web/

route.rs

use std::sync::Arc;

use axum::{
    Router, middleware,
    routing::{get, post},
};

use crate::pages::script;
use crate::pages::template;
use crate::{
    AppState,
    files::download_file,
    handler::{
        change_password_handler, get_home_link, get_logout_link, get_me_handler, get_version,
        login_form_handler, login_user_handler, logout_handler, refresh_access_token_handler,
        register_user_handler,
    },
    jwt_auth::{admin, auth},
    pages::{account, commodity, file_table, report, tag},
    rate_limit::{AuthLimiter, throttle_auth},
    redirect_middleware::redirect_on_auth_error,
};

/// Pages only an admin may see.
///
/// Registration is invite-only: `POST /api/auth/register` has always been
/// admin-gated, but the page carrying its form was public, so an anonymous
/// visitor was handed a signup form whose every submission is refused. The
/// page now sits behind the same gate as the endpoint it posts to.
///
/// Layer order matters: `auth` must run before `admin`, which reads the
/// extension `auth` inserts, and `redirect_on_auth_error` wraps both so an
/// HTML visitor is redirected rather than shown a JSON error.
pub fn create_admin_pages_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route("/register", get(crate::pages::register))
        .route_layer(middleware::from_fn_with_state(app_state.clone(), admin))
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_pages_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route(
            "/commodity/create",
            get(crate::pages::commodity::create::submit::commodity_create_page),
        )
        .route(
            "/commodity/convert",
            get(crate::pages::commodity::convert::submit::commodity_convert_page),
        )
        .route(
            "/commodity/list",
            get(crate::pages::commodity::list::commodity_list_page),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_accounts_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route(
            "/account/create",
            get(crate::pages::account::create::submit::account_create_page),
        )
        .route(
            "/account/list",
            get(crate::pages::account::list::account_list_page),
        )
        .route(
            "/account/manage",
            get(crate::pages::account::manage::account_manage_page),
        )
        .route(
            "/account/ssh-key",
            get(crate::pages::account::ssh_key::ssh_key_page),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_transactions_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route(
            "/transaction/create",
            get(crate::pages::transaction::create::submit::transaction_create_page),
        )
        .route(
            "/transaction/list",
            get(crate::pages::transaction::list::transaction_list_page),
        )
        .route(
            "/transaction/edit/{id}",
            get(crate::pages::transaction::edit::submit::transaction_edit_page),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_tags_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route(
            "/tag/create",
            get(crate::pages::tag::create::tag_create_page),
        )
        .route("/tag/list", get(crate::pages::tag::list::tag_list_page))
        .route(
            "/tag/edit/{id}",
            get(crate::pages::tag::edit::tag_edit_page),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_scripts_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route("/script/create", get(script::edit::script_create_page))
        .route("/script/list", get(script::list::script_list_page))
        .route("/script/edit/{id}", get(script::edit::script_edit_page))
        .route(
            "/template/create",
            get(template::edit::template_create_page),
        )
        .route("/template/list", get(template::list::template_list_page))
        .route(
            "/template/edit/{id}",
            get(template::edit::template_edit_page),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_reports_router(app_state: Arc<AppState>) -> Router<Arc<AppState>> {
    Router::new()
        .route("/report/balance", get(report::balance::balance_report_page))
        .route(
            "/report/activity",
            get(report::activity::activity_report_page),
        )
        .route(
            "/report/category-breakdown",
            get(report::category_breakdown::category_breakdown_report_page),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn(redirect_on_auth_error))
        .with_state(app_state.clone())
}

pub fn create_api_router(
    app_state: Arc<AppState>,
    limiter: Arc<AuthLimiter>,
) -> Router<Arc<AppState>> {
    // The login routes verify a password against a hash for anyone who asks,
    // so they carry a per-address throttle. `/version` is outside it: it reads
    // nothing and costs nothing, and throttling it would only make an unrelated
    // health check share a budget with the credential path.
    let login_router = Router::new()
        .route("/auth/login", post(login_form_handler))
        .route("/auth/login/json", post(login_user_handler))
        .route_layer(middleware::from_fn_with_state(
            limiter.clone(),
            throttle_auth,
        ));

    let public_router = login_router.route("/version", get(get_version));

