pageIdx, colIdx, widgetIdx int) (*yaml.Node, int, error) { pageNode, err := e.pageNodeAt(pageIdx) if err != nil { return nil, 0, err } var seq *yaml.Node if colIdx == -1 { seq, err = findOrCreateKey(pageNode, "head-widgets", false, yaml.SequenceNode) if err != nil { return nil, 0, err } } else { columns, err := columnsOf(pageNode) if err != nil { return nil, 0, err } if colIdx < 0 || colIdx >= len(columns.Content) { return nil, 0, fmt.Errorf("column index out of range") } seq, err = widgetsOf(columns.Content[colIdx]) if err != nil { return nil, 0, err } } if widgetIdx < 0 || widgetIdx >= len(seq.Content) { return nil, 0, fmt.Errorf("widget index out of range") } return seq, widgetIdx, nil } func (e *configEditor) pageNodeAt(idx int) (*yaml.Node, error) { pages, err := e.pagesNode(false) if err != nil { return nil, err } if pages.Kind != yaml.SequenceNode { return nil, fmt.Errorf("pages is not a sequence") } if idx < 0 || idx >= len(pages.Content) { return nil, fmt.Errorf("page index %d out of range", idx) } return pages.Content[idx], nil } func columnsOf(pageNode *yaml.Node) (*yaml.Node, error) { return findOrCreateKey(pageNode, "columns", false, yaml.SequenceNode) } func widgetsOf(columnNode *yaml.Node) (*yaml.Node, error) { return findOrCreateKey(columnNode, "widgets", true, yaml.SequenceNode) } func newPageNode(title string) *yaml.Node { return &yaml.Node{ Kind: yaml.MappingNode, Content: []*yaml.Node{ {Kind: yaml.ScalarNode, Value: "name"}, {Kind: yaml.ScalarNode, Value: title}, {Kind: yaml.ScalarNode, Value: "columns"}, {Kind: yaml.SequenceNode, Content: []*yaml.Node{ {Kind: yaml.MappingNode, Content: []*yaml.Node{ {Kind: yaml.ScalarNode, Value: "size"}, {Kind: yaml.ScalarNode, Value: "full"}, {Kind: yaml.ScalarNode, Value: "widgets"}, {Kind: yaml.SequenceNode}, }}, }}, }, } } // adminError renders a minimal HTML error page so failed mutations don't // leave the user staring at a blank screen. The hot-reload watcher will // still pick up any successful intermediate save state. func adminError(w http.ResponseWriter, status int, msg string) { w.Header().Set("Content-Type", "text/html; charset=utf-8") w.WriteHeader(status) w.Write([]byte("
The change wasn't applied. Your config file is unchanged.
"))
w.Write([]byte(htmlEscape(msg)))
w.Write([]byte(""))
}
func htmlEscape(s string) string {
r := strings.NewReplacer("&", "&", "<", "<", ">", ">", "\"", """, "'", "'")
return r.Replace(s)
}
// ---- handlers ----
func (a *application) handleAdminAddPage(w http.ResponseWriter, r *http.Request) {
if !a.adminAccessAllowed(w, r) {
return
}
if err := r.ParseForm(); err != nil {
adminError(w, http.StatusBadRequest, err.Error())
return
}
title := strings.TrimSpace(r.FormValue("title"))
if title == "" {
adminError(w, http.StatusBadRequest, "page title is required")
return
}
editor, err := loadConfigEditor(a.ConfigPath)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
pages, err := editor.pagesNode(true)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
pages.Content = append(pages.Content, newPageNode(title))
if err := editor.save(); err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
http.Redirect(w, r, a.Config.Server.BaseURL+"/edit", http.StatusSeeOther)
}
func (a *application) handleAdminDeletePage(w http.ResponseWriter, r *http.Request) {
if !a.adminAccessAllowed(w, r) {
return
}
slug := r.PathValue("page")
idx, ok := a.freshPageIndexBySlug(slug)
if !ok {
a.handleNotFound(w, r)
return
}
editor, err := loadConfigEditor(a.ConfigPath)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
pages, err := editor.pagesNode(false)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
if idx >= len(pages.Content) {
adminError(w, http.StatusInternalServerError, "page index out of range — config may have been edited externally")
return
}
if len(pages.Content) <= 1 {
adminError(w, http.StatusBadRequest, "cannot delete the last remaining page")
return
}
pages.Content = append(pages.Content[:idx], pages.Content[idx+1:]...)
