initial commit

pkg/api/client/client.go

@@ -0,0 +1,213 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Client struct {
+	endpoint    string
+	username    string
+	password    string
+	auth        bool
+	httpClient  *http.Client
+	debugWriter io.Writer
+	insecure    bool
+}
+
+var (
+	ErrNotFound = errors.New("not found")
+)
+
+type ClientOption func(*Client)
+
+func WithEndpoint(endpoint string) ClientOption {
+	return func(client *Client) {
+		client.endpoint = strings.TrimRight(endpoint, "/")
+	}
+}
+
+func WithDebugWriter(debugWriter io.Writer) ClientOption {
+	return func(client *Client) {
+		client.debugWriter = debugWriter
+	}
+}
+
+func WithHTTPClient(httpClient *http.Client) ClientOption {
+	return func(client *Client) {
+		client.httpClient = httpClient
+	}
+}
+
+func WithInsecureClient(insecure bool) ClientOption {
+	return func(client *Client) {
+		client.insecure = insecure
+	}
+}
+
+func WithCredentials(username, password string) ClientOption {
+	return func(client *Client) {
+		client.username = username
+		client.password = password
+		client.auth = true
+	}
+}
+
+var (
+	ErrMissingEndpointEnv = errors.New("missing environment variable HAPROXY_LB_ENDPOINT")
+	ErrMissingUserEnv     = errors.New("missing environment variable HAPROXY_LB_USER")
+	ErrMissingPasswordEnv = errors.New("missing environment variable HAPROXY_LB_PASSWORD")
+
+	ErrMissingEndpoint = errors.New("missing Endpoint in config")
+	ErrMissingUser     = errors.New("missing User in config")
+	ErrMissingPassword = errors.New("missing Password in config")
+)
+
+type Config struct {
+	Endpoint string `json:"endpoint"`
+	NoAuth   bool   `json:"no_auth"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+	Insecure bool   `json:"insecure"`
+}
+
+func ClientOptionsFromConfig(cfg Config) (options []ClientOption, err error) {
+	if cfg.Endpoint == "" {
+		err = ErrMissingEndpoint
+		return
+	}
+	options = []ClientOption{
+		WithEndpoint(cfg.Endpoint),
+		WithInsecureClient(cfg.Insecure),
+	}
+	if cfg.NoAuth {
+		return
+	}
+	if cfg.User == "" {
+		err = ErrMissingUser
+		return
+	}
+	if cfg.Password == "" {
+		err = ErrMissingPassword
+		return
+	}
+	options = append(options, WithCredentials(cfg.User, cfg.Password))
+	return
+}
+
+func ClientOptionsFromEnv() (options []ClientOption, err error) {
+	endpoint := os.Getenv("HAPROXY_LB_ENDPOINT")
+	if endpoint == "" {
+		err = ErrMissingEndpointEnv
+		return
+	}
+	insecure, _ := strconv.ParseBool(os.Getenv("HAPROXY_LB_INSECURE"))
+
+	options = []ClientOption{
+		WithEndpoint(endpoint),
+		WithInsecureClient(insecure),
+	}
+	noAuth, _ := strconv.ParseBool(os.Getenv("HAPROXY_LB_NO_AUTH"))
+	if noAuth {
+		return
+	}
+
+	user := os.Getenv("HAPROXY_LB_USER")
+	if user == "" {
+		err = ErrMissingUserEnv
+		return
+	}
+
+	pass := os.Getenv("HAPROXY_LB_PASSWORD")
+	if pass == "" {
+		err = ErrMissingPasswordEnv
+		return
+	}
+
+	options = append(options, WithCredentials(user, pass))
+	return
+}
+
+func NewClient(options ...ClientOption) *Client {
+	client := &Client{}
+
+	for _, option := range options {
+		option(client)
+	}
+
+	if client.httpClient == nil {
+		client.httpClient = &http.Client{Transport: &http.Transport{
+			DialContext: (&net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			ForceAttemptHTTP2:     true,
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: client.insecure,
+			},
+		}}
+	}
+	return client
+}
+
+func (c *Client) NewRequest(ctx context.Context, method, path string, body io.Reader) (*http.Request, error) {
+	url := c.endpoint + path
+	req, err := http.NewRequest(method, url, body)
+	if err != nil {
+		return nil, err
+	}
+	if c.auth {
+		req.SetBasicAuth(c.username, c.password)
+	}
+	req = req.WithContext(ctx)
+	return req, nil
+}
+
+func (c *Client) Do(r *http.Request, v interface{}) (resp *http.Response, err error) {
+	if c.debugWriter != nil {
+		dumpReq, err := httputil.DumpRequestOut(r, true)
+		if err != nil {
+			return &http.Response{}, err
+		}
+		fmt.Fprintf(c.debugWriter, "--- Request:\n%s\n\n", dumpReq)
+	}
+	resp, err = c.httpClient.Do(r)
+	if err != nil {
+		return
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		resp.Body.Close()
+		return
+	}
+	resp.Body.Close()
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+
+	if c.debugWriter != nil {
+		dumpResp, err := httputil.DumpResponse(resp, true)
+		if err != nil {
+			return resp, err
+		}
+		fmt.Fprintf(c.debugWriter, "--- Response:\n%s\n\n", dumpResp)
+	}
+
+	err = decodeResp(resp, v)
+	return
+}

