nettopo-go/internal/api/handler.go

package api

import (
	"encoding/json"
	"net/http"
	"strconv"
	"strings"
	"time"

	"nettopo-go/internal/scans"
)

type Handler struct {
	store scans.Store
	run   *scans.Runner
}

func NewHandler(store scans.Store, run *scans.Runner) *Handler {
	return &Handler{store: store, run: run}
}

func (h *Handler) Routes() http.Handler {
	mux := http.NewServeMux()
	mux.HandleFunc("GET /health", h.health)
	mux.HandleFunc("POST /api/scans", h.createScan)
	mux.HandleFunc("GET /api/scans", h.listScans)
	mux.HandleFunc("GET /api/scans/{id}", h.getScan)
	mux.HandleFunc("GET /api/scans/{id}/hosts", h.getScanHosts)
	mux.HandleFunc("GET /api/scans/{id}/ports", h.getScanPorts)
	return withJSON(mux)
}

func (h *Handler) health(w http.ResponseWriter, _ *http.Request) {
	writeJSON(w, http.StatusOK, map[string]any{
		"status": "ok",
		"time":   time.Now().UTC(),
	})
}

func (h *Handler) createScan(w http.ResponseWriter, r *http.Request) {
	var req scans.CreateScanRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		writeError(w, http.StatusBadRequest, "invalid json body")
		return
	}

	req.Name = strings.TrimSpace(req.Name)
	if req.Name == "" {
		req.Name = "manual-scan"
	}

	job, err := h.store.CreateScan(req)
	if err != nil {
		writeError(w, http.StatusBadRequest, err.Error())
		return
	}

	writeJSON(w, http.StatusCreated, map[string]any{
		"scan_id": job.ID,
		"status":  job.Status,
	})

	if h.run != nil {
		h.run.Start(job)
	}
}

func (h *Handler) listScans(w http.ResponseWriter, r *http.Request) {
	limit := 50
	if raw := r.URL.Query().Get("limit"); raw != "" {
		n, err := strconv.Atoi(raw)
		if err != nil || n <= 0 || n > 500 {
			writeError(w, http.StatusBadRequest, "limit must be between 1 and 500")
			return
		}
		limit = n
	}
	writeJSON(w, http.StatusOK, map[string]any{
		"items": h.store.ListScans(limit),
	})
}

func (h *Handler) getScan(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	if id == "" {
		writeError(w, http.StatusBadRequest, "scan id is required")
		return
	}

	job, ok := h.store.GetScan(id)
	if !ok {
		writeError(w, http.StatusNotFound, "scan not found")
		return
	}

	writeJSON(w, http.StatusOK, job)
}

func (h *Handler) getScanHosts(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	if id == "" {
		writeError(w, http.StatusBadRequest, "scan id is required")
		return
	}
	if _, ok := h.store.GetScan(id); !ok {
		writeError(w, http.StatusNotFound, "scan not found")
		return
	}

	limit := 500
	if raw := r.URL.Query().Get("limit"); raw != "" {
		n, err := strconv.Atoi(raw)
		if err != nil || n <= 0 || n > 5000 {
			writeError(w, http.StatusBadRequest, "limit must be between 1 and 5000")
			return
		}
		limit = n
	}

	writeJSON(w, http.StatusOK, map[string]any{
		"items": h.store.ListHostResults(id, limit),
	})
}

func (h *Handler) getScanPorts(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	if id == "" {
		writeError(w, http.StatusBadRequest, "scan id is required")
		return
	}
	if _, ok := h.store.GetScan(id); !ok {
		writeError(w, http.StatusNotFound, "scan not found")
		return
	}

	limit := 1000
	if raw := r.URL.Query().Get("limit"); raw != "" {
		n, err := strconv.Atoi(raw)
		if err != nil || n <= 0 || n > 10000 {
			writeError(w, http.StatusBadRequest, "limit must be between 1 and 10000")
			return
		}
		limit = n
	}

	writeJSON(w, http.StatusOK, map[string]any{
		"items": h.store.ListOpenPortResults(id, limit),
	})
}

func withJSON(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json; charset=utf-8")
		next.ServeHTTP(w, r)
	})
}

func writeJSON(w http.ResponseWriter, status int, payload any) {
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(payload)
}

func writeError(w http.ResponseWriter, status int, message string) {
	writeJSON(w, status, map[string]string{"error": message})
}