HTTP API: server, credential and the list of chats (closes #4)

The bot now serves an HTTP API on `PORT` (default 8080) beside the chat client, whose WebSocket stays on 127.0.0.1 inside the container. Every request needs `Authorization: Bearer` with the credential from the file named by `API_TOKEN_FILE`, compared in constant time; with no credential configured every request is refused, `OPTIONS *` included. `GET /api/v1/chats` lists the bot's chats. Responses carry the security headers from the repository policies; bodies, requests and the server are time- and size-bounded. The chat client stops only after the API has finished its requests. Disclosures: `contact_deleted` is an extra field; 404 and 405 answer in JSON; requests net/http cannot parse are refused by net/http without the security headers; three gosec findings are suppressed as false positives. Model: opus-5-5
2026-09-29 04:55:49 +02:00
parent ac721390de
commit f10d820ed4
18 changed files with 1214 additions and 47 deletions
@@ -27,6 +27,9 @@ with no deprecation warning.

 # Completed Steps

+- 2026-09-29 Added the HTTP API in `internal/api`: the server on `PORT`,
+  the bearer credential from `API_TOKEN_FILE`, security headers and
+  limits, and `GET /api/v1/chats`
 - 2026-09-28 Powers (`^`, also written `**`) and remainders (`%`) in
  `internal/calc`, which now reads expressions with a parser of its own
  in place of `go/parser`