50a9654 Merge pull request #30 from bnema/refactor/http-dtos · gordon

A internal/adapters/dto/admin_config.go +35 -0

@@ -0,0 +1,35 @@
	1	+	package dto
	2	+
	3	+	// ConfigResponse represents server configuration.
	4	+	type ConfigResponse struct {
	5	+	Server ServerConfig `json:"server"`
	6	+	AutoRoute AutoRouteConfig `json:"auto_route"`
	7	+	NetworkIsolation NetworkIsolationConfig `json:"network_isolation"`
	8	+	Routes []Route `json:"routes"`
	9	+	ExternalRoutes []ExternalRoute `json:"external_routes"`
	10	+	}
	11	+
	12	+	// ServerConfig represents server config details.
	13	+	type ServerConfig struct {
	14	+	Port int `json:"port"`
	15	+	RegistryPort int `json:"registry_port"`
	16	+	RegistryDomain string `json:"registry_domain"`
	17	+	DataDir string `json:"data_dir"`
	18	+	}
	19	+
	20	+	// AutoRouteConfig represents auto-route config details.
	21	+	type AutoRouteConfig struct {
	22	+	Enabled bool `json:"enabled"`
	23	+	}
	24	+
	25	+	// NetworkIsolationConfig represents network isolation settings.
	26	+	type NetworkIsolationConfig struct {
	27	+	Enabled bool `json:"enabled"`
	28	+	Prefix string `json:"prefix"`
	29	+	}
	30	+
	31	+	// ExternalRoute represents an external route config entry.
	32	+	type ExternalRoute struct {
	33	+	Domain string `json:"domain"`
	34	+	Target string `json:"target"`
	35	+	}

@@ -0,0 +1,35 @@
	1	+	package dto
	2	+
	3	+	// ConfigResponse represents server configuration.
	4	+	type ConfigResponse struct {
	5	+	Server ServerConfig `json:"server"`
	6	+	AutoRoute AutoRouteConfig `json:"auto_route"`
	7	+	NetworkIsolation NetworkIsolationConfig `json:"network_isolation"`
	8	+	Routes []Route `json:"routes"`
	9	+	ExternalRoutes []ExternalRoute `json:"external_routes"`
	10	+	}
	11	+
	12	+	// ServerConfig represents server config details.
	13	+	type ServerConfig struct {
	14	+	Port int `json:"port"`
	15	+	RegistryPort int `json:"registry_port"`
	16	+	RegistryDomain string `json:"registry_domain"`
	17	+	DataDir string `json:"data_dir"`
	18	+	}
	19	+
	20	+	// AutoRouteConfig represents auto-route config details.
	21	+	type AutoRouteConfig struct {
	22	+	Enabled bool `json:"enabled"`
	23	+	}
	24	+
	25	+	// NetworkIsolationConfig represents network isolation settings.
	26	+	type NetworkIsolationConfig struct {
	27	+	Enabled bool `json:"enabled"`
	28	+	Prefix string `json:"prefix"`
	29	+	}
	30	+
	31	+	// ExternalRoute represents an external route config entry.
	32	+	type ExternalRoute struct {
	33	+	Domain string `json:"domain"`
	34	+	Target string `json:"target"`
	35	+	}

A internal/adapters/dto/admin_deploy.go +8 -0

@@ -0,0 +1,8 @@
	1	+	package dto
	2	+
	3	+	// DeployResponse represents a deployment response.
	4	+	type DeployResponse struct {
	5	+	Status string `json:"status"`
	6	+	ContainerID string `json:"container_id"`
	7	+	Domain string `json:"domain"`
	8	+	}

@@ -0,0 +1,8 @@
	1	+	package dto
	2	+
	3	+	// DeployResponse represents a deployment response.
	4	+	type DeployResponse struct {
	5	+	Status string `json:"status"`
	6	+	ContainerID string `json:"container_id"`
	7	+	Domain string `json:"domain"`
	8	+	}

A internal/adapters/dto/admin_health.go +15 -0

@@ -0,0 +1,15 @@
	1	+	package dto
	2	+
	3	+	// HealthStatus represents health data for a route.
	4	+	type HealthStatus struct {
	5	+	ContainerStatus string `json:"container_status"`
	6	+	HTTPStatus int `json:"http_status"`
	7	+	ResponseTimeMs int64 `json:"response_time_ms"`
	8	+	Healthy bool `json:"healthy"`
	9	+	Error string `json:"error"`
	10	+	}
	11	+
	12	+	// HealthResponse represents the health status for all routes.
	13	+	type HealthResponse struct {
	14	+	Health map[string]HealthStatus `json:"health"`
	15	+	}

@@ -0,0 +1,15 @@
	1	+	package dto
	2	+
	3	+	// HealthStatus represents health data for a route.
	4	+	type HealthStatus struct {
	5	+	ContainerStatus string `json:"container_status"`
	6	+	HTTPStatus int `json:"http_status"`
	7	+	ResponseTimeMs int64 `json:"response_time_ms"`
	8	+	Healthy bool `json:"healthy"`
	9	+	Error string `json:"error"`
	10	+	}
	11	+
	12	+	// HealthResponse represents the health status for all routes.
	13	+	type HealthResponse struct {
	14	+	Health map[string]HealthStatus `json:"health"`
	15	+	}

A internal/adapters/dto/admin_logs.go +12 -0

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// ProcessLogsResponse represents process log response.
	4	+	type ProcessLogsResponse struct {
	5	+	Lines []string `json:"lines"`
	6	+	}
	7	+
	8	+	// ContainerLogsResponse represents container log response.
	9	+	type ContainerLogsResponse struct {
	10	+	Domain string `json:"domain"`
	11	+	Lines []string `json:"lines"`
	12	+	}

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// ProcessLogsResponse represents process log response.
	4	+	type ProcessLogsResponse struct {
	5	+	Lines []string `json:"lines"`
	6	+	}
	7	+
	8	+	// ContainerLogsResponse represents container log response.
	9	+	type ContainerLogsResponse struct {
	10	+	Domain string `json:"domain"`
	11	+	Lines []string `json:"lines"`
	12	+	}

A internal/adapters/dto/admin_networks.go +15 -0

@@ -0,0 +1,15 @@
	1	+	package dto
	2	+
	3	+	// Network represents a network in API responses.
	4	+	type Network struct {
	5	+	ID string `json:"id"`
	6	+	Name string `json:"name"`
	7	+	Driver string `json:"driver"`
	8	+	Containers []string `json:"containers"`
	9	+	Labels map[string]string `json:"labels"`
	10	+	}
	11	+
	12	+	// NetworksResponse represents a list of networks.
	13	+	type NetworksResponse struct {
	14	+	Networks []Network `json:"networks"`
	15	+	}

@@ -0,0 +1,15 @@
	1	+	package dto
	2	+
	3	+	// Network represents a network in API responses.
	4	+	type Network struct {
	5	+	ID string `json:"id"`
	6	+	Name string `json:"name"`
	7	+	Driver string `json:"driver"`
	8	+	Containers []string `json:"containers"`
	9	+	Labels map[string]string `json:"labels"`
	10	+	}
	11	+
	12	+	// NetworksResponse represents a list of networks.
	13	+	type NetworksResponse struct {
	14	+	Networks []Network `json:"networks"`
	15	+	}

A internal/adapters/dto/admin_reload.go +6 -0

@@ -0,0 +1,6 @@
	1	+	package dto
	2	+
	3	+	// ReloadResponse represents a reload response.
	4	+	type ReloadResponse struct {
	5	+	Status string `json:"status"`
	6	+	}

@@ -0,0 +1,6 @@
	1	+	package dto
	2	+
	3	+	// ReloadResponse represents a reload response.
	4	+	type ReloadResponse struct {
	5	+	Status string `json:"status"`
	6	+	}

R internal/adapters/dto/route.go → internal/adapters/dto/admin_route.go +27 -0 renamed, 50% similar

@@ -1,6 +1,13 @@
1	1		// Package dto provides shared data transfer objects for API responses.
2	2		package dto
3	3
	4	+	// Route represents route configuration in API responses.
	5	+	type Route struct {
	6	+	Domain string `json:"domain"`
	7	+	Image string `json:"image"`
	8	+	HTTPS bool `json:"https"`
	9	+	}
	10	+
4	11		// RouteInfo represents route details in API responses.
5	12		type RouteInfo struct {
6	13		Domain string `json:"domain"`

@@ -18,3 +25,23 @@ type Attachment struct {
18	25		ContainerID string `json:"container_id"`
19	26		Status string `json:"status"`
20	27		}
	28	+
	29	+	// RoutesResponse represents a list of routes.
	30	+	type RoutesResponse struct {
	31	+	Routes []Route `json:"routes"`
	32	+	}
	33	+
	34	+	// RoutesDetailResponse represents a detailed list of routes.
	35	+	type RoutesDetailResponse struct {
	36	+	Routes []RouteInfo `json:"routes"`
	37	+	}
	38	+
	39	+	// AttachmentsResponse represents a list of attachments for a route.
	40	+	type AttachmentsResponse struct {
	41	+	Attachments []Attachment `json:"attachments"`
	42	+	}
	43	+
	44	+	// RouteDeleteResponse represents a route removal response.
	45	+	type RouteDeleteResponse struct {
	46	+	Status string `json:"status"`
	47	+	}

@@ -1,6 +1,13 @@
1	// Package dto provides shared data transfer objects for API responses.	1		// Package dto provides shared data transfer objects for API responses.
2	package dto	2		package dto
3		3
		4	+	// Route represents route configuration in API responses.
		5	+	type Route struct {
		6	+	Domain string `json:"domain"`
		7	+	Image string `json:"image"`
		8	+	HTTPS bool `json:"https"`
		9	+	}
		10	+
4	// RouteInfo represents route details in API responses.	11		// RouteInfo represents route details in API responses.
5	type RouteInfo struct {	12		type RouteInfo struct {
6	Domain string `json:"domain"`	13		Domain string `json:"domain"`

@@ -18,3 +25,23 @@ type Attachment struct {
18	ContainerID string `json:"container_id"`	25		ContainerID string `json:"container_id"`
19	Status string `json:"status"`	26		Status string `json:"status"`
20	}	27		}
		28	+
		29	+	// RoutesResponse represents a list of routes.
		30	+	type RoutesResponse struct {
		31	+	Routes []Route `json:"routes"`
		32	+	}
		33	+
		34	+	// RoutesDetailResponse represents a detailed list of routes.
		35	+	type RoutesDetailResponse struct {
		36	+	Routes []RouteInfo `json:"routes"`
		37	+	}
		38	+
		39	+	// AttachmentsResponse represents a list of attachments for a route.
		40	+	type AttachmentsResponse struct {
		41	+	Attachments []Attachment `json:"attachments"`
		42	+	}
		43	+
		44	+	// RouteDeleteResponse represents a route removal response.
		45	+	type RouteDeleteResponse struct {
		46	+	Status string `json:"status"`
		47	+	}

A internal/adapters/dto/admin_secrets.go +12 -0

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// SecretsListResponse represents a list of secret keys for a domain.
	4	+	type SecretsListResponse struct {
	5	+	Domain string `json:"domain"`
	6	+	Keys []string `json:"keys"`
	7	+	}
	8	+
	9	+	// SecretsStatusResponse represents a secrets write response.
	10	+	type SecretsStatusResponse struct {
	11	+	Status string `json:"status"`
	12	+	}

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// SecretsListResponse represents a list of secret keys for a domain.
	4	+	type SecretsListResponse struct {
	5	+	Domain string `json:"domain"`
	6	+	Keys []string `json:"keys"`
	7	+	}
	8	+
	9	+	// SecretsStatusResponse represents a secrets write response.
	10	+	type SecretsStatusResponse struct {
	11	+	Status string `json:"status"`
	12	+	}

A internal/adapters/dto/admin_status.go +12 -0

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// StatusResponse represents admin status information.
	4	+	type StatusResponse struct {
	5	+	Routes int `json:"routes"`
	6	+	RegistryDomain string `json:"registry_domain"`
	7	+	RegistryPort int `json:"registry_port"`
	8	+	ServerPort int `json:"server_port"`
	9	+	AutoRoute bool `json:"auto_route"`
	10	+	NetworkIsolation bool `json:"network_isolation"`
	11	+	ContainerStatuses map[string]string `json:"container_status"`
	12	+	}

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// StatusResponse represents admin status information.
	4	+	type StatusResponse struct {
	5	+	Routes int `json:"routes"`
	6	+	RegistryDomain string `json:"registry_domain"`
	7	+	RegistryPort int `json:"registry_port"`
	8	+	ServerPort int `json:"server_port"`
	9	+	AutoRoute bool `json:"auto_route"`
	10	+	NetworkIsolation bool `json:"network_isolation"`
	11	+	ContainerStatuses map[string]string `json:"container_status"`
	12	+	}

A internal/adapters/dto/error.go +6 -0

@@ -0,0 +1,6 @@
	1	+	package dto
	2	+
	3	+	// ErrorResponse represents a common API error response.
	4	+	type ErrorResponse struct {
	5	+	Error string `json:"error"`
	6	+	}

@@ -0,0 +1,6 @@
	1	+	package dto
	2	+
	3	+	// ErrorResponse represents a common API error response.
	4	+	type ErrorResponse struct {
	5	+	Error string `json:"error"`
	6	+	}

A internal/adapters/dto/registry_errors.go +12 -0

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// RegistryErrorItem represents an individual registry error.
	4	+	type RegistryErrorItem struct {
	5	+	Code string `json:"code"`
	6	+	Message string `json:"message"`
	7	+	}
	8	+
	9	+	// RegistryErrorResponse represents registry errors.
	10	+	type RegistryErrorResponse struct {
	11	+	Errors []RegistryErrorItem `json:"errors"`
	12	+	}

@@ -0,0 +1,12 @@
	1	+	package dto
	2	+
	3	+	// RegistryErrorItem represents an individual registry error.
	4	+	type RegistryErrorItem struct {
	5	+	Code string `json:"code"`
	6	+	Message string `json:"message"`
	7	+	}
	8	+
	9	+	// RegistryErrorResponse represents registry errors.
	10	+	type RegistryErrorResponse struct {
	11	+	Errors []RegistryErrorItem `json:"errors"`
	12	+	}

A internal/adapters/dto/registry_tags.go +7 -0

@@ -0,0 +1,7 @@
	1	+	package dto
	2	+
	3	+	// TagListResponse represents registry tag list response.
	4	+	type TagListResponse struct {
	5	+	Name string `json:"name"`
	6	+	Tags []string `json:"tags"`
	7	+	}

@@ -0,0 +1,7 @@
	1	+	package dto
	2	+
	3	+	// TagListResponse represents registry tag list response.
	4	+	type TagListResponse struct {
	5	+	Name string `json:"name"`
	6	+	Tags []string `json:"tags"`
	7	+	}

