refactor(portal): move static assets into module

refactor(portal): move snapshot cache helpers into module

adk-rust/crates/detmir-portal/src/main.rs

@@ -3,7 +3,6 @@ use std::fs::{self, File, OpenOptions};
 use std::io::{Read, Write};
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
-use std::sync::{Arc, Mutex};
 use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
@@ -31,6 +30,9 @@ mod portal_roles;
 mod production;
 mod readiness_api;
 mod risk_narrative;
+mod role_access;
+mod snapshot_cache;
+mod static_assets;
 mod workforce_kpi_explain;
 
 use api_contracts::api_contract_summary;
@@ -52,16 +54,16 @@ use readiness_api::{readiness_bundle, readiness_latest, readiness_verify};
 use risk_narrative::{
     RiskNarrativeInputs, RiskNarrativeQuery, build_risk_narrative, build_risk_narrative_from_report,
 };
+use role_access::{portal_role_from_request, respond_forbidden, role_envelope};
+use snapshot_cache::{
+    SnapshotCache, build_fast_health, cached_snapshot, clone_snapshot_cache, new_snapshot_cache,
+};
+use static_assets::{
+    API_CONTRACT_OPENAPI, API_CONTRACT_TYPESCRIPT, APP_CSS, APP_JS, ARCHITECTURE_HTML, INDEX_HTML,
+};
 use workforce_kpi_explain::{KpiExplainQuery, build_workforce_kpi_explain};
 
-const INDEX_HTML: &str = include_str!("static/index.html");
-const ARCHITECTURE_HTML: &str = include_str!("static/architecture.html");
-const APP_CSS: &str = include_str!("static/app.css");
-const APP_JS: &str = include_str!("static/app.js");
-const API_CONTRACT_OPENAPI: &str = include_str!("contracts/openapi.json");
-const API_CONTRACT_TYPESCRIPT: &str = include_str!("contracts/typescript.d.ts");
 const UEBA_BASELINE_MIN_SAMPLES: usize = 3;
-const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
 const DEFAULT_DEPARTMENT_LABEL: &str = "Не привязано к подразделению";
 const LEGACY_UNASSIGNED_DEPARTMENT_LABEL: &str = "Без подразделения";
 const PORTAL_SCHEMA_VERSION: &str = "pilot-v1";
@@ -85,14 +87,6 @@ unsafe extern "C" {
     fn kill(pid: i32, sig: i32) -> i32;
 }
 
-type SnapshotCache = Arc<Mutex<Option<CachedSnapshot>>>;
-
-#[derive(Clone, Debug)]
-struct CachedSnapshot {
-    created: Instant,
-    snapshot: Snapshot,
-}
-
 #[derive(Clone, Debug, Parser)]
 #[command(about = "Read-only AWatch-rus operator/manager/owner web portal")]
 struct Cli {
@@ -1325,11 +1319,11 @@ fn run() -> Result<i32> {
     }
 
     let server = Server::http(&args.bind).map_err(|err| anyhow!("bind {}: {err}", args.bind))?;
-    let snapshot_cache: SnapshotCache = Arc::new(Mutex::new(None));
+    let snapshot_cache: SnapshotCache = new_snapshot_cache();
     eprintln!("detmir-portal listening on http://{}", args.bind);
     for request in server.incoming_requests() {
         let args = args.clone();
-        let snapshot_cache = Arc::clone(&snapshot_cache);
+        let snapshot_cache = clone_snapshot_cache(&snapshot_cache);
         thread::spawn(move || {
             let result = if args.evidence_only {
                 handle_evidence_only_request(request, &args)
@@ -1663,81 +1657,6 @@ fn handle_evidence_only_request(request: Request, args: &Cli) -> Result<()> {
     )
 }
 
-fn portal_role_from_request(request: &Request, url: &str) -> PortalRole {
-    query_param(url, "role")
-        .as_deref()
-        .and_then(PortalRole::parse)
-        .or_else(|| {
-            request
-                .headers()
-                .iter()
-                .find(|header| header.field.equiv("X-AWatch-Role"))
-                .and_then(|header| PortalRole::parse(header.value.as_str()))
-        })
-        .unwrap_or(PortalRole::Executive)
-}
-
-fn role_envelope(role: PortalRole, scope: &str) -> Value {
-    json!({
-        "role": role.as_str(),
-        "role_label": role.label_ru(),
-        "scope": scope,
-        "allowed_scopes": role.allowed_scopes(),
-        "server_enforced": true,
-    })
-}
-
-fn respond_forbidden(request: Request, role: PortalRole, scope: &str) -> Result<()> {
-    respond_json_status(
-        request,
-        StatusCode(403),
-        &json!({
-            "ok": false,
-            "error": "forbidden",
-            "message": format!("Роль {} не имеет доступа к контуру {scope}", role.label_ru()),
-            "role": role.as_str(),
-            "scope": scope,
-            "server_enforced": true,
-        }),
-    )
-}
-
-fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
-    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-    if let Some(cached) = guard.as_ref() {
-        if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-            return cached.snapshot.clone();
-        }
-    }
-    let snapshot = build_snapshot(args);
-    *guard = Some(CachedSnapshot {
-        created: Instant::now(),
-        snapshot: snapshot.clone(),
-    });
-    snapshot
-}
-
-fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
-    match cache.try_lock() {
-        Ok(guard) => guard
-            .as_ref()
-            .map(|cached| build_health(&cached.snapshot))
-            .unwrap_or_else(lightweight_health),
-        Err(_) => lightweight_health(),
-    }
-}
-
-fn lightweight_health() -> HealthResponse {
-    let mut sources = BTreeMap::new();
-    sources.insert("portal".to_string(), true);
-    HealthResponse {
-        ok: true,
-        generated_at_utc: now(),
-        version: env!("CARGO_PKG_VERSION").to_string(),
-        sources,
-    }
-}
-
 fn build_snapshot(args: &Cli) -> Snapshot {
     let timeout = Duration::from_secs(args.timeout_seconds);
     let security_events_config = SecurityEventsConfig {

