Reverse Proxy

package config

import (
	"fmt"
	"net/url"

	sharedconfig "github.com/hoa-platform/backend/pkg/config"
)

type rawConfig struct {
	Port           string `env:"GATEWAY_PORT" env-default:"8080"`
	UserServiceURL string `env:"USER_SERVICE_URL" env-required:"true"`
	AuthServiceURL string `env:"AUTH_SERVICE_URL" env-required:"true"`
}

type Upstreams struct {
	User *url.URL
	Auth *url.URL
}

type Config struct {
	Port      string
	Upstreams Upstreams
}

func Load() (Config, error) {
	var raw rawConfig
	if err := sharedconfig.Load(&raw); err != nil {
		return Config{}, err
	}
	user, err := parseUpstream("USER_SERVICE_URL", raw.UserServiceURL)
	if err != nil {
		return Config{}, err
	}
	auth, err := parseUpstream("AUTH_SERVICE_URL", raw.AuthServiceURL)
	if err != nil {
		return Config{}, err
	}
	return Config{Port: raw.Port, Upstreams: Upstreams{User: user, Auth: auth}}, nil
}

func parseUpstream(key, raw string) (*url.URL, error) {
	target, err := url.ParseRequestURI(raw)
	if err != nil || target.Host == "" {
		return nil, fmt.Errorf("%s must be an absolute HTTP URL", key)
	}
	if target.Scheme != "http" && target.Scheme != "https" {
		return nil, fmt.Errorf("%s uses unsupported scheme %q", key, target.Scheme)
	}
	if target.User != nil {
		return nil, fmt.Errorf("%s must not contain credentials", key)
	}
	return target, nil
}

package proxy

import (
	"net/http"
	"net/http/httputil"
	"net/url"

	"github.com/rs/zerolog"
)

// Route is one entry in the gateway's static routing table: any request
// whose path starts with Prefix is forwarded to Target.
type Route struct {
	Prefix string
	Target *url.URL
}

// New builds a single http.Handler that dispatches to whichever backend a
// request's path prefix matches, returning 404 for anything unrecognized
// rather than silently forwarding to a default.
func New(routes []Route, logger zerolog.Logger) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		for _, route := range routes {
			if hasPrefix(r.URL.Path, route.Prefix) {
				newReverseProxy(route.Target, logger).ServeHTTP(w, r)
				return
			}
		}
		http.NotFound(w, r)
	})
}

func hasPrefix(path, prefix string) bool {
	return len(path) >= len(prefix) && path[:len(prefix)] == prefix
}

func newReverseProxy(target *url.URL, logger zerolog.Logger) *httputil.ReverseProxy {
	proxy := httputil.NewSingleHostReverseProxy(target)

	originalDirector := proxy.Director
	proxy.Director = func(req *http.Request) {
		originalDirector(req)
		// X-Forwarded-Host preserves what the client actually requested,
		// since req.Host is about to be rewritten to the backend's own host.
		req.Header.Set("X-Forwarded-Host", req.Host)
	}

	// Without a custom ErrorHandler, a backend that is down or unreachable
	// produces a bare connection-reset with no response body at all — the
	// worst possible experience for a client that just gets nothing back.
	proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
		logger.Error().
			Str("target", target.String()).
			Str("path", r.URL.Path).
			Err(err).
			Msg("upstream unreachable")
		w.Header().Set("Content-Type", "application/json")
		w.WriteHeader(http.StatusBadGateway)
		w.Write([]byte(`{"error":"upstream_unavailable","message":"the requested service is temporarily unreachable"}`))
	}

	return proxy
}

cfg, err := config.Load()
if err != nil {
	logger.Error().Err(err).Msg("gateway config invalid")
	os.Exit(1)
}

routes := []proxy.Route{
	{Prefix: "/api/v1/auth", Target: cfg.Upstreams.Auth},
	{Prefix: "/api/v1/users", Target: cfg.Upstreams.User},
	{Prefix: "/api/v1/memberships", Target: cfg.Upstreams.User},
}

engine := gin.New()
engine.Use(gin.Recovery())
engine.GET("/healthz", healthHandler)
engine.NoRoute(gin.WrapH(proxy.New(routes, logger)))

http.ListenAndServe(":"+cfg.Port, engine)