yovision/Bell/cmd/bell-api/main.go

package main

import (
	"context"
	"crypto/tls"
	"errors"
	"fmt"
	"log/slog"
	"net"
	"net/http"
	"os"
	"os/signal"
	"path/filepath"
	"strconv"
	"strings"
	"syscall"
	"time"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/stdlib"

	"yovision/bell/contracts"
	"yovision/bell/internal/alert"
	"yovision/bell/internal/audit"
	"yovision/bell/internal/event"
	"yovision/bell/internal/ingress"
	"yovision/bell/internal/store"
	bellweb "yovision/bell/web"
)

var version = "dev"

type configuration struct {
	address               string
	dsn                   string
	keyFile               string
	tlsCert               string
	tlsKey                string
	eventIngressEnabled   bool
	eventKeyFile          string
	forbiddenNamesFile    string
	alertsEnabled         bool
	alertRulesFile        string
	alertConsoleEnabled   bool
	alertConsoleTokenFile string
	alertConsoleTenantID  int64
	alertConsoleSiteID    int64
	alertConsoleActorRef  string
}

func main() {
	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
	if err := run(logger); err != nil {
		logger.Error("Bell stopped", "error", err)
		os.Exit(1)
	}
}

func loadConfiguration() (configuration, error) {
	value := configuration{
		address:               envOr("BELL_HTTP_ADDR", "127.0.0.1:8081"),
		dsn:                   os.Getenv("BELL_DB_DSN"),
		keyFile:               os.Getenv("BELL_AUDIT_KEYS_FILE"),
		tlsCert:               os.Getenv("BELL_TLS_CERT_FILE"),
		tlsKey:                os.Getenv("BELL_TLS_KEY_FILE"),
		eventKeyFile:          os.Getenv("BELL_EVENT_INGRESS_KEYS_FILE"),
		forbiddenNamesFile:    os.Getenv("BELL_EVIDENCE_FORBIDDEN_NAMES_FILE"),
		alertRulesFile:        os.Getenv("BELL_ALERT_RULES_FILE"),
		alertConsoleTokenFile: os.Getenv("BELL_ALERT_CONSOLE_TOKEN_FILE"),
		alertConsoleActorRef:  os.Getenv("BELL_ALERT_CONSOLE_ACTOR_REF"),
	}
	switch os.Getenv("BELL_EVENT_INGRESS_ENABLED") {
	case "", "false":
	case "true":
		value.eventIngressEnabled = true
	default:
		return configuration{}, errors.New("BELL_EVENT_INGRESS_ENABLED must be true or false")
	}
	if value.dsn == "" {
		return configuration{}, errors.New("BELL_DB_DSN is required")
	}
	if value.keyFile == "" || !filepath.IsAbs(value.keyFile) {
		return configuration{}, errors.New("BELL_AUDIT_KEYS_FILE must be an absolute external path")
	}
	host, _, err := net.SplitHostPort(value.address)
	if err != nil {
		return configuration{}, errors.New("invalid BELL_HTTP_ADDR")
	}
	ip := net.ParseIP(host)
	loopback := host == "localhost" || (ip != nil && ip.IsLoopback())
	if !loopback && (value.tlsCert == "" || value.tlsKey == "" || !filepath.IsAbs(value.tlsCert) || !filepath.IsAbs(value.tlsKey)) {
		return configuration{}, errors.New("non-loopback Bell bind requires absolute TLS certificate and key paths")
	}
	if (value.tlsCert == "") != (value.tlsKey == "") {
		return configuration{}, errors.New("Bell TLS certificate and key must be configured together")
	}
	if value.eventIngressEnabled {
		if value.eventKeyFile == "" || !filepath.IsAbs(value.eventKeyFile) {
			return configuration{}, errors.New("BELL_EVENT_INGRESS_KEYS_FILE must be an absolute external path when event ingress is enabled")
		}
		if value.forbiddenNamesFile == "" || !filepath.IsAbs(value.forbiddenNamesFile) {
			return configuration{}, errors.New("BELL_EVIDENCE_FORBIDDEN_NAMES_FILE must be an absolute external path when event ingress is enabled")
		}
	}
	value.alertsEnabled, err = strictBoolEnv("BELL_ALERTS_ENABLED")
	if err != nil {
		return configuration{}, err
	}
	value.alertConsoleEnabled, err = strictBoolEnv("BELL_ALERT_CONSOLE_ENABLED")
	if err != nil {
		return configuration{}, err
	}
	if value.alertsEnabled && (value.alertRulesFile == "" || !filepath.IsAbs(value.alertRulesFile)) {
		return configuration{}, errors.New("BELL_ALERT_RULES_FILE must be an absolute external path when alerts are enabled")
	}
	if value.alertConsoleEnabled {
		if !value.alertsEnabled || !loopback || os.Getenv("BELL_HTTP_ADDR") == "" {
			return configuration{}, errors.New("Bell alert console requires alerts and an explicit loopback bind")
		}
		if value.alertConsoleTokenFile == "" || !filepath.IsAbs(value.alertConsoleTokenFile) {
			return configuration{}, errors.New("BELL_ALERT_CONSOLE_TOKEN_FILE must be an absolute external path")
		}
		value.alertConsoleTenantID, err = positiveEnv("BELL_ALERT_CONSOLE_TENANT_ID")
		if err != nil {
			return configuration{}, err
		}
		value.alertConsoleSiteID, err = positiveEnv("BELL_ALERT_CONSOLE_SITE_ID")
		if err != nil {
			return configuration{}, err
		}
		if value.alertConsoleActorRef == "" {
			return configuration{}, errors.New("BELL_ALERT_CONSOLE_ACTOR_REF is required")
		}
	}
	return value, nil
}