    // Both layers: it verifies a password, so it belongs behind the same
    // throttle as login, and it acts on the caller, so it needs `auth`.
    let password_router = Router::new()
        .route("/auth/password", post(change_password_handler))
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .route_layer(middleware::from_fn_with_state(limiter, throttle_auth))
        .with_state(app_state.clone());

    let auth_router = Router::new()
        .route("/auth/refresh", get(refresh_access_token_handler))
        .route("/files/list", get(file_table))
        .route("/files/download/{file_name}", get(download_file))
        .route("/auth/logout", get(logout_handler))
        .route("/users/me", get(get_me_handler))
        .route("/htmx/logoutlink", get(get_logout_link))
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let account_router = Router::new()
        .route("/account/list", get(account::list::account_table))
        .route("/account/info", get(account::list::account_info))
        .route("/account/tree", get(account::manage::account_tree))
        .route(
            "/account/manage/view",
            get(account::manage::account_manage_view),
        )
        .route(
            "/account/manage/details",
            get(account::manage::account_manage_details),
        )
        .route(
            "/account/manage/tag",
            post(account::manage::account_manage_set_tag),
        )
        .route(
            "/account/manage/tag/submit",
            post(account::manage::account_manage_set_tag_submit),
        )
        .route(
            "/account/manage/tag/delete/{tag_id}",
            post(account::manage::account_manage_delete_tag_submit),
        )
        .route("/account/search", post(account::search::search_accounts))
        .route(
            "/account/create/submit",
            post(account::create::submit::create_account),
        )
        .route(
            "/account/create/validate/name",
            post(account::create::validate::validate_name),
        )
        .route("/account/rename", post(account::edit::rename_account))
        .route(
            "/account/{id}/tags/submit",
            post(account::edit::account_tags_submit),
        )
        .route("/account/ssh-key/add", post(account::ssh_key::ssh_key_add))
        .route(
            "/account/ssh-key/remove",
            post(account::ssh_key::ssh_key_remove),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let nav_router = Router::new()
        .route("/nav/home", get(get_home_link))
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let commodity_router = Router::new()
        .route("/commodity/list", get(commodity::list::commodity_table))
        .route(
            "/commodity/search",
            post(commodity::search::search_commodities),
        )
        .route(
            "/commodity/create/submit",
            post(commodity::create::submit::commodity_submit),
        )
        .route(
            "/commodity/create/validate/symbol",
            post(commodity::create::validate::validate_symbol),
        )
        .route(
            "/commodity/create/validate/name",
            post(commodity::create::validate::validate_name),
        )
        .route(
            "/commodity/convert/submit",
            post(commodity::convert::submit::commodity_convert_submit),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let transaction_router = Router::new()
        .route(
            "/transaction/list",
            get(crate::pages::transaction::list::transaction_table),
        )
        .route(
            "/transaction/split/create",
            get(crate::pages::transaction::create::split::split_create_handler),
        )
        .route(
            "/transaction/create/submit",
            post(crate::pages::transaction::create::submit::transaction_submit),
        )
        .route(
            "/transaction/create/validate/amount",
            post(crate::pages::transaction::validate::validate_amount_html),
        )
        .route(
            "/transaction/create/validate/from_account",
            post(crate::pages::transaction::validate::validate_from_account_html),
        )
        .route(
            "/transaction/create/validate/to_account",
            post(crate::pages::transaction::validate::validate_to_account_html),
        )
        .route(
            "/transaction/create/validate/note",
            post(crate::pages::transaction::validate::validate_note_html),
        )
        .route(
            "/transaction/edit/submit",
            post(crate::pages::transaction::edit::submit::transaction_edit_submit),
        )
        .route(
            "/transaction/edit/validate/amount",
            post(crate::pages::transaction::validate::validate_amount_json),
        )
        .route(
            "/transaction/edit/validate/from_account",
            post(crate::pages::transaction::validate::validate_from_account_json),
