Files
Agent-System/internal/server/admin_template_handlers.go
weichenandCursor f6813cc272 feat(api): add additive HTTP/SSE error envelopes
Public errors now emit code, safe message, and request_id while keeping the legacy error field. Raw SQL, paths, tokens, and XSS payloads are stripped; the frontend branches on code instead of substring matching.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-15 14:40:56 +00:00

92 lines
2.6 KiB
Go

package server
import (
"errors"
"io"
"net/http"
"strings"
"chat-agent-system/internal/workflowdef"
)
func (s *Server) handleAdminTemplates(w http.ResponseWriter, r *http.Request) {
user, ok := s.requireWorkflowAdmin(w, r)
if !ok {
return
}
switch r.Method {
case http.MethodGet:
assets, err := s.wfDefSvc.ListTemplates(r.Context())
if err != nil {
writeSafeError(w, r, http.StatusInternalServerError, err.Error())
return
}
writeJSONResponse(w, http.StatusOK, map[string]any{"templates": assets})
case http.MethodPost:
if err := r.ParseMultipartForm(defaultUploadBodyLimit); err != nil {
if isRequestBodyTooLarge(err) {
writeSafeError(w, r, http.StatusRequestEntityTooLarge, "upload too large")
return
}
writeSafeError(w, r, http.StatusBadRequest, "invalid multipart")
return
}
assetKey := strings.TrimSpace(r.FormValue("asset_key"))
name := strings.TrimSpace(r.FormValue("name"))
if assetKey == "" {
assetKey = strings.TrimSpace(r.FormValue("key"))
}
if name == "" {
name = assetKey
}
file, header, err := r.FormFile("file")
if err != nil || assetKey == "" {
writeSafeError(w, r, http.StatusBadRequest, "asset_key and file required")
return
}
defer file.Close()
data, err := io.ReadAll(io.LimitReader(file, 32<<20))
if err != nil {
writeSafeError(w, r, http.StatusBadRequest, "read file failed")
return
}
tv, err := s.wfDefSvc.UploadTemplate(r.Context(), assetKey, name, data, header.Filename, user.ID)
if err != nil {
status := http.StatusBadRequest
switch {
case errors.Is(err, workflowdef.ErrUploadRejected):
status = http.StatusUnsupportedMediaType
case errors.Is(err, workflowdef.ErrNotAvailable):
status = http.StatusServiceUnavailable
}
writeSafeError(w, r, status, err.Error())
return
}
writeJSONResponse(w, http.StatusCreated, tv)
default:
writeSafeError(w, r, http.StatusMethodNotAllowed, "method not allowed")
}
}
func (s *Server) handleAdminTemplateVersions(w http.ResponseWriter, r *http.Request) {
if _, ok := s.requireWorkflowAdmin(w, r); !ok {
return
}
if r.Method != http.MethodGet {
writeSafeError(w, r, http.StatusMethodNotAllowed, "method not allowed")
return
}
assetKey := strings.TrimSpace(r.PathValue("key"))
if assetKey == "" {
writeSafeError(w, r, http.StatusBadRequest, "invalid asset key")
return
}
versions, err := s.wfDefSvc.ListTemplateVersions(r.Context(), assetKey)
if err != nil {
writeSafeError(w, r, http.StatusInternalServerError, err.Error())
return
}
writeJSONResponse(w, http.StatusOK, map[string]any{"versions": versions})
}