// ui-proxy exposes the read-only loopback viewer to the private Docker gateway.
package main

import (
	"flag"
	"log"
	"net"
	"net/http"
	"net/http/httputil"
	"net/url"
	"time"
)

func handler(target *url.URL) http.Handler {
	proxy := httputil.NewSingleHostReverseProxy(target)
	original := proxy.Director
	proxy.Director = func(r *http.Request) {
		original(r)
		r.Host = target.Host
		// The viewer is read-only behind NPM; do not forward the public browser origin
		// into the loopback-only origin guard. Mutating methods are rejected below.
		r.Header.Del("Origin")
	}
	proxy.FlushInterval = -1 // stream SSE immediately
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != http.MethodGet && r.Method != http.MethodHead {
			w.Header().Set("Allow", "GET, HEAD")
			http.Error(w, "read-only viewer", http.StatusMethodNotAllowed)
			return
		}
		proxy.ServeHTTP(w, r)
	})
}

func main() {
	address := flag.String("listen", "172.20.0.1:18082", "Private Docker gateway listener")
	flag.Parse()
	host, _, err := net.SplitHostPort(*address)
	ip := net.ParseIP(host)
	if err != nil || ip == nil || !ip.IsPrivate() {
		log.Fatal("listen must use an explicit private IP and port")
	}
	target, _ := url.Parse("http://127.0.0.1:18080")
	server := &http.Server{Addr: *address, Handler: handler(target), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second, MaxHeaderBytes: 8 << 10}
	log.Fatal(server.ListenAndServe())
}