up

src/Scanner/StellaOps.Scanner.WebService/Program.cs

@@ -1,8 +1,8 @@
-using System.Collections.Generic;
-using System.Diagnostics;
-using System.Text;
-using System.Text.Json;
-using System.Text.Json.Serialization;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+using System.Text.Json;
+using System.Text.Json.Serialization;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Diagnostics;
 using Microsoft.AspNetCore.Http;
@@ -38,21 +38,21 @@ using StellaOps.Scanner.Storage.Extensions;
 using StellaOps.Scanner.Storage.Mongo;
 using StellaOps.Scanner.WebService.Endpoints;
 using StellaOps.Scanner.WebService.Options;
-
-var builder = WebApplication.CreateBuilder(args);
-
-builder.Configuration.AddStellaOpsDefaults(options =>
-{
-    options.BasePath = builder.Environment.ContentRootPath;
-    options.EnvironmentPrefix = "SCANNER_";
-    options.ConfigureBuilder = configurationBuilder =>
-    {
-        configurationBuilder.AddScannerYaml(Path.Combine(builder.Environment.ContentRootPath, "../etc/scanner.yaml"));
-    };
-});
-
-var contentRoot = builder.Environment.ContentRootPath;
-
+
+var builder = WebApplication.CreateBuilder(args);
+
+builder.Configuration.AddStellaOpsDefaults(options =>
+{
+    options.BasePath = builder.Environment.ContentRootPath;
+    options.EnvironmentPrefix = "SCANNER_";
+    options.ConfigureBuilder = configurationBuilder =>
+    {
+        configurationBuilder.AddScannerYaml(Path.Combine(builder.Environment.ContentRootPath, "../etc/scanner.yaml"));
+    };
+});
+
+var contentRoot = builder.Environment.ContentRootPath;
+
 var bootstrapOptions = builder.Configuration.BindOptions<ScannerWebServiceOptions>(
     ScannerWebServiceOptions.SectionName,
     (opts, _) =>
@@ -62,25 +62,25 @@ var bootstrapOptions = builder.Configuration.BindOptions<ScannerWebServiceOption
     });
 
 builder.Services.AddStellaOpsCrypto(bootstrapOptions.Crypto);
-
-builder.Services.AddOptions<ScannerWebServiceOptions>()
-    .Bind(builder.Configuration.GetSection(ScannerWebServiceOptions.SectionName))
-    .PostConfigure(options =>
-    {
-        ScannerWebServiceOptionsPostConfigure.Apply(options, contentRoot);
-        ScannerWebServiceOptionsValidator.Validate(options);
-    })
-    .ValidateOnStart();
-
-builder.Host.UseSerilog((context, services, loggerConfiguration) =>
-{
-    loggerConfiguration
-        .MinimumLevel.Information()
-        .MinimumLevel.Override("Microsoft.AspNetCore", LogEventLevel.Warning)
-        .Enrich.FromLogContext()
-        .WriteTo.Console();
-});
-
+
+builder.Services.AddOptions<ScannerWebServiceOptions>()
+    .Bind(builder.Configuration.GetSection(ScannerWebServiceOptions.SectionName))
+    .PostConfigure(options =>
+    {
+        ScannerWebServiceOptionsPostConfigure.Apply(options, contentRoot);
+        ScannerWebServiceOptionsValidator.Validate(options);
+    })
+    .ValidateOnStart();
+
+builder.Host.UseSerilog((context, services, loggerConfiguration) =>
+{
+    loggerConfiguration
+        .MinimumLevel.Information()
+        .MinimumLevel.Override("Microsoft.AspNetCore", LogEventLevel.Warning)
+        .Enrich.FromLogContext()
+        .WriteTo.Console();
+});
+
 if (bootstrapOptions.Determinism.FixedClock)
 {
     builder.Services.AddSingleton<TimeProvider>(_ => new DeterministicTimeProvider(bootstrapOptions.Determinism.FixedInstantUtc));
@@ -114,6 +114,7 @@ builder.Services.AddSurfaceFileCache();
 builder.Services.AddSurfaceManifestStore();
 builder.Services.AddSurfaceSecrets();
 builder.Services.AddSingleton<IConfigureOptions<ScannerWebServiceOptions>, ScannerSurfaceSecretConfigurator>();
+builder.Services.AddSingleton<IConfigureOptions<ScannerWebServiceOptions>, SurfaceFeatureFlagsConfigurator>();
 builder.Services.AddSingleton<IConfigureOptions<SurfaceCacheOptions>>(sp =>
     new SurfaceCacheOptionsConfigurator(sp.GetRequiredService<ISurfaceEnvironment>()));
 builder.Services.AddSingleton<IConfigureOptions<SurfaceManifestStoreOptions>>(sp =>
@@ -205,100 +206,100 @@ builder.Services.AddSingleton<RuntimeEventRateLimiter>();