if err := editor.save(); err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
http.Redirect(w, r, a.Config.Server.BaseURL+"/edit", http.StatusSeeOther)
}
func (a *application) handleAdminDeleteWidget(w http.ResponseWriter, r *http.Request) {
if !a.adminAccessAllowed(w, r) {
return
}
slug := r.PathValue("page")
pageIdx, ok := a.freshPageIndexBySlug(slug)
if !ok {
a.handleNotFound(w, r)
return
}
col, err := strconv.Atoi(r.PathValue("col"))
if err != nil {
a.handleNotFound(w, r)
return
}
idx, err := strconv.Atoi(r.PathValue("idx"))
if err != nil {
a.handleNotFound(w, r)
return
}
editor, err := loadConfigEditor(a.ConfigPath)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
pageNode, err := editor.pageNodeAt(pageIdx)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
columns, err := columnsOf(pageNode)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
if col < 0 || col >= len(columns.Content) {
adminError(w, http.StatusBadRequest, "column index out of range")
return
}
widgets, err := widgetsOf(columns.Content[col])
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
if idx < 0 || idx >= len(widgets.Content) {
adminError(w, http.StatusBadRequest, "widget index out of range")
return
}
widgets.Content = append(widgets.Content[:idx], widgets.Content[idx+1:]...)
if err := editor.save(); err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
http.Redirect(w, r, a.Config.Server.BaseURL+"/edit/pages/"+slug, http.StatusSeeOther)
}
func (a *application) handleAdminMoveWidget(w http.ResponseWriter, r *http.Request) {
if !a.adminAccessAllowed(w, r) {
return
}
slug := r.PathValue("page")
pageIdx, ok := a.freshPageIndexBySlug(slug)
if !ok {
a.handleNotFound(w, r)
return
}
col, err := strconv.Atoi(r.PathValue("col"))
if err != nil {
a.handleNotFound(w, r)
return
}
idx, err := strconv.Atoi(r.PathValue("idx"))
if err != nil {
a.handleNotFound(w, r)
return
}
dir := r.URL.Query().Get("dir")
delta := 0
switch dir {
case "up":
delta = -1
case "down":
delta = 1
default:
adminError(w, http.StatusBadRequest, "dir must be 'up' or 'down'")
return
}
editor, err := loadConfigEditor(a.ConfigPath)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
pageNode, err := editor.pageNodeAt(pageIdx)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
columns, err := columnsOf(pageNode)
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
if col < 0 || col >= len(columns.Content) {
adminError(w, http.StatusBadRequest, "column index out of range")
return
}
widgets, err := widgetsOf(columns.Content[col])
if err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
target := idx + delta
if idx < 0 || idx >= len(widgets.Content) || target < 0 || target >= len(widgets.Content) {
adminError(w, http.StatusBadRequest, "cannot move further in that direction")
return
}
widgets.Content[idx], widgets.Content[target] = widgets.Content[target], widgets.Content[idx]
if err := editor.save(); err != nil {
adminError(w, http.StatusInternalServerError, err.Error())
return
}
http.Redirect(w, r, a.Config.Server.BaseURL+"/edit/pages/"+slug, http.StatusSeeOther)
}
func (a *application) handleAdminEditWidget(w http.ResponseWriter, r *http.Request) {
if !a.adminAccessAllowed(w, r) {
return
}
if err := r.ParseForm(); err != nil {
adminError(w, http.StatusBadRequest, err.Error())
