fix(api): self-host Swagger UI; add Dependabot for Go and actions

The /v1/docs page pulled the Swagger UI shell (CSS + JS bundle) from
jsdelivr — the last external fetch in the panel. It renders half-drawn
where that CDN is blocked, which is the networks this panel serves, and
tells a third party who opened the docs. Vendor swagger-ui-dist 5.17.14
into the binary and serve it from our own origin, matching what the
decoys and the subscription page already do.

Dependabot bumps the go.mod toolchain and the CI actions weekly, so a
stdlib CVE (this run's govulncheck failure) is patched by a one-line PR
instead of a red main; govulncheck stays the backstop between runs.

Author: AppsGanin

.github/dependabot.yml

@@ -0,0 +1,31 @@
+# Keeps the Go toolchain and the CI actions patched without waiting for someone to
+# notice a failing govulncheck. The `go` directive in go.mod is what CI resolves its
+# toolchain from (go-version-file: go.mod), so a Dependabot bump of it is exactly the
+# one-line fix a stdlib CVE needs — govulncheck in CI stays the backstop for anything
+# that lands between weekly runs.
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    # One PR for the toolchain + all module bumps of a kind, rather than a swarm.
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      ci-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(ci)"
+    open-pull-requests-limit: 5

internal/server/api_v1.go

@@ -91,6 +91,13 @@ func (rt *Router) apiHandler() http.Handler {
 		rt.apiRoutes = append(rt.apiRoutes, pattern)
 		mux.HandleFunc(pattern, h)
 	}
+	// The Swagger UI shell, served from our own origin rather than a CDN — the same
+	// reason the decoys and the subscription page carry their own assets: a jsdelivr
+	// link renders half a docs page where jsdelivr is blocked, and it tells a third
+	// party who opened them. Not recorded in apiRoutes: these are static assets, not
+	// REST resources the OpenAPI document should list.
+	mux.HandleFunc("GET /v1/swagger-ui.css", rt.swaggerAsset("swagger-ui.css", "text/css"))
+	mux.HandleFunc("GET /v1/swagger-ui-bundle.js", rt.swaggerAsset("swagger-ui-bundle.js", "text/javascript"))
 	// The MCP endpoint authenticates from the path (see api_v1_mcp.go), so it is
 	// mounted before the bearer-authenticated catch-all. Deliberately NOT recorded in
 	// apiRoutes: it is a JSON-RPC transport rather than a REST resource, so there is

internal/server/openapi.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"embed"
 	"maps"
 	"net/http"
 	"reflect"
@@ -699,25 +700,48 @@ func (rt *Router) apiOpenAPI(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, buildOpenAPI(apiBaseURL(r, apiPath)))
 }
 
-// apiDocs serves a Swagger UI page pointed at the generated spec. The UI shell is
-// loaded from a CDN (this page is a developer convenience, reached only by someone
-// who already knows the secret API path); the spec it renders is fully local.
+// swaggerAssets holds the Swagger UI shell (CSS + JS bundle), vendored so the docs
+// page loads entirely from our own origin — see apiDocs.
+//
+//go:embed swaggerui/swagger-ui.css swaggerui/swagger-ui-bundle.js
+var swaggerAssets embed.FS
+
+// apiDocs serves a Swagger UI page pointed at the generated spec. Both the shell and
+// the spec are local: a CDN link would render a half-drawn page where that CDN is
+// blocked (the networks this panel serves), and leak to a third party who opened it.
+// The links are relative to /v1/docs, so they resolve to /v1/swagger-ui* regardless
+// of the secret API path in front.
 func (rt *Router) apiDocs(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	_, _ = w.Write([]byte(swaggerHTML))
 }
 
+// swaggerAsset serves one embedded Swagger UI file with a long cache lifetime (the
+// bundle is versioned by its bytes and changes only on a rebuild).
+func (rt *Router) swaggerAsset(name, contentType string) http.HandlerFunc {
+	body, err := swaggerAssets.ReadFile("swaggerui/" + name)
+	return func(w http.ResponseWriter, r *http.Request) {
+		if err != nil {
+			http.Error(w, "asset unavailable", http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Content-Type", contentType+"; charset=utf-8")
+		w.Header().Set("Cache-Control", "public, max-age=86400")
+		_, _ = w.Write(body)
+	}
+}
+
 const swaggerHTML = `<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>RosPanel API</title>
-  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css">
+  <link rel="stylesheet" href="swagger-ui.css">
 </head>
 <body>
   <div id="swagger-ui"></div>
-  <script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui-bundle.js" crossorigin></script>
+  <script src="swagger-ui-bundle.js"></script>
   <script>
     window.ui = SwaggerUIBundle({
       url: "openapi.json",

internal/server/swagger_test.go

@@ -0,0 +1,50 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// The docs page and its shell must load entirely from our own origin — a CDN link
+// renders a half-drawn page where that CDN is blocked and leaks who opened it, the
+// same rule the decoys and the subscription page already follow.
+func TestSwaggerUISelfHosted(t *testing.T) {
+	h, _, st := nodeAPITestServer(t)
+	base, _ := apiFixture(t, h, st)
+
+	// The docs page is key-free and references only relative assets.
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, base+"/v1/docs", nil)
+	req.RemoteAddr = testClientIP + ":40000"
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("docs page status %d", rec.Code)
+	}
+	body := rec.Body.String()
+	if strings.Contains(body, "jsdelivr") || strings.Contains(body, "http://") ||
+		strings.Contains(body, "https://") {
+		t.Errorf("docs page still references an external origin:\n%s", body)
+	}
+
+	// Both assets are served locally with a sane content type.
+	for _, a := range []struct{ path, ct string }{
+		{"/v1/swagger-ui.css", "text/css"},
+		{"/v1/swagger-ui-bundle.js", "text/javascript"},
+	} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, base+a.path, nil)
+		req.RemoteAddr = testClientIP + ":40000"
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Errorf("%s status %d", a.path, rec.Code)
+		}
+		if !strings.HasPrefix(rec.Header().Get("Content-Type"), a.ct) {
+			t.Errorf("%s content-type %q, want %s", a.path, rec.Header().Get("Content-Type"), a.ct)
+		}
+		if rec.Body.Len() < 1000 {
+			t.Errorf("%s suspiciously small (%d bytes) — asset missing?", a.path, rec.Body.Len())
+		}
+	}
+}