Major changes: logic add to panel, local variables, panel histor, users management...

internal/server/server.go

@@ -5,12 +5,15 @@ import (
 	"io/fs"
 	"log/slog"
 	"net/http"
+	"strings"
 	"time"
 
+	"github.com/uopi/uopi/internal/access"
 	"github.com/uopi/uopi/internal/api"
 	"github.com/uopi/uopi/internal/broker"
 	"github.com/uopi/uopi/internal/datasource/synthetic"
 	"github.com/uopi/uopi/internal/metrics"
+	"github.com/uopi/uopi/internal/panelacl"
 	"github.com/uopi/uopi/internal/storage"
 )
 
@@ -23,7 +26,7 @@ type Server struct {
 
 // New creates the HTTP server, registers all routes, and returns a ready-to-start Server.
 // synth may be nil if the synthetic data source is not enabled.
-func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Synthetic, store *storage.Store, channelFinderURL, archiverURL string, log *slog.Logger) *Server {
+func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Synthetic, store *storage.Store, policy *access.Policy, acl *panelacl.Store, channelFinderURL, archiverURL, trustedUserHeader string, log *slog.Logger) *Server {
 	mux := http.NewServeMux()
 
 	// Health check
@@ -33,13 +36,16 @@ func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Syntheti
 	})
 
 	// WebSocket endpoint
-	mux.Handle("/ws", &wsHandler{broker: brk, log: log})
+	mux.Handle("/ws", &wsHandler{broker: brk, log: log, userHeader: trustedUserHeader, policy: policy})
 
 	// Prometheus-format metrics
 	mux.HandleFunc("/metrics", metrics.Handler(brk.ActiveSubscriptions))
 
-	// REST API
-	api.New(brk, synth, store, channelFinderURL, archiverURL, log).Register(mux, apiPrefix)
+	// REST API — registered on a dedicated mux so it can be wrapped with the
+	// access-control middleware (identity resolution + global level enforcement).
+	apiMux := http.NewServeMux()
+	api.New(brk, synth, store, policy, acl, channelFinderURL, archiverURL, log).Register(apiMux, apiPrefix)
+	mux.Handle(apiPrefix+"/", accessMiddleware(policy, trustedUserHeader, apiMux))
 
 	// Embedded frontend — must be last (catch-all)
 	mux.Handle("/", http.FileServerFS(webFS))
@@ -56,6 +62,44 @@ func New(addr string, webFS fs.FS, brk *broker.Broker, synth *synthetic.Syntheti
 	}
 }
 
+// accessMiddleware resolves the end-user identity from the trusted proxy header
+// (falling back to the configured default_user), stores it on the request
+// context, and enforces the user's global access level on every API request:
+//   - LevelNone  → 403 for all requests.
+//   - LevelRead  → 403 for any mutating request (non GET/HEAD).
+//   - LevelWrite → no restriction.
+//
+// The /me endpoint is always reachable so the frontend can discover the
+// caller's identity and level even when otherwise restricted.
+func accessMiddleware(policy *access.Policy, userHeader string, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var raw string
+		if userHeader != "" {
+			raw = r.Header.Get(userHeader)
+		}
+		user := policy.ResolveUser(raw)
+		r = r.WithContext(access.WithUser(r.Context(), user))
+
+		// Always allow identity discovery.
+		if strings.HasSuffix(r.URL.Path, apiPrefix+"/me") {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		switch policy.Level(user) {
+		case access.LevelNone:
+			http.Error(w, "access denied", http.StatusForbidden)
+			return
+		case access.LevelRead:
+			if r.Method != http.MethodGet && r.Method != http.MethodHead {
+				http.Error(w, "read-only access", http.StatusForbidden)
+				return
+			}
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 // Start listens and serves until ctx is cancelled.
 func (s *Server) Start(ctx context.Context) error {
 	s.log.Info("listening", "addr", s.httpServer.Addr)

internal/server/ws.go

@@ -6,11 +6,13 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/coder/websocket"
 
+	"github.com/uopi/uopi/internal/access"
 	"github.com/uopi/uopi/internal/broker"
 	"github.com/uopi/uopi/internal/datasource"
 	"github.com/uopi/uopi/internal/metrics"
@@ -87,9 +89,21 @@ type histPoint struct {
 type wsHandler struct {
 	broker *broker.Broker
 	log    *slog.Logger
+	// userHeader is the HTTP header from which the per-session end-user identity
+	// is read (set by a trusted auth proxy). Empty disables per-user identity.
+	userHeader string
+	// policy enforces the global access level (blacklist) on signal writes.
+	policy *access.Policy
 }
 
 func (h *wsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Capture the end-user identity from the trusted proxy header (if enabled)
+	// before the connection is upgraded, while the original headers are present.
+	var user string
+	if h.userHeader != "" {
+		user = strings.TrimSpace(r.Header.Get(h.userHeader))
+	}
+
 	conn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
 		// Permissive origin check for LAN / SSH-tunnel use; tighten when auth lands.
 		InsecureSkipVerify: true,
@@ -107,6 +121,8 @@ func (h *wsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	c := &wsClient{
 		conn:     conn,
 		broker:   h.broker,
+		user:     user,
+		policy:   h.policy,
 		outCh:    make(chan []byte, 512),
 		updateCh: make(chan broker.Update, 1024),
 		subs:     make(map[broker.SignalRef]func()),
@@ -136,6 +152,8 @@ type wsClient struct {
 	conn   *websocket.Conn
 	broker *broker.Broker
 	log    *slog.Logger
+	user   string         // end-user identity from the trusted proxy header ("" if none)
+	policy *access.Policy // global access-level enforcement
 
 	outCh    chan []byte        // serialised outgoing messages
 	updateCh chan broker.Update // raw updates from the broker
@@ -277,6 +295,14 @@ func (c *wsClient) handleUnsubscribe(refs []sigRef) {
 }
 
 func (c *wsClient) handleWrite(ctx context.Context, msg inMsg) {
+	// Enforce the user's global access level: blacklisted read-only / no-access
+	// users may not write signals, regardless of the channel's own writability.
+	if c.policy != nil && c.policy.Level(c.policy.ResolveUser(c.user)) < access.LevelWrite {
+		c.log.Warn("write: access denied", "ds", msg.DS, "name", msg.Name, "user", c.user)
+		c.sendError(ctx, "ACCESS_DENIED", "you do not have write access")
+		return
+	}
+
 	ds, ok := c.broker.Source(msg.DS)
 	if !ok {
 		c.log.Warn("write: unknown data source", "ds", msg.DS, "name", msg.Name)
@@ -305,8 +331,11 @@ func (c *wsClient) handleWrite(ctx context.Context, msg inMsg) {
 		return
 	}
 
-	c.log.Info("write", "ds", msg.DS, "name", msg.Name, "value", value)
+	c.log.Info("write", "ds", msg.DS, "name", msg.Name, "value", value, "user", c.user)
 	metrics.IncWrites()
+	// Attribute the write to the connecting end-user so data sources (EPICS) can
+	// act under that identity rather than the server's.
+	ctx = datasource.WithUser(ctx, c.user)
 	if err := ds.Write(ctx, msg.Name, value); err != nil {
 		c.log.Warn("write: ds.Write failed", "ds", msg.DS, "name", msg.Name, "err", err)
 		c.sendError(ctx, "WRITE_ERROR", err.Error())