3 files changed, 117 insertions, 6 deletions

diff --git a/web/config.go b/web/config.go
index 2479e38..acdc4bf 100644
--- a/web/config.go
+++ b/web/config.go
@@ -1,6 +1,7 @@
 package web
 
 import (
+        "crypto/subtle"
         "encoding/json"
         "io/ioutil"
         "strings"
@@ -10,12 +11,13 @@ import (
 )
 
 type ServerConfig struct {
-        BindConfig     *bind.BINDConfig
-        DNSClient      *dns.DNSClient
-        AcmeView       string
-        DynamicDnsView string
-        DDNSSecrets    map[string]string         `json:"DDNS"`
-        AcmeSecrets    map[string]map[string]int `json:"ACME"`
+        BindConfig       *bind.BINDConfig
+        DNSClient        *dns.DNSClient
+        AcmeView         string
+        DynamicDnsView   string
+        DDNSSecrets      map[string]string         `json:"DDNS"`
+        AcmeSecrets      map[string]map[string]int `json:"ACME"`
+        DNSManageSecrets map[string]string         `json:"DNS_MANAGE"`
 }
 
 func LoadServerConfig(zonesFile, secretsFile, server, view string) (*ServerConfig, error) {
@@ -53,6 +55,14 @@ func (s *ServerConfig) AcmeSecretExists(k string) bool {
         return ok
 }
 
+func (s *ServerConfig) DNSUserAuth(u, p string) bool {
+        cp, ok := s.DNSManageSecrets[u]
+        if !ok {
+                return false
+        }
+        return subtle.ConstantTimeCompare([]byte(p), []byte(cp)) == 1
+}
+
 func (s *ServerConfig) IsAcmeClientAllowed(key, zone string) bool {
         u, ok := s.AcmeSecrets[key]
         if !ok {
diff --git a/web/controllers/dns_manage.go b/web/controllers/dns_manage.go
new file mode 100644
index 0000000..6db0b13
--- /dev/null
+++ b/web/controllers/dns_manage.go
@@ -0,0 +1,68 @@
+package controllers
+
+import (
+        "net/http"
+
+        "github.com/gin-gonic/gin"
+        "github.com/miekg/dns"
+
+        "code.crute.me/mcrute/go_ddns_manager/bind"
+        "code.crute.me/mcrute/go_ddns_manager/util"
+        "code.crute.me/mcrute/go_ddns_manager/web/middleware"
+)
+
+func DnsManageRoot(c *gin.Context) {
+        c.IndentedJSON(http.StatusOK, gin.H{
+                "_rels": gin.H{
+                        "zones": util.MakeURL(c.Request, "/dns/zone").String(),
+                        "views": util.MakeURL(c.Request, "/dns/view").String(),
+                },
+        })
+}
+
+func DnsViews(c *gin.Context) {
+        cfg := middleware.GetServerConfig(c)
+        out := map[string]map[string]string{}
+
+        for _, v := range cfg.BindConfig.Views() {
+                k := map[string]string{}
+                out[v] = k
+                for _, z := range cfg.BindConfig.ZonesInView(v) {
+                        zn := bind.DeCanonicalize(z.Name)
+                        k[zn] = util.MakeURL(c.Request, "/dns/zone/%s/%s", v, zn).String()
+                }
+        }
+
+        c.IndentedJSON(http.StatusOK, gin.H{"views": out})
+}
+
+func DnsZones(c *gin.Context) {
+
+}
+
+func DnsZoneDetails(c *gin.Context) {
+        cfg := middleware.GetServerConfig(c)
+
+        z := cfg.BindConfig.Zone(c.Param("view"), c.Param("name"))
+        if z == nil {
+                c.JSON(http.StatusNotFound, gin.H{
+                        "error": "Zone not found",
+                })
+                return
+        }
+
+        envs := []*dns.Envelope{}
+        ec, err := cfg.DNSClient.AXFR(z)
+        if err != nil {
+                c.JSON(http.StatusInternalServerError, gin.H{
+                        "error": err.Error(),
+                })
+                return
+        }
+
+        for e := range ec {
+                envs = append(envs, e)
+        }
+
+        c.JSON(http.StatusOK, envs)
+}
diff --git a/web/middleware/dns_manage.go b/web/middleware/dns_manage.go
new file mode 100644
index 0000000..d3b420b
--- /dev/null
+++ b/web/middleware/dns_manage.go
@@ -0,0 +1,33 @@
+package middleware
+
+import (
+        "net/http"
+
+        "github.com/gin-gonic/gin"
+)
+
+const dnsUserId = "DNSManageUserID"
+
+func DnsManageAuthMiddleware(c *gin.Context) {
+        cfg := GetServerConfig(c)
+
+        user, pwd, ok := c.Request.BasicAuth()
+        if !ok {
+                c.Request.Header.Set("WWW-Authenticate", `Basic realm="closed site"`)
+                c.AbortWithStatus(http.StatusUnauthorized)
+                return
+        }
+
+        if !cfg.DNSUserAuth(user, pwd) {
+                c.AbortWithStatus(http.StatusForbidden)
+                return
+        } else {
+                c.Set(dnsUserId, user)
+        }
+
+        c.Next()
+}
+
+func GetDnsAuthContext(c *gin.Context) string {
+        return c.GetString(dnsUserId)
+}