feat: add Web UI server with basic-auth and artist dashboard

internal/web/server.go

@@ -0,0 +1,172 @@
+// Package web implements the NaviWatcher HTTP dashboard: a net/http server with
+// embedded templates, basic-auth protection, and a dashboard that lists
+// monitored artists with their missing-release counts.
+package web
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"naviwatcher/internal/config"
+	"naviwatcher/internal/database"
+	"naviwatcher/internal/scanner"
+)
+
+// Server is the NaviWatcher web dashboard HTTP server.
+type Server struct {
+	cfg *config.ServerConfig
+	db  *database.DB
+	mux *http.ServeMux
+
+	// uiBaseURL is the externally reachable base URL of the dashboard (scheme +
+	// host), used to build links in notifications and elsewhere. Optional.
+	uiBaseURL string
+}
+
+// NewServer constructs a dashboard Server bound to the given DB and server
+// config. uiBaseURL is the externally reachable origin (e.g.
+// "http://localhost:8080") used when rendering absolute links; pass "" to omit.
+func NewServer(cfg *config.ServerConfig, db *database.DB, uiBaseURL string) *Server {
+	s := &Server{
+		cfg:       cfg,
+		db:        db,
+		uiBaseURL: strings.TrimRight(uiBaseURL, "/"),
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", s.handleDashboard)
+	s.mux = mux
+	return s
+}
+
+// Handler returns the http.Handler (auth-wrapped mux) for the server. It is
+// exported so callers can embed the dashboard in a larger handler tree or test
+// it directly via httptest.
+func (s *Server) Handler() http.Handler {
+	return s.authMiddleware(s.mux)
+}
+
+// Addr returns the listen address ("host:port") for this server.
+func (s *Server) Addr() string {
+	return fmt.Sprintf("%s:%d", s.cfg.Host, s.cfg.Port)
+}
+
+// Start begins listening and serving until the context is cancelled, then shuts
+// down gracefully. It returns any unrecoverable serve error (a clean shutdown
+// due to ctx cancellation returns nil).
+func (s *Server) Start(ctx context.Context) error {
+	srv := &http.Server{
+		Addr:    s.Addr(),
+		Handler: s.Handler(),
+	}
+
+	go func() {
+		<-ctx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		if err := srv.Shutdown(shutdownCtx); err != nil {
+			log.Printf("web server shutdown error: %v", err)
+		}
+	}()
+
+	log.Printf("Web UI listening on %s", s.Addr())
+	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		return fmt.Errorf("web server serve: %w", err)
+	}
+	return nil
+}
+
+// authMiddleware enforces HTTP Basic auth per RFC 7617 using a constant-time
+// comparison of the base64-encoded "user:pass" credential. When either
+// Username or Password is empty, auth is disabled (useful for local/dev).
+func (s *Server) authMiddleware(next http.Handler) http.Handler {
+	user := s.cfg.Username
+	pass := s.cfg.Password
+	if user == "" || pass == "" {
+		return next
+	}
+
+	// Precompute the expected Authorization header value once.
+	want := "Basic " + base64.StdEncoding.EncodeToString([]byte(user+":"+pass))
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		header := r.Header.Get("Authorization")
+		if header == "" {
+			unauthorized(w)
+			return
+		}
+		// Constant-time compare of the full header value.
+		if subtle.ConstantTimeCompare([]byte(header), []byte(want)) != 1 {
+			unauthorized(w)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// unauthorized writes a 401 with a Basic auth challenge.
+func unauthorized(w http.ResponseWriter) {
+	w.Header().Set("WWW-Authenticate", `Basic realm="NaviWatcher"`)
+	w.WriteHeader(http.StatusUnauthorized)
+	_, _ = w.Write([]byte("401 Unauthorized\n"))
+}
+
+// ArtistSummary is the dashboard projection of a single monitored artist and
+// its missing-release count.
+type ArtistSummary struct {
+	ID              string
+	Name            string
+	MBID            string
+	MissingCount    int
+	Monitored       bool
+}
+
+// DashboardData is the view model passed to the dashboard template.
+type DashboardData struct {
+	Artists []ArtistSummary
+	// TotalMissing is the sum of all artists' missing counts.
+	TotalMissing int
+	// UIBaseURL is the externally reachable origin, for building links.
+	UIBaseURL string
+}
+
+// buildDashboardData computes the dashboard view model: every monitored artist
+// joined with its current missing-release count (from the scanner).
+func (s *Server) buildDashboardData(ctx context.Context, threshold float64) (*DashboardData, error) {
+	settings, err := database.GetAllArtistSettings(s.db)
+	if err != nil {
+		return nil, fmt.Errorf("load artist settings: %w", err)
+	}
+
+	// Compute missing releases once and group by artist.
+	missing, err := scanner.ScanAll(ctx, s.db, threshold)
+	if err != nil {
+		return nil, fmt.Errorf("scan: %w", err)
+	}
+	missingByArtist := make(map[string]int)
+	for _, m := range missing {
+		missingByArtist[m.ArtistID]++
+	}
+
+	data := &DashboardData{UIBaseURL: s.uiBaseURL}
+	for _, a := range settings {
+		if !a.Monitored {
+			continue
+		}
+		count := missingByArtist[a.ID]
+		data.Artists = append(data.Artists, ArtistSummary{
+			ID:           a.ID,
+			Name:         a.Name,
+			MBID:         a.MBID,
+			MissingCount: count,
+			Monitored:    true,
+		})
+		data.TotalMissing += count
+	}
+	return data, nil
+}