118 lines
4.6 KiB
Go
118 lines
4.6 KiB
Go
package event_ingress
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/tls"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
|
|
"gorm.io/gorm"
|
|
|
|
"go-admin/app/bell/integration/machine_identity"
|
|
)
|
|
|
|
type EvidenceClient struct {
|
|
Endpoint string
|
|
Signer machine_identity.Signer
|
|
HTTP interface {
|
|
Do(*http.Request) (*http.Response, error)
|
|
}
|
|
}
|
|
|
|
func NewEvidenceClient(endpoint string, signer machine_identity.Signer) (*EvidenceClient, error) {
|
|
parsed, err := url.Parse(endpoint)
|
|
if err != nil || parsed.Scheme != "https" || parsed.Host == "" || parsed.User != nil || parsed.Path != "" || parsed.RawQuery != "" || parsed.Fragment != "" {
|
|
return nil, errors.New("Sense evidence endpoint must be an HTTPS origin without userinfo")
|
|
}
|
|
transport := &http.Transport{TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12}, TLSHandshakeTimeout: 5 * time.Second, ResponseHeaderTimeout: 5 * time.Second}
|
|
return &EvidenceClient{Endpoint: strings.TrimRight(endpoint, "/"), Signer: signer, HTTP: &http.Client{Transport: transport, Timeout: 8 * time.Second}}, nil
|
|
}
|
|
|
|
func (c EvidenceClient) Refresh(ctx context.Context, db *gorm.DB, status EvidenceStatus) error {
|
|
path := "/v1/evidence/" + status.EvidenceID
|
|
token, err := c.Signer.Mint("yovision-sense", []string{"evidence:read"}, http.MethodGet, path, nil)
|
|
if err != nil {
|
|
return c.degrade(db, status, "unavailable", "machine_identity_error")
|
|
}
|
|
request, err := http.NewRequestWithContext(ctx, http.MethodGet, c.Endpoint+path, nil)
|
|
if err != nil {
|
|
return c.degrade(db, status, "unavailable", "invalid_request")
|
|
}
|
|
request.Header.Set("Authorization", "Bearer "+token)
|
|
request.Header.Set("X-Request-ID", newCorrelationID())
|
|
response, err := c.HTTP.Do(request)
|
|
if err != nil {
|
|
code := "evidence_unavailable"
|
|
if errors.Is(err, context.DeadlineExceeded) || errors.Is(ctx.Err(), context.DeadlineExceeded) {
|
|
code = "evidence_timeout"
|
|
}
|
|
return c.degrade(db, status, "unavailable", code)
|
|
}
|
|
defer response.Body.Close()
|
|
body, readErr := io.ReadAll(io.LimitReader(response.Body, 64*1024+1))
|
|
if readErr != nil || len(body) > 64*1024 {
|
|
return c.degrade(db, status, "unavailable", "invalid_evidence_response")
|
|
}
|
|
if response.StatusCode == http.StatusNotFound {
|
|
return c.degrade(db, status, "unavailable", "evidence_not_found")
|
|
}
|
|
if response.StatusCode == http.StatusGone {
|
|
return c.degrade(db, status, "expired", "evidence_expired")
|
|
}
|
|
if response.StatusCode != http.StatusOK {
|
|
return c.degrade(db, status, "unavailable", "evidence_unavailable")
|
|
}
|
|
decoder := json.NewDecoder(bytes.NewReader(body))
|
|
decoder.DisallowUnknownFields()
|
|
var evidence Evidence
|
|
if err = decoder.Decode(&evidence); err != nil || evidence.EvidenceID != status.EvidenceID || evidence.OwnerID != status.OwnerID || validateEvidence(evidence) != nil {
|
|
return c.degrade(db, status, "unavailable", "invalid_evidence_response")
|
|
}
|
|
canonical, err := canonicalJSON(body)
|
|
if err != nil {
|
|
return c.degrade(db, status, "unavailable", "invalid_evidence_response")
|
|
}
|
|
now := time.Now().UTC()
|
|
var expiresAt *time.Time
|
|
if evidence.ExpiresAt != "" {
|
|
parsedExpiry, parseErr := time.Parse(time.RFC3339Nano, evidence.ExpiresAt)
|
|
if parseErr != nil {
|
|
return c.degrade(db, status, "unavailable", "invalid_evidence_response")
|
|
}
|
|
parsedExpiry = parsedExpiry.UTC()
|
|
expiresAt = &parsedExpiry
|
|
}
|
|
return db.Model(&EvidenceStatus{}).Where("event_id = ? AND evidence_id = ?", status.EventID, status.EvidenceID).Updates(map[string]any{"status": evidence.Status, "resolution": "current", "current_payload": canonical, "last_error": "", "expires_at": expiresAt, "checked_at": now, "updated_at": now}).Error
|
|
}
|
|
|
|
func (c EvidenceClient) degrade(db *gorm.DB, status EvidenceStatus, resolution, code string) error {
|
|
now := time.Now().UTC()
|
|
return db.Model(&EvidenceStatus{}).Where("event_id = ? AND evidence_id = ?", status.EventID, status.EvidenceID).Updates(map[string]any{"resolution": resolution, "last_error": code, "checked_at": now, "updated_at": now}).Error
|
|
}
|
|
|
|
func newCorrelationID() string {
|
|
raw := make([]byte, 16)
|
|
if _, err := rand.Read(raw); err != nil {
|
|
return "request-id-fallback"
|
|
}
|
|
return base64.RawURLEncoding.EncodeToString(raw)
|
|
}
|
|
|
|
func LoadEvidenceClient(getenv func(string) string) (*EvidenceClient, error) {
|
|
key, err := machine_identity.LoadPrivateKey(getenv("BELL_SENSE_PRIVATE_KEY_PATH"))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("load Bell evidence key: %w", err)
|
|
}
|
|
signer := machine_identity.Signer{Principal: strings.TrimSpace(getenv("BELL_SENSE_PRINCIPAL_ID")), KeyID: strings.TrimSpace(getenv("BELL_SENSE_KEY_ID")), PrivateKey: key}
|
|
return NewEvidenceClient(strings.TrimSpace(getenv("BELL_SENSE_EVIDENCE_ENDPOINT")), signer)
|
|
}
|