pkg/api/client/helper.go

@@ -0,0 +1,43 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package client
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+type Error struct {
+	Err    string `json:"error"`
+	Status int    `json:"status"`
+}
+
+func (e Error) Error() string {
+	return e.Err
+}
+
+func (e Error) Is(target error) bool {
+	return e.Err == target.Error()
+}
+
+func decodeResp(resp *http.Response, v interface{}) error {
+	if resp.Body == nil {
+		return nil
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == 200 {
+		if v == nil {
+			return nil
+		}
+		return json.NewDecoder(resp.Body).Decode(&v)
+	}
+	var e Error
+	err := json.NewDecoder(resp.Body).Decode(&e)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode >= 400 && resp.StatusCode <= 599 {
+		return e
+	}
+	return nil
+}

pkg/api/server.go

@@ -0,0 +1,101 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package api
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"time"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	serverv1 "git.giftfish.de/ston1th/keyctl/pkg/api/v1/server"
+	"git.giftfish.de/ston1th/keyctl/pkg/db"
+
+	"github.com/go-logr/logr"
+	"github.com/gorilla/mux"
+)
+
+// Server is the webapp and api server
+type Server struct {
+	srv *http.Server
+	mux *mux.Router
+	log logr.Logger
+
+	Data *types.ContextData
+
+	init         chan struct{}
+	stop         chan struct{}
+	stopKeyReset chan struct{}
+
+	listen net.Listener
+
+	db *db.DB
+}
+
+type notFoundHandler struct {
+	s *Server
+}
+
+func (nf *notFoundHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	types.NewContext(w, r, nf.s.Data, nf.s.log).Err(types.ErrInvalidAPIRoute)
+}
+
+// NewHTTPServer returns a new HTTPServer
+func NewServer(log logr.Logger, listen string) (*Server, error) {
+	s := &Server{
+		mux:  mux.NewRouter(),
+		log:  log,
+		Data: &types.ContextData{},
+
+		init:         make(chan struct{}),
+		stop:         make(chan struct{}),
+		stopKeyReset: make(chan struct{}),
+	}
+	l, err := net.Listen("tcp", listen)
+	if err != nil {
+		return nil, err
+	}
+	s.listen = l
+
+	s.mux.NotFoundHandler = &notFoundHandler{s}
+	for _, v := range serverv1.Routes {
+		s.mux.HandleFunc(v.Path, s.contextWrapper(v.Handler)).Methods(v.Methods...)
+	}
+	s.start()
+	return s, nil
+}
+
+func (s *Server) start() {
+	s.srv = &http.Server{
+		Handler:      s.mux,
+		ReadTimeout:  10 * time.Second,
+		WriteTimeout: 10 * time.Second,
+	}
+	go func() {
+		<-s.init
+		err := s.srv.Serve(s.listen)
+		if err != nil {
+			s.log.Error(err, "")
+		}
+	}()
+	return
+}
+
+func (s *Server) contextWrapper(h types.CtxHandler) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		h(types.NewContext(w, r, s.Data, s.log))
+	}
+}
+
+// Stop stops listening for incoming connections and closes currently open connections
+func (s *Server) Stop() {
+	s.log.Info("stopping")
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	err := s.srv.Shutdown(ctx)
+	if err != nil {
+		s.log.Error(err, "")
+	}
+	s.log.Info("stopped")
+}

