Rebuild API Server on the PilotVault structure

Mirror PilotVault's API Server layout and add the superadmin console, plugin system, runtime PocketBase settings, and user/organization management. The car domain (cars, service records, parts, sharing) is carried over unchanged apart from the auth switch. Layout: main.go -> cmd/server/main.go; module carcontrol/api -> drivervault/apiserver. internal/api is split by concern (auth, users, orgs, settings, plugins, status, health, respond). Auth: replace the server-minted HS256 JWT and the sessions collection with a PocketBase token proxy. /api/auth/login relays PocketBase's {token, record}, and every protected request re-resolves that token against PocketBase, so a role change or deletion takes effect at once instead of waiting out a token. AUTH_SECRET is obsolete and internal/auth is gone. Per-device session listing/revocation goes with it: PocketBase tokens are stateless. Changing a password rotates the user's token key, which invalidates every token already issued. Roles: add superadmin alongside user/admin, plus an organizations collection and users.organization. Admins are scoped to their own organization; superadmins span all of them. Guards prevent changing your own role, deleting your own account, an admin touching a superadmin, and deleting an organization that still has members. Plugins: new internal/plugins package with one contract over two kinds -- builtin (compiled in) and external (any HTTP service, registered at runtime with no rebuild). State persists to plugins.json; secrets are masked on read and preserved when saved back at the mask. PocketBase settings: /api/admin/pb-config applies a new connection at runtime and persists it to .env. It deliberately does not require a working service account, so a wrong or unreachable connection can still be fixed from the panel. Panel: rebuilt as the superadmin console -- login gate, status, users, organizations, PocketBase, plugins, and the endpoint reference. Clients: update the Web App and Phone App for the PocketBase token shape, the move of user management to /api/users ({users}/{user} envelopes, with password resets folded into PATCH), and the removal of sessions. Both now mirror the server's real guards rather than the old last-admin rule, and parse PocketBase's field-level error shape. Config: modern POCKETBASE_*/API_ADDR names with legacy PB_*/PORT fallbacks, so existing .env files keep working. Also fixes /api/status probing the Web App on 8090 instead of DriverVault's 5173. Run scripts/setup-pocketbase.mjs to add the organizations collection and grow users.role; every client must log in once more. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-16 22:29:45 +02:00
parent 7d55f0a4cd
commit ae6ed4ac1e
56 changed files with 4474 additions and 1475 deletions
@@ -0,0 +1,80 @@
+// Command server runs the DriverVault API Server. It is the single gateway
+// between clients (web app, phone app, Home Assistant plugin, ESP32 device) and
+// the PocketBase database kept behind it — clients never talk to PocketBase
+// directly. It also serves the superadmin web panel at the server root.
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"drivervault/apiserver/internal/api"
+	"drivervault/apiserver/internal/config"
+	"drivervault/apiserver/internal/pb"
+)
+
+func main() {
+	log.SetFlags(log.LstdFlags | log.Lmsgprefix)
+	log.SetPrefix("[api] ")
+
+	cfg := config.Load()
+
+	client := pb.New(cfg.PocketBaseURL, cfg.PocketBaseAdminEmail, cfg.PocketBaseAdminPassword)
+
+	// Authenticate the service account up front so the first request doesn't pay
+	// for it. A failure is NOT fatal: the PocketBase connection is editable at
+	// runtime from the panel, so a superadmin must be able to log in and fix a
+	// bad address or bad credentials.
+	if cfg.AdminConfigured() {
+		authCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		if err := client.Authenticate(authCtx); err != nil {
+			log.Printf("WARNING: PocketBase service account auth failed (%s): %v", cfg.PocketBaseURL, err)
+			log.Printf("fix it under Settings → PocketBase in the panel at %s", cfg.Addr)
+		} else {
+			log.Printf("authenticated to PocketBase at %s", cfg.PocketBaseURL)
+		}
+		cancel()
+	} else {
+		log.Println("WARNING: POCKETBASE_ADMIN_EMAIL/PASSWORD unset — management endpoints return 503 until configured")
+	}
+
+	srv := api.New(cfg, client)
+
+	if err := srv.StartPlugins(); err != nil {
+		log.Printf("plugins: load failed: %v", err)
+	}
+
+	httpServer := &http.Server{
+		Addr:              cfg.Addr,
+		Handler:           srv.Handler(),
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       60 * time.Second,
+	}
+
+	go func() {
+		log.Printf("listening on %s (PocketBase: %s, panel at /)", cfg.Addr, cfg.PocketBaseURL)
+		if err := httpServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Fatalf("server error: %v", err)
+		}
+	}()
+
+	// Graceful shutdown on SIGINT/SIGTERM.
+	stop := make(chan os.Signal, 1)
+	signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
+	<-stop
+	log.Println("shutting down...")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	srv.Stop(ctx)
+	if err := httpServer.Shutdown(ctx); err != nil {
+		log.Printf("shutdown error: %v", err)
+	}
+	log.Println("stopped")
+}