LokiStack/backend/routers/router.go

package routers

import (
	"net/http"
	"os"
	"path/filepath"
	"strings"
	"time"

	"lokistack/controllers"
	"lokistack/middleware"
	"lokistack/pkg/metrics"
	"lokistack/services"

	"github.com/gin-contrib/cors"
	"github.com/gin-gonic/gin"
)

// Version 由 main 启动时注入(构建期 -ldflags -X main.version,再传到这里),
// 保持 /api/v1/health 与关于页版本一致
var Version = "dev"

func SetupRouter() *gin.Engine {
	// 用 gin.New() 而不是 gin.Default()：Default 自带文本格式的 gin.Logger()，
	// 这里换成结构化 JSON 访问日志（middleware.AccessLog），便于 Promtail→Loki
	// 按字段过滤，同时跳过健康检查/静态资源，避免探针轮询把日志量刷满。
	// Recovery 必须显式加回来（Default 里包含它），否则 panic 会打挂进程。
	r := gin.New()
	// AuditLog 放在最外层：它依赖的 userId/username 由 group 内的 JWTAuth 写入，
	// 但中间件的后置逻辑在 c.Next() 返回后才执行，那时已就绪（见 middleware/audit.go）。
	r.Use(middleware.AccessLog(), middleware.AuditLog(), middleware.Metrics(), gin.Recovery())

	// CORS
	cfg := cors.DefaultConfig()
	cfg.AllowAllOrigins = true
	cfg.AllowHeaders = []string{"Origin", "Content-Type", "Accept", "Authorization", "X-Requested-With"}
	cfg.AllowMethods = []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"}
	r.Use(cors.New(cfg))

	// Controllers
	authCtrl := controllers.NewAuthController()
	clusterCtrl := controllers.NewClusterController()
	hostCtrl := controllers.NewHostController()
	storageCtrl := controllers.NewStorageController()
	deploymentCtrl := controllers.NewDeploymentController()
	collectorCtrl := controllers.NewCollectorController()
	userCtrl := controllers.NewUserController()
	ldapCtrl := controllers.NewLdapController()
	logsCtrl := controllers.NewLogsController()
	alertsCtrl := controllers.NewAlertsController()
	auditCtrl := controllers.NewAuditController()
	systemCtrl := controllers.NewSystemController()
	registryCtrl := controllers.NewImageRegistryController()

	// API v1
	api := r.Group("/api/v1")

	// 健康检查（公开访问，用于负载均衡和监控）
	api.GET("/health", func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{
			"status":    "ok",
			"timestamp": time.Now().Unix(),
			"version":   Version,
		})
	})

	// Prometheus metrics 端点（真实指标，见 services/metrics.go）
	// 原实现只返回一行注释却声称"可被 Prometheus 抓取"，平台自身等于不可观测。
	api.GET("/metrics", gin.WrapH(metrics.Handler()))

	// Public（登录接口挂 IP 限流防爆破：20 次/分钟）
	api.POST("/auth/login", middleware.LoginRateLimit(20, time.Minute), authCtrl.Login)
	api.POST("/auth/refresh", authCtrl.RefreshToken)

	// Auth required
	authorized := api.Group("")
	authorized.Use(middleware.JWTAuth())

	// Auth routes
	authorized.GET("/auth/user", authCtrl.GetUser)
	authorized.POST("/auth/password", authCtrl.ChangePassword)

