6b9c7cf4ae
- Add ValidateFileName (allowlist regex, rejects .. and separators) and apply it to every route that concatenates a raw path segment into a filesystem or remote FTP path: /show/lvgmc-forecast, /show/grib, /grib/binary-chunk, and /debug/file. Previously an unauthenticated caller could read arbitrary files, including /proc/self/environ (leaks LVGMC_PASSWORD/POSTGRES_PASSWORD). - Harden ValidateInt to reject negative integers. - Gate /api/fetch/lvgmc/stations behind ENABLE_LVGMC_FTP_JOBS so it can no longer trigger a real, unauthenticated FTP login regardless of the flag; stop leaking error.getMessage in its response. - Add an explicit /api/* catch-all (NotFound) so an unmatched API route can never fall through to the SPA fallback and be served index.html as a 200. - Cap binary-chunk read length at 64MB to prevent an unbounded allocation.
250 lines
11 KiB
Scala
250 lines
11 KiB
Scala
package server
|
|
|
|
import cats.effect._
|
|
import cats.implicits.toTraverseOps
|
|
import cats.syntax.semigroupk._
|
|
import com.comcast.ip4s.IpLiteralSyntax
|
|
import data.DataService
|
|
import db.PostgresService
|
|
import fetch.csv.FileNameService
|
|
import fetch.lvgmc.{FetchService, WaterTemperatureService}
|
|
import fetch.warnings.WarningService
|
|
import fs2.io.file.{Files, Path}
|
|
import server.ValidateRoutes.{AggFieldList, AggKey, CityList, DateTimeRange, Granularity, ValidateDate, ValidateDateTime, ValidateFileName, ValidateInt, ValidateMonths, ValidateZonedDateTime}
|
|
import org.http4s._
|
|
import org.http4s.dsl.io._
|
|
import org.http4s.implicits._
|
|
import org.http4s.server.{Router, staticcontent}
|
|
import org.http4s.server.middleware.CORS
|
|
import org.http4s.server.middleware.CORSConfig
|
|
import org.http4s.server.staticcontent.FileService
|
|
import org.http4s.ember.server.EmberServerBuilder
|
|
import io.circe.generic.auto._
|
|
import io.circe.syntax._
|
|
import parse.csv.Aggregate.AggregateValueImplicits.aggregateValueEncoder
|
|
import parse.csv.Aggregate.userQueryEncoder
|
|
import parse.csv.Aggregate.{AggregateKey, UserQuery}
|
|
import org.http4s.circe.jsonEncoder
|
|
import org.typelevel.log4cats.Logger
|
|
import org.typelevel.log4cats.slf4j.Slf4jLogger
|
|
import parse.csv.Aggregate
|
|
import org.http4s.headers.`Content-Type`
|
|
|
|
import java.time.{ZoneOffset, ZonedDateTime}
|
|
import scala.concurrent.duration.DurationInt
|
|
|
|
|
|
object Server {
|
|
def of(postgresService: PostgresService, dataService: DataService, fetch: FetchService, warnings: WarningService, waterTemperatures: WaterTemperatureService): IO[Server] = {
|
|
Slf4jLogger.create[IO].map {
|
|
new Server(postgresService, dataService, fetch, warnings, waterTemperatures, _)
|
|
}
|
|
}
|
|
}
|
|
|
|
class Server(postgresService: PostgresService, dataService: DataService, fetch: FetchService, warnings: WarningService, waterTemperatures: WaterTemperatureService, log: Logger[IO]) {
|
|
private case class ResponseWrapper(result: Map[String, Option[Aggregate.AggregateValue]], query: UserQuery)
|
|
private case class LatestTemperature(city: String, observedAt: String, value: Option[Double])
|
|
|
|
private val apiRoutes = HttpRoutes.of[IO] {
|
|
case GET -> Root / "warnings" =>
|
|
warnings.fetchWarnings
|
|
.flatMap(result => Ok(result.asJson))
|
|
.handleErrorWith { error =>
|
|
log.error(error)("Unable to load LVĢMC warnings") *>
|
|
ServiceUnavailable("LVĢMC brīdinājumu dati pašlaik nav pieejami")
|
|
}
|
|
|
|
case GET -> Root / "water-temperatures" =>
|
|
waterTemperatures.fetchWaterTemperatures
|
|
.flatMap(result => Ok(result.asJson))
|
|
.handleErrorWith { error =>
|
|
log.error(error)("Unable to load LVĢMC water temperatures") *>
|
|
ServiceUnavailable("Ūdens temperatūras dati pašlaik nav pieejami")
|
|
}
|
|
|
|
// http://0.0.0.0:8080/api/show/lvgmc-forecast/Latvija_LTV_pilsetas_tekosa_dn.csv
|
|
case GET -> Root / "show" / "lvgmc-forecast" / ValidateFileName(fileName) =>
|
|
fetch.fetchFile(fileName).flatMap(bytes =>
|
|
Ok(bytes).map(_.withContentType(`Content-Type`(MediaType.text.csv)))
|
|
)
|
|
|
|
// http://0.0.0.0:8080/api/fetch/lvgmc/stations
|
|
// Gated behind the same flag as the scheduled FTP task: this route would
|
|
// otherwise let anyone unauthenticated trigger a real LVGMC FTP login on
|
|
// demand, bypassing ENABLE_LVGMC_FTP_JOBS entirely.