 builder.Services.AddSingleton<IRuntimeEventIngestionService, RuntimeEventIngestionService>();
 builder.Services.AddSingleton<IRuntimeAttestationVerifier, RuntimeAttestationVerifier>();
 builder.Services.AddSingleton<IRuntimePolicyService, RuntimePolicyService>();
-
-var pluginHostOptions = ScannerPluginHostFactory.Build(bootstrapOptions, contentRoot);
-builder.Services.RegisterPluginRoutines(builder.Configuration, pluginHostOptions);
-
-builder.Services.AddOpenApiIfAvailable();
-
-if (bootstrapOptions.Authority.Enabled)
-{
-    builder.Services.AddStellaOpsAuthClient(clientOptions =>
-    {
-        clientOptions.Authority = bootstrapOptions.Authority.Issuer;
-        clientOptions.ClientId = bootstrapOptions.Authority.ClientId ?? string.Empty;
-        clientOptions.ClientSecret = bootstrapOptions.Authority.ClientSecret;
-        clientOptions.HttpTimeout = TimeSpan.FromSeconds(bootstrapOptions.Authority.BackchannelTimeoutSeconds);
-
-        clientOptions.DefaultScopes.Clear();
-        foreach (var scope in bootstrapOptions.Authority.ClientScopes)
-        {
-            clientOptions.DefaultScopes.Add(scope);
-        }
-
-        var resilience = bootstrapOptions.Authority.Resilience ?? new ScannerWebServiceOptions.AuthorityOptions.ResilienceOptions();
-        if (resilience.EnableRetries.HasValue)
-        {
-            clientOptions.EnableRetries = resilience.EnableRetries.Value;
-        }
-
-        if (resilience.RetryDelays is { Count: > 0 })
-        {
-            clientOptions.RetryDelays.Clear();
-            foreach (var delay in resilience.RetryDelays)
-            {
-                clientOptions.RetryDelays.Add(delay);
-            }
-        }
-
-        if (resilience.AllowOfflineCacheFallback.HasValue)
-        {
-            clientOptions.AllowOfflineCacheFallback = resilience.AllowOfflineCacheFallback.Value;
-        }
-
-        if (resilience.OfflineCacheTolerance.HasValue)
-        {
-            clientOptions.OfflineCacheTolerance = resilience.OfflineCacheTolerance.Value;
-        }
-    });
-
-    builder.Services.AddStellaOpsResourceServerAuthentication(
-        builder.Configuration,
-        configurationSection: null,
-        configure: resourceOptions =>
-        {
-            resourceOptions.Authority = bootstrapOptions.Authority.Issuer;
-            resourceOptions.RequireHttpsMetadata = bootstrapOptions.Authority.RequireHttpsMetadata;
-            resourceOptions.MetadataAddress = bootstrapOptions.Authority.MetadataAddress;
-            resourceOptions.BackchannelTimeout = TimeSpan.FromSeconds(bootstrapOptions.Authority.BackchannelTimeoutSeconds);
-            resourceOptions.TokenClockSkew = TimeSpan.FromSeconds(bootstrapOptions.Authority.TokenClockSkewSeconds);
-
-            resourceOptions.Audiences.Clear();
-            foreach (var audience in bootstrapOptions.Authority.Audiences)
-            {
-                resourceOptions.Audiences.Add(audience);
-            }
-
-            resourceOptions.RequiredScopes.Clear();
-            foreach (var scope in bootstrapOptions.Authority.RequiredScopes)
-            {
-                resourceOptions.RequiredScopes.Add(scope);
-            }
-
-            resourceOptions.BypassNetworks.Clear();
-            foreach (var network in bootstrapOptions.Authority.BypassNetworks)
-            {
-                resourceOptions.BypassNetworks.Add(network);
-            }
-        });
-
-    builder.Services.AddAuthorization(options =>
-    {
+
+var pluginHostOptions = ScannerPluginHostFactory.Build(bootstrapOptions, contentRoot);
+builder.Services.RegisterPluginRoutines(builder.Configuration, pluginHostOptions);
+
+builder.Services.AddOpenApiIfAvailable();
+
+if (bootstrapOptions.Authority.Enabled)
+{
+    builder.Services.AddStellaOpsAuthClient(clientOptions =>
+    {
+        clientOptions.Authority = bootstrapOptions.Authority.Issuer;
+        clientOptions.ClientId = bootstrapOptions.Authority.ClientId ?? string.Empty;
+        clientOptions.ClientSecret = bootstrapOptions.Authority.ClientSecret;