pkg/api/types/approver.go

@@ -0,0 +1,103 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+import (
+	"sync"
+	"time"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/key"
+	"golang.org/x/exp/maps"
+)
+
+const maxSize = 10
+
+type ApprovalMap map[string]Approval
+
+type Approver struct {
+	// protects m
+	mu sync.RWMutex
+	m  ApprovalMap
+}
+
+func NewApprover() *Approver {
+	return &Approver{
+		m: make(ApprovalMap),
+	}
+}
+
+func (a *Approver) New(id, name string) (aid string, err error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	size := len(a.m)
+	if size > maxSize {
+		err = ErrTooManyApprovals
+		return
+	}
+	aid, err = key.GenerateID()
+	if err != nil {
+		return
+	}
+	a.m[aid] = Approval{
+		ID:      id,
+		Name:    name,
+		Created: time.Now().Unix(),
+	}
+	return
+}
+
+func (a *Approver) List() (m ApprovalMap) {
+	a.mu.RLock()
+	m = maps.Clone(a.m)
+	a.mu.RUnlock()
+	return
+}
+func (a *Approver) Status(id, aid string) (s Status) {
+	a.mu.RLock()
+	if app, ok := a.m[aid]; ok && app.ID == id {
+		s = app.Status
+	}
+	a.mu.RUnlock()
+	return
+}
+
+func (a *Approver) Update(aid string, s Status) {
+	a.mu.Lock()
+	if _, ok := a.m[aid]; ok {
+		a.m[aid].Status = s
+	}
+	a.mu.Unlock()
+}
+
+type Approval struct {
+	ID      string
+	Name    string
+	Created int64
+	Status  Status
+}
+
+type Status int
+
+const (
+	Pending Status = iota
+	Approved
+	Rejected
+)
+
+func (s Status) String() string {
+	switch s {
+	case Pending:
+		return "pending"
+	case Approved:
+		return "approved"
+	case Rejected:
+		return "rejected"
+	}
+	return "[invalid]"
+}
+
+type Route struct {
+	Path    string
+	Handler CtxHandler
+	Methods []string
+}

pkg/api/types/context.go

@@ -0,0 +1,138 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+import (
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+
+	"github.com/go-logr/logr"
+	"github.com/gorilla/mux"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/db"
+)
+
+type ContextData struct {
+	DB *db.DB
+}
+
+func NewContext(w http.ResponseWriter, r *http.Request, data *ContextData, log logr.Logger) *Context {
+	h := w.Header()
+	h.Set("Content-Type", "application/json")
+	return &Context{
+		Code:     http.StatusOK,
+		Request:  r,
+		Response: w,
+		Data:     data,
+		Log:      log,
+	}
+}
+
+// Context is the context object shared between http handlers
+type Context struct {
+	Code int
+
+	Request  *http.Request
+	Response http.ResponseWriter
+
+	Data *ContextData
+	Log  logr.Logger
+}
+
+// Method returns the request method
+func (c *Context) Method() string {
+	return c.Request.Method
+}
+
+// Path returns the request URL path
+func (c *Context) Path() string {
+	return c.Request.URL.Path
+}
+
+// Header returns the given http header
+func (c *Context) Header(name string) string {
+	return c.Request.Header.Get(name)
+}
+
+// SetHeader sets the given http header
+func (c *Context) SetHeader(name, value string) {
+	h := c.Response.Header()
+	h.Set(name, value)
+}
+
+// Form returns the given form value
+func (c *Context) Form(name string) string {
+	return c.Request.FormValue(name)
+}
+
+func (c *Context) ClientIP() (host string) {
+	host, _, _ = net.SplitHostPort(c.Request.RemoteAddr)
+	return
+}
+
+// Var returns the given url variable
+func (c *Context) Var(name string) (ret string) {
+	ret, _ = mux.Vars(c.Request)[name]
+	return
+}
+
+func (c *Context) log() {
+	c.Log.Info("access",
+		"addr", c.Request.RemoteAddr,
+		"method", c.Request.Method,
+		"path", c.Request.URL.Path,
+		"code", c.Code,
+	)
+}
+
+func (c *Context) NotFound() {
+	c.Err(ErrNotFound)
+}
+
+// OK is a empty HTTP 200 JSON response
+func (c *Context) OK() {
+	c.log()
+}
+
+func (c *Context) ReadBody() (b []byte, err error) {
+	b, err = io.ReadAll(c.Request.Body)
+	c.Request.Body.Close()
+	return
+}
+
+func (c *Context) Body(b []byte) {
+	c.Response.Write(b)
+	c.log()
+}
+
+// JSON is a json response
+func (c *Context) JSON(v any) {
+	err := json.NewEncoder(c.Response).Encode(v)
+	if err != nil {
+		c.Err(ErrISE)
+		return
+	}
+	c.log()
+}
+
+func (c *Context) Redirect(url string, code int) {
+	c.Code = code
+	http.Redirect(c.Response, c.Request, url, code)
+	c.log()
+}
+
+// Err is a HTTPErr wrapper for the custom Error type
+func (c *Context) Err(err Error) {
+	c.HTTPErr(err.JSON(), err.Code())
+}
+
+// HTTPErr is a http.Error wrapper
+func (c *Context) HTTPErr(err string, code int) {
+	c.Code = code
+	http.Error(c.Response, err, code)
+	c.log()
+}
+
+type CtxHandler func(*Context)