|
|
case GET -> Root / "fetch" / "lvgmc" / "stations" =>
|
|
if (sys.env.get("ENABLE_LVGMC_FTP_JOBS").exists(_.equalsIgnoreCase("true")))
|
|
(
|
|
for {
|
|
fileName <- new FileNameService().generateCurrentHour
|
|
stationDataStr <- fetch.fetchWeatherStations()
|
|
_ <- postgresService.save(fileName, stationDataStr)
|
|
} yield stationDataStr
|
|
)
|
|
.flatMap(content => Ok(content))
|
|
.handleErrorWith(error =>
|
|
log.error(error)("Failed to fetch LVGMC stations") *>
|
|
InternalServerError("Failed to fetch stations")
|
|
)
|
|
else
|
|
ServiceUnavailable("LVGMC FTP fetching is currently disabled")
|
|
|
|
// http://0.0.0.0:8080/api/show/grib-all-structure
|
|
case GET -> Root / "show" / "grib-all-structure" =>
|
|
dataService.getAllFileStructure().flatMap(gribList => Ok(gribList.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/show/grib-list
|
|
case GET -> Root / "show" / "grib-list" =>
|
|
dataService.getFileList().flatMap(fileList => Ok(fileList.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/show/grib-name/harmonie_2025-02-01T1500Z_2025-02-01T180000Z.grib
|
|
case GET -> Root / "show" / "grib" / ValidateFileName(fileName) =>
|
|
dataService.getGribStucture(fileName).flatMap(response => Ok(response.asJson))
|
|
|
|
case GET -> Root / "grib" / "binary-chunk" / ValidateInt(binaryOffset) / ValidateInt(binaryLength) / ValidateFileName(fileName) =>
|
|
dataService.getBinaryChunk(binaryOffset, binaryLength, fileName).flatMap(buffer => Ok(buffer))
|
|
|
|
// http://0.0.0.0:8080/api/grib/delete-old-forecasts
|
|
case GET -> Root / "grib" / "delete-old-forecasts" =>
|
|
dataService.deleteOldForecasts().flatMap(result => Ok(result.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/debug/delete-tmp
|
|
case GET -> Root / "debug" / "delete-tmp" =>
|
|
dataService.deleteTmp().flatMap(result => Ok(result.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/debug/time
|
|
case GET -> Root / "debug" / "time" =>
|
|
val nowUTC = ZonedDateTime.now(ZoneOffset.UTC)
|
|
val ageThreshold = nowUTC.minusHours(9)
|
|
Ok(ageThreshold.toString)
|
|
|
|
// http://0.0.0.0:8080/api/debug/folder-structure
|
|
case GET -> Root / "debug" / "folder-structure" =>
|
|
DebugUtils.getFolderStructure.flatMap(response => Ok(response.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/debug/file/error_2025-03-16_152201.txt
|
|
case GET -> Root / "debug" / "file" / ValidateFileName(fileName) =>
|
|
val filePath = Path(s"data/tmp/$fileName")
|
|
|
|
Files[IO].exists(filePath).flatMap {
|
|
case true =>
|
|
Files[IO].readUtf8(filePath)
|
|
.compile
|
|
.string
|
|
.flatMap(content => Ok(content).map(_.withContentType(`Content-Type`(MediaType.text.plain, Charset.`UTF-8`))))
|
|
.handleErrorWith(err => InternalServerError(s"Failed to read file: ${err.getMessage}"))
|
|
case false =>
|
|
NotFound(s"File not found: $fileName")
|
|
}
|
|
|
|
// http://0.0.0.0:8080/api/query/city/Liepāja,Rēzekne/20230414_2200-20230501_1230/hour/tempMax/max
|
|
case GET -> Root / "query" / "city" / CityList(cities) / DateTimeRange(from, to) / Granularity(granularity) / field / AggKey(key) =>
|
|
val userQuery = UserQuery(cities, field, key, granularity, from, to)
|
|
|
|
postgresService.query(userQuery)
|
|
.map(result => ResponseWrapper(result, userQuery))
|
|
.flatMap(responseWrapper => Ok(responseWrapper.asJson))
|
|
|
|
// Latest observation-time temperatures for a fixed production station set.