	// 日志查询:数据源管理 + Loki 代理查询
	logs := authorized.Group("/logs")
	{
		logs.GET("/sources", logsCtrl.ListSources)
		logs.POST("/sources", middleware.AdminAuth(), logsCtrl.CreateSource)
		logs.PUT("/sources/:id", middleware.AdminAuth(), logsCtrl.UpdateSource)
		logs.DELETE("/sources/:id", middleware.AdminAuth(), logsCtrl.DeleteSource)
		logs.POST("/sources/test", middleware.AdminAuth(), logsCtrl.TestSource)
		logs.GET("/policy-groups", middleware.AdminAuth(), logsCtrl.ListPolicyGroups)
		logs.POST("/policy-groups", middleware.AdminAuth(), logsCtrl.CreatePolicyGroup)
		logs.PUT("/policy-groups/:id", middleware.AdminAuth(), logsCtrl.UpdatePolicyGroup)
		logs.DELETE("/policy-groups/:id", middleware.AdminAuth(), logsCtrl.DeletePolicyGroup)
		logs.POST("/query", logsCtrl.Query)
		logs.POST("/context", logsCtrl.Context)
		logs.GET("/labels", logsCtrl.Labels)
		logs.GET("/label/:name/values", logsCtrl.LabelValues)
		// 批量取 label 值：一次请求拿多个 label（app+service_name+container 三级回退），
		// 前端下拉联动从 3 个往返降到 1 个
		logs.GET("/label-values", logsCtrl.LabelValuesBatch)
		logs.GET("/my-scope", logsCtrl.MyScope)
		// ⚠️ 必须是 POST：前端 logsApi.histogram 用 POST 传 body（sourceId/query/start/end）。
		// 曾被误改成 GET，导致 POST /logs/histogram 全部 404，
		// 表现为日志查询页直方图不显示、分析页直接报 "API endpoint not found"。
		// 同时保留 GET 作为简单调试入口（参数放 query string）。
		logs.POST("/histogram", logsCtrl.Histogram)
		logs.GET("/histogram", logsCtrl.Histogram)
		logs.GET("/daily-volume", logsCtrl.DailyVolume)
		// 应用排行：长范围读平台预聚合快照（毫秒级），不扫日志内容
		logs.GET("/app-ranking", logsCtrl.AppRanking)
		// 总量统计（index/stats）：只读索引，用于算总页数
		logs.POST("/stats", logsCtrl.Stats)
		logs.POST("/metrics", middleware.AdminAuth(), logsCtrl.Metrics)
		logs.GET("/health", logsCtrl.Health)
	}

	// 平台数据保留期（告警发送历史 / 审计日志）
	authorized.GET("/settings/retention", systemCtrl.GetRetention)
	authorized.PUT("/settings/retention", middleware.AdminAuth(), systemCtrl.SaveRetention)

	// 镜像源(国内加速/海外/私有仓库)
	authorized.GET("/settings/image-registry", registryCtrl.Get)
	authorized.PUT("/settings/image-registry", middleware.AdminAuth(), registryCtrl.Save)

	// 告警:飞书通知配置 + 告警规则
	alertNotify := authorized.Group("/alerts")
	{
		alertNotify.GET("/notify-config", alertsCtrl.GetNotifyConfig)
		alertNotify.PUT("/notify-config", middleware.AdminAuth(), alertsCtrl.UpdateNotifyConfig)
		alertNotify.POST("/notify-config/test", middleware.AdminAuth(), alertsCtrl.TestNotifyConfig)
		alertNotify.GET("/rules", alertsCtrl.ListRules)
		alertNotify.POST("/rules", middleware.AdminAuth(), alertsCtrl.CreateRule)
		alertNotify.PUT("/rules/:id", middleware.AdminAuth(), alertsCtrl.UpdateRule)
		alertNotify.DELETE("/rules/:id", middleware.AdminAuth(), alertsCtrl.DeleteRule)
		alertNotify.POST("/check", middleware.AdminAuth(), alertsCtrl.CheckNow)
		alertNotify.GET("/deliveries", alertsCtrl.Deliveries)
		alertNotify.GET("/channels", alertsCtrl.ListChannels)
		alertNotify.POST("/channels", middleware.AdminAuth(), alertsCtrl.SaveChannel)
		alertNotify.PUT("/channels/:id", middleware.AdminAuth(), alertsCtrl.SaveChannel)
		alertNotify.DELETE("/channels/:id", middleware.AdminAuth(), alertsCtrl.DeleteChannel)
		alertNotify.POST("/channels/test", middleware.AdminAuth(), alertsCtrl.TestChannel)
	}

	// LDAP 配置(admin 读写;查询供用户页判断导入按钮显隐,登录用户即可读)
	authorized.GET("/settings/ldap", middleware.AdminAuth(), ldapCtrl.GetConfig)
	authorized.PUT("/settings/ldap", middleware.AdminAuth(), ldapCtrl.UpdateConfig)
	authorized.POST("/settings/ldap/test", middleware.AdminAuth(), ldapCtrl.TestConnection)
	authorized.POST("/settings/ldap/users", middleware.AdminAuth(), ldapCtrl.ListUsers)

	// Users（admin 专用）
	// 系统运维：备份 / 恢复 / 一键自检（仅管理员）
	system := authorized.Group("/system")
	system.Use(middleware.AdminAuth())
	{
		system.GET("/self-check", systemCtrl.Health)
	}

