This commit is contained in:
ITWorx Pulse release export
@@ -0,0 +1,252 @@
|
||||
package alertcontrolapi
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"io"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/itworx/pulse/internal/alertcontrol"
|
||||
"github.com/itworx/pulse/internal/audit"
|
||||
"github.com/itworx/pulse/internal/auth"
|
||||
"github.com/itworx/pulse/internal/correlation"
|
||||
"github.com/itworx/pulse/internal/problem"
|
||||
)
|
||||
|
||||
type Handler struct {
|
||||
Store alertcontrol.Store
|
||||
Audit audit.Store
|
||||
}
|
||||
|
||||
func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
principal, ok := auth.PrincipalFromContext(r.Context())
|
||||
if !ok {
|
||||
fail(w, r, http.StatusUnauthorized, "UNAUTHORIZED", "Authentication required.")
|
||||
return
|
||||
}
|
||||
base := "/api/v1/alert-silences"
|
||||
maintenance := strings.HasPrefix(r.URL.Path, "/api/v1/maintenance-windows")
|
||||
if maintenance {
|
||||
base = "/api/v1/maintenance-windows"
|
||||
}
|
||||
path := strings.Trim(strings.TrimPrefix(r.URL.Path, base), "/")
|
||||
if path == "" {
|
||||
switch r.Method {
|
||||
case http.MethodGet:
|
||||
h.list(w, r, maintenance)
|
||||
case http.MethodPost:
|
||||
if !requireOperate(w, r, principal.Role) {
|
||||
return
|
||||
}
|
||||
h.create(w, r, principal.Subject, maintenance)
|
||||
default:
|
||||
fail(w, r, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", "This method is not supported.")
|
||||
}
|
||||
return
|
||||
}
|
||||
if path == "preview" && r.Method == http.MethodPost {
|
||||
h.preview(w, r, maintenance)
|
||||
return
|
||||
}
|
||||
parts := strings.Split(path, "/")
|
||||
if len(parts) == 2 && parts[1] == "revoke" && r.Method == http.MethodPost {
|
||||
if !requireOperate(w, r, principal.Role) {
|
||||
return
|
||||
}
|
||||
h.revoke(w, r, parts[0], principal.Subject, maintenance)
|
||||
return
|
||||
}
|
||||
fail(w, r, http.StatusNotFound, "NOT_FOUND", "Alert-control route not found.")
|
||||
}
|
||||
|
||||
func (h Handler) list(w http.ResponseWriter, r *http.Request, maintenance bool) {
|
||||
limit := 100
|
||||
if value := r.URL.Query().Get("limit"); value != "" {
|
||||
parsed, err := strconv.Atoi(value)
|
||||
if err != nil || parsed < 1 || parsed > 100 {
|
||||
fail(w, r, http.StatusBadRequest, "INVALID_LIMIT", "The limit must be between 1 and 100.")
|
||||
return
|
||||
}
|
||||
limit = parsed
|
||||
}
|
||||
if maintenance {
|
||||
items, err := h.Store.ListMaintenance(r.Context(), limit, time.Now().UTC())
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
write(w, http.StatusOK, map[string]any{"items": items})
|
||||
return
|
||||
}
|
||||
items, err := h.Store.ListSilences(r.Context(), limit, time.Now().UTC())
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
write(w, http.StatusOK, map[string]any{"items": items})
|
||||
}
|
||||
|
||||
func (h Handler) create(w http.ResponseWriter, r *http.Request, actor string, maintenance bool) {
|
||||
if maintenance {
|
||||
var item alertcontrol.MaintenanceWindow
|
||||
if err := decode(r, &item); err != nil {
|
||||
fail(w, r, http.StatusBadRequest, "INVALID_MAINTENANCE", "The maintenance-window document is invalid.")
|
||||
return
|
||||
}
|
||||
created, err := h.Store.CreateMaintenance(r.Context(), actor, item)
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
if err := h.record(r, actor, "maintenance_window.create", created.ID, "maintenance_window", nil, map[string]any{"state": created.State, "revision": created.Revision}); err != nil {
|
||||
fail(w, r, http.StatusServiceUnavailable, "AUDIT_UNAVAILABLE", "The audit event could not be recorded.")
|
||||
return
|
||||
}
|
||||
write(w, http.StatusCreated, map[string]any{"maintenance": created})
|
||||
return
|
||||
}
|
||||
var item alertcontrol.Silence
|
||||
if err := decode(r, &item); err != nil {
|
||||
fail(w, r, http.StatusBadRequest, "INVALID_SILENCE", "The silence document is invalid.")
|
||||
return
|
||||
}
|
||||
item.Owner = actor
|
||||
created, err := h.Store.CreateSilence(r.Context(), actor, item)
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
if err := h.record(r, actor, "alert_silence.create", created.ID, "alert_silence", nil, map[string]any{"state": created.State, "revision": created.Revision}); err != nil {
|
||||
fail(w, r, http.StatusServiceUnavailable, "AUDIT_UNAVAILABLE", "The audit event could not be recorded.")
|
||||
return
|
||||
}
|
||||
write(w, http.StatusCreated, map[string]any{"silence": created})
|
||||
}
|
||||
|
||||
func (h Handler) revoke(w http.ResponseWriter, r *http.Request, id, actor string, maintenance bool) {
|
||||
expected, err := revision(r)
|
||||
if err != nil {
|
||||
fail(w, r, http.StatusBadRequest, "INVALID_REVISION", "A valid If-Match or revision value is required.")
|
||||
return
|
||||
}
|
||||
if maintenance {
|
||||
item, err := h.Store.RevokeMaintenance(r.Context(), id, actor, expected, time.Now().UTC())
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
if err := h.record(r, actor, "maintenance_window.revoke", id, "maintenance_window", map[string]any{"revision": expected}, map[string]any{"state": item.State, "revision": item.Revision}); err != nil {
|
||||
fail(w, r, http.StatusServiceUnavailable, "AUDIT_UNAVAILABLE", "The audit event could not be recorded.")