pkg/api/types/error.go

@@ -0,0 +1,55 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+import (
+	"net/http"
+	"strconv"
+)
+
+// Error interface is a custom api error
+type Error interface {
+	Error() string
+	JSON() string
+	Status() int
+}
+
+// Err implements the Error interface
+type Err struct {
+	err    string
+	status int
+}
+
+// Error returns the error string
+func (a Err) Error() string {
+	return a.err
+}
+
+// Error returns the error string as JSON format
+func (a Err) JSON() string {
+	return `{"error":"` + a.err + `","status":` + strconv.Itoa(a.status) + `}`
+}
+
+// Status returns the HTTP status code
+func (a Err) Status() int {
+	return a.status
+}
+
+func newError(err string, status int) Error {
+	return Err{
+		err:    err,
+		status: status,
+	}
+}
+
+var (
+	ErrInvalidAPIRoute  = newError("invalid api route", http.StatusNotFound)
+	ErrBadreq           = newError("bad request", http.StatusBadRequest)
+	ErrForbidden        = newError("forbidden", http.StatusForbidden)
+	ErrNotFound         = newError("not found", http.StatusNotFound)
+	ErrKeyNotFound      = newError("key not found", http.StatusNotFound)
+	ErrReqNotFound      = newError("key request not found", http.StatusNotFound)
+	ErrTooManyApprovals = newError("too many approvals pending", http.StatusConflict)
+	ErrMNA              = newError("method not allowed", http.StatusMethodNotAllowed)
+	ErrISE              = newError("internal server error", http.StatusInternalServerError)
+)

pkg/api/types/types.go

@@ -0,0 +1,9 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package types
+
+type Route struct {
+	Path    string
+	Handler CtxHandler
+	Methods []string
+}

pkg/api/v1/client/client.go

@@ -0,0 +1,100 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	apiclient "git.giftfish.de/ston1th/keyctl/pkg/api/client"
+	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
+)
+
+var (
+	ErrClientIsNil = errors.New("client is nil")
+	base           = schema.LBPath
+)
+
+type Client struct {
+	c *apiclient.Client
+}
+
+func NewClient(c *apiclient.Client) (*Client, error) {
+	if c == nil {
+		return nil, ErrClientIsNil
+	}
+	return &Client{c}, nil
+}
+
+func (c *Client) GetLoadBalancers(ctx context.Context) (lbs map[string]*schema.LoadBalancer, err error) {
+	return c.GetLoadBalancersWithCluster(ctx, "")
+}
+
+func (c *Client) GetLoadBalancersWithCluster(ctx context.Context, cluster string) (lbs map[string]*schema.LoadBalancer, err error) {
+	path := base
+	if cluster != "" {
+		path += "/" + cluster
+	}
+	req, err := c.c.NewRequest(ctx, "GET", path, nil)
+	if err != nil {
+		return
+	}
+	lbs = make(map[string]*schema.LoadBalancer)
+	_, err = c.c.Do(req, &lbs)
+	return
+}
+
+func (c *Client) GetLoadBalancer(ctx context.Context, cluster, name string) (lb *schema.LoadBalancer, err error) {
+	path := fmt.Sprintf("%s/%s/%s", base, cluster, name)
+	req, err := c.c.NewRequest(ctx, "GET", path, nil)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, &lb)
+	return
+}
+
+func (c *Client) CreateLoadBalancer(ctx context.Context, cluster, name string, lb *schema.LoadBalancer) (err error) {
+	buf := new(bytes.Buffer)
+	path := fmt.Sprintf("%s/%s/%s", base, cluster, name)
+	err = lb.ValidateClient()
+	if err != nil {
+		return
+	}
+	err = json.NewEncoder(buf).Encode(lb)
+	if err != nil {
+		return
+	}
+	req, err := c.c.NewRequest(ctx, "POST", path, buf)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, nil)
+	return
+}
+
+func (c *Client) DeleteLoadBalancer(ctx context.Context, cluster, name string) (err error) {
+	path := fmt.Sprintf("%s/%s/%s", base, cluster, name)
+	req, err := c.c.NewRequest(ctx, "DELETE", path, nil)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, nil)
+	return
+}
+
+func (c *Client) DeleteLoadBalancersWithCluster(ctx context.Context, cluster string) (err error) {
+	if cluster == "" {
+		return errors.New("cluster value can not be empty")
+	}
+	path := base + "/" + cluster
+	req, err := c.c.NewRequest(ctx, "DELETE", path, nil)
+	if err != nil {
+		return
+	}
+	_, err = c.c.Do(req, nil)
+	return
+}