A internal/adapters/dto/registry_token.go +9 -0

@@ -0,0 +1,9 @@
	1	+	package dto
	2	+
	3	+	// TokenResponse represents the response from the token server.
	4	+	type TokenResponse struct {
	5	+	Token string `json:"token"`
	6	+	AccessToken string `json:"access_token,omitempty"`
	7	+	ExpiresIn int `json:"expires_in,omitempty"`
	8	+	IssuedAt string `json:"issued_at,omitempty"`
	9	+	}

@@ -0,0 +1,9 @@
	1	+	package dto
	2	+
	3	+	// TokenResponse represents the response from the token server.
	4	+	type TokenResponse struct {
	5	+	Token string `json:"token"`
	6	+	AccessToken string `json:"access_token,omitempty"`
	7	+	ExpiresIn int `json:"expires_in,omitempty"`
	8	+	IssuedAt string `json:"issued_at,omitempty"`
	9	+	}

M internal/adapters/in/cli/routes.go +26 -19


@@ -23,6 +23,10 @@ var configPath string
23	23		// For tags, truncates to maxLen with ellipsis if needed.
24	24		func truncateImage(image string, maxLen int) string {
25	25		// Handle digest references: image@sha256:abc123...
	26	+	if maxLen <= 0 {
	27	+	return ""
	28	+	}
	29	+
26	30		if idx := strings.Index(image, "@sha256:"); idx != -1 {
27	31		name := image[:idx]
28	32		digest := image[idx+8:] // Skip "@sha256:"

@@ -30,37 +34,40 @@ func truncateImage(image string, maxLen int) string {
30	34		digest = digest[:12]
31	35		}
32	36		short := fmt.Sprintf("%s@sha256:%s", name, digest)
33		-	if len(short) > maxLen {
34		-	// Truncate from the end to maintain valid reference format
35		-	if maxLen <= 3 {
36		-	return short[:maxLen]
37		-	}
38		-	return short[:maxLen-3] + "..."
	37	+	if len(short) <= maxLen {
	38	+	return short
39	39		}
40		-	return short
	40	+	// Truncate from the end to maintain valid reference format
	41	+	if maxLen <= 3 {
	42	+	return short[:maxLen]
	43	+	}
	44	+	return short[:maxLen-3] + "..."
41	45		}
42	46
43	47		// Regular tag: truncate if needed
44		-	if len(image) > maxLen {
45		-	if maxLen <= 3 {
46		-	return image[:maxLen]
47		-	}
48		-	return image[:maxLen-3] + "..."
	48	+	if len(image) <= maxLen {
	49	+	return image
	50	+	}
	51	+	if maxLen <= 3 {
	52	+	return image[:maxLen]
49	53		}
50		-	return image
	54	+	return image[:maxLen-3] + "..."
51	55		}
52	56
53	57		func truncateNetwork(network string, maxLen int) string {
54	58		if network == "" \|\| network == "-" {
55	59		return "-"
56	60		}
57		-	if len(network) > maxLen {
58		-	if maxLen <= 3 {
59		-	return network[:maxLen]
60		-	}
61		-	return network[:maxLen-3] + "..."
	61	+	if maxLen <= 0 {
	62	+	return ""
	63	+	}
	64	+	if len(network) <= maxLen {
	65	+	return network
	66	+	}
	67	+	if maxLen <= 3 {
	68	+	return network[:maxLen]
62	69		}
63		-	return network
	70	+	return network[:maxLen-3] + "..."
64	71		}
65	72
66	73		// newRoutesCmd creates the routes command group.

 // For tags, truncates to maxLen with ellipsis if needed.
 func truncateImage(image string, maxLen int) string {
 	// Handle digest references: image@sha256:abc123...
+	if maxLen <= 0 {
+		return ""
+	}
 	if idx := strings.Index(image, "@sha256:"); idx != -1 {
 		name := image[:idx]
 		digest := image[idx+8:] // Skip "@sha256:"
 			digest = digest[:12]
 		}
 		short := fmt.Sprintf("%s@sha256:%s", name, digest)
-		if len(short) > maxLen {
+		if len(short) <= maxLen {
-			// Truncate from the end to maintain valid reference format
+			return short
-			if maxLen <= 3 {
-				return short[:maxLen]
-			}
-			return short[:maxLen-3] + "..."
 		}
-		return short
+		// Truncate from the end to maintain valid reference format
+		if maxLen <= 3 {
+			return short[:maxLen]
+		}
+		return short[:maxLen-3] + "..."
 	}
 	// Regular tag: truncate if needed
-	if len(image) > maxLen {
+	if len(image) <= maxLen {
-		if maxLen <= 3 {
+		return image
-			return image[:maxLen]
+	}
-		}
+	if maxLen <= 3 {
-		return image[:maxLen-3] + "..."
+		return image[:maxLen]
 	}
-	return image
+	return image[:maxLen-3] + "..."
 }
 func truncateNetwork(network string, maxLen int) string {
 	if network == "" || network == "-" {
 		return "-"
 	}
-	if len(network) > maxLen {
+	if maxLen <= 0 {
-		if maxLen <= 3 {
+		return ""
-			return network[:maxLen]
+	}
-		}
+	if len(network) <= maxLen {
-		return network[:maxLen-3] + "..."
+		return network
+	}
+	if maxLen <= 3 {
+		return network[:maxLen]
 	}
-	return network
+	return network[:maxLen-3] + "..."
 }
 // newRoutesCmd creates the routes command group.

A internal/adapters/in/cli/routes_test.go +181 -0

@@ -0,0 +1,181 @@
	1	+	package cli
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/assert"
	7	+	)
	8	+
	9	+	func TestTruncateImage(t *testing.T) {
	10	+	tests := []struct {
	11	+	name string
	12	+	image string
	13	+	maxLen int
	14	+	expected string
	15	+	}{
	16	+	// Basic cases - no truncation needed
	17	+	{
	18	+	name: "short image fits",
	19	+	image: "nginx:latest",
	20	+	maxLen: 20,
	21	+	expected: "nginx:latest",
	22	+	},
	23	+	{
	24	+	name: "exact fit",
	25	+	image: "nginx:latest",
	26	+	maxLen: 12,
	27	+	expected: "nginx:latest",
	28	+	},
	29	+
	30	+	// Regular tag truncation
	31	+	{
	32	+	name: "truncate long tag with ellipsis",
	33	+	image: "registry.test.com/test:v1234567890",
	34	+	maxLen: 30,
	35	+	expected: "registry.test.com/test:v123...",
	36	+	},
	37	+	{
	38	+	name: "truncate very long image",
	39	+	image: "registry.example.com/organization/project/image:v1.2.3-beta.4",
	40	+	maxLen: 35,
	41	+	expected: "registry.example.com/organizatio...",
	42	+	},
	43	+
	44	+	// Digest truncation
	45	+	{
	46	+	name: "digest shortened to 12 chars",
	47	+	image: "myapp@sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4",
	48	+	maxLen: 50,
	49	+	expected: "myapp@sha256:a3ed95caeb02",
	50	+	},
	51	+	{
	52	+	name: "digest truncated with ellipsis when too long",
	53	+	image: "registry.example.com/org/app@sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4",
	54	+	maxLen: 35,
	55	+	expected: "registry.example.com/org/app@sha...",
	56	+	},
	57	+	{
	58	+	name: "short digest fits",
	59	+	image: "app@sha256:abc123",
	60	+	maxLen: 30,
	61	+	expected: "app@sha256:abc123",
	62	+	},
	63	+
	64	+	// Edge cases
	65	+	{
	66	+	name: "maxLen zero returns empty",
	67	+	image: "nginx:latest",
	68	+	maxLen: 0,
	69	+	expected: "",
	70	+	},
	71	+	{
	72	+	name: "maxLen negative returns empty",
	73	+	image: "nginx:latest",
	74	+	maxLen: -1,
	75	+	expected: "",
	76	+	},
	77	+	{
	78	+	name: "maxLen 3 or less - no ellipsis",
	79	+	image: "nginx:latest",
	80	+	maxLen: 3,
	81	+	expected: "ngi",
	82	+	},
	83	+	{
	84	+	name: "maxLen 4 - truncate with ellipsis",
	85	+	image: "nginx:latest",
	86	+	maxLen: 4,
	87	+	expected: "n...",
	88	+	},
	89	+	{
	90	+	name: "empty image",
	91	+	image: "",
	92	+	maxLen: 10,
	93	+	expected: "",
	94	+	},
	95	+	}
	96	+
	97	+	for _, tt := range tests {
	98	+	t.Run(tt.name, func(t *testing.T) {
	99	+	result := truncateImage(tt.image, tt.maxLen)
	100	+	assert.Equal(t, tt.expected, result)
	101	+	})
	102	+	}
	103	+	}
	104	+
	105	+	func TestTruncateNetwork(t *testing.T) {
	106	+	tests := []struct {
	107	+	name string
	108	+	network string
	109	+	maxLen int
	110	+	expected string
	111	+	}{
	112	+	// Basic cases
	113	+	{
	114	+	name: "short network fits",
	115	+	network: "gordon-net",
	116	+	maxLen: 20,
	117	+	expected: "gordon-net",
	118	+	},
	119	+	{
	120	+	name: "exact fit",
	121	+	network: "gordon-net",
	122	+	maxLen: 10,
	123	+	expected: "gordon-net",
	124	+	},
	125	+
	126	+	// Truncation
	127	+	{
	128	+	name: "truncate long network with ellipsis",
	129	+	network: "gordon-my-very-long-network-name",
	130	+	maxLen: 20,
	131	+	expected: "gordon-my-very-lo...",
	132	+	},
	133	+
	134	+	// Special values
	135	+	{
	136	+	name: "empty returns dash",
	137	+	network: "",
	138	+	maxLen: 10,
	139	+	expected: "-",
	140	+	},
	141	+	{
	142	+	name: "dash returns dash",
	143	+	network: "-",
	144	+	maxLen: 10,
	145	+	expected: "-",
	146	+	},
	147	+
	148	+	// Edge cases
	149	+	{
	150	+	name: "maxLen zero returns empty",
	151	+	network: "gordon-net",
	152	+	maxLen: 0,
	153	+	expected: "",
	154	+	},
	155	+	{
	156	+	name: "maxLen negative returns empty",
	157	+	network: "gordon-net",
	158	+	maxLen: -1,
	159	+	expected: "",
	160	+	},
	161	+	{
	162	+	name: "maxLen 3 or less - no ellipsis",
	163	+	network: "gordon-net",
	164	+	maxLen: 3,
	165	+	expected: "gor",
	166	+	},
	167	+	{
	168	+	name: "maxLen 4 - truncate with ellipsis",
	169	+	network: "gordon-net",
	170	+	maxLen: 4,
	171	+	expected: "g...",
	172	+	},
	173	+	}
	174	+
	175	+	for _, tt := range tests {
	176	+	t.Run(tt.name, func(t *testing.T) {
	177	+	result := truncateNetwork(tt.network, tt.maxLen)
	178	+	assert.Equal(t, tt.expected, result)
	179	+	})
	180	+	}
	181	+	}

@@ -0,0 +1,181 @@
	1	+	package cli
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/stretchr/testify/assert"
	7	+	)
	8	+
	9	+	func TestTruncateImage(t *testing.T) {
	10	+	tests := []struct {
	11	+	name string
	12	+	image string
	13	+	maxLen int
	14	+	expected string
	15	+	}{
	16	+	// Basic cases - no truncation needed
	17	+	{
	18	+	name: "short image fits",
	19	+	image: "nginx:latest",
	20	+	maxLen: 20,
	21	+	expected: "nginx:latest",
	22	+	},
	23	+	{
	24	+	name: "exact fit",
	25	+	image: "nginx:latest",
	26	+	maxLen: 12,
	27	+	expected: "nginx:latest",
	28	+	},
	29	+
	30	+	// Regular tag truncation
	31	+	{
	32	+	name: "truncate long tag with ellipsis",
	33	+	image: "registry.test.com/test:v1234567890",
	34	+	maxLen: 30,
	35	+	expected: "registry.test.com/test:v123...",
	36	+	},
	37	+	{
	38	+	name: "truncate very long image",
	39	+	image: "registry.example.com/organization/project/image:v1.2.3-beta.4",
	40	+	maxLen: 35,
	41	+	expected: "registry.example.com/organizatio...",
	42	+	},
	43	+
	44	+	// Digest truncation
	45	+	{
	46	+	name: "digest shortened to 12 chars",
	47	+	image: "myapp@sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4",
	48	+	maxLen: 50,
	49	+	expected: "myapp@sha256:a3ed95caeb02",
	50	+	},
	51	+	{
	52	+	name: "digest truncated with ellipsis when too long",
	53	+	image: "registry.example.com/org/app@sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4",
	54	+	maxLen: 35,
	55	+	expected: "registry.example.com/org/app@sha...",
	56	+	},
	57	+	{
	58	+	name: "short digest fits",
	59	+	image: "app@sha256:abc123",
	60	+	maxLen: 30,
	61	+	expected: "app@sha256:abc123",
	62	+	},
	63	+
	64	+	// Edge cases
	65	+	{
	66	+	name: "maxLen zero returns empty",
	67	+	image: "nginx:latest",
	68	+	maxLen: 0,
	69	+	expected: "",
	70	+	},
	71	+	{
	72	+	name: "maxLen negative returns empty",
	73	+	image: "nginx:latest",
	74	+	maxLen: -1,
	75	+	expected: "",
	76	+	},
	77	+	{
	78	+	name: "maxLen 3 or less - no ellipsis",
	79	+	image: "nginx:latest",
	80	+	maxLen: 3,
	81	+	expected: "ngi",
	82	+	},
	83	+	{
	84	+	name: "maxLen 4 - truncate with ellipsis",
	85	+	image: "nginx:latest",
	86	+	maxLen: 4,
	87	+	expected: "n...",
	88	+	},
	89	+	{
	90	+	name: "empty image",
	91	+	image: "",
	92	+	maxLen: 10,
	93	+	expected: "",
	94	+	},
	95	+	}
	96	+
	97	+	for _, tt := range tests {
	98	+	t.Run(tt.name, func(t *testing.T) {
	99	+	result := truncateImage(tt.image, tt.maxLen)
	100	+	assert.Equal(t, tt.expected, result)
	101	+	})
	102	+	}
	103	+	}
	104	+
	105	+	func TestTruncateNetwork(t *testing.T) {
	106	+	tests := []struct {
	107	+	name string
	108	+	network string
	109	+	maxLen int
	110	+	expected string
	111	+	}{
	112	+	// Basic cases
	113	+	{
	114	+	name: "short network fits",
	115	+	network: "gordon-net",
	116	+	maxLen: 20,
	117	+	expected: "gordon-net",
	118	+	},
	119	+	{
	120	+	name: "exact fit",
	121	+	network: "gordon-net",
	122	+	maxLen: 10,
	123	+	expected: "gordon-net",
	124	+	},
	125	+
	126	+	// Truncation
	127	+	{
	128	+	name: "truncate long network with ellipsis",
	129	+	network: "gordon-my-very-long-network-name",
	130	+	maxLen: 20,
	131	+	expected: "gordon-my-very-lo...",
	132	+	},
	133	+
	134	+	// Special values
	135	+	{
	136	+	name: "empty returns dash",
	137	+	network: "",
	138	+	maxLen: 10,
	139	+	expected: "-",
	140	+	},
	141	+	{
	142	+	name: "dash returns dash",
	143	+	network: "-",
	144	+	maxLen: 10,
	145	+	expected: "-",
	146	+	},
	147	+
	148	+	// Edge cases
	149	+	{
	150	+	name: "maxLen zero returns empty",
	151	+	network: "gordon-net",
	152	+	maxLen: 0,
	153	+	expected: "",
	154	+	},
	155	+	{
	156	+	name: "maxLen negative returns empty",
	157	+	network: "gordon-net",
	158	+	maxLen: -1,
	159	+	expected: "",
	160	+	},
	161	+	{
	162	+	name: "maxLen 3 or less - no ellipsis",
	163	+	network: "gordon-net",
	164	+	maxLen: 3,
	165	+	expected: "gor",
	166	+	},
	167	+	{
	168	+	name: "maxLen 4 - truncate with ellipsis",
	169	+	network: "gordon-net",
	170	+	maxLen: 4,
	171	+	expected: "g...",
	172	+	},
	173	+	}
	174	+
	175	+	for _, tt := range tests {
	176	+	t.Run(tt.name, func(t *testing.T) {
	177	+	result := truncateNetwork(tt.network, tt.maxLen)
	178	+	assert.Equal(t, tt.expected, result)
	179	+	})
	180	+	}
	181	+	}

