Add post method handler into backend

Author: mjudeikis

backend/http/handler.go

@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	htmltemplate "html/template"
 	"net/http"
 	"net/url"
 	"strings"
@@ -42,15 +41,10 @@ import (
 	"github.com/kube-bind/kube-bind/backend/kubernetes/resources"
 	"github.com/kube-bind/kube-bind/backend/session"
 	"github.com/kube-bind/kube-bind/backend/spaserver"
-	"github.com/kube-bind/kube-bind/backend/template"
 	bindversion "github.com/kube-bind/kube-bind/pkg/version"
 	kubebindv1alpha2 "github.com/kube-bind/kube-bind/sdk/apis/kubebind/v1alpha2"
 )
 
-var (
-	resourcesTemplate = htmltemplate.Must(htmltemplate.New("resource").Parse(mustRead(template.Files.ReadFile, "resources.gohtml")))
-)
-
 // See https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching?hl=en
 var noCacheHeaders = map[string]string{
 	"Expires":         time.Unix(0, 0).Format(time.RFC1123),
@@ -105,20 +99,23 @@ func NewHandler(
 func (h *handler) AddRoutes(mux *mux.Router) {
 	// API routes - Server contains double routes for when backend is multi-cluster aware or single cluster.
 	// When called multi-cluster aware route in single cluster mode, it will ignore cluster parameter.
-	mux.HandleFunc("/api/clusters/{cluster}/exports", h.handleServiceExport).Methods("GET")
-	mux.HandleFunc("/api/exports", h.handleServiceExport).Methods("GET")
+	mux.HandleFunc("/api/clusters/{cluster}/exports", h.handleServiceExport).Methods(http.MethodGet)
+	mux.HandleFunc("/api/exports", h.handleServiceExport).Methods(http.MethodGet)
+
+	mux.HandleFunc("/api/clusters/{cluster}/resources", h.handleResources).Methods(http.MethodGet)
+	mux.HandleFunc("/api/resources", h.handleResources).Methods(http.MethodGet)
 
-	mux.HandleFunc("/api/clusters/{cluster}/resources", h.handleResources).Methods("GET")
-	mux.HandleFunc("/api/resources", h.handleResources).Methods("GET")
+	mux.HandleFunc("/api/clusters/{cluster}/bind", h.handleBind).Methods(http.MethodGet)
+	mux.HandleFunc("/api/bind", h.handleBind).Methods(http.MethodGet)
 
-	mux.HandleFunc("/api/clusters/{cluster}/bind", h.handleBind).Methods("GET")
-	mux.HandleFunc("/api/bind", h.handleBind).Methods("GET")
+	mux.HandleFunc("/api/clusters/{cluster}/bind", h.handleBindPost).Methods(http.MethodPost)
+	mux.HandleFunc("/api/bind", h.handleBindPost).Methods(http.MethodPost)
 
-	mux.HandleFunc("/api/clusters/{cluster}/authorize", h.handleAuthorize).Methods("GET")
-	mux.HandleFunc("/api/authorize", h.handleAuthorize).Methods("GET")
+	mux.HandleFunc("/api/clusters/{cluster}/authorize", h.handleAuthorize).Methods(http.MethodGet)
+	mux.HandleFunc("/api/authorize", h.handleAuthorize).Methods(http.MethodGet)
 
-	mux.HandleFunc("/api/callback", h.handleCallback).Methods("GET")
-	mux.HandleFunc("/api/healthz", h.handleHealthz).Methods("GET")
+	mux.HandleFunc("/api/callback", h.handleCallback).Methods(http.MethodGet)
+	mux.HandleFunc("/api/healthz", h.handleHealthz).Methods(http.MethodGet)
 
 	if strings.HasPrefix(h.frontend, "http://") {
 		spaserver, err := spaserver.NewSPAReverseProxyServer(h.frontend)
@@ -523,12 +520,149 @@ func (h *handler) handleBind(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, parsedAuthURL.String(), http.StatusFound)
 }
 