pkg/api/v1/schema/schema.go

@@ -0,0 +1,95 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package schema
+
+import (
+	"errors"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	"git.giftfish.de/ston1th/keyctl/pkg/core"
+	"golang.org/x/exp/slices"
+)
+
+const (
+	Version = "v1"
+	KeyName = "key"
+	ReqName = "req"
+	KeyPath = "/" + Version + "/" + KeyName
+	ReqPath = "/" + Version + "/" + ReqName
+)
+
+type NewKey struct {
+	Name     string        `json:"name"`
+	Size     int           `json:"size"`
+	Encoding core.Encoding `json:"encoding"`
+}
+
+var (
+	ErrInvalidKeyName = errors.New("invalid key name")
+	ErrInvalidKeySize = errors.New("invalid key size")
+)
+
+const (
+	MinKeySize = 1
+	MaxKeySize = 1024
+)
+
+func (nk NewKey) Validate() error {
+	if core.NameRe.MatchString(nk.Name) {
+		return ErrInvalidKeyName
+	}
+	if nk.Size > MaxKeySize || nk.Size < MinKeySize {
+		return ErrInvalidKeySize
+	}
+	return nil
+}
+
+func ApproveURL(id, aid string) string {
+	return KeyPath + "/" + id + "/" + aid
+}
+
+type Key struct {
+	ID       string        `json:"id"`
+	Name     string        `json:"name"`
+	Created  int64         `json:"created"`
+	Size     int           `json:"size"`
+	Encoding core.Encoding `json:"encoding"`
+	Key      string        `json:"key"`
+}
+
+type Keys []Key
+
+func (Keys) Less(a, b Key) { return a.Name < b.Name }
+func (k Keys) Sort()       { slices.SortStableFunc(k, k.Less) }
+
+func NewKeys(keys core.Keys) (k Keys) {
+	k = Keys(keys)
+	k.Sort()
+}
+
+type Approval struct {
+	ID      string       `json:"id"`
+	AID     string       `json:"aid"`
+	Name    string       `json:"name"`
+	Created int64        `json:"created"`
+	Status  types.Status `json:"status"`
+}
+
+type Approvals []Approval
+
+func (Approvals) Less(a, b Approval) { return a.Name < b.Name }
+func (a Approvals) Sort()            { slices.SortStableFunc(a, a.Less) }
+
+func NewApprovals(m types.ApprovalMap) (a Approvals) {
+	for k, v := range m {
+		a = append(a, Approval{
+			ID:      v.ID,
+			AID:     k,
+			Name:    v.Name,
+			Created: v.Created,
+			Status:  v.Status,
+		})
+	}
+	a.Sort()
+	return
+}