+        clientOptions.HttpTimeout = TimeSpan.FromSeconds(bootstrapOptions.Authority.BackchannelTimeoutSeconds);
+
+        clientOptions.DefaultScopes.Clear();
+        foreach (var scope in bootstrapOptions.Authority.ClientScopes)
+        {
+            clientOptions.DefaultScopes.Add(scope);
+        }
+
+        var resilience = bootstrapOptions.Authority.Resilience ?? new ScannerWebServiceOptions.AuthorityOptions.ResilienceOptions();
+        if (resilience.EnableRetries.HasValue)
+        {
+            clientOptions.EnableRetries = resilience.EnableRetries.Value;
+        }
+
+        if (resilience.RetryDelays is { Count: > 0 })
+        {
+            clientOptions.RetryDelays.Clear();
+            foreach (var delay in resilience.RetryDelays)
+            {
+                clientOptions.RetryDelays.Add(delay);
+            }
+        }
+
+        if (resilience.AllowOfflineCacheFallback.HasValue)
+        {
+            clientOptions.AllowOfflineCacheFallback = resilience.AllowOfflineCacheFallback.Value;
+        }
+
+        if (resilience.OfflineCacheTolerance.HasValue)
+        {
+            clientOptions.OfflineCacheTolerance = resilience.OfflineCacheTolerance.Value;
+        }
+    });
+
+    builder.Services.AddStellaOpsResourceServerAuthentication(
+        builder.Configuration,
+        configurationSection: null,
+        configure: resourceOptions =>
+        {
+            resourceOptions.Authority = bootstrapOptions.Authority.Issuer;
+            resourceOptions.RequireHttpsMetadata = bootstrapOptions.Authority.RequireHttpsMetadata;
+            resourceOptions.MetadataAddress = bootstrapOptions.Authority.MetadataAddress;
+            resourceOptions.BackchannelTimeout = TimeSpan.FromSeconds(bootstrapOptions.Authority.BackchannelTimeoutSeconds);
+            resourceOptions.TokenClockSkew = TimeSpan.FromSeconds(bootstrapOptions.Authority.TokenClockSkewSeconds);
+
+            resourceOptions.Audiences.Clear();
+            foreach (var audience in bootstrapOptions.Authority.Audiences)
+            {
+                resourceOptions.Audiences.Add(audience);
+            }
+
+            resourceOptions.RequiredScopes.Clear();
+            foreach (var scope in bootstrapOptions.Authority.RequiredScopes)
+            {
+                resourceOptions.RequiredScopes.Add(scope);
+            }
+
+            resourceOptions.BypassNetworks.Clear();
+            foreach (var network in bootstrapOptions.Authority.BypassNetworks)
+            {
+                resourceOptions.BypassNetworks.Add(network);
+            }
+        });
+
+    builder.Services.AddAuthorization(options =>
+    {
         options.AddStellaOpsScopePolicy(ScannerPolicies.ScansEnqueue, bootstrapOptions.Authority.RequiredScopes.ToArray());
         options.AddStellaOpsScopePolicy(ScannerPolicies.ScansRead, ScannerAuthorityScopes.ScansRead);
         options.AddStellaOpsScopePolicy(ScannerPolicies.Reports, ScannerAuthorityScopes.ReportsRead);
         options.AddStellaOpsScopePolicy(ScannerPolicies.RuntimeIngest, ScannerAuthorityScopes.RuntimeIngest);
-    });
-}
-else
-{
-    builder.Services.AddAuthentication(options =>
-    {
-        options.DefaultAuthenticateScheme = "Anonymous";
-        options.DefaultChallengeScheme = "Anonymous";
-    })
-    .AddScheme<AuthenticationSchemeOptions, AnonymousAuthenticationHandler>("Anonymous", _ => { });
-
+    });
+}
+else
+{
+    builder.Services.AddAuthentication(options =>
+    {
+        options.DefaultAuthenticateScheme = "Anonymous";
+        options.DefaultChallengeScheme = "Anonymous";
+    })
+    .AddScheme<AuthenticationSchemeOptions, AnonymousAuthenticationHandler>("Anonymous", _ => { });
+
     builder.Services.AddAuthorization(options =>
     {
         options.AddPolicy(ScannerPolicies.ScansEnqueue, policy => policy.RequireAssertion(_ => true));
@@ -307,7 +308,7 @@ else
         options.AddPolicy(ScannerPolicies.RuntimeIngest, policy => policy.RequireAssertion(_ => true));
     });
 }
-
+
 var app = builder.Build();
 
 // Fail fast if surface configuration is invalid at startup.