|
|
case GET -> Root / "query" / "latest-temperatures" / CityList(cities) =>
|
|
postgresService.queryLatestTemperatures(cities)
|
|
.map(_.map { case (city, observedAt, value) => LatestTemperature(city, observedAt.toString, value) })
|
|
.flatMap(result => Ok(result.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/query/city/Kolka/20230414_2200-20230501_1230/allFields
|
|
case GET -> Root / "query" / "city" / (city: String) / DateTimeRange(from, to) / "allFields" =>
|
|
postgresService.queryCityAllFields(city, from, to).flatMap(result => Ok(result.asJson))
|
|
|
|
// http://0.0.0.0:8080/api/query/country/20230414_2200-20230501_1230/tempMax,tempMin,tempAvg,precipitation
|
|
case GET -> Root / "query" / "country" / DateTimeRange(from, to) / AggFieldList(fieldList) =>
|
|
postgresService.queryCountry(from, to, fieldList)
|
|
.flatMap(result => Ok(result.asJson))
|
|
|
|
// // http://0.0.0.0:8080/api/fetch/date/20230514
|
|
// case GET -> Root / "fetch" / "date" / ValidateDate(date) =>
|
|
// val result = for {
|
|
// fetchResultEither <- fetch.fetchFromDate(date).attempt
|
|
// fetchServiceError = fetchResultEither.left.toOption.map(e => s"FetchServiceError: ${e.getMessage}").toList
|
|
// fetchResult = fetchResultEither.getOrElse(List.empty)
|
|
// (fetchErrors, successDownloads) = fetchResult.partitionMap(identity)
|
|
// _ <- log.info(s"FETCHED SUCCESSFULLY files: ${successDownloads.size}")
|
|
// saveResults <- successDownloads.traverse { case (name, content) => postgresService.save(name, content).attempt }
|
|
// (saveErrors, successSaves) = saveResults.partitionMap(identity)
|
|
//// successes = successDownloads.map(s => s"fetched: ${s._1}") ++ successSaves.map(s => s"saved: $s")
|
|
// successes = successSaves
|
|
// errors = fetchServiceError ++ fetchErrors.map(e => s"FetchError: ${e.getMessage}") ++ saveErrors.map(e => s"SaveError: ${e.getMessage}")
|
|
// _ <- log.error(s"errors: $errors")
|
|
// _ <- log.info(s"successes: $successes")
|
|
// } yield (successes, errors)
|
|
//
|
|
// result.flatMap { case (successes, errors) =>
|
|
// Ok(Json.obj(
|
|
// "errors" -> errors.asJson,
|
|
// "successes" -> successes.asJson
|
|
// ).pretty)
|
|
// }
|
|
|
|
// http://0.0.0.0:8080/api/show/months/202304,202305,202306
|
|
case GET -> Root / "show" / "months" / ValidateMonths(monthList) =>
|
|
postgresService.getDatesByMonths(monthList).flatMap(dates =>
|
|
Ok(dates.asJson)
|
|
)
|
|
|
|
// http://0.0.0.0:8080/api/show/date/20230423
|
|
case GET -> Root / "show" / "date" / ValidateDate(date) =>
|
|
postgresService.getDateFileNames(date).flatMap(fileNames =>
|
|
Ok(fileNames.asJson)
|
|
)
|
|
|
|
// http://0.0.0.0:8080/api/show/datetime/20230423_1300
|
|
case GET -> Root / "show" / "datetime" / ValidateDateTime(datetime) =>
|
|
postgresService.getDateTimeEntries(datetime).flatMap(content => Ok(content.asJson))
|
|
|
|
// Explicit catch-all: guarantees every /api/* request resolves inside
|
|
// this route set (never falls through to the SPA fallback below and
|
|
// gets served index.html as a false 200).
|
|
case _ =>
|
|
NotFound()
|
|
}
|
|
|
|
private val corsConfig = CORSConfig.default
|
|
.withAnyOrigin(true)
|
|
.withAnyMethod(true)
|
|
.withAllowedMethods(Some(Set(Method.GET, Method.POST)))
|
|
.withAllowCredentials(false)
|
|
.withMaxAge(1.day)
|
|
|
|
private val apiRoutesCors = CORS(apiRoutes, corsConfig)
|
|
|
|
// Real files (JS/CSS/images/favicon) are served as-is; anything else falls
|
|
// back to index.html so the SolidJS router can handle it client-side. This
|
|
// replaces an explicit per-route list that silently 404ed on a direct hit
|
|
// (e.g. a browser refresh) for any client-side route not on the list —
|
|
// real, observed on /faktiska and /udens-temperatura in production.
|
|
private val assets = staticcontent.fileService[IO](FileService.Config("./web/dist"))
|
|
private val spaFallback = HttpRoutes.of[IO] {
|
|
// A missing file under /assets (the only place Vite emits hashed build
|
|
// output) should stay a real 404, not silently serve HTML — otherwise a
|
|
// stale tab referencing a since-removed bundle after a future deploy
|
|
// would get a confusing "unexpected token" JS parse error instead.
|
|
case GET -> Root / "assets" / _ => NotFound()
|
|
case req @ GET -> _ =>
|
|
StaticFile.fromPath(Path("./web/dist/index.html"), Some(req)).getOrElseF(NotFound())
|
|
}
|
|
|
|
private val httpApp = Router(
|
|
"/api" -> apiRoutesCors,
|
|
"/" -> (assets <+> spaFallback),
|
|
).orNotFound
|
|
|
|
def run: IO[ExitCode] =
|
|
EmberServerBuilder
|
|
.default[IO]
|
|
.withHost(ipv4"0.0.0.0")
|
|
.withPort(port"8080")
|
|
.withHttpApp(httpApp)
|
|
.build
|
|
.useForever
|
|
}
|