Files
Agent-System/internal/server/admin_template_handlers.go
T
weichenandCursor 6bc238c665 feat(upload): reuse MIME validator for workflow template uploads.
Centralize template extension, magic-byte, and HTML/script rejection in upload.ValidateTemplate so admin template POST matches project asset hardening.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:23 +00:00

92 lines
2.5 KiB
Go

package server
import (
"errors"
"io"
"net/http"
"strings"
"chat-agent-system/internal/workflowdef"
)
func (s *Server) handleAdminTemplates(w http.ResponseWriter, r *http.Request) {
user, ok := s.requireWorkflowAdmin(w, r)
if !ok {
return
}
switch r.Method {
case http.MethodGet:
assets, err := s.wfDefSvc.ListTemplates(r.Context())
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
writeJSONResponse(w, http.StatusOK, map[string]any{"templates": assets})
case http.MethodPost:
if err := r.ParseMultipartForm(defaultUploadBodyLimit); err != nil {
if isRequestBodyTooLarge(err) {
http.Error(w, "upload too large", http.StatusRequestEntityTooLarge)
return
}
http.Error(w, "invalid multipart", http.StatusBadRequest)
return
}
assetKey := strings.TrimSpace(r.FormValue("asset_key"))
name := strings.TrimSpace(r.FormValue("name"))
if assetKey == "" {
assetKey = strings.TrimSpace(r.FormValue("key"))
}
if name == "" {
name = assetKey
}
file, header, err := r.FormFile("file")
if err != nil || assetKey == "" {
http.Error(w, "asset_key and file required", http.StatusBadRequest)
return
}
defer file.Close()
data, err := io.ReadAll(io.LimitReader(file, 32<<20))
if err != nil {
http.Error(w, "read file failed", http.StatusBadRequest)
return
}
tv, err := s.wfDefSvc.UploadTemplate(r.Context(), assetKey, name, data, header.Filename, user.ID)
if err != nil {
status := http.StatusBadRequest
switch {
case errors.Is(err, workflowdef.ErrUploadRejected):
status = http.StatusUnsupportedMediaType
case errors.Is(err, workflowdef.ErrNotAvailable):
status = http.StatusServiceUnavailable
}
http.Error(w, err.Error(), status)
return
}
writeJSONResponse(w, http.StatusCreated, tv)
default:
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
}
}
func (s *Server) handleAdminTemplateVersions(w http.ResponseWriter, r *http.Request) {
if _, ok := s.requireWorkflowAdmin(w, r); !ok {
return
}
if r.Method != http.MethodGet {
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
return
}
assetKey := strings.TrimSpace(r.PathValue("key"))
if assetKey == "" {
http.Error(w, "invalid asset key", http.StatusBadRequest)
return
}
versions, err := s.wfDefSvc.ListTemplateVersions(r.Context(), assetKey)
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
writeJSONResponse(w, http.StatusOK, map[string]any{"versions": versions})
}