M internal/adapters/in/http/admin/handler.go +105 -55


@@ -38,6 +38,7 @@ type Handler struct {
38	38		// Type aliases for API responses using shared DTO types.
39	39		type routeInfoResponse = dto.RouteInfo
40	40		type attachmentResponse = dto.Attachment
	41	+	type routeResponse = dto.Route
41	42
42	43		// toAttachmentResponse converts a domain.Attachment to a dto.Attachment.
43	44		func toAttachmentResponse(a domain.Attachment) dto.Attachment {

@@ -65,6 +66,15 @@ func toRouteInfoResponse(r domain.RouteInfo) dto.RouteInfo {
65	66		}
66	67		}
67	68
	69	+	// toRouteResponse converts a domain.Route to a dto.Route.
	70	+	func toRouteResponse(r domain.Route) dto.Route {
	71	+	return dto.Route{
	72	+	Domain: r.Domain,
	73	+	Image: r.Image,
	74	+	HTTPS: r.HTTPS,
	75	+	}
	76	+	}
	77	+
68	78		// NewHandler creates a new admin HTTP handler.
69	79		func NewHandler(
70	80		configSvc in.ConfigService,

@@ -131,7 +141,7 @@ func (h Handler) handleAdminRoutes(w http.ResponseWriter, r http.Request) {
131	141		case path == "/config":
132	142		h.handleConfig(w, r)
133	143		default:
134		-	http.NotFound(w, r)
	144	+	h.sendError(w, http.StatusNotFound, "route not found")
135	145		}
136	146		}
137	147

@@ -146,7 +156,7 @@ func (h *Handler) sendJSON(w http.ResponseWriter, status int, data any) {
146	156
147	157		// sendError sends an error response.
148	158		func (h *Handler) sendError(w http.ResponseWriter, status int, message string) {
149		-	h.sendJSON(w, status, map[string]string{"error": message})
	159	+	h.sendJSON(w, status, dto.ErrorResponse{Error: message})
150	160		}
151	161
152	162		// handleRoutes handles /admin/routes endpoints.

@@ -187,12 +197,16 @@ func (h Handler) handleRoutesGet(w http.ResponseWriter, r http.Request, routeD
187	197		for _, route := range routes {
188	198		response = append(response, toRouteInfoResponse(route))
189	199		}
190		-	h.sendJSON(w, http.StatusOK, map[string]any{"routes": response})
	200	+	h.sendJSON(w, http.StatusOK, dto.RoutesDetailResponse{Routes: response})
191	201		return
192	202		}
193	203
194	204		routes := h.configSvc.GetRoutes(ctx)
195		-	h.sendJSON(w, http.StatusOK, map[string]any{"routes": routes})
	205	+	response := make([]routeResponse, 0, len(routes))
	206	+	for _, route := range routes {
	207	+	response = append(response, toRouteResponse(route))
	208	+	}
	209	+	h.sendJSON(w, http.StatusOK, dto.RoutesResponse{Routes: response})
196	210		return
197	211		}
198	212

@@ -207,7 +221,7 @@ func (h Handler) handleRoutesGet(w http.ResponseWriter, r http.Request, routeD
207	221		for _, attachment := range attachments {
208	222		response = append(response, toAttachmentResponse(attachment))
209	223		}
210		-	h.sendJSON(w, http.StatusOK, map[string]any{"attachments": response})
	224	+	h.sendJSON(w, http.StatusOK, dto.AttachmentsResponse{Attachments: response})
211	225		return
212	226		}
213	227

@@ -216,7 +230,7 @@ func (h Handler) handleRoutesGet(w http.ResponseWriter, r http.Request, routeD
216	230		h.sendError(w, http.StatusNotFound, "route not found")
217	231		return
218	232		}
219		-	h.sendJSON(w, http.StatusOK, route)
	233	+	h.sendJSON(w, http.StatusOK, toRouteResponse(*route))
220	234		}
221	235
222	236		func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {

@@ -251,7 +265,7 @@ func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {
251	265		}
252	266
253	267		log.Info().Str("domain", route.Domain).Str("image", route.Image).Msg("route added")
254		-	h.sendJSON(w, http.StatusCreated, route)
	268	+	h.sendJSON(w, http.StatusCreated, toRouteResponse(route))
255	269		}
256	270
257	271		func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeDomain string) {

@@ -295,7 +309,7 @@ func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeD
295	309		}
296	310
297	311		log.Info().Str("domain", route.Domain).Str("image", route.Image).Msg("route updated")
298		-	h.sendJSON(w, http.StatusOK, route)
	312	+	h.sendJSON(w, http.StatusOK, toRouteResponse(route))
299	313		}
300	314
301	315		func (h Handler) handleRoutesDelete(w http.ResponseWriter, r http.Request, routeDomain string) {

@@ -320,7 +334,7 @@ func (h Handler) handleRoutesDelete(w http.ResponseWriter, r http.Request, rou
320	334		}
321	335
322	336		log.Info().Str("domain", routeDomain).Msg("route removed")
323		-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "removed"})
	337	+	h.sendJSON(w, http.StatusOK, dto.RouteDeleteResponse{Status: "removed"})
324	338		}
325	339
326	340		func (h Handler) handleNetworks(w http.ResponseWriter, r http.Request) {

@@ -342,7 +356,28 @@ func (h Handler) handleNetworks(w http.ResponseWriter, r http.Request) {
342	356		return
343	357		}
344	358
345		-	h.sendJSON(w, http.StatusOK, map[string]any{"networks": networks})
	359	+	response := make([]dto.Network, 0, len(networks))
	360	+	for _, network := range networks {
	361	+	if network == nil {
	362	+	continue
	363	+	}
	364	+	var labelsCopy map[string]string
	365	+	if network.Labels != nil {
	366	+	labelsCopy = make(map[string]string, len(network.Labels))
	367	+	for key, value := range network.Labels {
	368	+	labelsCopy[key] = value
	369	+	}
	370	+	}
	371	+	response = append(response, dto.Network{
	372	+	ID: network.ID,
	373	+	Name: network.Name,
	374	+	Driver: network.Driver,
	375	+	Containers: append([]string{}, network.Containers...),
	376	+	Labels: labelsCopy,
	377	+	})
	378	+	}
	379	+
	380	+	h.sendJSON(w, http.StatusOK, dto.NetworksResponse{Networks: response})
346	381		}
347	382
348	383		// handleSecrets handles /admin/secrets endpoints.

@@ -377,7 +412,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
377	412		h.sendError(w, http.StatusBadRequest, "invalid domain")
378	413		return
379	414		}
380		-	h.sendJSON(w, http.StatusOK, map[string]any{"domain": secretDomain, "keys": keys})
	415	+	h.sendJSON(w, http.StatusOK, dto.SecretsListResponse{Domain: secretDomain, Keys: keys})
381	416
382	417		case http.MethodPost:
383	418		// Check write permission

@@ -404,7 +439,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
404	439		}
405	440
406	441		log.Info().Str("domain", secretDomain).Int("count", len(data)).Msg("secrets set")
407		-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "updated"})
	442	+	h.sendJSON(w, http.StatusOK, dto.SecretsStatusResponse{Status: "updated"})
408	443
409	444		case http.MethodDelete:
410	445		// Check write permission

@@ -424,7 +459,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
424	459		}
425	460
426	461		log.Info().Str("domain", secretDomain).Str("key", secretKey).Msg("secret deleted")
427		-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "deleted"})
	462	+	h.sendJSON(w, http.StatusOK, dto.SecretsStatusResponse{Status: "deleted"})
428	463
429	464		default:
430	465		h.sendError(w, http.StatusMethodNotAllowed, "method not allowed")

@@ -449,19 +484,21 @@ func (h Handler) handleHealth(w http.ResponseWriter, r http.Request) {
449	484
450	485		health := h.healthSvc.CheckAllRoutes(ctx)
451	486
452		-	// Convert to JSON-friendly format
453		-	result := make(map[string]any, len(health))
454		-	for domain, h := range health {
455		-	result[domain] = map[string]any{
456		-	"container_status": h.ContainerStatus,
457		-	"http_status": h.HTTPStatus,
458		-	"response_time_ms": h.ResponseTimeMs,
459		-	"healthy": h.Healthy,
460		-	"error": h.Error,
	487	+	response := make(map[string]dto.HealthStatus, len(health))
	488	+	for domain, healthStatus := range health {
	489	+	if healthStatus == nil {
	490	+	continue
	491	+	}
	492	+	response[domain] = dto.HealthStatus{
	493	+	ContainerStatus: healthStatus.ContainerStatus,
	494	+	HTTPStatus: healthStatus.HTTPStatus,
	495	+	ResponseTimeMs: healthStatus.ResponseTimeMs,
	496	+	Healthy: healthStatus.Healthy,
	497	+	Error: healthStatus.Error,
461	498		}
462	499		}
463	500
464		-	h.sendJSON(w, http.StatusOK, map[string]any{"health": result})
	501	+	h.sendJSON(w, http.StatusOK, dto.HealthResponse{Health: response})
465	502		}
466	503
467	504		// handleStatus handles /admin/status endpoint.

@@ -492,14 +529,14 @@ func (h Handler) handleStatus(w http.ResponseWriter, r http.Request) {
492	529		statuses[route.Domain] = status
493	530		}
494	531
495		-	status := map[string]any{
496		-	"routes": len(routes),
497		-	"registry_domain": h.configSvc.GetRegistryDomain(),
498		-	"registry_port": h.configSvc.GetRegistryPort(),
499		-	"server_port": h.configSvc.GetServerPort(),
500		-	"auto_route": h.configSvc.IsAutoRouteEnabled(),
501		-	"network_isolation": h.configSvc.IsNetworkIsolationEnabled(),
502		-	"container_status": statuses,
	532	+	status := dto.StatusResponse{
	533	+	Routes: len(routes),
	534	+	RegistryDomain: h.configSvc.GetRegistryDomain(),
	535	+	RegistryPort: h.configSvc.GetRegistryPort(),
	536	+	ServerPort: h.configSvc.GetServerPort(),
	537	+	AutoRoute: h.configSvc.IsAutoRouteEnabled(),
	538	+	NetworkIsolation: h.configSvc.IsNetworkIsolationEnabled(),
	539	+	ContainerStatuses: statuses,
503	540		}
504	541
505	542		h.sendJSON(w, http.StatusOK, status)

@@ -538,7 +575,7 @@ func (h Handler) handleReload(w http.ResponseWriter, r http.Request) {
538	575		}
539	576
540	577		log.Info().Msg("config reloaded via admin API")
541		-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "reloaded"})
	578	+	h.sendJSON(w, http.StatusOK, dto.ReloadResponse{Status: "reloaded"})
542	579		}
543	580
544	581		// handleConfig handles /admin/config endpoint.

@@ -556,22 +593,37 @@ func (h Handler) handleConfig(w http.ResponseWriter, r http.Request) {
556	593		return
557	594		}
558	595
559		-	config := map[string]any{
560		-	"server": map[string]any{
561		-	"port": h.configSvc.GetServerPort(),
562		-	"registry_port": h.configSvc.GetRegistryPort(),
563		-	"registry_domain": h.configSvc.GetRegistryDomain(),
564		-	"data_dir": h.configSvc.GetDataDir(),
	596	+	routes := h.configSvc.GetRoutes(ctx)
	597	+	routeResponses := make([]dto.Route, 0, len(routes))
	598	+	for _, route := range routes {
	599	+	routeResponses = append(routeResponses, toRouteResponse(route))
	600	+	}
	601	+
	602	+	externalRoutes := h.configSvc.GetExternalRoutes()
	603	+	externalResponses := make([]dto.ExternalRoute, 0, len(externalRoutes))
	604	+	for domain, target := range externalRoutes {
	605	+	externalResponses = append(externalResponses, dto.ExternalRoute{
	606	+	Domain: domain,
	607	+	Target: target,
	608	+	})
	609	+	}
	610	+
	611	+	config := dto.ConfigResponse{
	612	+	Server: dto.ServerConfig{
	613	+	Port: h.configSvc.GetServerPort(),
	614	+	RegistryPort: h.configSvc.GetRegistryPort(),
	615	+	RegistryDomain: h.configSvc.GetRegistryDomain(),
	616	+	DataDir: h.configSvc.GetDataDir(),
565	617		},
566		-	"auto_route": map[string]any{
567		-	"enabled": h.configSvc.IsAutoRouteEnabled(),
	618	+	AutoRoute: dto.AutoRouteConfig{
	619	+	Enabled: h.configSvc.IsAutoRouteEnabled(),
568	620		},
569		-	"network_isolation": map[string]any{
570		-	"enabled": h.configSvc.IsNetworkIsolationEnabled(),
571		-	"prefix": h.configSvc.GetNetworkPrefix(),
	621	+	NetworkIsolation: dto.NetworkIsolationConfig{
	622	+	Enabled: h.configSvc.IsNetworkIsolationEnabled(),
	623	+	Prefix: h.configSvc.GetNetworkPrefix(),
572	624		},
573		-	"routes": h.configSvc.GetRoutes(ctx),
574		-	"external_routes": h.configSvc.GetExternalRoutes(),
	625	+	Routes: routeResponses,
	626	+	ExternalRoutes: externalResponses,
575	627		}
576	628
577	629		h.sendJSON(w, http.StatusOK, config)

@@ -617,10 +669,10 @@ func (h Handler) handleDeploy(w http.ResponseWriter, r http.Request, path stri
617	669		}
618	670
619	671		log.Info().Str("domain", deployDomain).Str("container_id", container.ID).Msg("container deployed via admin API")
620		-	h.sendJSON(w, http.StatusOK, map[string]any{
621		-	"status": "deployed",
622		-	"container_id": container.ID,
623		-	"domain": deployDomain,
	672	+	h.sendJSON(w, http.StatusOK, dto.DeployResponse{
	673	+	Status: "deployed",
	674	+	ContainerID: container.ID,
	675	+	Domain: deployDomain,
624	676		})
625	677		}
626	678

@@ -697,9 +749,7 @@ func (h Handler) handleProcessLogs(w http.ResponseWriter, r http.Request, line
697	749		return
698	750		}
699	751
700		-	h.sendJSON(w, http.StatusOK, map[string]any{
701		-	"lines": logLines,
702		-	})
	752	+	h.sendJSON(w, http.StatusOK, dto.ProcessLogsResponse{Lines: logLines})
703	753		}
704	754
705	755		// handleContainerLogs handles container logs for a specific domain.