	// 审计日志：仅管理员可查（含他人操作记录）
	audit := authorized.Group("/audit-logs")
	audit.Use(middleware.AdminAuth())
	{
		audit.GET("", auditCtrl.List)
		audit.GET("/stats", auditCtrl.Stats)
		audit.GET("/:id", auditCtrl.Get)
	}

	users := authorized.Group("/users")
	users.Use(middleware.AdminAuth())
	{
		users.GET("", userCtrl.List)
		users.POST("", userCtrl.Create)
		users.DELETE("/:id", userCtrl.Delete)
		users.POST("/batch-delete", userCtrl.BatchDelete)
		users.POST("/:id/reset-password", userCtrl.ResetPassword)
		users.POST("/batch-import-ldap", userCtrl.BatchImportLDAP)
	}
	// 普通用户仅可访问日志查询及自己的账号接口；管理资源统一在服务端保护。
	authorized.Use(middleware.AdminAuth())

	// Clusters
	authorized.GET("/clusters", clusterCtrl.List)
	authorized.GET("/clusters/:id", clusterCtrl.Get)
	authorized.POST("/clusters", clusterCtrl.Create)
	authorized.PUT("/clusters/:id", clusterCtrl.Update)
	authorized.DELETE("/clusters/:id", clusterCtrl.Delete)
	authorized.POST("/clusters/:id/validate", clusterCtrl.Validate)
	authorized.GET("/clusters/:id/info", clusterCtrl.GetInfo)
	authorized.GET("/clusters/:id/namespaces", clusterCtrl.Namespaces)
	authorized.GET("/clusters/:id/namespaces/:namespace/deployments", clusterCtrl.Deployments)

	// Hosts
	authorized.GET("/hosts", hostCtrl.List)
	authorized.GET("/hosts/:id", hostCtrl.Get)
	authorized.POST("/hosts", hostCtrl.Create)
	authorized.PUT("/hosts/:id", hostCtrl.Update)
	authorized.DELETE("/hosts/:id", hostCtrl.Delete)
	authorized.POST("/hosts/:id/validate", hostCtrl.Validate)
	authorized.GET("/hosts/:id/info", hostCtrl.GetInfo)

	// Storage
	authorized.GET("/storages", storageCtrl.List)
	authorized.GET("/storages/:id", storageCtrl.Get)
	authorized.POST("/storages", storageCtrl.Create)
	authorized.POST("/storages/test", storageCtrl.TestConnection)
	authorized.PUT("/storages/:id", storageCtrl.Update)
	authorized.DELETE("/storages/:id", storageCtrl.Delete)
	authorized.GET("/storages/default", storageCtrl.GetDefault)

	// Deployments
	authorized.GET("/deployments", deploymentCtrl.List)
	authorized.GET("/deployments/:id", deploymentCtrl.Get)
	authorized.POST("/deployments", deploymentCtrl.Create)
	authorized.PUT("/deployments/:id", deploymentCtrl.Update)
	authorized.POST("/deployments/:id/retention", deploymentCtrl.UpdateRetention)
	authorized.GET("/deployments/:id/config", middleware.AdminAuth(), deploymentCtrl.GetLiveConfig)
	authorized.DELETE("/deployments/:id", deploymentCtrl.Delete)
	authorized.POST("/deployments/:id/deploy", deploymentCtrl.Deploy)
	authorized.POST("/deployments/:id/stop", deploymentCtrl.Stop)
	authorized.POST("/deployments/:id/restart", deploymentCtrl.Restart)
	authorized.GET("/deployments/:id/logs", deploymentCtrl.GetLogs)
	// 资源用量（CPU/内存/限流），页面用来判断是否要扩容
	authorized.GET("/deployments/:id/usage", deploymentCtrl.GetUsage)
	authorized.GET("/deployments/stats", deploymentCtrl.GetStats)
	authorized.GET("/deployments/preflight", deploymentCtrl.Preflight)
	authorized.GET("/deployments/:id/ready", deploymentCtrl.Ready)
	authorized.GET("/deployments/versions", deploymentCtrl.GetVersions)