pkg/api/v1/server/handler.go

@@ -0,0 +1,136 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/netip"
+
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
+)
+
+func local(h types.CtxHandler) types.CtxHandler {
+	return func(ctx *types.Context) {
+		addr, err := netip.ParseAddr(ctx.ClientIP())
+		if err != nil {
+			ctx.Err(types.ErrForbidden)
+			return
+		}
+		if !addr.IsLoopback() {
+			ctx.Err(types.ErrForbidden)
+			return
+		}
+		h(ctx)
+	}
+}
+
+func healthzHandler(ctx *types.Context) {
+	ctx.OK()
+}
+
+func newHandler(ctx *types.Context) {
+	if ctx.Method() == "POST" {
+		b, err := ctx.ReadBody()
+		if err != nil {
+			ctx.Log.Error(err, "error reading request body")
+			ctx.Err(types.ErrISE)
+			return
+		}
+		var newKey schema.NewKey
+		err = json.Unmarshal(b, &newKey)
+		if err != nil {
+			ctx.Log.Error(err, "error decoding request body")
+			ctx.Err(types.ErrInvalid)
+			return
+		}
+		err = newKey.Validate()
+		if err != nil {
+			ctx.Log.Error(err, "error empty name for new key")
+			ctx.Err(types.ErrInvalid)
+			return
+		}
+		key, err := ctx.Data.DB.CreateKey(newKey.Name, newKey.Size, newKey.Encoding)
+		if err != nil {
+			ctx.Log.Error(err, "error writing loadbalancer", "cluster", cl, "name", n)
+			ctx.Err(types.ErrISE)
+			return
+		}
+		ctx.JSON(schema.Key(key))
+	}
+}
+
+func keyHandler(ctx *types.Context) {
+	id := ctx.Var("id")
+	k, err := ctx.Data.DB.GetKey(id)
+	if err != nil {
+		//TODO error 404
+		ctx.Log.Error(err, "error reading key", "id", id)
+		ctx.Err(types.ErrISE)
+		return
+	}
+	switch ctx.Method() {
+	case "GET":
+		aid := ctx.Var("aid")
+		if aid == "" {
+			aid, err = ctx.Data.Approvals.New(id, k.Name)
+			if err != nil {
+				ctx.Log.Error(err, "error creating approval", "id", id, "name", k.Name)
+				ctx.Err(types.ErrISE)
+				return
+			}
+			ctx.Redirect(schema.ApproveURL(id, aid), http.StatusFound)
+			return
+		}
+		if !ctx.Data.Approvals.Approved(id, aid) {
+			ctx.Redirect(schema.ApproveURL(id, aid), http.StatusFound)
+			return
+		}
+		k, err := ctx.Data.DB.GetKeyWithSecret(id)
+		if err != nil {
+			//TODO error 404
+			ctx.Log.Error(err, "error reading key", "id", id)
+			ctx.Err(types.ErrISE)
+			return
+		}
+		ctx.JSON(schema.Key(k))
+	case "DELETE":
+		err = ctx.Data.DB.DeleteKey(id)
+		if err != nil {
+			ctx.Log.Error(err, "error deleting key", "id", id, "name", k.Name)
+			ctx.Err(types.ErrISE)
+			return
+		}
+		ctx.OK()
+	}
+}
+
+func reqListHandler(ctx *types.Context) {
+	l := ctx.Data.Approvals.List()
+	ctx.JSON(schema.NewApprovals(l))
+}
+
+func keyListHandler(ctx *types.Context) {
+	k, err := ctx.Data.DB.GetKeys()
+	if err != nil {
+		//TODO error 404
+		ctx.Log.Error(err, "error reading keys")
+		ctx.Err(types.ErrISE)
+		return
+	}
+	ctx.JSON(schema.NewKeys(k))
+}
+
+func reqHandler(ctx *types.Context) {
+	id := ctx.Var("id")
+	status := types.Pending
+	switch ctx.Method() {
+	case "PUT":
+		status = types.Approved
+	case "DELETE":
+		status = types.Rejected
+	}
+	ctx.Data.Approvals.Update(id, status)
+	ctx.OK()
+}

pkg/api/v1/server/routes.go

@@ -0,0 +1,59 @@
+// Copyright (C) 2023 Marius Schellenberger
+
+package server
+
+import (
+	"git.giftfish.de/ston1th/keyctl/pkg/api/types"
+	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
+	"git.giftfish.de/ston1th/keyctl/pkg/core"
+)
+
+const (
+	healthz  = "/healthz"
+	keyID    = schema.KeyPath + core.IDRoute
+	keyReqID = schema.KeyPath + core.IDRoute + core.AIDRoute
+	reqID    = schema.ReqPath + core.IDRoute
+)
+
+var Routes = []types.Route{
+	{
+		healthz,
+		healthzHandler,
+		[]string{"GET"},
+	},
+	{
+		schema.KeyPath,
+		local(keyListHandler),
+		[]string{"GET"},
+	},
+	{
+		schema.KeyPath,
+		local(newHandler),
+		[]string{"POST"},
+	},
+	{
+		keyID,
+		keyHandler,
+		[]string{"GET"},
+	},
+	{
+		keyReqID,
+		keyHandler,
+		[]string{"GET"},
+	},
+	{
+		keyID,
+		local(keyHandler),
+		[]string{"DELETE"},
+	},
+	{
+		schema.ReqPath,
+		local(reqListHandler),
+		[]string{"GET"},
+	},
+	{
+		reqID,
+		local(reqHandler),
+		[]string{"PUT", "DELETE"},
+	},
+}