netmaker/controllers/dns.go

package controller

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"strings"
	"time"

	"github.com/google/uuid"
	"github.com/gorilla/mux"
	"github.com/gravitl/netmaker/db"
	"github.com/gravitl/netmaker/logger"
	"github.com/gravitl/netmaker/logic"
	"github.com/gravitl/netmaker/middleware"
	"github.com/gravitl/netmaker/models"
	"github.com/gravitl/netmaker/mq"
	"github.com/gravitl/netmaker/schema"
	"github.com/gravitl/netmaker/scope"
	"github.com/gravitl/netmaker/servercfg"
	"gorm.io/datatypes"
)

func dnsHandlers(r *mux.Router) {

	r.HandleFunc("/api/dns", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(getAllDNS)))).
		Methods(http.MethodGet)
	r.HandleFunc("/api/dns/adm/{network}/nodes", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(getNodeDNS)))).
		Methods(http.MethodGet)
	r.HandleFunc("/api/dns/adm/{network}/custom", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(getCustomDNS)))).
		Methods(http.MethodGet)
	r.HandleFunc("/api/dns/adm/{network}", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(getDNS)))).
		Methods(http.MethodGet)
	r.HandleFunc("/api/dns/adm/{network}/sync", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(syncDNS)))).
		Methods(http.MethodPost)
	r.HandleFunc("/api/dns/{network}", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(createDNS)))).
		Methods(http.MethodPost)
	r.HandleFunc("/api/dns/adm/pushdns", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(pushDNS)))).
		Methods(http.MethodPost)
	r.HandleFunc("/api/dns/{network}/{domain}", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(deleteDNS)))).
		Methods(http.MethodDelete)
	r.HandleFunc("/api/v1/nameserver", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(createNs)))).Methods(http.MethodPost)
	r.HandleFunc("/api/v1/nameserver", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(listNs)))).Methods(http.MethodGet)
	r.HandleFunc("/api/v1/nameserver", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(updateNs)))).Methods(http.MethodPut)
	r.HandleFunc("/api/v1/nameserver", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(deleteNs)))).Methods(http.MethodDelete)
	r.HandleFunc("/api/v1/nameserver/global", middleware.Scope(scope.TenantScope, logic.SecurityCheck(true, http.HandlerFunc(getGlobalNs)))).Methods(http.MethodGet)
}

// @Summary     List Global Nameservers
// @Router      /api/v1/nameserver/global [get]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Success     200 {object} map[string]schema.Nameserver
// @Failure     400 {object} models.ErrorResponse
// @Failure     401 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func getGlobalNs(w http.ResponseWriter, r *http.Request) {

	logic.ReturnSuccessResponseWithJson(w, r, logic.GlobalNsList, "fetched nameservers")
}

// @Summary     Create Nameserver
// @Router      /api/v1/nameserver [post]
// @Tags        DNS
// @Security    oauth
// @Accept      json
// @Produce     json
// @Param       body body models.NameserverReq true "Nameserver request body"
// @Success     200 {object} schema.Nameserver
// @Failure     400 {object} models.ErrorResponse
// @Failure     401 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func createNs(w http.ResponseWriter, r *http.Request) {