	// Collectors
	authorized.GET("/collectors", collectorCtrl.List)
	authorized.GET("/collectors/:id", collectorCtrl.Get)
	authorized.POST("/collectors", collectorCtrl.Create)
	authorized.PUT("/collectors/:id", collectorCtrl.Update)
	authorized.DELETE("/collectors/:id", collectorCtrl.Delete)
	authorized.POST("/collectors/:id/install", collectorCtrl.Install)
	authorized.POST("/collectors/:id/uninstall", collectorCtrl.Uninstall)
	authorized.POST("/collectors/:id/preview", collectorCtrl.Preview)
	authorized.GET("/collectors/:id/logs", collectorCtrl.Logs)
	// 采集项 YAML 双向转换（方案 A：只开放采集规则，不开放 clients/positions）
	authorized.POST("/collector-jobs/render", collectorCtrl.RenderJobsYAML)
	authorized.POST("/collector-jobs/parse", collectorCtrl.ParseJobsYAML)

	// 文档站(docsify,docs/)与落地页(homepage/)随二进制一起发布;
	// 独立于前端 dist 存在与否注册,目录不存在时路由不生效
	docsCtrl := controllers.NewDocsController()
	if services.DocsBaseDir() != "" {
		r.GET("/docs", docsCtrl.Home)
		r.GET("/docs/search-data.json", docsCtrl.SearchData)
		r.GET("/docs/:slug", docsCtrl.Page)
		r.Static("/docs/assets", filepath.Join(services.DocsBaseDir(), "assets"))
	}
	serveStaticDir(r, "/homepage", "homepage")

	// Static files - use executable directory as base
	distPath := findDistPath()

	if distPath != "" {
		r.Static("/assets", filepath.Join(distPath, "assets"))

		// favicon：NoRoute 会把所有非 /api/ 请求回退到 index.html，
		// 故此处显式注册 /favicon.svg 与 /favicon.ico，否则浏览器请求图标只会拿到 HTML。
		faviconSVG := filepath.Join(distPath, "favicon.svg")
		serveFavicon := func(c *gin.Context) {
			if _, err := os.Stat(faviconSVG); err != nil {
				c.Status(404)
				return
			}
			c.Header("Content-Type", "image/svg+xml")
			c.File(faviconSVG)
		}
		r.GET("/favicon.svg", serveFavicon)
		r.GET("/favicon.ico", serveFavicon)

		r.NoRoute(func(c *gin.Context) {
			if strings.HasPrefix(c.Request.URL.Path, "/api/") {
				c.JSON(404, gin.H{"code": 404, "message": "API endpoint not found"})
				return
			}
			c.File(filepath.Join(distPath, "index.html"))
		})
	}

	return r
}

// serveStaticDir 把本地目录挂为只读静态站点:目录回退到 fallbackFile(SPA/docsify 需要)。
// baseDir 候选与 findDistPath 同源:可执行文件相对路径优先,再退工作目录。
func serveStaticDir(r *gin.Engine, urlPrefix, dirName string) {
	root := findAuxDir(dirName)
	if root == "" {
		return
	}
	// http.FileServer 自带目录回退:访问 /docs 自动 301 到 /docs/ 并命中 index.html
	r.Static(urlPrefix, root)
}

// findAuxDir 定位 dist 之外的附属静态目录(docs/homepage),规则与 findDistPath 对齐
func findAuxDir(dirName string) string {
	if ex, err := os.Executable(); err == nil {
		execDir := filepath.Dir(ex)
		if !strings.Contains(execDir, "/tmp/go-build") {
			for _, rel := range []string{dirName, "../" + dirName, "../../" + dirName} {
				p := filepath.Join(execDir, rel)
				if _, err := os.Stat(filepath.Join(p, "index.html")); err == nil {
					return p
				}
			}
		}
	}
	for _, p := range []string{"./" + dirName, "../" + dirName, "/app/" + dirName} {
		if abs, err := filepath.Abs(p); err == nil {
			if _, err := os.Stat(filepath.Join(abs, "index.html")); err == nil {
				return abs
			}
		}
	}
	return ""
}

// findDistPath finds the frontend dist directory
func findDistPath() string {
	// Try relative to executable
	if ex, err := os.Executable(); err == nil {
		execDir := filepath.Dir(ex)
		// If running via "go run", executable is in temp dir - fall through
		if !strings.Contains(execDir, "/tmp/go-build") {
			for _, rel := range []string{"dist", "../dist", "../../dist"} {
				p := filepath.Join(execDir, rel)
				if _, err := os.Stat(filepath.Join(p, "index.html")); err == nil {
					return p
				}
			}
		}
	}
	// Try working directory relative paths
	for _, p := range []string{"./dist", "../dist", "/app/dist"} {
		if abs, err := filepath.Abs(p); err == nil {
			if _, err := os.Stat(filepath.Join(abs, "index.html")); err == nil {
				return abs
			}
		}
	}
	return ""
}