@@ -721,9 +771,9 @@ func (h Handler) handleContainerLogs(w http.ResponseWriter, r http.Request, lo
721	771		return
722	772		}
723	773
724		-	h.sendJSON(w, http.StatusOK, map[string]any{
725		-	"domain": logDomain,
726		-	"lines": logLines,
	774	+	h.sendJSON(w, http.StatusOK, dto.ContainerLogsResponse{
	775	+	Domain: logDomain,
	776	+	Lines: logLines,
727	777		})
728	778		}
729	779


@@ -38,6 +38,7 @@ type Handler struct {
38		// Type aliases for API responses using shared DTO types.	38		// Type aliases for API responses using shared DTO types.
39		type routeInfoResponse = dto.RouteInfo	39		type routeInfoResponse = dto.RouteInfo
40		type attachmentResponse = dto.Attachment	40		type attachmentResponse = dto.Attachment
			41	+	type routeResponse = dto.Route
41			42
42		// toAttachmentResponse converts a domain.Attachment to a dto.Attachment.	43		// toAttachmentResponse converts a domain.Attachment to a dto.Attachment.
43		func toAttachmentResponse(a domain.Attachment) dto.Attachment {	44		func toAttachmentResponse(a domain.Attachment) dto.Attachment {

@@ -65,6 +66,15 @@ func toRouteInfoResponse(r domain.RouteInfo) dto.RouteInfo {
65		}	66		}
66		}	67		}
67			68
			69	+	// toRouteResponse converts a domain.Route to a dto.Route.
			70	+	func toRouteResponse(r domain.Route) dto.Route {
			71	+	return dto.Route{
			72	+	Domain: r.Domain,
			73	+	Image: r.Image,
			74	+	HTTPS: r.HTTPS,
			75	+	}
			76	+	}
			77	+
68		// NewHandler creates a new admin HTTP handler.	78		// NewHandler creates a new admin HTTP handler.
69		func NewHandler(	79		func NewHandler(
70		configSvc in.ConfigService,	80		configSvc in.ConfigService,

@@ -131,7 +141,7 @@ func (h Handler) handleAdminRoutes(w http.ResponseWriter, r http.Request) {
131		case path == "/config":	141		case path == "/config":
132		h.handleConfig(w, r)	142		h.handleConfig(w, r)
133		default:	143		default:
134	-	http.NotFound(w, r)	144	+	h.sendError(w, http.StatusNotFound, "route not found")
135		}	145		}
136		}	146		}
137			147

@@ -146,7 +156,7 @@ func (h *Handler) sendJSON(w http.ResponseWriter, status int, data any) {
146			156
147		// sendError sends an error response.	157		// sendError sends an error response.
148		func (h *Handler) sendError(w http.ResponseWriter, status int, message string) {	158		func (h *Handler) sendError(w http.ResponseWriter, status int, message string) {
149	-	h.sendJSON(w, status, map[string]string{"error": message})	159	+	h.sendJSON(w, status, dto.ErrorResponse{Error: message})
150		}	160		}
151			161
152		// handleRoutes handles /admin/routes endpoints.	162		// handleRoutes handles /admin/routes endpoints.

@@ -187,12 +197,16 @@ func (h Handler) handleRoutesGet(w http.ResponseWriter, r http.Request, routeD
187		for _, route := range routes {	197		for _, route := range routes {
188		response = append(response, toRouteInfoResponse(route))	198		response = append(response, toRouteInfoResponse(route))
189		}	199		}
190	-	h.sendJSON(w, http.StatusOK, map[string]any{"routes": response})	200	+	h.sendJSON(w, http.StatusOK, dto.RoutesDetailResponse{Routes: response})
191		return	201		return
192		}	202		}
193			203
194		routes := h.configSvc.GetRoutes(ctx)	204		routes := h.configSvc.GetRoutes(ctx)
195	-	h.sendJSON(w, http.StatusOK, map[string]any{"routes": routes})	205	+	response := make([]routeResponse, 0, len(routes))
			206	+	for _, route := range routes {
			207	+	response = append(response, toRouteResponse(route))
			208	+	}
			209	+	h.sendJSON(w, http.StatusOK, dto.RoutesResponse{Routes: response})
196		return	210		return
197		}	211		}
198			212

@@ -207,7 +221,7 @@ func (h Handler) handleRoutesGet(w http.ResponseWriter, r http.Request, routeD
207		for _, attachment := range attachments {	221		for _, attachment := range attachments {
208		response = append(response, toAttachmentResponse(attachment))	222		response = append(response, toAttachmentResponse(attachment))
209		}	223		}
210	-	h.sendJSON(w, http.StatusOK, map[string]any{"attachments": response})	224	+	h.sendJSON(w, http.StatusOK, dto.AttachmentsResponse{Attachments: response})
211		return	225		return
212		}	226		}
213			227

@@ -216,7 +230,7 @@ func (h Handler) handleRoutesGet(w http.ResponseWriter, r http.Request, routeD
216		h.sendError(w, http.StatusNotFound, "route not found")	230		h.sendError(w, http.StatusNotFound, "route not found")
217		return	231		return
218		}	232		}
219	-	h.sendJSON(w, http.StatusOK, route)	233	+	h.sendJSON(w, http.StatusOK, toRouteResponse(*route))
220		}	234		}
221			235
222		func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {	236		func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {

@@ -251,7 +265,7 @@ func (h Handler) handleRoutesPost(w http.ResponseWriter, r http.Request) {
251		}	265		}
252			266
253		log.Info().Str("domain", route.Domain).Str("image", route.Image).Msg("route added")	267		log.Info().Str("domain", route.Domain).Str("image", route.Image).Msg("route added")
254	-	h.sendJSON(w, http.StatusCreated, route)	268	+	h.sendJSON(w, http.StatusCreated, toRouteResponse(route))
255		}	269		}
256			270
257		func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeDomain string) {	271		func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeDomain string) {

@@ -295,7 +309,7 @@ func (h Handler) handleRoutesPut(w http.ResponseWriter, r http.Request, routeD
295		}	309		}
296			310
297		log.Info().Str("domain", route.Domain).Str("image", route.Image).Msg("route updated")	311		log.Info().Str("domain", route.Domain).Str("image", route.Image).Msg("route updated")
298	-	h.sendJSON(w, http.StatusOK, route)	312	+	h.sendJSON(w, http.StatusOK, toRouteResponse(route))
299		}	313		}
300			314
301		func (h Handler) handleRoutesDelete(w http.ResponseWriter, r http.Request, routeDomain string) {	315		func (h Handler) handleRoutesDelete(w http.ResponseWriter, r http.Request, routeDomain string) {

@@ -320,7 +334,7 @@ func (h Handler) handleRoutesDelete(w http.ResponseWriter, r http.Request, rou
320		}	334		}
321			335
322		log.Info().Str("domain", routeDomain).Msg("route removed")	336		log.Info().Str("domain", routeDomain).Msg("route removed")
323	-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "removed"})	337	+	h.sendJSON(w, http.StatusOK, dto.RouteDeleteResponse{Status: "removed"})
324		}	338		}
325			339
326		func (h Handler) handleNetworks(w http.ResponseWriter, r http.Request) {	340		func (h Handler) handleNetworks(w http.ResponseWriter, r http.Request) {

@@ -342,7 +356,28 @@ func (h Handler) handleNetworks(w http.ResponseWriter, r http.Request) {
342		return	356		return
343		}	357		}
344			358
345	-	h.sendJSON(w, http.StatusOK, map[string]any{"networks": networks})	359	+	response := make([]dto.Network, 0, len(networks))
			360	+	for _, network := range networks {
			361	+	if network == nil {
			362	+	continue
			363	+	}
			364	+	var labelsCopy map[string]string
			365	+	if network.Labels != nil {
			366	+	labelsCopy = make(map[string]string, len(network.Labels))
			367	+	for key, value := range network.Labels {
			368	+	labelsCopy[key] = value
			369	+	}
			370	+	}
			371	+	response = append(response, dto.Network{
			372	+	ID: network.ID,
			373	+	Name: network.Name,
			374	+	Driver: network.Driver,
			375	+	Containers: append([]string{}, network.Containers...),
			376	+	Labels: labelsCopy,
			377	+	})
			378	+	}
			379	+
			380	+	h.sendJSON(w, http.StatusOK, dto.NetworksResponse{Networks: response})
346		}	381		}
347			382
348		// handleSecrets handles /admin/secrets endpoints.	383		// handleSecrets handles /admin/secrets endpoints.

@@ -377,7 +412,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
377		h.sendError(w, http.StatusBadRequest, "invalid domain")	412		h.sendError(w, http.StatusBadRequest, "invalid domain")
378		return	413		return
379		}	414		}
380	-	h.sendJSON(w, http.StatusOK, map[string]any{"domain": secretDomain, "keys": keys})	415	+	h.sendJSON(w, http.StatusOK, dto.SecretsListResponse{Domain: secretDomain, Keys: keys})
381			416
382		case http.MethodPost:	417		case http.MethodPost:
383		// Check write permission	418		// Check write permission

@@ -404,7 +439,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
404		}	439		}
405			440
406		log.Info().Str("domain", secretDomain).Int("count", len(data)).Msg("secrets set")	441		log.Info().Str("domain", secretDomain).Int("count", len(data)).Msg("secrets set")
407	-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "updated"})	442	+	h.sendJSON(w, http.StatusOK, dto.SecretsStatusResponse{Status: "updated"})
408			443
409		case http.MethodDelete:	444		case http.MethodDelete:
410		// Check write permission	445		// Check write permission

@@ -424,7 +459,7 @@ func (h Handler) handleSecrets(w http.ResponseWriter, r http.Request, path str
424		}	459		}
425			460
426		log.Info().Str("domain", secretDomain).Str("key", secretKey).Msg("secret deleted")	461		log.Info().Str("domain", secretDomain).Str("key", secretKey).Msg("secret deleted")
427	-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "deleted"})	462	+	h.sendJSON(w, http.StatusOK, dto.SecretsStatusResponse{Status: "deleted"})
428			463
429		default:	464		default:
430		h.sendError(w, http.StatusMethodNotAllowed, "method not allowed")	465		h.sendError(w, http.StatusMethodNotAllowed, "method not allowed")

@@ -449,19 +484,21 @@ func (h Handler) handleHealth(w http.ResponseWriter, r http.Request) {
449			484
450		health := h.healthSvc.CheckAllRoutes(ctx)	485		health := h.healthSvc.CheckAllRoutes(ctx)
451			486
452	-	// Convert to JSON-friendly format	487	+	response := make(map[string]dto.HealthStatus, len(health))
453	-	result := make(map[string]any, len(health))	488	+	for domain, healthStatus := range health {
454	-	for domain, h := range health {	489	+	if healthStatus == nil {
455	-	result[domain] = map[string]any{	490	+	continue
456	-	"container_status": h.ContainerStatus,	491	+	}
457	-	"http_status": h.HTTPStatus,	492	+	response[domain] = dto.HealthStatus{
458	-	"response_time_ms": h.ResponseTimeMs,	493	+	ContainerStatus: healthStatus.ContainerStatus,
459	-	"healthy": h.Healthy,	494	+	HTTPStatus: healthStatus.HTTPStatus,
460	-	"error": h.Error,	495	+	ResponseTimeMs: healthStatus.ResponseTimeMs,
			496	+	Healthy: healthStatus.Healthy,
			497	+	Error: healthStatus.Error,
461		}	498		}
462		}	499		}
463			500
464	-	h.sendJSON(w, http.StatusOK, map[string]any{"health": result})	501	+	h.sendJSON(w, http.StatusOK, dto.HealthResponse{Health: response})
465		}	502		}
466			503
467		// handleStatus handles /admin/status endpoint.	504		// handleStatus handles /admin/status endpoint.

@@ -492,14 +529,14 @@ func (h Handler) handleStatus(w http.ResponseWriter, r http.Request) {
492		statuses[route.Domain] = status	529		statuses[route.Domain] = status
493		}	530		}
494			531
495	-	status := map[string]any{	532	+	status := dto.StatusResponse{
496	-	"routes": len(routes),	533	+	Routes: len(routes),
497	-	"registry_domain": h.configSvc.GetRegistryDomain(),	534	+	RegistryDomain: h.configSvc.GetRegistryDomain(),
498	-	"registry_port": h.configSvc.GetRegistryPort(),	535	+	RegistryPort: h.configSvc.GetRegistryPort(),
499	-	"server_port": h.configSvc.GetServerPort(),	536	+	ServerPort: h.configSvc.GetServerPort(),
500	-	"auto_route": h.configSvc.IsAutoRouteEnabled(),	537	+	AutoRoute: h.configSvc.IsAutoRouteEnabled(),
501	-	"network_isolation": h.configSvc.IsNetworkIsolationEnabled(),	538	+	NetworkIsolation: h.configSvc.IsNetworkIsolationEnabled(),
502	-	"container_status": statuses,	539	+	ContainerStatuses: statuses,
503		}	540		}
504			541
505		h.sendJSON(w, http.StatusOK, status)	542		h.sendJSON(w, http.StatusOK, status)

@@ -538,7 +575,7 @@ func (h Handler) handleReload(w http.ResponseWriter, r http.Request) {
538		}	575		}
539			576
540		log.Info().Msg("config reloaded via admin API")	577		log.Info().Msg("config reloaded via admin API")
541	-	h.sendJSON(w, http.StatusOK, map[string]string{"status": "reloaded"})	578	+	h.sendJSON(w, http.StatusOK, dto.ReloadResponse{Status: "reloaded"})
542		}	579		}
543			580
544		// handleConfig handles /admin/config endpoint.	581		// handleConfig handles /admin/config endpoint.