|
||||
return
|
||||
}
|
||||
write(w, http.StatusOK, map[string]any{"maintenance": item})
|
||||
return
|
||||
}
|
||||
item, err := h.Store.RevokeSilence(r.Context(), id, actor, expected, time.Now().UTC())
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
if err := h.record(r, actor, "alert_silence.revoke", id, "alert_silence", map[string]any{"revision": expected}, map[string]any{"state": item.State, "revision": item.Revision}); err != nil {
|
||||
fail(w, r, http.StatusServiceUnavailable, "AUDIT_UNAVAILABLE", "The audit event could not be recorded.")
|
||||
return
|
||||
}
|
||||
write(w, http.StatusOK, map[string]any{"silence": item})
|
||||
}
|
||||
|
||||
func (h Handler) preview(w http.ResponseWriter, r *http.Request, maintenance bool) {
|
||||
var request struct {
|
||||
Matcher alertcontrol.Matcher `json:"matcher"`
|
||||
Selector alertcontrol.Matcher `json:"selector"`
|
||||
Signals []alertcontrol.Signal `json:"signals"`
|
||||
}
|
||||
if err := decode(r, &request); err != nil {
|
||||
fail(w, r, http.StatusBadRequest, "INVALID_PREVIEW", "The matcher preview request is invalid.")
|
||||
return
|
||||
}
|
||||
matcher := request.Matcher
|
||||
if maintenance {
|
||||
matcher = request.Selector
|
||||
}
|
||||
result, err := alertcontrol.PreviewSignals(matcher, request.Signals)
|
||||
if err != nil {
|
||||
h.repositoryFailure(w, r, err)
|
||||
return
|
||||
}
|
||||
write(w, http.StatusOK, map[string]any{"preview": result})
|
||||
}
|
||||
|
||||
func (h Handler) record(r *http.Request, actor, action, id, resourceType string, before, after map[string]any) error {
|
||||
if h.Audit == nil {
|
||||
return nil
|
||||
}
|
||||
return h.Audit.Append(r.Context(), audit.Event{Actor: actor, Action: action, ResourceType: resourceType, ResourceID: id, Result: "success", CorrelationID: correlation.FromContext(r.Context()), Before: before, After: after})
|
||||
}
|
||||
|
||||
func (h Handler) repositoryFailure(w http.ResponseWriter, r *http.Request, err error) {
|
||||
switch {
|
||||
case errors.Is(err, alertcontrol.ErrInvalid):
|
||||
fail(w, r, http.StatusBadRequest, "INVALID_ALERT_CONTROL", "The alert-control document is invalid.")
|
||||
case errors.Is(err, alertcontrol.ErrConflict):
|
||||
fail(w, r, http.StatusConflict, "REVISION_CONFLICT", "The alert control was changed or expired.")
|
||||
case errors.Is(err, alertcontrol.ErrNotFound):
|
||||
fail(w, r, http.StatusNotFound, "NOT_FOUND", "The alert control was not found.")
|
||||
case errors.Is(err, alertcontrol.ErrUnavailable):
|
||||
fail(w, r, http.StatusServiceUnavailable, "DATABASE_UNAVAILABLE", "Alert controls are unavailable.")
|
||||
default:
|
||||
fail(w, r, http.StatusInternalServerError, "ALERT_CONTROL_REQUEST_FAILED", "The alert-control request failed.")
|
||||
}
|
||||
}
|
||||
func requireOperate(w http.ResponseWriter, r *http.Request, role auth.Role) bool {
|
||||
if auth.Allows(role, auth.PermissionOperate) {
|
||||
return true
|
||||
}
|
||||
fail(w, r, http.StatusForbidden, "FORBIDDEN", "Alert-control editing is not allowed for this role.")
|
||||
return false
|
||||
}
|
||||
func revision(r *http.Request) (int64, error) {
|
||||
value := r.Header.Get("If-Match")
|
||||
if value == "" {
|
||||
value = r.URL.Query().Get("revision")
|
||||
}
|
||||
value = strings.Trim(value, "\"")
|
||||
if value == "" {
|
||||
return 0, errors.New("revision required")
|
||||
}
|
||||
return strconv.ParseInt(value, 10, 64)
|
||||
}
|
||||
func decode(r *http.Request, target any) error {
|
||||
contentType := strings.ToLower(strings.TrimSpace(strings.Split(r.Header.Get("Content-Type"), ";")[0]))
|
||||
if contentType != "" && contentType != "application/json" {
|
||||
return errors.New("unsupported content type")
|
||||
}
|
||||
body, err := io.ReadAll(io.LimitReader(r.Body, 2<<20+1))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer r.Body.Close()
|
||||
if len(body) > 2<<20 {
|
||||
return errors.New("request too large")
|
||||
}
|
||||
decoder := json.NewDecoder(strings.NewReader(string(body)))
|
||||
decoder.DisallowUnknownFields()
|
||||
if err := decoder.Decode(target); err != nil {
|
||||
return err
|
||||
}
|
||||
var extra any
|
||||
if err := decoder.Decode(&extra); err != io.EOF {
|
||||
return errors.New("multiple JSON values")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
func fail(w http.ResponseWriter, r *http.Request, status int, code, detail string) {
|
||||
problem.Write(w, r, status, code, http.StatusText(status), detail, nil)
|
||||
}
|
||||
func write(w http.ResponseWriter, status int, value any) {
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(status)
|
||||
_ = json.NewEncoder(w).Encode(value)
|
||||
}
|
||||
Reference in New Issue
Block a user