-func mustRead(f func(name string) ([]byte, error), name string) string {
-	bs, err := f(name)
+func (h *handler) handleBindPost(w http.ResponseWriter, r *http.Request) {
+	logger := getLogger(r)
+	providerCluster := mux.Vars(r)["cluster"]
+
+	prepareNoCache(w)
+
+	// Get session ID from query parameter
+	sessionID := r.URL.Query().Get("s")
+	if sessionID == "" {
+		logger.Error(errors.New("missing session parameter"), "failed to get session from query")
+		http.Error(w, "missing session parameter 's'", http.StatusBadRequest)
+		return
+	}
+
+	// Get session cookie
+	ck, err := r.Cookie(sessionID)
+	if err != nil {
+		logger.Error(err, "failed to get session cookie")
+		http.Error(w, "no session cookie found", http.StatusBadRequest)
+		return
+	}
+
+	// Decode session state
+	state := session.State{}
+	s := securecookie.New(h.cookieSigningKey, h.cookieEncryptionKey)
+	if err := s.Decode(sessionID, ck.Value, &state); err != nil {
+		logger.Error(err, "failed to decode session cookie")
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	// Parse JSON request body
+	var bindRequest kubebindv1alpha2.BindableResourcesRequest
+	if err := json.NewDecoder(r.Body).Decode(&bindRequest); err != nil {
+		logger.Error(err, "failed to parse JSON request body")
+		http.Error(w, "invalid JSON request body", http.StatusBadRequest)
+		return
+	}
+
+	logger.V(1).Info("received bind request", "resources", len(bindRequest.Resources), "permissionClaims", len(bindRequest.PermissionClaims))
+
+	// Validate request
+	if len(bindRequest.Resources) == 0 {
+		logger.Error(errors.New("no resources specified"), "validation failed")
+		http.Error(w, "at least one resource must be specified", http.StatusBadRequest)
+		return
+	}
+
+	// Handle kubeconfig setup
+	kfg, err := h.kubeManager.HandleResources(r.Context(), state.Token.Subject+"#"+state.ClusterID, providerCluster)
+	if err != nil {
+		logger.Error(err, "failed to handle resources")
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	// Create API service export requests for each resource
+	var requests []runtime.RawExtension
+	for _, bindableResource := range bindRequest.Resources {
+		exportRequest := kubebindv1alpha2.APIServiceExportRequestResponse{
+			TypeMeta: metav1.TypeMeta{
+				APIVersion: kubebindv1alpha2.SchemeGroupVersion.String(),
+				Kind:       "APIServiceExportRequest",
+			},
+			ObjectMeta: kubebindv1alpha2.NameObjectMeta{
+				Name: bindableResource.Resource + "." + bindableResource.Group,
+			},
+			Spec: kubebindv1alpha2.APIServiceExportRequestSpec{
+				Resources: []kubebindv1alpha2.APIServiceExportRequestResource{
+					{
+						GroupResource: kubebindv1alpha2.GroupResource{
+							Group:    bindableResource.Group,
+							Resource: bindableResource.Resource,
+						},
+						Versions: []string{bindableResource.APIVersion},
+					},
+				},
+			},
+		}
+
+		requestBytes, err := json.Marshal(&exportRequest)
+		if err != nil {
+			logger.Error(err, "failed to marshal export request", "resource", bindableResource.Resource)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+
+		requests = append(requests, runtime.RawExtension{Raw: requestBytes})
+	}
+
+	// Create binding response
+	response := kubebindv1alpha2.BindingResponse{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: kubebindv1alpha2.SchemeGroupVersion.String(),
+			Kind:       "BindingResponse",
+		},
+		Authentication: kubebindv1alpha2.BindingResponseAuthentication{
+			OAuth2CodeGrant: &kubebindv1alpha2.BindingResponseAuthenticationOAuth2CodeGrant{
+				SessionID: state.SessionID,
+				ID:        state.Token.Issuer + "/" + state.Token.Subject,
+			},
+		},
+		Kubeconfig: kfg,
+		Requests:   requests,
+	}
+
+	payload, err := json.Marshal(&response)
 	if err != nil {
-		panic(err)
+		logger.Error(err, "failed to marshal binding response")
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	encoded := base64.URLEncoding.EncodeToString(payload)
+
+	parsedAuthURL, err := url.Parse(state.RedirectURL)
+	if err != nil {
+		logger.Error(err, "failed to parse redirect URL")
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	values := parsedAuthURL.Query()
+	values.Add("response", encoded)
+
+	parsedAuthURL.RawQuery = values.Encode()
+
+	logger.V(1).Info("redirecting to auth callback after POST bind",
+		"url", state.RedirectURL+"?response=<redacted>",
+		"resourceCount", len(bindRequest.Resources))
+
+	// For POST requests, we can either redirect or return JSON response
+	// Since this is called from frontend JavaScript, return the redirect URL as JSON
+	w.Header().Set("Content-Type", "application/json")
+	redirectResponse := map[string]string{
+		"redirectURL": parsedAuthURL.String(),
+	}
+
+	if err := json.NewEncoder(w).Encode(redirectResponse); err != nil {
+		logger.Error(err, "failed to encode redirect response")
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
 	}
-	return string(bs)
 }
 
 func (h *handler) getBackendDynamicResource(ctx context.Context, cluster string) (kubebindv1alpha2.ExportedSchemas, error) {

sdk/apis/kubebind/v1alpha2/bindingresponse_types.go

@@ -85,6 +85,7 @@ type BindableResourcesResponse struct {
 	Resources []BindableResource `json:"resources"`
 }
 