@@ -556,22 +593,37 @@ func (h Handler) handleConfig(w http.ResponseWriter, r http.Request) {
556		return	593		return
557		}	594		}
558			595
559	-	config := map[string]any{	596	+	routes := h.configSvc.GetRoutes(ctx)
560	-	"server": map[string]any{	597	+	routeResponses := make([]dto.Route, 0, len(routes))
561	-	"port": h.configSvc.GetServerPort(),	598	+	for _, route := range routes {
562	-	"registry_port": h.configSvc.GetRegistryPort(),	599	+	routeResponses = append(routeResponses, toRouteResponse(route))
563	-	"registry_domain": h.configSvc.GetRegistryDomain(),	600	+	}
564	-	"data_dir": h.configSvc.GetDataDir(),	601	+
			602	+	externalRoutes := h.configSvc.GetExternalRoutes()
			603	+	externalResponses := make([]dto.ExternalRoute, 0, len(externalRoutes))
			604	+	for domain, target := range externalRoutes {
			605	+	externalResponses = append(externalResponses, dto.ExternalRoute{
			606	+	Domain: domain,
			607	+	Target: target,
			608	+	})
			609	+	}
			610	+
			611	+	config := dto.ConfigResponse{
			612	+	Server: dto.ServerConfig{
			613	+	Port: h.configSvc.GetServerPort(),
			614	+	RegistryPort: h.configSvc.GetRegistryPort(),
			615	+	RegistryDomain: h.configSvc.GetRegistryDomain(),
			616	+	DataDir: h.configSvc.GetDataDir(),
565		},	617		},
566	-	"auto_route": map[string]any{	618	+	AutoRoute: dto.AutoRouteConfig{
567	-	"enabled": h.configSvc.IsAutoRouteEnabled(),	619	+	Enabled: h.configSvc.IsAutoRouteEnabled(),
568		},	620		},
569	-	"network_isolation": map[string]any{	621	+	NetworkIsolation: dto.NetworkIsolationConfig{
570	-	"enabled": h.configSvc.IsNetworkIsolationEnabled(),	622	+	Enabled: h.configSvc.IsNetworkIsolationEnabled(),
571	-	"prefix": h.configSvc.GetNetworkPrefix(),	623	+	Prefix: h.configSvc.GetNetworkPrefix(),
572		},	624		},
573	-	"routes": h.configSvc.GetRoutes(ctx),	625	+	Routes: routeResponses,
574	-	"external_routes": h.configSvc.GetExternalRoutes(),	626	+	ExternalRoutes: externalResponses,
575		}	627		}
576			628
577		h.sendJSON(w, http.StatusOK, config)	629		h.sendJSON(w, http.StatusOK, config)

@@ -617,10 +669,10 @@ func (h Handler) handleDeploy(w http.ResponseWriter, r http.Request, path stri
617		}	669		}
618			670
619		log.Info().Str("domain", deployDomain).Str("container_id", container.ID).Msg("container deployed via admin API")	671		log.Info().Str("domain", deployDomain).Str("container_id", container.ID).Msg("container deployed via admin API")
620	-	h.sendJSON(w, http.StatusOK, map[string]any{	672	+	h.sendJSON(w, http.StatusOK, dto.DeployResponse{
621	-	"status": "deployed",	673	+	Status: "deployed",
622	-	"container_id": container.ID,	674	+	ContainerID: container.ID,
623	-	"domain": deployDomain,	675	+	Domain: deployDomain,
624		})	676		})
625		}	677		}
626			678

@@ -697,9 +749,7 @@ func (h Handler) handleProcessLogs(w http.ResponseWriter, r http.Request, line
697		return	749		return
698		}	750		}
699			751
700	-	h.sendJSON(w, http.StatusOK, map[string]any{	752	+	h.sendJSON(w, http.StatusOK, dto.ProcessLogsResponse{Lines: logLines})
701	-	"lines": logLines,
702	-	})
703		}	753		}
704			754
705		// handleContainerLogs handles container logs for a specific domain.	755		// handleContainerLogs handles container logs for a specific domain.

@@ -721,9 +771,9 @@ func (h Handler) handleContainerLogs(w http.ResponseWriter, r http.Request, lo
721		return	771		return
722		}	772		}
723			773
724	-	h.sendJSON(w, http.StatusOK, map[string]any{	774	+	h.sendJSON(w, http.StatusOK, dto.ContainerLogsResponse{
725	-	"domain": logDomain,	775	+	Domain: logDomain,
726	-	"lines": logLines,	776	+	Lines: logLines,
727		})	777		})
728		}	778		}
729			779

M internal/adapters/in/http/admin/handler_test.go +13 -5


@@ -573,13 +573,17 @@ func TestHandler_RoutesGet_ReturnsRoutes(t *testing.T) {
573	573
574	574		assert.Equal(t, http.StatusOK, rec.Code)
575	575
576		-	var response map[string]any
	576	+	var response struct {
	577	+	Routes []struct {
	578	+	Domain string `json:"domain"`
	579	+	Image string `json:"image"`
	580	+	HTTPS bool `json:"https"`
	581	+	} `json:"routes"`
	582	+	}
577	583		err := json.NewDecoder(rec.Body).Decode(&response)
578	584		assert.NoError(t, err)
579	585
580		-	routes, ok := response["routes"].([]any)
581		-	assert.True(t, ok)
582		-	assert.Len(t, routes, 2)
	586	+	assert.Len(t, response.Routes, 2)
583	587		}
584	588
585	589		func TestHandler_RoutesGet_SingleRoute(t *testing.T) {

@@ -602,7 +606,11 @@ func TestHandler_RoutesGet_SingleRoute(t *testing.T) {
602	606
603	607		assert.Equal(t, http.StatusOK, rec.Code)
604	608
605		-	var route domain.Route
	609	+	var route struct {
	610	+	Domain string `json:"domain"`
	611	+	Image string `json:"image"`
	612	+	HTTPS bool `json:"https"`
	613	+	}
606	614		err := json.NewDecoder(rec.Body).Decode(&route)
607	615		assert.NoError(t, err)
608	616		assert.Equal(t, "app.example.com", route.Domain)

 	assert.Equal(t, http.StatusOK, rec.Code)
-	var response map[string]any
+	var response struct {
+		Routes []struct {
+			Domain string `json:"domain"`
+			Image  string `json:"image"`
+			HTTPS  bool   `json:"https"`
+		} `json:"routes"`
+	}
 	err := json.NewDecoder(rec.Body).Decode(&response)
 	assert.NoError(t, err)
-	routes, ok := response["routes"].([]any)
+	assert.Len(t, response.Routes, 2)
-	assert.True(t, ok)
-	assert.Len(t, routes, 2)
 }
 func TestHandler_RoutesGet_SingleRoute(t *testing.T) {
 	assert.Equal(t, http.StatusOK, rec.Code)
-	var route domain.Route
+	var route struct {
+		Domain string `json:"domain"`
+		Image  string `json:"image"`
+		HTTPS  bool   `json:"https"`
+	}
 	err := json.NewDecoder(rec.Body).Decode(&route)
 	assert.NoError(t, err)
 	assert.Equal(t, "app.example.com", route.Domain)

M internal/adapters/in/http/admin/middleware.go +4 -3


@@ -9,6 +9,7 @@ import (
9	9		"github.com/bnema/zerowrap"
10	10		"golang.org/x/time/rate"
11	11
	12	+	"gordon/internal/adapters/dto"
12	13		"gordon/internal/boundaries/in"
13	14		"gordon/internal/domain"
14	15		)

@@ -35,7 +36,7 @@ func AuthMiddleware(authSvc in.AuthService, limiter *rate.Limiter, log zerowrap.
35	36		w.Header().Set("Content-Type", "application/json")
36	37		w.Header().Set("Retry-After", "1")
37	38		w.WriteHeader(http.StatusTooManyRequests)
38		-	_ = json.NewEncoder(w).Encode(map[string]string{"error": "rate limit exceeded"})
	39	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "rate limit exceeded"})
39	40		return
40	41		}
41	42

@@ -142,11 +143,11 @@ func sendUnauthorized(w http.ResponseWriter, message string) {
142	143		w.Header().Set("Content-Type", "application/json")
143	144		w.Header().Set("WWW-Authenticate", `Bearer realm="gordon-admin"`)
144	145		w.WriteHeader(http.StatusUnauthorized)
145		-	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
	146	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: message})
146	147		}
147	148
148	149		func sendForbidden(w http.ResponseWriter, message string) {
149	150		w.Header().Set("Content-Type", "application/json")
150	151		w.WriteHeader(http.StatusForbidden)
151		-	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
	152	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: message})
152	153		}

 	"github.com/bnema/zerowrap"
 	"golang.org/x/time/rate"
+	"gordon/internal/adapters/dto"
 	"gordon/internal/boundaries/in"
 	"gordon/internal/domain"
 )
 				w.Header().Set("Content-Type", "application/json")
 				w.Header().Set("Retry-After", "1")
 				w.WriteHeader(http.StatusTooManyRequests)
-				_ = json.NewEncoder(w).Encode(map[string]string{"error": "rate limit exceeded"})
+				_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "rate limit exceeded"})
 				return
 			}
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("WWW-Authenticate", `Bearer realm="gordon-admin"`)
 	w.WriteHeader(http.StatusUnauthorized)
-	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: message})
 }
 func sendForbidden(w http.ResponseWriter, message string) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusForbidden)
-	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: message})
 }

M internal/adapters/in/http/middleware/auth.go +11 -3


@@ -3,11 +3,13 @@ package middleware
3	3		import (
4	4		"context"
5	5		"crypto/subtle"
	6	+	"encoding/json"
6	7		"net/http"
7	8		"strings"
8	9
9	10		"github.com/bnema/zerowrap"
10	11
	12	+	"gordon/internal/adapters/dto"
11	13		"gordon/internal/boundaries/in"
12	14		"gordon/internal/domain"
13	15		)

@@ -26,7 +28,9 @@ func RegistryAuth(username, password string, log zerowrap.Logger) func(http.Hand
26	28		if !isAuthenticated(r, username, password, log) {
27	29		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
28	30		w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
29		-	http.Error(w, "Unauthorized", http.StatusUnauthorized)
	31	+	w.Header().Set("Content-Type", "application/json")
	32	+	w.WriteHeader(http.StatusUnauthorized)
	33	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Unauthorized"})
30	34
31	35		log.Warn().
32	36		Str(zerowrap.FieldLayer, "adapter").

@@ -364,7 +368,9 @@ func checkScopeAccess(r http.Request, claims domain.TokenClaims, log zerowrap.
364	368		// sendForbidden sends an HTTP 403 response.
365	369		func sendForbidden(w http.ResponseWriter, log zerowrap.Logger, r *http.Request) {
366	370		w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
367		-	http.Error(w, "Forbidden: insufficient scope", http.StatusForbidden)
	371	+	w.Header().Set("Content-Type", "application/json")
	372	+	w.WriteHeader(http.StatusForbidden)
	373	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden: insufficient scope"})
368	374
369	375		log.Warn().
370	376		Str(zerowrap.FieldLayer, "adapter").

@@ -400,7 +406,9 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri
400	406		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
401	407		}
402	408
403		-	http.Error(w, "Unauthorized", http.StatusUnauthorized)
	409	+	w.Header().Set("Content-Type", "application/json")
	410	+	w.WriteHeader(http.StatusUnauthorized)
	411	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Unauthorized"})
404	412
405	413		log.Warn().
406	414		Str(zerowrap.FieldLayer, "adapter").

 import (
 	"context"
 	"crypto/subtle"
+	"encoding/json"
 	"net/http"
 	"strings"
 	"github.com/bnema/zerowrap"
+	"gordon/internal/adapters/dto"
 	"gordon/internal/boundaries/in"
 	"gordon/internal/domain"
 )
 			if !isAuthenticated(r, username, password, log) {
 				w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
 				w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
-				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusUnauthorized)
+				_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Unauthorized"})
 				log.Warn().
 					Str(zerowrap.FieldLayer, "adapter").
 // sendForbidden sends an HTTP 403 response.
 func sendForbidden(w http.ResponseWriter, log zerowrap.Logger, r *http.Request) {
 	w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
-	http.Error(w, "Forbidden: insufficient scope", http.StatusForbidden)
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusForbidden)
+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Forbidden: insufficient scope"})
 	log.Warn().
 		Str(zerowrap.FieldLayer, "adapter").
 		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
 	}
-	http.Error(w, "Unauthorized", http.StatusUnauthorized)
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusUnauthorized)
+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Unauthorized"})
 	log.Warn().
 		Str(zerowrap.FieldLayer, "adapter").

M internal/adapters/in/http/middleware/logging.go +6 -1


@@ -2,10 +2,13 @@
2	2		package middleware
3	3
4	4		import (
	5	+	"encoding/json"
5	6		"net/http"
6	7		"time"
7	8
8	9		"github.com/bnema/zerowrap"
	10	+
	11	+	"gordon/internal/adapters/dto"
9	12		)
10	13
11	14		// ResponseWriter wraps http.ResponseWriter to capture status code and bytes written.