func run(logger *slog.Logger) error {
	cfg, err := loadConfiguration()
	if err != nil {
		return err
	}
	pgConfig, err := pgx.ParseConfig(cfg.dsn)
	if err != nil {
		return errors.New("invalid Bell postgres DSN")
	}
	if pgConfig.RuntimeParams == nil {
		pgConfig.RuntimeParams = make(map[string]string)
	}
	pgConfig.RuntimeParams["application_name"] = "yovision-bell"
	db := stdlib.OpenDB(*pgConfig)
	db.SetMaxOpenConns(16)
	db.SetMaxIdleConns(4)
	db.SetConnMaxLifetime(30 * time.Minute)
	defer db.Close()

	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
	defer stop()
	repository, err := store.OpenPostgres(ctx, db)
	if err != nil {
		return err
	}
	if err := repository.AuditRelayReady(ctx); err != nil {
		return err
	}
	keys, err := audit.LoadKeys(cfg.keyFile)
	if err != nil {
		return err
	}
	handler, err := audit.NewHandler(repository, keys)
	if err != nil {
		return err
	}
	mux := http.NewServeMux()
	mux.Handle(audit.RelayPath, handler)
	if cfg.eventIngressEnabled {
		if err := repository.EventIngressReady(ctx); err != nil {
			return err
		}
		eventKeys, err := ingress.LoadKeys(cfg.eventKeyFile)
		if err != nil {
			return err
		}
		forbiddenNames, err := loadForbiddenNames(cfg.forbiddenNamesFile)
		if err != nil {
			return err
		}
		guard, err := event.NewEvidenceGuard(forbiddenNames...)
		if err != nil {
			return err
		}
		factory, err := event.NewFactory(contracts.EventV01Schema, event.ULIDGenerator{}, repository, guard)
		if err != nil {
			return err
		}
		eventHandler, err := ingress.NewHandler(repository, eventKeys, factory)
		if err != nil {
			return err
		}
		mux.Handle(ingress.Path, eventHandler)
	}
	if cfg.alertsEnabled {
		if err := repository.AlertReady(ctx); err != nil {
			return err
		}
		rules, err := alert.LoadRules(cfg.alertRulesFile)
		if err != nil {
			return err
		}
		if err := alert.Publish(ctx, repository, rules); err != nil {
			return err
		}
		go alert.RunWorker(ctx, repository, func(workerErr error) {
			logger.Error("Bell alert worker retrying", "error", workerErr)
		})
	}
	if cfg.alertConsoleEnabled {
		token, err := loadConsoleToken(cfg.alertConsoleTokenFile)
		if err != nil {
			return err
		}
		console, err := bellweb.NewHandler(repository, bellweb.Config{
			Token: token, TenantID: cfg.alertConsoleTenantID, SiteID: cfg.alertConsoleSiteID, ActorRef: cfg.alertConsoleActorRef,
		})
		if err != nil {
			return err
		}
		console.Register(mux)
	}
	mux.HandleFunc("GET /healthz", func(writer http.ResponseWriter, _ *http.Request) {
		writeStatus(writer, http.StatusOK, "ok")
	})
	mux.HandleFunc("GET /readyz", func(writer http.ResponseWriter, request *http.Request) {
		if err := repository.AuditRelayReady(request.Context()); err != nil {
			writeStatus(writer, http.StatusServiceUnavailable, "not_ready")
			return
		}
		if cfg.eventIngressEnabled {
			if err := repository.EventIngressReady(request.Context()); err != nil {