	var req schema.Nameserver
	err := json.NewDecoder(r.Body).Decode(&req)
	if err != nil {
		logger.Log(0, "error decoding request body: ",
			err.Error())
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
		return
	}
	if err := logic.ValidateNameserverReq(r.Context(), &req); err != nil {
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
		return
	}
	if req.Tags == nil {
		req.Tags = make(datatypes.JSONMap)
	}
	if req.Nodes == nil {
		req.Nodes = make(datatypes.JSONMap)
	}
	if gNs, ok := logic.GlobalNsList[req.Name]; ok {
		req.Servers = gNs.IPs
	}
	if !servercfg.IsPro {
		req.Tags = datatypes.JSONMap{
			"*": struct{}{},
		}
	}
	if req.MatchAll {
		req.Domains = []schema.NameserverDomain{
			{
				Domain: ".",
			},
		}
	}
	if req.Fallback {
		for _, domain := range req.Domains {
			if domain.IsADDomain {
				logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("cannot configure ad domain for fallback nameservers"), "badrequest"))
				return
			}
		}
	}
	ns := schema.Nameserver{
		ID:          uuid.New().String(),
		TenantID:    scope.ID(r.Context()),
		Name:        req.Name,
		NetworkID:   req.NetworkID,
		Description: req.Description,
		Fallback:    req.Fallback,
		Servers:     req.Servers,
		MatchAll:    req.MatchAll,
		Domains:     req.Domains,
		Tags:        req.Tags,
		Nodes:       req.Nodes,
		Status:      true,
		CreatedBy:   r.Header.Get("user"),
		CreatedAt:   time.Now().UTC(),
	}
	err = ns.Create(db.WithContext(r.Context()))
	if err != nil {
		logic.ReturnErrorResponse(
			w,
			r,
			logic.FormatError(errors.New("error creating nameserver "+err.Error()), logic.Internal),
		)
		return
	}
	logic.LogEvent(r.Context(), &models.Event{
		Action: schema.Create,
		Source: models.Subject{
			ID:   r.Header.Get("user"),
			Name: r.Header.Get("user"),
			Type: schema.UserSub,
		},
		TriggeredBy: r.Header.Get("user"),
		Target: models.Subject{
			ID:   ns.ID,
			Name: ns.Name,
			Type: schema.NameserverSub,
		},
		NetworkID: schema.NetworkID(ns.NetworkID),
		Origin:    schema.Dashboard,
	})
	ctx := scope.WithContext(db.WithContext(context.Background()), scope.Level(r.Context()), scope.ID(r.Context()))
	go mq.PublishPeerUpdate(ctx, false)
	logic.ReturnSuccessResponseWithJson(w, r, ns, "created nameserver")
}

// @Summary     List Nameservers
// @Router      /api/v1/nameserver [get]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Param       network query string true "Network identifier"
// @Success     200 {array} schema.Nameserver
// @Failure     400 {object} models.ErrorResponse
// @Failure     401 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func listNs(w http.ResponseWriter, r *http.Request) {

	network := r.URL.Query().Get("network")
	if network == "" {
		logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("network is required"), "badrequest"))
		return
	}
	ns := schema.Nameserver{NetworkID: network}
	list, err := ns.ListByNetwork(db.WithContext(r.Context()))
	if err != nil {
		logic.ReturnErrorResponse(
			w,
			r,
			logic.FormatError(errors.New("error listing nameservers "+err.Error()), "internal"),
		)
		return
	}
	logic.ReturnSuccessResponseWithJson(w, r, list, "fetched nameservers")
}

// @Summary     Update Nameserver
// @Router      /api/v1/nameserver [put]
// @Tags        DNS
// @Security    oauth
// @Accept      json
// @Produce     json
// @Param       body body models.NameserverReq true "Nameserver request body"
// @Success     200 {object} schema.Nameserver
// @Failure     400 {object} models.ErrorResponse
// @Failure     401 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func updateNs(w http.ResponseWriter, r *http.Request) {

	var updateNs schema.Nameserver
	err := json.NewDecoder(r.Body).Decode(&updateNs)
	if err != nil {
		logger.Log(0, "error decoding request body: ",
			err.Error())
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
		return
	}

	if err := logic.ValidateNameserverReq(r.Context(), &updateNs); err != nil {
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
		return
	}

	if updateNs.Fallback {
		for _, domain := range updateNs.Domains {
			if domain.IsADDomain {
				logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("cannot configure ad domain for fallback nameservers"), "badrequest"))
				return
			}
		}
	}

	if updateNs.Tags == nil {
		updateNs.Tags = make(datatypes.JSONMap)
	}
	if updateNs.Nodes == nil {
		updateNs.Nodes = make(datatypes.JSONMap)
	}