@@ -131,7 +134,9 @@ func PanicRecovery(log zerowrap.Logger) func(http.Handler) http.Handler {
131	134		Str(zerowrap.FieldHost, r.Host).
132	135		Msg("panic recovered")
133	136
134		-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
	137	+	w.Header().Set("Content-Type", "application/json")
	138	+	w.WriteHeader(http.StatusInternalServerError)
	139	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Internal Server Error"})
135	140		}
136	141		}()
137	142

 package middleware
 import (
+	"encoding/json"
 	"net/http"
 	"time"
 	"github.com/bnema/zerowrap"
+	"gordon/internal/adapters/dto"
 )
 // ResponseWriter wraps http.ResponseWriter to capture status code and bytes written.
 						Str(zerowrap.FieldHost, r.Host).
 						Msg("panic recovered")
-					http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+					w.Header().Set("Content-Type", "application/json")
+					w.WriteHeader(http.StatusInternalServerError)
+					_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Internal Server Error"})
 				}
 			}()

M internal/adapters/in/http/registry/handler.go +33 -33


@@ -12,6 +12,7 @@ import (
12	12
13	13		"github.com/bnema/zerowrap"
14	14
	15	+	"gordon/internal/adapters/dto"
15	16		"gordon/internal/boundaries/in"
16	17		"gordon/internal/domain"
17	18		"gordon/pkg/manifest"

@@ -93,15 +94,15 @@ func (h Handler) handleRegistryRoutes(w http.ResponseWriter, r http.Request) {
93	94		h.handleBase(w, r)
94	95		return
95	96		}
	97	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
96	98
97		-	http.NotFound(w, r)
98	99		}
99	100
100	101		func (h Handler) handleManifestRoutes(w http.ResponseWriter, r http.Request) {
101	102		// Parse path: /v2/{name}/manifests/{reference}
102	103		parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/v2/"), "/")
103	104		if len(parts) < 3 \|\| parts[len(parts)-2] != "manifests" {
104		-	http.NotFound(w, r)
	105	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
105	106		return
106	107		}
107	108

@@ -127,7 +128,7 @@ func (h Handler) handleManifestRoutes(w http.ResponseWriter, r http.Request) {
127	128		case "PUT":
128	129		h.handlePutManifest(w, r)
129	130		default:
130		-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	131	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
131	132		}
132	133		}
133	134

@@ -135,7 +136,7 @@ func (h Handler) handleBlobRoutes(w http.ResponseWriter, r http.Request) {
135	136		// Parse path: /v2/{name}/blobs/{digest}
136	137		parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/v2/"), "/")
137	138		if len(parts) < 3 \|\| parts[len(parts)-2] != "blobs" {
138		-	http.NotFound(w, r)
	139	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
139	140		return
140	141		}
141	142

@@ -159,7 +160,7 @@ func (h Handler) handleBlobRoutes(w http.ResponseWriter, r http.Request) {
159	160		case "HEAD", "GET":
160	161		h.handleGetBlob(w, r)
161	162		default:
162		-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	163	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
163	164		}
164	165		}
165	166

@@ -168,7 +169,7 @@ func (h Handler) handleBlobUploadRoutes(w http.ResponseWriter, r http.Request)
168	169		path := strings.TrimPrefix(r.URL.Path, "/v2/")
169	170		uploadIndex := strings.Index(path, "/blobs/uploads/")
170	171		if uploadIndex == -1 {
171		-	http.NotFound(w, r)
	172	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
172	173		return
173	174		}
174	175

@@ -189,7 +190,7 @@ func (h Handler) handleBlobUploadRoutes(w http.ResponseWriter, r http.Request)
189	190		case "POST":
190	191		h.handleStartBlobUpload(w, r)
191	192		default:
192		-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	193	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
193	194		}
194	195		} else {
195	196		// Validate UUID to prevent path traversal

@@ -203,7 +204,7 @@ func (h Handler) handleBlobUploadRoutes(w http.ResponseWriter, r http.Request)
203	204		case "PATCH", "PUT":
204	205		h.handleBlobUpload(w, r)
205	206		default:
206		-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	207	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
207	208		}
208	209		}
209	210		}

@@ -212,7 +213,7 @@ func (h Handler) handleTagListRoutes(w http.ResponseWriter, r http.Request) {
212	213		// Parse path: /v2/{name}/tags/list
213	214		path := strings.TrimPrefix(r.URL.Path, "/v2/")
214	215		if !strings.HasSuffix(path, "/tags/list") {
215		-	http.NotFound(w, r)
	216	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
216	217		return
217	218		}
218	219

@@ -230,7 +231,7 @@ func (h Handler) handleTagListRoutes(w http.ResponseWriter, r http.Request) {
230	231		case "GET":
231	232		h.handleListTags(w, r)
232	233		default:
233		-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	234	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
234	235		}
235	236		}
236	237

@@ -244,10 +245,11 @@ func (h *Handler) sendRegistryError(w http.ResponseWriter, status int, code, mes
244	245		w.Header().Set("Content-Type", "application/json")
245	246		w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
246	247		w.WriteHeader(status)
247		-	_ = json.NewEncoder(w).Encode(map[string]any{
248		-	"errors": []map[string]string{
249		-	{"code": code, "message": message},
250		-	},
	248	+	_ = json.NewEncoder(w).Encode(dto.RegistryErrorResponse{
	249	+	Errors: []dto.RegistryErrorItem{{
	250	+	Code: code,
	251	+	Message: message,
	252	+	}},
251	253		})
252	254		}
253	255

@@ -262,7 +264,7 @@ func (h Handler) handleGetManifest(w http.ResponseWriter, r http.Request) {
262	264		manifestData, err := h.registrySvc.GetManifest(ctx, name, reference)
263	265		if err != nil {
264	266		log.Warn().Err(err).Str("name", name).Str("reference", reference).Msg("manifest not found")
265		-	http.NotFound(w, r)
	267	+	h.sendRegistryError(w, http.StatusNotFound, "MANIFEST_UNKNOWN", "manifest not found")
266	268		return
267	269		}
268	270

@@ -286,7 +288,7 @@ func (h Handler) handlePutManifest(w http.ResponseWriter, r http.Request) {
286	288
287	289		if contentType == "" {
288	290		log.Warn().Str("name", name).Str("reference", reference).Msg("Content-Type header missing")
289		-	http.Error(w, "Content-Type header required", http.StatusBadRequest)
	291	+	h.sendRegistryError(w, http.StatusBadRequest, "MANIFEST_INVALID", "Content-Type header required")
290	292		return
291	293		}
292	294

@@ -303,7 +305,7 @@ func (h Handler) handlePutManifest(w http.ResponseWriter, r http.Request) {
303	305		return
304	306		}
305	307		log.Error().Err(err).Msg("failed to read manifest data")
306		-	http.Error(w, "Bad Request", http.StatusBadRequest)
	308	+	h.sendRegistryError(w, http.StatusBadRequest, "MANIFEST_INVALID", "invalid manifest data")
307	309		return
308	310		}
309	311

@@ -326,7 +328,7 @@ func (h Handler) handlePutManifest(w http.ResponseWriter, r http.Request) {
326	328		digest, err := h.registrySvc.PutManifest(ctx, manifestObj)
327	329		if err != nil {
328	330		log.Error().Err(err).Str("name", name).Str("reference", reference).Msg("failed to store manifest")
329		-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
	331	+	h.sendRegistryError(w, http.StatusInternalServerError, "MANIFEST_INVALID", "failed to store manifest")
330	332		return
331	333		}
332	334

@@ -346,7 +348,7 @@ func (h Handler) handleGetBlob(w http.ResponseWriter, r http.Request) {
346	348		path, err := h.registrySvc.GetBlobPath(ctx, digest)
347	349		if err != nil {
348	350		log.Warn().Err(err).Str("name", name).Str("digest", digest).Msg("blob not found")
349		-	http.NotFound(w, r)
	351	+	h.sendRegistryError(w, http.StatusNotFound, "BLOB_UNKNOWN", "blob not found")
350	352		return
351	353		}
352	354

@@ -364,7 +366,7 @@ func (h Handler) handleStartBlobUpload(w http.ResponseWriter, r http.Request)
364	366		uuid, err := h.registrySvc.StartUpload(ctx, name)
365	367		if err != nil {
366	368		log.Error().Err(err).Msg("failed to start blob upload")
367		-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
	369	+	h.sendRegistryError(w, http.StatusInternalServerError, "BLOB_UPLOAD_UNKNOWN", "failed to start upload")
368	370		return
369	371		}
370	372

@@ -408,7 +410,7 @@ func (h Handler) handleBlobUpload(w http.ResponseWriter, r http.Request) {
408	410		return
409	411		}
410	412		log.Error().Err(err).Msg("failed to read blob chunk")
411		-	http.Error(w, "Bad Request", http.StatusBadRequest)
	413	+	h.sendRegistryError(w, http.StatusBadRequest, "BLOB_UPLOAD_INVALID", "invalid blob chunk")
412	414		return
413	415		}
414	416

@@ -416,7 +418,7 @@ func (h Handler) handleBlobUpload(w http.ResponseWriter, r http.Request) {
416	418		length, err := h.registrySvc.AppendBlobChunk(ctx, name, uuid, chunk)
417	419		if err != nil {
418	420		log.Error().Err(err).Msg("failed to append blob chunk")
419		-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
	421	+	h.sendRegistryError(w, http.StatusInternalServerError, "BLOB_UPLOAD_UNKNOWN", "failed to append blob chunk")
420	422		return
421	423		}
422	424

@@ -425,7 +427,7 @@ func (h Handler) handleBlobUpload(w http.ResponseWriter, r http.Request) {
425	427		if err := h.registrySvc.FinishUpload(ctx, uuid, digest); err != nil {
426	428		log.Error().Err(err).Str("digest", digest).Msg("failed to finalize blob upload")
427	429		_ = h.registrySvc.CancelUpload(ctx, uuid)
428		-	http.Error(w, "Bad Request: digest mismatch", http.StatusBadRequest)
	430	+	h.sendRegistryError(w, http.StatusBadRequest, "DIGEST_INVALID", "digest mismatch")
429	431		return
430	432		}
431	433

@@ -451,21 +453,19 @@ func (h Handler) handleListTags(w http.ResponseWriter, r http.Request) {
451	453		tags, err := h.registrySvc.ListTags(ctx, name)
452	454		if err != nil {
453	455		log.Warn().Err(err).Str("name", name).Msg("tags not found")
454		-	w.WriteHeader(http.StatusNotFound)
	456	+	h.sendRegistryError(w, http.StatusNotFound, "NAME_UNKNOWN", "repository not found")
455	457		return
456	458		}
457	459
458		-	tagsJSON, err := json.Marshal(tags)
459		-	if err != nil {
460		-	log.Error().Err(err).Str("name", name).Msg("failed to marshal tags")
461		-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
462		-	return
	460	+	response := dto.TagListResponse{
	461	+	Name: name,
	462	+	Tags: tags,
463	463		}
464	464
465		-	response := fmt.Sprintf(`{"name":"%s","tags":%s}`, name, string(tagsJSON))
466		-
467	465		w.Header().Set("Content-Type", "application/json")
468		-	w.Header().Set("Content-Length", strconv.Itoa(len(response)))
469	466		w.WriteHeader(http.StatusOK)
470		-	w.Write([]byte(response))
	467	+
	468	+	if err := json.NewEncoder(w).Encode(response); err != nil {
	469	+	log.Error().Err(err).Str("name", name).Msg("failed to encode tags")
	470	+	}
471	471		}


@@ -12,6 +12,7 @@ import (
12			12
13		"github.com/bnema/zerowrap"	13		"github.com/bnema/zerowrap"
14			14
			15	+	"gordon/internal/adapters/dto"
15		"gordon/internal/boundaries/in"	16		"gordon/internal/boundaries/in"
16		"gordon/internal/domain"	17		"gordon/internal/domain"
17		"gordon/pkg/manifest"	18		"gordon/pkg/manifest"

@@ -93,15 +94,15 @@ func (h Handler) handleRegistryRoutes(w http.ResponseWriter, r http.Request) {
93		h.handleBase(w, r)	94		h.handleBase(w, r)
94		return	95		return
95		}	96		}
			97	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
96			98
97	-	http.NotFound(w, r)
98		}	99		}
99			100
100		func (h Handler) handleManifestRoutes(w http.ResponseWriter, r http.Request) {	101		func (h Handler) handleManifestRoutes(w http.ResponseWriter, r http.Request) {
101		// Parse path: /v2/{name}/manifests/{reference}	102		// Parse path: /v2/{name}/manifests/{reference}
102		parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/v2/"), "/")	103		parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/v2/"), "/")
103		if len(parts) < 3 \|\| parts[len(parts)-2] != "manifests" {	104		if len(parts) < 3 \|\| parts[len(parts)-2] != "manifests" {
104	-	http.NotFound(w, r)	105	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
105		return	106		return
106		}	107		}
107			108

@@ -127,7 +128,7 @@ func (h Handler) handleManifestRoutes(w http.ResponseWriter, r http.Request) {
127		case "PUT":	128		case "PUT":
128		h.handlePutManifest(w, r)	129		h.handlePutManifest(w, r)
129		default:	130		default:
130	-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)	131	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
131		}	132		}
132		}	133		}
133			134

@@ -135,7 +136,7 @@ func (h Handler) handleBlobRoutes(w http.ResponseWriter, r http.Request) {
135		// Parse path: /v2/{name}/blobs/{digest}	136		// Parse path: /v2/{name}/blobs/{digest}
136		parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/v2/"), "/")	137		parts := strings.Split(strings.TrimPrefix(r.URL.Path, "/v2/"), "/")
137		if len(parts) < 3 \|\| parts[len(parts)-2] != "blobs" {	138		if len(parts) < 3 \|\| parts[len(parts)-2] != "blobs" {
138	-	http.NotFound(w, r)	139	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
139		return	140		return
140		}	141		}
141			142

@@ -159,7 +160,7 @@ func (h Handler) handleBlobRoutes(w http.ResponseWriter, r http.Request) {
159		case "HEAD", "GET":	160		case "HEAD", "GET":
160		h.handleGetBlob(w, r)	161		h.handleGetBlob(w, r)
161		default:	162		default:
162	-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)	163	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
163		}	164		}
164		}	165		}
165			166

@@ -168,7 +169,7 @@ func (h Handler) handleBlobUploadRoutes(w http.ResponseWriter, r http.Request)
168		path := strings.TrimPrefix(r.URL.Path, "/v2/")	169		path := strings.TrimPrefix(r.URL.Path, "/v2/")
169		uploadIndex := strings.Index(path, "/blobs/uploads/")	170		uploadIndex := strings.Index(path, "/blobs/uploads/")
170		if uploadIndex == -1 {	171		if uploadIndex == -1 {
171	-	http.NotFound(w, r)	172	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
172		return	173		return
173		}	174		}
174			175

@@ -189,7 +190,7 @@ func (h Handler) handleBlobUploadRoutes(w http.ResponseWriter, r http.Request)
189		case "POST":	190		case "POST":
190		h.handleStartBlobUpload(w, r)	191		h.handleStartBlobUpload(w, r)
191		default:	192		default:
192	-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)	193	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
193		}	194		}
194		} else {	195		} else {
195		// Validate UUID to prevent path traversal	196		// Validate UUID to prevent path traversal

@@ -203,7 +204,7 @@ func (h Handler) handleBlobUploadRoutes(w http.ResponseWriter, r http.Request)
203		case "PATCH", "PUT":	204		case "PATCH", "PUT":
204		h.handleBlobUpload(w, r)	205		h.handleBlobUpload(w, r)
205		default:	206		default:
206	-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)	207	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
207		}	208		}
208		}	209		}
209		}	210		}

@@ -212,7 +213,7 @@ func (h Handler) handleTagListRoutes(w http.ResponseWriter, r http.Request) {
212		// Parse path: /v2/{name}/tags/list	213		// Parse path: /v2/{name}/tags/list
213		path := strings.TrimPrefix(r.URL.Path, "/v2/")	214		path := strings.TrimPrefix(r.URL.Path, "/v2/")
214		if !strings.HasSuffix(path, "/tags/list") {	215		if !strings.HasSuffix(path, "/tags/list") {
215	-	http.NotFound(w, r)	216	+	h.sendRegistryError(w, http.StatusNotFound, "NOT_FOUND", "route not found")
216		return	217		return
217		}	218		}
218			219