return
}
slug := r.PathValue("page")
page, pageIdx, exists := findPageBySlug(a.freshPagesFromDisk(), slug)
if !exists {
a.handleNotFound(w, r)
return
}
col, err := strconv.Atoi(r.PathValue("col"))
if err != nil {
a.handleNotFound(w, r)
return
}
idx, err := strconv.Atoi(r.PathValue("idx"))
if err != nil {
a.handleNotFound(w, r)
return
}
yamlText := r.FormValue("yaml")
rerenderError := func(msg string) {
a.renderWidgetEditor(w, r, editorRenderInput{
pageTitle: page.Title,
pageSlug: page.Slug,
col: col,
idx: idx,
widgetType: widgetTypeFromYAML(yamlText),
yamlText: yamlText,
errorMessage: msg,
})
}
newNode, err := parseWidgetYAML(yamlText)
if err != nil {
rerenderError(err.Error())
return
}
editor, err := loadConfigEditor(a.ConfigPath)
if err != nil {
rerenderError(err.Error())
return
}
seq, pos, err := editor.widgetSlot(pageIdx, col, idx)
if err != nil {
rerenderError(err.Error())
return
}
seq.Content[pos] = newNode
if err := editor.save(); err != nil {
rerenderError(err.Error())
return
}
http.Redirect(w, r,
fmt.Sprintf("%s/edit/pages/%s/widgets/%d/%d", a.Config.Server.BaseURL, slug, col, idx),
http.StatusSeeOther)
}
// parseWidgetYAML parses the editor's submitted text into a single mapping
// node suitable for splicing into the config tree.
func parseWidgetYAML(yamlText string) (*yaml.Node, error) {
var doc yaml.Node
if err := yaml.Unmarshal([]byte(yamlText), &doc); err != nil {
return nil, fmt.Errorf("YAML parse error: %w", err)
}
if doc.Kind != yaml.DocumentNode || len(doc.Content) == 0 {
return nil, fmt.Errorf("submitted YAML is empty")
}
node := doc.Content[0]
if node.Kind != yaml.MappingNode {
return nil, fmt.Errorf("widget YAML must be a mapping (key: value pairs)")
}
return node, nil
}
func (a *application) handleAdminCreateWidget(w http.ResponseWriter, r *http.Request) {
if !a.adminAccessAllowed(w, r) {
return
}
if err := r.ParseForm(); err != nil {
adminError(w, http.StatusBadRequest, err.Error())
return
}
slug := r.PathValue("page")
page, pageIdx, exists := findPageBySlug(a.freshPagesFromDisk(), slug)
if !exists {
a.handleNotFound(w, r)
return
}
col, err := strconv.Atoi(r.PathValue("col"))
if err != nil {
a.handleNotFound(w, r)
return
}
yamlText := r.FormValue("yaml")
rerenderError := func(msg string) {
a.renderWidgetEditor(w, r, editorRenderInput{
pageTitle: page.Title,
pageSlug: page.Slug,
isNew: true,
col: col,
widgetType: widgetTypeFromYAML(yamlText),
yamlText: yamlText,
errorMessage: msg,
})
}
newNode, err := parseWidgetYAML(yamlText)
if err != nil {
rerenderError(err.Error())
return
}
editor, err := loadConfigEditor(a.ConfigPath)
if err != nil {
rerenderError(err.Error())
return
}
pageNode, err := editor.pageNodeAt(pageIdx)
if err != nil {
rerenderError(err.Error())
return
}
columns, err := columnsOf(pageNode)
if err != nil {
rerenderError("page has no columns; add a column first")
return
}
if col < 0 || col >= len(columns.Content) {
rerenderError("column index out of range")
return
}
widgets, err := widgetsOf(columns.Content[col])
if err != nil {
rerenderError(err.Error())
return
}
widgets.Content = append(widgets.Content, newNode)
if err := editor.save(); err != nil {
rerenderError(err.Error())
return
}
http.Redirect(w, r, a.Config.Server.BaseURL+"/edit/pages/"+slug, http.StatusSeeOther)
}