@@ -335,67 +336,67 @@ using (var scope = app.Services.CreateScope())
     var bootstrapper = scope.ServiceProvider.GetRequiredService<MongoBootstrapper>();
     await bootstrapper.InitializeAsync(CancellationToken.None).ConfigureAwait(false);
 }
-
-if (resolvedOptions.Telemetry.EnableLogging && resolvedOptions.Telemetry.EnableRequestLogging)
-{
-    app.UseSerilogRequestLogging(options =>
-    {
-        options.GetLevel = (httpContext, elapsed, exception) =>
-            exception is null ? LogEventLevel.Information : LogEventLevel.Error;
-        options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
-        {
-            diagnosticContext.Set("RequestId", httpContext.TraceIdentifier);
-            diagnosticContext.Set("UserAgent", httpContext.Request.Headers.UserAgent.ToString());
-            if (Activity.Current is { TraceId: var traceId } && traceId != default)
-            {
-                diagnosticContext.Set("TraceId", traceId.ToString());
-            }
-        };
-    });
-}
-
-app.UseExceptionHandler(errorApp =>
-{
-    errorApp.Run(async context =>
-    {
-        context.Response.ContentType = "application/problem+json";
-        var feature = context.Features.Get<IExceptionHandlerFeature>();
-        var error = feature?.Error;
-
-        var extensions = new Dictionary<string, object?>(StringComparer.Ordinal)
-        {
-            ["traceId"] = Activity.Current?.TraceId.ToString() ?? context.TraceIdentifier,
-        };
-
-        var problem = Results.Problem(
-            detail: error?.Message,
-            instance: context.Request.Path,
-            statusCode: StatusCodes.Status500InternalServerError,
-            title: "Unexpected server error",
-            type: "https://stellaops.org/problems/internal-error",
-            extensions: extensions);
-
-        await problem.ExecuteAsync(context).ConfigureAwait(false);
-    });
-});
-
-if (authorityConfigured)
-{
-    app.UseAuthentication();
-    app.UseAuthorization();
-}
-
-app.MapHealthEndpoints();
-
-var apiGroup = app.MapGroup(resolvedOptions.Api.BasePath);
-
-if (app.Environment.IsEnvironment("Testing"))
-{
-    apiGroup.MapGet("/__auth-probe", () => Results.Ok("ok"))
-        .RequireAuthorization(ScannerPolicies.ScansEnqueue)
-        .WithName("scanner.auth-probe");
-}
-
+
+if (resolvedOptions.Telemetry.EnableLogging && resolvedOptions.Telemetry.EnableRequestLogging)
+{
+    app.UseSerilogRequestLogging(options =>
+    {
+        options.GetLevel = (httpContext, elapsed, exception) =>
+            exception is null ? LogEventLevel.Information : LogEventLevel.Error;
+        options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
+        {
+            diagnosticContext.Set("RequestId", httpContext.TraceIdentifier);
+            diagnosticContext.Set("UserAgent", httpContext.Request.Headers.UserAgent.ToString());
+            if (Activity.Current is { TraceId: var traceId } && traceId != default)
+            {
+                diagnosticContext.Set("TraceId", traceId.ToString());
+            }
+        };
+    });
+}
+
+app.UseExceptionHandler(errorApp =>
+{
+    errorApp.Run(async context =>
+    {
+        context.Response.ContentType = "application/problem+json";
+        var feature = context.Features.Get<IExceptionHandlerFeature>();
+        var error = feature?.Error;
+
+        var extensions = new Dictionary<string, object?>(StringComparer.Ordinal)
+        {
+            ["traceId"] = Activity.Current?.TraceId.ToString() ?? context.TraceIdentifier,
+        };
+
+        var problem = Results.Problem(
+            detail: error?.Message,
+            instance: context.Request.Path,
+            statusCode: StatusCodes.Status500InternalServerError,
+            title: "Unexpected server error",
+            type: "https://stellaops.org/problems/internal-error",
+            extensions: extensions);
+
+        await problem.ExecuteAsync(context).ConfigureAwait(false);
+    });
+});
+
+if (authorityConfigured)
+{
+    app.UseAuthentication();
+    app.UseAuthorization();
+}
+
+app.MapHealthEndpoints();
+
+var apiGroup = app.MapGroup(resolvedOptions.Api.BasePath);
+
+if (app.Environment.IsEnvironment("Testing"))
+{
+    apiGroup.MapGet("/__auth-probe", () => Results.Ok("ok"))
+        .RequireAuthorization(ScannerPolicies.ScansEnqueue)
+        .WithName("scanner.auth-probe");
+}
+
 apiGroup.MapScanEndpoints(resolvedOptions.Api.ScansSegment);
 apiGroup.MapReplayEndpoints();
 
@@ -406,7 +407,7 @@ if (resolvedOptions.Features.EnablePolicyPreview)
 
 apiGroup.MapReportEndpoints(resolvedOptions.Api.ReportsSegment);
 apiGroup.MapRuntimeEndpoints(resolvedOptions.Api.RuntimeSegment);
-
+
 app.MapOpenApiIfAvailable();
 await app.RunAsync().ConfigureAwait(false);