@@ -230,7 +231,7 @@ func (h Handler) handleTagListRoutes(w http.ResponseWriter, r http.Request) {
230		case "GET":	231		case "GET":
231		h.handleListTags(w, r)	232		h.handleListTags(w, r)
232		default:	233		default:
233	-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)	234	+	h.sendRegistryError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "method not allowed")
234		}	235		}
235		}	236		}
236			237

@@ -244,10 +245,11 @@ func (h *Handler) sendRegistryError(w http.ResponseWriter, status int, code, mes
244		w.Header().Set("Content-Type", "application/json")	245		w.Header().Set("Content-Type", "application/json")
245		w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")	246		w.Header().Set("Docker-Distribution-API-Version", "registry/2.0")
246		w.WriteHeader(status)	247		w.WriteHeader(status)
247	-	_ = json.NewEncoder(w).Encode(map[string]any{	248	+	_ = json.NewEncoder(w).Encode(dto.RegistryErrorResponse{
248	-	"errors": []map[string]string{	249	+	Errors: []dto.RegistryErrorItem{{
249	-	{"code": code, "message": message},	250	+	Code: code,
250	-	},	251	+	Message: message,
			252	+	}},
251		})	253		})
252		}	254		}
253			255

@@ -262,7 +264,7 @@ func (h Handler) handleGetManifest(w http.ResponseWriter, r http.Request) {
262		manifestData, err := h.registrySvc.GetManifest(ctx, name, reference)	264		manifestData, err := h.registrySvc.GetManifest(ctx, name, reference)
263		if err != nil {	265		if err != nil {
264		log.Warn().Err(err).Str("name", name).Str("reference", reference).Msg("manifest not found")	266		log.Warn().Err(err).Str("name", name).Str("reference", reference).Msg("manifest not found")
265	-	http.NotFound(w, r)	267	+	h.sendRegistryError(w, http.StatusNotFound, "MANIFEST_UNKNOWN", "manifest not found")
266		return	268		return
267		}	269		}
268			270

@@ -286,7 +288,7 @@ func (h Handler) handlePutManifest(w http.ResponseWriter, r http.Request) {
286			288
287		if contentType == "" {	289		if contentType == "" {
288		log.Warn().Str("name", name).Str("reference", reference).Msg("Content-Type header missing")	290		log.Warn().Str("name", name).Str("reference", reference).Msg("Content-Type header missing")
289	-	http.Error(w, "Content-Type header required", http.StatusBadRequest)	291	+	h.sendRegistryError(w, http.StatusBadRequest, "MANIFEST_INVALID", "Content-Type header required")
290		return	292		return
291		}	293		}
292			294

@@ -303,7 +305,7 @@ func (h Handler) handlePutManifest(w http.ResponseWriter, r http.Request) {
303		return	305		return
304		}	306		}
305		log.Error().Err(err).Msg("failed to read manifest data")	307		log.Error().Err(err).Msg("failed to read manifest data")
306	-	http.Error(w, "Bad Request", http.StatusBadRequest)	308	+	h.sendRegistryError(w, http.StatusBadRequest, "MANIFEST_INVALID", "invalid manifest data")
307		return	309		return
308		}	310		}
309			311

@@ -326,7 +328,7 @@ func (h Handler) handlePutManifest(w http.ResponseWriter, r http.Request) {
326		digest, err := h.registrySvc.PutManifest(ctx, manifestObj)	328		digest, err := h.registrySvc.PutManifest(ctx, manifestObj)
327		if err != nil {	329		if err != nil {
328		log.Error().Err(err).Str("name", name).Str("reference", reference).Msg("failed to store manifest")	330		log.Error().Err(err).Str("name", name).Str("reference", reference).Msg("failed to store manifest")
329	-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)	331	+	h.sendRegistryError(w, http.StatusInternalServerError, "MANIFEST_INVALID", "failed to store manifest")
330		return	332		return
331		}	333		}
332			334

@@ -346,7 +348,7 @@ func (h Handler) handleGetBlob(w http.ResponseWriter, r http.Request) {
346		path, err := h.registrySvc.GetBlobPath(ctx, digest)	348		path, err := h.registrySvc.GetBlobPath(ctx, digest)
347		if err != nil {	349		if err != nil {
348		log.Warn().Err(err).Str("name", name).Str("digest", digest).Msg("blob not found")	350		log.Warn().Err(err).Str("name", name).Str("digest", digest).Msg("blob not found")
349	-	http.NotFound(w, r)	351	+	h.sendRegistryError(w, http.StatusNotFound, "BLOB_UNKNOWN", "blob not found")
350		return	352		return
351		}	353		}
352			354

@@ -364,7 +366,7 @@ func (h Handler) handleStartBlobUpload(w http.ResponseWriter, r http.Request)
364		uuid, err := h.registrySvc.StartUpload(ctx, name)	366		uuid, err := h.registrySvc.StartUpload(ctx, name)
365		if err != nil {	367		if err != nil {
366		log.Error().Err(err).Msg("failed to start blob upload")	368		log.Error().Err(err).Msg("failed to start blob upload")
367	-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)	369	+	h.sendRegistryError(w, http.StatusInternalServerError, "BLOB_UPLOAD_UNKNOWN", "failed to start upload")
368		return	370		return
369		}	371		}
370			372

@@ -408,7 +410,7 @@ func (h Handler) handleBlobUpload(w http.ResponseWriter, r http.Request) {
408		return	410		return
409		}	411		}
410		log.Error().Err(err).Msg("failed to read blob chunk")	412		log.Error().Err(err).Msg("failed to read blob chunk")
411	-	http.Error(w, "Bad Request", http.StatusBadRequest)	413	+	h.sendRegistryError(w, http.StatusBadRequest, "BLOB_UPLOAD_INVALID", "invalid blob chunk")
412		return	414		return
413		}	415		}
414			416

@@ -416,7 +418,7 @@ func (h Handler) handleBlobUpload(w http.ResponseWriter, r http.Request) {
416		length, err := h.registrySvc.AppendBlobChunk(ctx, name, uuid, chunk)	418		length, err := h.registrySvc.AppendBlobChunk(ctx, name, uuid, chunk)
417		if err != nil {	419		if err != nil {
418		log.Error().Err(err).Msg("failed to append blob chunk")	420		log.Error().Err(err).Msg("failed to append blob chunk")
419	-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)	421	+	h.sendRegistryError(w, http.StatusInternalServerError, "BLOB_UPLOAD_UNKNOWN", "failed to append blob chunk")
420		return	422		return
421		}	423		}
422			424

@@ -425,7 +427,7 @@ func (h Handler) handleBlobUpload(w http.ResponseWriter, r http.Request) {
425		if err := h.registrySvc.FinishUpload(ctx, uuid, digest); err != nil {	427		if err := h.registrySvc.FinishUpload(ctx, uuid, digest); err != nil {
426		log.Error().Err(err).Str("digest", digest).Msg("failed to finalize blob upload")	428		log.Error().Err(err).Str("digest", digest).Msg("failed to finalize blob upload")
427		_ = h.registrySvc.CancelUpload(ctx, uuid)	429		_ = h.registrySvc.CancelUpload(ctx, uuid)
428	-	http.Error(w, "Bad Request: digest mismatch", http.StatusBadRequest)	430	+	h.sendRegistryError(w, http.StatusBadRequest, "DIGEST_INVALID", "digest mismatch")
429		return	431		return
430		}	432		}
431			433

@@ -451,21 +453,19 @@ func (h Handler) handleListTags(w http.ResponseWriter, r http.Request) {
451		tags, err := h.registrySvc.ListTags(ctx, name)	453		tags, err := h.registrySvc.ListTags(ctx, name)
452		if err != nil {	454		if err != nil {
453		log.Warn().Err(err).Str("name", name).Msg("tags not found")	455		log.Warn().Err(err).Str("name", name).Msg("tags not found")
454	-	w.WriteHeader(http.StatusNotFound)	456	+	h.sendRegistryError(w, http.StatusNotFound, "NAME_UNKNOWN", "repository not found")
455		return	457		return
456		}	458		}
457			459
458	-	tagsJSON, err := json.Marshal(tags)	460	+	response := dto.TagListResponse{
459	-	if err != nil {	461	+	Name: name,
460	-	log.Error().Err(err).Str("name", name).Msg("failed to marshal tags")	462	+	Tags: tags,
461	-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
462	-	return
463		}	463		}
464			464
465	-	response := fmt.Sprintf(`{"name":"%s","tags":%s}`, name, string(tagsJSON))
466	-
467		w.Header().Set("Content-Type", "application/json")	465		w.Header().Set("Content-Type", "application/json")
468	-	w.Header().Set("Content-Length", strconv.Itoa(len(response)))
469		w.WriteHeader(http.StatusOK)	466		w.WriteHeader(http.StatusOK)
470	-	w.Write([]byte(response))	467	+
			468	+	if err := json.NewEncoder(w).Encode(response); err != nil {
			469	+	log.Error().Err(err).Str("name", name).Msg("failed to encode tags")
			470	+	}
471		}	471		}

M internal/adapters/in/http/registry/handler_test.go +15 -2


@@ -2,6 +2,7 @@ package registry
2	2
3	3		import (
4	4		"bytes"
	5	+	"encoding/json"
5	6		"net/http"
6	7		"net/http/httptest"
7	8		"os"

@@ -106,6 +107,7 @@ func TestHandler_GetManifest_NotFound(t *testing.T) {
106	107		handler.ServeHTTP(rec, req)
107	108
108	109		assert.Equal(t, http.StatusNotFound, rec.Code)
	110	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
109	111		}
110	112
111	113		func TestHandler_GetManifest_NestedName(t *testing.T) {

@@ -247,6 +249,7 @@ func TestHandler_BlobRoutes_MethodNotAllowed(t *testing.T) {
247	249		handler.ServeHTTP(rec, req)
248	250
249	251		assert.Equal(t, http.StatusMethodNotAllowed, rec.Code)
	252	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
250	253		}
251	254
252	255		func TestHandler_StartBlobUpload_Success(t *testing.T) {

@@ -279,6 +282,7 @@ func TestHandler_StartBlobUpload_Error(t *testing.T) {
279	282		handler.ServeHTTP(rec, req)
280	283
281	284		assert.Equal(t, http.StatusInternalServerError, rec.Code)
	285	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
282	286		}
283	287
284	288		func TestHandler_BlobUpload_PATCH(t *testing.T) {

@@ -332,6 +336,7 @@ func TestHandler_BlobUpload_PUT_DigestMismatch(t *testing.T) {
332	336		handler.ServeHTTP(rec, req)
333	337
334	338		assert.Equal(t, http.StatusBadRequest, rec.Code)
	339	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
335	340		}
336	341
337	342		func TestHandler_ListTags_Success(t *testing.T) {

@@ -348,8 +353,14 @@ func TestHandler_ListTags_Success(t *testing.T) {
348	353
349	354		assert.Equal(t, http.StatusOK, rec.Code)
350	355		assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
351		-	assert.Contains(t, rec.Body.String(), "myapp")
352		-	assert.Contains(t, rec.Body.String(), "latest")
	356	+
	357	+	var response struct {
	358	+	Name string `json:"name"`
	359	+	Tags []string `json:"tags"`
	360	+	}
	361	+	assert.NoError(t, json.NewDecoder(rec.Body).Decode(&response))
	362	+	assert.Equal(t, "myapp", response.Name)
	363	+	assert.Contains(t, response.Tags, "latest")
353	364		}
354	365
355	366		func TestHandler_ListTags_NotFound(t *testing.T) {

@@ -365,6 +376,7 @@ func TestHandler_ListTags_NotFound(t *testing.T) {
365	376		handler.ServeHTTP(rec, req)
366	377
367	378		assert.Equal(t, http.StatusNotFound, rec.Code)
	379	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
368	380		}
369	381
370	382		func TestHandler_ListTags_MethodNotAllowed(t *testing.T) {

@@ -378,6 +390,7 @@ func TestHandler_ListTags_MethodNotAllowed(t *testing.T) {
378	390		handler.ServeHTTP(rec, req)
379	391
380	392		assert.Equal(t, http.StatusMethodNotAllowed, rec.Code)
	393	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
381	394		}
382	395
383	396		func TestHandler_RegisterRoutes(t *testing.T) {


@@ -2,6 +2,7 @@ package registry
2			2
3		import (	3		import (
4		"bytes"	4		"bytes"
			5	+	"encoding/json"
5		"net/http"	6		"net/http"
6		"net/http/httptest"	7		"net/http/httptest"
7		"os"	8		"os"

@@ -106,6 +107,7 @@ func TestHandler_GetManifest_NotFound(t *testing.T) {
106		handler.ServeHTTP(rec, req)	107		handler.ServeHTTP(rec, req)
107			108
108		assert.Equal(t, http.StatusNotFound, rec.Code)	109		assert.Equal(t, http.StatusNotFound, rec.Code)
			110	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
109		}	111		}
110			112
111		func TestHandler_GetManifest_NestedName(t *testing.T) {	113		func TestHandler_GetManifest_NestedName(t *testing.T) {

@@ -247,6 +249,7 @@ func TestHandler_BlobRoutes_MethodNotAllowed(t *testing.T) {
247		handler.ServeHTTP(rec, req)	249		handler.ServeHTTP(rec, req)
248			250
249		assert.Equal(t, http.StatusMethodNotAllowed, rec.Code)	251		assert.Equal(t, http.StatusMethodNotAllowed, rec.Code)
			252	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
250		}	253		}
251			254
252		func TestHandler_StartBlobUpload_Success(t *testing.T) {	255		func TestHandler_StartBlobUpload_Success(t *testing.T) {

@@ -279,6 +282,7 @@ func TestHandler_StartBlobUpload_Error(t *testing.T) {
279		handler.ServeHTTP(rec, req)	282		handler.ServeHTTP(rec, req)
280			283
281		assert.Equal(t, http.StatusInternalServerError, rec.Code)	284		assert.Equal(t, http.StatusInternalServerError, rec.Code)
			285	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
282		}	286		}
283			287
284		func TestHandler_BlobUpload_PATCH(t *testing.T) {	288		func TestHandler_BlobUpload_PATCH(t *testing.T) {

@@ -332,6 +336,7 @@ func TestHandler_BlobUpload_PUT_DigestMismatch(t *testing.T) {
332		handler.ServeHTTP(rec, req)	336		handler.ServeHTTP(rec, req)
333			337
334		assert.Equal(t, http.StatusBadRequest, rec.Code)	338		assert.Equal(t, http.StatusBadRequest, rec.Code)
			339	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
335		}	340		}
336			341
337		func TestHandler_ListTags_Success(t *testing.T) {	342		func TestHandler_ListTags_Success(t *testing.T) {