adk-rust/crates/detmir-portal/src/role_access.rs

@@ -0,0 +1,52 @@
+//! Portal role extraction and access-denial helpers.
+//!
+//! CONTRACT: role aliases, role envelope fields and forbidden response shape
+//! are part of the portal security boundary. Keep changes explicit and covered
+//! by role-gate tests.
+
+use anyhow::Result;
+use serde_json::{Value, json};
+use tiny_http::{Request, StatusCode};
+
+use crate::path_query::query_param;
+use crate::portal_roles::PortalRole;
+use crate::respond_json_status;
+
+pub(crate) fn portal_role_from_request(request: &Request, url: &str) -> PortalRole {
+    query_param(url, "role")
+        .as_deref()
+        .and_then(PortalRole::parse)
+        .or_else(|| {
+            request
+                .headers()
+                .iter()
+                .find(|header| header.field.equiv("X-AWatch-Role"))
+                .and_then(|header| PortalRole::parse(header.value.as_str()))
+        })
+        .unwrap_or(PortalRole::Executive)
+}
+
+pub(crate) fn role_envelope(role: PortalRole, scope: &str) -> Value {
+    json!({
+        "role": role.as_str(),
+        "role_label": role.label_ru(),
+        "scope": scope,
+        "allowed_scopes": role.allowed_scopes(),
+        "server_enforced": true,
+    })
+}
+
+pub(crate) fn respond_forbidden(request: Request, role: PortalRole, scope: &str) -> Result<()> {
+    respond_json_status(
+        request,
+        StatusCode(403),
+        &json!({
+            "ok": false,
+            "error": "forbidden",
+            "message": format!("Роль {} не имеет доступа к контуру {scope}", role.label_ru()),
+            "role": role.as_str(),
+            "scope": scope,
+            "server_enforced": true,
+        }),
+    )
+}

adk-rust/crates/detmir-portal/src/snapshot_cache.rs

@@ -0,0 +1,65 @@
+//! Snapshot cache helpers for the portal request path.
+//!
+//! CONTRACT: this module only owns short-lived in-process cache behavior.
+//! It must not change snapshot payloads, source collection, API routes or
+//! business calculations.
+
+use std::collections::BTreeMap;
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use crate::{Cli, HealthResponse, Snapshot, build_health, build_snapshot, now};
+
+const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
+
+pub(crate) type SnapshotCache = Arc<Mutex<Option<CachedSnapshot>>>;
+
+#[derive(Clone, Debug)]
+pub(crate) struct CachedSnapshot {
+    created: Instant,
+    snapshot: Snapshot,
+}
+
+pub(crate) fn new_snapshot_cache() -> SnapshotCache {
+    Arc::new(Mutex::new(None))
+}
+
+pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
+    Arc::clone(cache)
+}
+
+pub(crate) fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
+    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+    if let Some(cached) = guard.as_ref() {
+        if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+            return cached.snapshot.clone();
+        }
+    }
+    let snapshot = build_snapshot(args);
+    *guard = Some(CachedSnapshot {
+        created: Instant::now(),
+        snapshot: snapshot.clone(),
+    });
+    snapshot
+}
+
+pub(crate) fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
+    match cache.try_lock() {
+        Ok(guard) => guard
+            .as_ref()
+            .map(|cached| build_health(&cached.snapshot))
+            .unwrap_or_else(lightweight_health),
+        Err(_) => lightweight_health(),
+    }
+}
+
+fn lightweight_health() -> HealthResponse {
+    let mut sources = BTreeMap::new();
+    sources.insert("portal".to_string(), true);
+    HealthResponse {
+        ok: true,
+        generated_at_utc: now(),
+        version: env!("CARGO_PKG_VERSION").to_string(),
+        sources,
+    }
+}

adk-rust/crates/detmir-portal/src/static_assets.rs

@@ -0,0 +1,11 @@
+//! Static portal assets and generated API contract text.
+//!
+//! CONTRACT: this module only exposes embedded static files. Do not change
+//! file contents, MIME handling, routes or API contracts from here.
+
+pub(crate) const INDEX_HTML: &str = include_str!("static/index.html");
+pub(crate) const ARCHITECTURE_HTML: &str = include_str!("static/architecture.html");
+pub(crate) const APP_CSS: &str = include_str!("static/app.css");
+pub(crate) const APP_JS: &str = include_str!("static/app.js");
+pub(crate) const API_CONTRACT_OPENAPI: &str = include_str!("contracts/openapi.json");
+pub(crate) const API_CONTRACT_TYPESCRIPT: &str = include_str!("contracts/typescript.d.ts");