	ns := schema.Nameserver{ID: updateNs.ID}
	err = ns.Get(db.WithContext(r.Context()))
	if err != nil {
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
		return
	}
	var updateStatus bool
	var updateMatchAll bool
	var updateFallback bool
	if updateNs.Status != ns.Status {
		updateStatus = true
	}
	if updateNs.MatchAll != ns.MatchAll {
		updateMatchAll = true
	}
	if updateNs.Fallback != ns.Fallback {
		updateFallback = true
	}
	event := &models.Event{
		Action: schema.Update,
		Source: models.Subject{
			ID:   r.Header.Get("user"),
			Name: r.Header.Get("user"),
			Type: schema.UserSub,
		},
		TriggeredBy: r.Header.Get("user"),
		Target: models.Subject{
			ID:   ns.ID,
			Name: updateNs.Name,
			Type: schema.NameserverSub,
		},
		Diff: models.Diff{
			Old: ns,
			New: updateNs,
		},
		NetworkID: schema.NetworkID(ns.NetworkID),
		Origin:    schema.Dashboard,
	}

	if !ns.Default {
		if updateNs.MatchAll {
			updateNs.Domains = []schema.NameserverDomain{
				{
					Domain: ".",
				},
			}
		}
		ns.Servers = updateNs.Servers
		ns.Tags = updateNs.Tags
		ns.Domains = updateNs.Domains
		ns.Description = updateNs.Description
		ns.Name = updateNs.Name
		ns.Nodes = updateNs.Nodes
		ns.UpdatedAt = time.Now().UTC()

		err = ns.Update(r.Context())
		if err != nil {
			logic.ReturnErrorResponse(
				w,
				r,
				logic.FormatError(errors.New("error creating egress resource"+err.Error()), "internal"),
			)
			return
		}

		if updateMatchAll {
			ns.MatchAll = updateNs.MatchAll
			ns.UpdateMatchAll(r.Context())
		}

		if updateFallback {
			ns.Fallback = updateNs.Fallback
			ns.UpdateFallback(r.Context())
		}
	}

	if updateStatus {
		ns.Status = updateNs.Status
		ns.UpdateStatus(r.Context())
	}
	logic.LogEvent(r.Context(), event)
	ctx := scope.WithContext(db.WithContext(context.Background()), scope.Level(r.Context()), scope.ID(r.Context()))
	go mq.PublishPeerUpdate(ctx, false)
	logic.ReturnSuccessResponseWithJson(w, r, ns, "updated nameserver")
}

// @Summary     Delete Nameserver Resource
// @Router      /api/v1/nameserver [delete]
// @Tags        DNS
// @Security    oauth
// @Accept      json
// @Produce     json
// @Param       id query string true "Nameserver ID"
// @Success     200 {string} string
// @Failure     400 {object} models.ErrorResponse
// @Failure     401 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func deleteNs(w http.ResponseWriter, r *http.Request) {

	id := r.URL.Query().Get("id")
	if id == "" {
		logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("id is required"), "badrequest"))
		return
	}
	ns := schema.Nameserver{ID: id}
	err := ns.Get(db.WithContext(r.Context()))
	if err != nil {
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, logic.BadReq))
		return
	}
	if ns.Default {
		logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("cannot delete default nameservers"), logic.BadReq))
		return
	}
	err = ns.Delete(db.WithContext(r.Context()))
	if err != nil {
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, logic.Internal))
		return
	}
	logic.LogEvent(r.Context(), &models.Event{
		Action: schema.Delete,
		Source: models.Subject{
			ID:   r.Header.Get("user"),
			Name: r.Header.Get("user"),
			Type: schema.UserSub,
		},
		TriggeredBy: r.Header.Get("user"),
		Target: models.Subject{
			ID:   ns.ID,
			Name: ns.Name,
			Type: schema.NameserverSub,
		},
		NetworkID: schema.NetworkID(ns.NetworkID),
		Origin:    schema.Dashboard,
		Diff: models.Diff{
			Old: ns,
			New: nil,
		},
	})
	ctx := scope.WithContext(db.WithContext(context.Background()), scope.Level(r.Context()), scope.ID(r.Context()))
	go mq.PublishPeerUpdate(ctx, false)
	logic.ReturnSuccessResponseWithJson(w, r, nil, "deleted nameserver resource")
}