@@ -348,8 +353,14 @@ func TestHandler_ListTags_Success(t *testing.T) {
348			353
349		assert.Equal(t, http.StatusOK, rec.Code)	354		assert.Equal(t, http.StatusOK, rec.Code)
350		assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))	355		assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
351	-	assert.Contains(t, rec.Body.String(), "myapp")	356	+
352	-	assert.Contains(t, rec.Body.String(), "latest")	357	+	var response struct {
			358	+	Name string `json:"name"`
			359	+	Tags []string `json:"tags"`
			360	+	}
			361	+	assert.NoError(t, json.NewDecoder(rec.Body).Decode(&response))
			362	+	assert.Equal(t, "myapp", response.Name)
			363	+	assert.Contains(t, response.Tags, "latest")
353		}	364		}
354			365
355		func TestHandler_ListTags_NotFound(t *testing.T) {	366		func TestHandler_ListTags_NotFound(t *testing.T) {

@@ -365,6 +376,7 @@ func TestHandler_ListTags_NotFound(t *testing.T) {
365		handler.ServeHTTP(rec, req)	376		handler.ServeHTTP(rec, req)
366			377
367		assert.Equal(t, http.StatusNotFound, rec.Code)	378		assert.Equal(t, http.StatusNotFound, rec.Code)
			379	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
368		}	380		}
369			381
370		func TestHandler_ListTags_MethodNotAllowed(t *testing.T) {	382		func TestHandler_ListTags_MethodNotAllowed(t *testing.T) {

@@ -378,6 +390,7 @@ func TestHandler_ListTags_MethodNotAllowed(t *testing.T) {
378		handler.ServeHTTP(rec, req)	390		handler.ServeHTTP(rec, req)
379			391
380		assert.Equal(t, http.StatusMethodNotAllowed, rec.Code)	392		assert.Equal(t, http.StatusMethodNotAllowed, rec.Code)
			393	+	assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
381		}	394		}
382			395
383		func TestHandler_RegisterRoutes(t *testing.T) {	396		func TestHandler_RegisterRoutes(t *testing.T) {

M internal/adapters/in/http/registry/token.go +12 -13


@@ -8,18 +8,11 @@ import (
8	8
9	9		"github.com/bnema/zerowrap"
10	10
	11	+	"gordon/internal/adapters/dto"
11	12		"gordon/internal/boundaries/in"
12	13		"gordon/internal/domain"
13	14		)
14	15
15		-	// TokenResponse represents the response from the token server.
16		-	type TokenResponse struct {
17		-	Token string `json:"token"`
18		-	AccessToken string `json:"access_token,omitempty"`
19		-	ExpiresIn int `json:"expires_in,omitempty"`
20		-	IssuedAt string `json:"issued_at,omitempty"`
21		-	}
22		-
23	16		// InternalAuth holds credentials for internal loopback registry access.
24	17		type InternalAuth struct {
25	18		Username string

@@ -60,7 +53,9 @@ func (h TokenHandler) handleToken(w http.ResponseWriter, r http.Request) {
60	53		log := zerowrap.FromCtx(ctx)
61	54
62	55		if r.Method != http.MethodGet {
63		-	http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
	56	+	w.Header().Set("Content-Type", "application/json")
	57	+	w.WriteHeader(http.StatusMethodNotAllowed)
	58	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Method not allowed"})
64	59		return
65	60		}
66	61

@@ -103,7 +98,9 @@ func (h TokenHandler) handleToken(w http.ResponseWriter, r http.Request) {
103	98		Str("username", username).
104	99		Msg("token request authentication failed")
105	100		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
106		-	http.Error(w, "Unauthorized", http.StatusUnauthorized)
	101	+	w.Header().Set("Content-Type", "application/json")
	102	+	w.WriteHeader(http.StatusUnauthorized)
	103	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Unauthorized"})
107	104		return
108	105		}
109	106

@@ -115,11 +112,13 @@ func (h TokenHandler) handleToken(w http.ResponseWriter, r http.Request) {
115	112		accessToken, err := h.authSvc.GenerateAccessToken(ctx, username, requestedScopes, 5*time.Minute)
116	113		if err != nil {
117	114		log.Error().Err(err).Msg("failed to generate access token")
118		-	http.Error(w, "Internal Server Error", http.StatusInternalServerError)
	115	+	w.Header().Set("Content-Type", "application/json")
	116	+	w.WriteHeader(http.StatusInternalServerError)
	117	+	_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Internal Server Error"})
119	118		return
120	119		}
121	120
122		-	response := TokenResponse{
	121	+	response := dto.TokenResponse{
123	122		Token: accessToken,
124	123		ExpiresIn: 300, // 5 minutes in seconds
125	124		IssuedAt: time.Now().Format(time.RFC3339),

@@ -141,7 +140,7 @@ func (h TokenHandler) handleToken(w http.ResponseWriter, r http.Request) {
141	140		// sendAnonymousToken sends a token for anonymous/unauthenticated access.
142	141		func (h *TokenHandler) sendAnonymousToken(w http.ResponseWriter, log zerowrap.Logger) {
143	142		// For anonymous access, we issue a very short-lived token with limited scope
144		-	response := TokenResponse{
	143	+	response := dto.TokenResponse{
145	144		Token: "", // Empty token indicates limited access
146	145		ExpiresIn: 60, // 1 minute
147	146		IssuedAt: time.Now().Format(time.RFC3339),

 	"github.com/bnema/zerowrap"
+	"gordon/internal/adapters/dto"
 	"gordon/internal/boundaries/in"
 	"gordon/internal/domain"
 )
-// TokenResponse represents the response from the token server.
-type TokenResponse struct {
-	Token       string `json:"token"`
-	AccessToken string `json:"access_token,omitempty"`
-	ExpiresIn   int    `json:"expires_in,omitempty"`
-	IssuedAt    string `json:"issued_at,omitempty"`
-}
 // InternalAuth holds credentials for internal loopback registry access.
 type InternalAuth struct {
 	Username string
 	log := zerowrap.FromCtx(ctx)
 	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Method not allowed"})
 		return
 	}
 			Str("username", username).
 			Msg("token request authentication failed")
 		w.Header().Set("WWW-Authenticate", `Basic realm="Gordon Registry"`)
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusUnauthorized)
+		_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Unauthorized"})
 		return
 	}
 	accessToken, err := h.authSvc.GenerateAccessToken(ctx, username, requestedScopes, 5*time.Minute)
 	if err != nil {
 		log.Error().Err(err).Msg("failed to generate access token")
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		_ = json.NewEncoder(w).Encode(dto.ErrorResponse{Error: "Internal Server Error"})
 		return
 	}
-	response := TokenResponse{
+	response := dto.TokenResponse{
 		Token:     accessToken,
 		ExpiresIn: 300, // 5 minutes in seconds
 		IssuedAt:  time.Now().Format(time.RFC3339),
 // sendAnonymousToken sends a token for anonymous/unauthenticated access.
 func (h *TokenHandler) sendAnonymousToken(w http.ResponseWriter, log zerowrap.Logger) {
 	// For anonymous access, we issue a very short-lived token with limited scope
-	response := TokenResponse{
+	response := dto.TokenResponse{
 		Token:     "", // Empty token indicates limited access
 		ExpiresIn: 60, // 1 minute
 		IssuedAt:  time.Now().Format(time.RFC3339),

M internal/usecase/container/routes_test.go +3 -0


@@ -79,6 +79,9 @@ func TestService_ListRoutesWithDetails_Empty(t *testing.T) {
79	79		svc := NewService(runtime, nil, nil, nil, Config{NetworkPrefix: "gordon"})
80	80		ctx := testContext()
81	81
	82	+	// getAllAttachments is called even with empty containers
	83	+	runtime.EXPECT().ListContainers(mock.Anything, true).Return([]*domain.Container{}, nil)
	84	+
82	85		results := svc.ListRoutesWithDetails(ctx)
83	86
84	87		assert.Empty(t, results)


@@ -79,6 +79,9 @@ func TestService_ListRoutesWithDetails_Empty(t *testing.T) {
79	svc := NewService(runtime, nil, nil, nil, Config{NetworkPrefix: "gordon"})	79		svc := NewService(runtime, nil, nil, nil, Config{NetworkPrefix: "gordon"})
80	ctx := testContext()	80		ctx := testContext()
81		81
		82	+	// getAllAttachments is called even with empty containers
		83	+	runtime.EXPECT().ListContainers(mock.Anything, true).Return([]*domain.Container{}, nil)
		84	+
82	results := svc.ListRoutesWithDetails(ctx)	85		results := svc.ListRoutesWithDetails(ctx)
83		86
84	assert.Empty(t, results)	87		assert.Empty(t, results)

M internal/usecase/container/service.go +47 -1


@@ -326,6 +326,9 @@ func (s *Service) ListRoutesWithDetails(ctx context.Context) []domain.RouteInfo
326	326		maps.Copy(containers, s.containers)
327	327		s.mu.RUnlock()
328	328
	329	+	// Fetch all attachments once to avoid N+1 queries
	330	+	attachmentsByDomain := s.getAllAttachments(ctx)
	331	+
329	332		results := make([]domain.RouteInfo, 0, len(containers))
330	333		for domainName, container := range containers {
331	334		network := ""

@@ -352,7 +355,7 @@ func (s *Service) ListRoutesWithDetails(ctx context.Context) []domain.RouteInfo
352	355		ContainerID: containerID,
353	356		ContainerStatus: status,
354	357		Network: network,
355		-	Attachments: s.getAttachmentsForDomain(ctx, domainName),
	358	+	Attachments: attachmentsByDomain[domainName],
356	359		})
357	360		}
358	361

@@ -940,6 +943,49 @@ func (s *Service) getAttachmentsForDomain(ctx context.Context, domainName string
940	943		return nil
941	944		}
942	945
	946	+	return s.filterAttachments(containers, domainName)
	947	+	}
	948	+
	949	+	// getAllAttachments fetches all containers once and returns attachments grouped by domain.
	950	+	// This avoids N+1 queries when listing multiple routes.
	951	+	func (s *Service) getAllAttachments(ctx context.Context) map[string][]domain.Attachment {
	952	+	containers, err := s.runtime.ListContainers(ctx, true)
	953	+	if err != nil {
	954	+	return nil
	955	+	}
	956	+
	957	+	result := make(map[string][]domain.Attachment)
	958	+	for _, container := range containers {
	959	+	if container.Labels == nil {
	960	+	continue
	961	+	}
	962	+	if container.Labels[domain.LabelAttachment] != "true" {
	963	+	continue
	964	+	}
	965	+	ownerDomain := container.Labels[domain.LabelAttachedTo]
	966	+	if ownerDomain == "" {
	967	+	continue
	968	+	}
	969	+	image := container.Image
	970	+	serviceName := container.Name
	971	+	if labelImage, ok := container.Labels[domain.LabelImage]; ok && labelImage != "" {
	972	+	image = labelImage
	973	+	serviceName = extractServiceName(labelImage)
	974	+	}
	975	+	attachment := domain.Attachment{
	976	+	Name: serviceName,
	977	+	Image: image,
	978	+	ContainerID: container.ID,
	979	+	Status: container.Status,
	980	+	}
	981	+	result[ownerDomain] = append(result[ownerDomain], attachment)
	982	+	}
	983	+
	984	+	return result
	985	+	}
	986	+
	987	+	// filterAttachments extracts attachments for a specific domain from a container list.
	988	+	func (s Service) filterAttachments(containers []domain.Container, domainName string) []domain.Attachment {
943	989		attachments := make([]domain.Attachment, 0)
944	990		for _, container := range containers {
945	991		if container.Labels == nil {


@@ -326,6 +326,9 @@ func (s *Service) ListRoutesWithDetails(ctx context.Context) []domain.RouteInfo
326		maps.Copy(containers, s.containers)	326		maps.Copy(containers, s.containers)
327		s.mu.RUnlock()	327		s.mu.RUnlock()
328			328
			329	+	// Fetch all attachments once to avoid N+1 queries
			330	+	attachmentsByDomain := s.getAllAttachments(ctx)
			331	+
329		results := make([]domain.RouteInfo, 0, len(containers))	332		results := make([]domain.RouteInfo, 0, len(containers))
330		for domainName, container := range containers {	333		for domainName, container := range containers {
331		network := ""	334		network := ""

@@ -352,7 +355,7 @@ func (s *Service) ListRoutesWithDetails(ctx context.Context) []domain.RouteInfo
352		ContainerID: containerID,	355		ContainerID: containerID,
353		ContainerStatus: status,	356		ContainerStatus: status,
354		Network: network,	357		Network: network,
355	-	Attachments: s.getAttachmentsForDomain(ctx, domainName),	358	+	Attachments: attachmentsByDomain[domainName],
356		})	359		})
357		}	360		}
358			361

@@ -940,6 +943,49 @@ func (s *Service) getAttachmentsForDomain(ctx context.Context, domainName string
940		return nil	943		return nil
941		}	944		}
942			945
			946	+	return s.filterAttachments(containers, domainName)
			947	+	}
			948	+
			949	+	// getAllAttachments fetches all containers once and returns attachments grouped by domain.
			950	+	// This avoids N+1 queries when listing multiple routes.
			951	+	func (s *Service) getAllAttachments(ctx context.Context) map[string][]domain.Attachment {
			952	+	containers, err := s.runtime.ListContainers(ctx, true)
			953	+	if err != nil {
			954	+	return nil
			955	+	}
			956	+
			957	+	result := make(map[string][]domain.Attachment)
			958	+	for _, container := range containers {
			959	+	if container.Labels == nil {
			960	+	continue
			961	+	}
			962	+	if container.Labels[domain.LabelAttachment] != "true" {
			963	+	continue
			964	+	}
			965	+	ownerDomain := container.Labels[domain.LabelAttachedTo]
			966	+	if ownerDomain == "" {
			967	+	continue
			968	+	}
			969	+	image := container.Image
			970	+	serviceName := container.Name
			971	+	if labelImage, ok := container.Labels[domain.LabelImage]; ok && labelImage != "" {
			972	+	image = labelImage
			973	+	serviceName = extractServiceName(labelImage)
			974	+	}
			975	+	attachment := domain.Attachment{
			976	+	Name: serviceName,
			977	+	Image: image,
			978	+	ContainerID: container.ID,
			979	+	Status: container.Status,
			980	+	}
			981	+	result[ownerDomain] = append(result[ownerDomain], attachment)
			982	+	}
			983	+
			984	+	return result
			985	+	}
			986	+
			987	+	// filterAttachments extracts attachments for a specific domain from a container list.
			988	+	func (s Service) filterAttachments(containers []domain.Container, domainName string) []domain.Attachment {
943		attachments := make([]domain.Attachment, 0)	989		attachments := make([]domain.Attachment, 0)
944		for _, container := range containers {	990		for _, container := range containers {
945		if container.Labels == nil {	991		if container.Labels == nil {