        )
        .route(
            "/transaction/edit/validate/to_account",
            post(crate::pages::transaction::validate::validate_to_account_json),
        )
        .route(
            "/transaction/edit/validate/note",
            post(crate::pages::transaction::validate::validate_note_json),
        )
        .route(
            "/transaction/delete/{id}",
            post(crate::pages::transaction::delete::submit::transaction_delete_submit),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let tag_router = Router::new()
        .route("/tag/list", get(tag::list::tag_table))
        .route("/tag/create/submit", post(tag::create::create_tag))
        .route(
            "/transaction/{id}/tag/create/submit",
            post(tag::create::create_transaction_tag),
        )
        .route(
            "/split/{id}/tag/create/submit",
            post(tag::create::create_split_tag),
        )
        .route(
            "/account/{id}/tag/create/submit",
            post(tag::create::create_account_tag),
        )
        .route("/tag/edit/submit", post(tag::edit::edit_tag))
        .route("/tag/delete/{id}", post(tag::edit::delete_tag))
        .route(
            "/tags/transaction/names",
            get(tag::autocomplete::transaction_tag_names),
        )
        .route(
            "/tags/transaction/values",
            get(tag::autocomplete::transaction_tag_values),
        )
        .route("/tags/split/names", get(tag::autocomplete::split_tag_names))
        .route(
            "/tags/split/values",
            get(tag::autocomplete::split_tag_values),
        )
        .route(
            "/tags/account/names",
            get(tag::autocomplete::account_tag_names),
        )
        .route(
            "/tags/account/values",
            get(tag::autocomplete::account_tag_values),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let script_router = Router::new()
        .route("/script/list", get(script::list::script_table))
        .route("/script/create/submit", post(script::edit::create_script))
        .route("/script/edit/submit", post(script::edit::edit_script))
        .route(
            "/script/bytecode/{id}",
            post(script::edit::upload_script_bytecode),
        )
        .route("/script/delete/{id}", post(script::edit::delete_script))
        .route(
            "/account/{account_id}/script/run/{script_id}",
            post(account::edit::run_account_script),
        )
        .route("/template/list", get(template::list::template_table))
        .route(
            "/template/create/submit",
            post(template::edit::create_template),
        )
        .route("/template/test", post(template::edit::test_template))
        .route("/template/edit/submit", post(template::edit::edit_template))
        .route(
            "/template/delete/{id}",
            post(template::edit::delete_template),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let report_router = Router::new()
        .route(
            "/report/balance",
            get(report::balance::balance_report_table),
        )
        .route(
            "/report/balance/chart.svg",
            get(report::balance::balance_report_chart_svg),
        )
        .route(
            "/report/balance/chart.json",
            get(report::balance::balance_report_chart_json),
        )
        .route(
            "/report/activity",
            get(report::activity::activity_report_table),
        )
        .route(
            "/report/activity/chart.svg",
            get(report::activity::activity_report_chart_svg),
        )
        .route(
            "/report/activity/chart.json",
            get(report::activity::activity_report_chart_json),
        )
        .route(
            "/report/category-breakdown",
            get(report::category_breakdown::category_breakdown_report_table),
        )
        .route(
            "/report/category-breakdown/chart.svg",
            get(report::category_breakdown::category_breakdown_report_chart_svg),
        )
        .route(
            "/report/category-breakdown/chart.json",
            get(report::category_breakdown::category_breakdown_report_chart_json),
        )
        .route_layer(middleware::from_fn_with_state(app_state.clone(), auth))
        .with_state(app_state.clone());

    let admin_router = Router::new()
        .route("/auth/register", post(register_user_handler))
        .route_layer(middleware::from_fn_with_state(app_state.clone(), admin))
        .route_layer(middleware::from_fn_with_state(app_state, auth));

    let router = Router::new()
        .merge(public_router)
        .merge(password_router)
        .merge(nav_router)
        .merge(auth_router)
        .merge(account_router)
        .merge(commodity_router)
        .merge(transaction_router)
        .merge(tag_router)
        .merge(report_router)
        .merge(admin_router);

    router.merge(script_router)
}