				writeStatus(writer, http.StatusServiceUnavailable, "not_ready")
				return
			}
		}
		if cfg.alertsEnabled {
			if err := repository.AlertReady(request.Context()); err != nil {
				writeStatus(writer, http.StatusServiceUnavailable, "not_ready")
				return
			}
		}
		writeStatus(writer, http.StatusOK, "ready")
	})
	server := &http.Server{Addr: cfg.address, Handler: mux, ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 15 * time.Second, WriteTimeout: 15 * time.Second, IdleTimeout: 60 * time.Second, TLSConfig: &tls.Config{MinVersion: tls.VersionTLS12}}
	serverErrors := make(chan error, 1)
	go func() {
		logger.Info("Bell listening", "address", cfg.address, "version", version, "tls_enabled", cfg.tlsCert != "")
		if cfg.tlsCert != "" {
			serverErrors <- server.ListenAndServeTLS(cfg.tlsCert, cfg.tlsKey)
			return
		}
		serverErrors <- server.ListenAndServe()
	}()
	select {
	case <-ctx.Done():
	case serverErr := <-serverErrors:
		if !errors.Is(serverErr, http.ErrServerClosed) {
			return fmt.Errorf("serve Bell HTTP: %w", serverErr)
		}
	}
	shutdownContext, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	return server.Shutdown(shutdownContext)
}

func loadForbiddenNames(path string) ([]string, error) {
	raw, err := os.ReadFile(path)
	if err != nil || len(raw) > 64<<10 {
		return nil, errors.New("read Bell evidence forbidden-names file")
	}
	var values []string
	for _, line := range strings.Split(string(raw), "\n") {
		line = strings.TrimSpace(line)
		if line == "" {
			continue
		}
		values = append(values, line)
	}
	if len(values) == 0 || len(values) > 256 {
		return nil, errors.New("Bell evidence forbidden-names file must contain 1 to 256 names")
	}
	return values, nil
}

func writeStatus(writer http.ResponseWriter, status int, value string) {
	writer.Header().Set("Content-Type", "application/json")
	writer.WriteHeader(status)
	_, _ = fmt.Fprintf(writer, `{"status":%q}`, value)
}

func envOr(name, fallback string) string {
	if value := os.Getenv(name); value != "" {
		return value
	}
	return fallback
}

func strictBoolEnv(name string) (bool, error) {
	switch os.Getenv(name) {
	case "", "false":
		return false, nil
	case "true":
		return true, nil
	default:
		return false, fmt.Errorf("%s must be true or false", name)
	}
}

func positiveEnv(name string) (int64, error) {
	value, err := strconv.ParseInt(os.Getenv(name), 10, 64)
	if err != nil || value < 1 {
		return 0, fmt.Errorf("%s must be a positive integer", name)
	}
	return value, nil
}

func loadConsoleToken(path string) (string, error) {
	raw, err := os.ReadFile(path)
	if err != nil || len(raw) > 4096 {
		return "", errors.New("read Bell alert console token file")
	}
	value := strings.TrimSpace(string(raw))
	if len(value) < 32 || len(value) > 256 || strings.ContainsAny(value, " \t\r\n") {
		return "", errors.New("Bell alert console token must contain 32 to 256 non-whitespace characters")
	}
	return value, nil
}