// @Summary     Gets node DNS entries associated with a network
// @Router      /api/dns/adm/{network}/nodes [get]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Param       network path string true "Network identifier"
// @Success     200 {array} models.DNSEntry
// @Failure     500 {object} models.ErrorResponse
func getNodeDNS(w http.ResponseWriter, r *http.Request) {

	w.Header().Set("Content-Type", "application/json")

	var dns []models.DNSEntry
	var params = mux.Vars(r)
	network := params["network"]
	dns, err := logic.GetNodeDNS(r.Context(), network)
	if err != nil {
		logger.Log(0, r.Header.Get("user"),
			fmt.Sprintf("failed to get node DNS entries for network [%s]: %v", network, err))
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}
	w.WriteHeader(http.StatusOK)
	json.NewEncoder(w).Encode(dns)
}

// @Summary     Get all DNS entries
// @Router      /api/dns [get]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Success     200 {array} models.DNSEntry
// @Failure     500 {object} models.ErrorResponse
func getAllDNS(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")
	dns, err := logic.GetAllDNS(r.Context())
	if err != nil {
		logger.Log(0, r.Header.Get("user"), "failed to get all DNS entries: ", err.Error())
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}
	logic.SortDNSEntrys(dns[:])
	w.WriteHeader(http.StatusOK)
	json.NewEncoder(w).Encode(dns)
}

// @Summary     Gets custom DNS entries associated with a network
// @Router      /api/dns/adm/{network}/custom [get]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Param       network path string true "Network identifier"
// @Success     200 {array} models.DNSEntry
// @Failure     500 {object} models.ErrorResponse
func getCustomDNS(w http.ResponseWriter, r *http.Request) {

	w.Header().Set("Content-Type", "application/json")

	var dns []models.DNSEntry
	var params = mux.Vars(r)
	network := params["network"]
	dns, err := logic.GetCustomDNS(r.Context(), network)
	if err != nil {
		logger.Log(
			0,
			r.Header.Get("user"),
			fmt.Sprintf(
				"failed to get custom DNS entries for network [%s]: %v",
				network,
				err.Error(),
			),
		)
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}
	w.WriteHeader(http.StatusOK)
	json.NewEncoder(w).Encode(dns)
}

// @Summary     Get all DNS entries associated with the network
// @Router      /api/dns/adm/{network} [get]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Param       network path string true "Network identifier"
// @Success     200 {array} models.DNSEntry
// @Failure     500 {object} models.ErrorResponse
func getDNS(w http.ResponseWriter, r *http.Request) {

	w.Header().Set("Content-Type", "application/json")

	var dns []models.DNSEntry
	var params = mux.Vars(r)
	network := params["network"]
	dns, err := logic.GetDNS(r.Context(), network)
	if err != nil {
		logger.Log(0, r.Header.Get("user"),
			fmt.Sprintf("failed to get all DNS entries for network [%s]: %v", network, err.Error()))
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}
	w.WriteHeader(http.StatusOK)
	json.NewEncoder(w).Encode(dns)
}

// @Summary     Create a new DNS entry
// @Router      /api/dns/{network} [post]
// @Tags        DNS
// @Security    oauth
// @Accept      json
// @Produce     json
// @Param       network path string true "Network identifier"
// @Param       body body models.DNSEntry true "DNS entry details"
// @Success     200 {object} models.DNSEntry
// @Failure     400 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func createDNS(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "application/json")

	var entry models.DNSEntry
	var params = mux.Vars(r)
	netID := params["network"]