+// BindableResource describes a resource that the user can select to bind to.
 type BindableResource struct {
 	// name is the name of the resource.
 	//
@@ -128,9 +129,30 @@ type BindableResource struct {
 	Resource string `json:"resource"`
 
 	// sessionID is a session ID that the consumer must pass back to the service provider
-	// during the binding step.
+	// during the binding step. If multiple backends are aggregated, this can be used to
+	// to authenticate the user to the correct backend.
 	//
 	// +required
 	// +kubebuilder:validation:Required
 	SessionID string `json:"sessionID"`
 }
+
+// BindableResourcesRequest is sent by the consumer to the service provider
+// to indicate which resources the user wants to bind to. It is sent after
+// authentication and resource selection on the service provider website.
+type BindableResourcesRequest struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// resources is a list of resources that the user can select from.
+	//
+	// +required
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinItems=1
+	Resources []BindableResource `json:"resources"`
+
+	// PermissionClaims are additional permissions that the user wants to have.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	PermissionClaims []PermissionClaim `json:"permissionClaims,omitempty"`
+}

web/src/services/auth.ts

@@ -6,6 +6,28 @@ export interface SessionInfo {
   isAuthenticated: boolean
 }
 
+export interface BindableResource {
+  name: string
+  kind: string
+  scope: string
+  apiVersion: string
+  group: string
+  resource: string
+  sessionID: string
+}
+
+export interface PermissionClaim {
+  // Add permission claim properties as needed
+  [key: string]: any
+}
+
+export interface BindableResourcesRequest {
+  apiVersion: string
+  kind: string
+  resources: BindableResource[]
+  permissionClaims?: PermissionClaim[]
+}
+
 class AuthService {
   private sessionInfo: SessionInfo | null = null
 
@@ -95,17 +117,14 @@ class AuthService {
     }
   }
 
-  async bindResource(group: string, resource: string, version: string, clusterId: string = ''): Promise<void> {
+  async bindResource(group: string, resource: string, version: string, clusterId: string = ''): Promise<any> {
     try {
       const sessionCookie = this.getSessionCookie()
       if (!sessionCookie) {
         throw new Error('No session found')
       }
 
-      // Use cluster-aware endpoint if clusterId is provided
-      const bindPath = clusterId ? `/api/clusters/${clusterId}/bind` : '/api/bind'
-      const bindUrl = `${bindPath}?group=${group}&resource=${resource}&version=${version}&s=${sessionCookie}`
-      window.location.href = bindUrl
+      return this.bindResourceWithSession(group, resource, version, clusterId, sessionCookie)
     } catch (error) {
       console.error('Failed to bind resource:', error)
       throw error
@@ -140,14 +159,51 @@ class AuthService {
     }
   }
 
-  async bindResourceWithSession(group: string, resource: string, version: string, clusterId: string = '', sessionId: string): Promise<void> {
+  async bindResourceWithSession(group: string, resource: string, version: string, clusterId: string = '', sessionId: string, scope: string = 'Namespaced', kind: string = '', name: string = ''): Promise<any> {
     try {
+      console.log('🔗 Binding resource with POST request')
+      console.log('📋 Resource details:', { group, resource, version, clusterId, sessionId })
+      
       // Use cluster-aware endpoint if clusterId is provided
       const bindPath = clusterId ? `/api/clusters/${clusterId}/bind` : '/api/bind'
-      const bindUrl = `${bindPath}?group=${group}&resource=${resource}&version=${version}&s=${sessionId}`
-      window.location.href = bindUrl
-    } catch (error) {
-      console.error('Failed to bind resource with session:', error)
+      const bindUrl = `${bindPath}?s=${sessionId}`
+      
+      console.log('🌐 POST request to:', bindUrl)
+      
+      // Create the BindableResourcesRequest payload
+      const requestPayload: BindableResourcesRequest = {
+        apiVersion: 'kubebind.io/v1alpha2',
+        kind: 'BindableResourcesRequest',
+        resources: [{
+          name: name || `${resource}.${group || 'core'}`,
+          kind: kind || resource,
+          scope: scope,
+          apiVersion: version,
+          group: group || '',
+          resource: resource,
+          sessionID: sessionId
+        }],
+        permissionClaims: []
+      }
+      
+      console.log('📦 Request payload:', requestPayload)
+      
+      const response = await axios.post(bindUrl, requestPayload, {
+        headers: {
+          'Content-Type': 'application/json'
+        }
+      })
+      
+      console.log('✅ Bind response status:', response.status)
+      console.log('📦 Bind response data:', response.data)
+      
+      return response.data
+    } catch (error: any) {
+      console.error('❌ Failed to bind resource with session:', error)
+      if (error.response) {
+        console.error('📄 Error Response Status:', error.response.status)
+        console.error('📄 Error Response Data:', error.response.data)
+      }
       throw error
     }
   }