	_ = json.NewDecoder(r.Body).Decode(&entry)
	entry.Network = params["network"]

	err := logic.ValidateDNSCreate(r.Context(), entry)
	if err != nil {
		logger.Log(0, r.Header.Get("user"),
			fmt.Sprintf("invalid DNS entry %+v: %v", entry, err))
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "badrequest"))
		return
	}
	entry, err = logic.CreateDNS(r.Context(), entry)
	if err != nil {
		logger.Log(0, r.Header.Get("user"),
			fmt.Sprintf("Failed to create DNS entry %+v: %v", entry, err))
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}

	if logic.GetManageDNS(r.Context()) {
		mq.SendDNSSyncByNetwork(r.Context(), netID)
	}

	logger.Log(1, "new DNS record added:", entry.Name)
	logger.Log(2, r.Header.Get("user"),
		fmt.Sprintf("DNS entry is set: %+v", entry))
	w.WriteHeader(http.StatusOK)
	json.NewEncoder(w).Encode(entry)
}

// @Summary     Delete a DNS entry
// @Router      /api/dns/{network}/{domain} [delete]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Param       network path string true "Network identifier"
// @Param       domain path string true "Domain Name"
// @Success     200 {string} string
// @Failure     500 {object} models.ErrorResponse
func deleteDNS(w http.ResponseWriter, r *http.Request) {
	// Set header
	w.Header().Set("Content-Type", "application/json")

	// get params
	var params = mux.Vars(r)
	domain := params["domain"]
	netID := params["network"]
	entrytext := domain + "." + netID
	domain, _ = strings.CutSuffix(domain, "."+logic.GetServerSettings(r.Context()).DefaultDomain)
	err := logic.DeleteDNS(r.Context(), domain, netID)

	if err != nil {
		logger.Log(0, "failed to delete dns entry: ", entrytext)
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}
	logger.Log(1, "deleted dns entry: ", entrytext)

	if logic.GetManageDNS(r.Context()) {
		mq.SendDNSSyncByNetwork(r.Context(), netID)
	}

	json.NewEncoder(w).Encode(entrytext + " deleted.")

}

// @Summary     Push DNS entries to nameserver
// @Router      /api/dns/adm/pushdns [post]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Success     200 {string} string "DNS Pushed to CoreDNS"
// @Failure     400 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func pushDNS(w http.ResponseWriter, r *http.Request) {
	// Set header
	w.Header().Set("Content-Type", "application/json")
	if !servercfg.IsDNSMode() {
		logic.ReturnErrorResponse(
			w,
			r,
			logic.FormatError(errors.New("DNS Mode is set to off"), "badrequest"),
		)
		return
	}

	// TODO: deprecate API. does nothing.

	logger.Log(1, r.Header.Get("user"), "pushed DNS updates to nameserver")
	json.NewEncoder(w).Encode("DNS Pushed to CoreDNS")
}

// @Summary     Sync DNS entries for a given network
// @Router      /api/dns/adm/{network}/sync [post]
// @Tags        DNS
// @Security    oauth
// @Produce     json
// @Param       network path string true "Network identifier"
// @Success     200 {string} string "DNS Sync completed successfully"
// @Failure     400 {object} models.ErrorResponse
// @Failure     500 {object} models.ErrorResponse
func syncDNS(w http.ResponseWriter, r *http.Request) {
	// Set header
	w.Header().Set("Content-Type", "application/json")
	if !logic.GetManageDNS(r.Context()) {
		logic.ReturnErrorResponse(
			w,
			r,
			logic.FormatError(errors.New("manage DNS is set to false"), "badrequest"),
		)
		return
	}
	var params = mux.Vars(r)
	netID := params["network"]
	k, err := logic.GetDNS(r.Context(), netID)
	if err == nil && len(k) > 0 {
		err = mq.PushSyncDNS(k)
	}

	if err != nil {
		logger.Log(0, r.Header.Get("user"),
			fmt.Sprintf("Failed to Sync DNS entries to network %s: %v", netID, err))
		logic.ReturnErrorResponse(w, r, logic.FormatError(err, "internal"))
		return
	}
	logger.Log(1, r.Header.Get("user"), "DNS Sync complelted successfully")
	json.NewEncoder(w).Encode("DNS Sync completed successfully")
}