Restructure solution layout by module
This commit is contained in:
master
@@ -0,0 +1,583 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Collections.Immutable;
|
||||
using System.Diagnostics;
|
||||
using System.Linq;
|
||||
using System.Security.Claims;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Options;
|
||||
using StellaOps.Auth.Abstractions;
|
||||
using StellaOps.Policy;
|
||||
using StellaOps.Scanner.WebService.Contracts;
|
||||
using StellaOps.Scanner.WebService.Options;
|
||||
|
||||
namespace StellaOps.Scanner.WebService.Services;
|
||||
|
||||
internal sealed class ReportEventDispatcher : IReportEventDispatcher
|
||||
{
|
||||
private const string DefaultTenant = "default";
|
||||
private const string Source = "scanner.webservice";
|
||||
|
||||
private readonly IPlatformEventPublisher _publisher;
|
||||
private readonly TimeProvider _timeProvider;
|
||||
private readonly ILogger<ReportEventDispatcher> _logger;
|
||||
private readonly string[] _apiBaseSegments;
|
||||
private readonly string _reportsSegment;
|
||||
private readonly string _policySegment;
|
||||
|
||||
public ReportEventDispatcher(
|
||||
IPlatformEventPublisher publisher,
|
||||
IOptions<ScannerWebServiceOptions> options,
|
||||
TimeProvider timeProvider,
|
||||
ILogger<ReportEventDispatcher> logger)
|
||||
{
|
||||
_publisher = publisher ?? throw new ArgumentNullException(nameof(publisher));
|
||||
if (options is null)
|
||||
{
|
||||
throw new ArgumentNullException(nameof(options));
|
||||
}
|
||||
|
||||
var apiOptions = options.Value.Api ?? new ScannerWebServiceOptions.ApiOptions();
|
||||
_apiBaseSegments = SplitSegments(apiOptions.BasePath);
|
||||
_reportsSegment = string.IsNullOrWhiteSpace(apiOptions.ReportsSegment)
|
||||
? "reports"
|
||||
: apiOptions.ReportsSegment.Trim('/');
|
||||
_policySegment = string.IsNullOrWhiteSpace(apiOptions.PolicySegment)
|
||||
? "policy"
|
||||
: apiOptions.PolicySegment.Trim('/');
|
||||
_timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
|
||||
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
|
||||
}
|
||||
|
||||
public async Task PublishAsync(
|
||||
ReportRequestDto request,
|
||||
PolicyPreviewResponse preview,
|
||||
ReportDocumentDto document,
|
||||
DsseEnvelopeDto? envelope,
|
||||
HttpContext httpContext,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(request);
|
||||
ArgumentNullException.ThrowIfNull(preview);
|
||||
ArgumentNullException.ThrowIfNull(document);
|
||||
ArgumentNullException.ThrowIfNull(httpContext);
|
||||
|
||||
cancellationToken.ThrowIfCancellationRequested();
|
||||
|
||||
var now = _timeProvider.GetUtcNow();
|
||||
var occurredAt = document.GeneratedAt == default ? now : document.GeneratedAt;
|
||||
var tenant = ResolveTenant(httpContext);
|
||||
var scope = BuildScope(request, document);
|
||||
var attributes = BuildAttributes(document);
|
||||
var links = BuildLinks(httpContext, document, envelope);
|
||||
var correlationId = document.ReportId;
|
||||
var (traceId, spanId) = ResolveTraceContext();
|
||||
|
||||
var reportEvent = new OrchestratorEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
Kind = OrchestratorEventKinds.ScannerReportReady,
|
||||
Version = 1,
|
||||
Tenant = tenant,
|
||||
OccurredAt = occurredAt,
|
||||
RecordedAt = now,
|
||||
Source = Source,
|
||||
IdempotencyKey = BuildIdempotencyKey(OrchestratorEventKinds.ScannerReportReady, tenant, document.ReportId),
|
||||
CorrelationId = correlationId,
|
||||
TraceId = traceId,
|
||||
SpanId = spanId,
|
||||
Scope = scope,
|
||||
Attributes = attributes,
|
||||
Payload = BuildReportReadyPayload(request, preview, document, envelope, links, correlationId)
|
||||
};
|
||||
|
||||
await PublishSafelyAsync(reportEvent, document.ReportId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
var scanCompletedEvent = new OrchestratorEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
Kind = OrchestratorEventKinds.ScannerScanCompleted,
|
||||
Version = 1,
|
||||
Tenant = tenant,
|
||||
OccurredAt = occurredAt,
|
||||
RecordedAt = now,
|
||||
Source = Source,
|
||||
IdempotencyKey = BuildIdempotencyKey(OrchestratorEventKinds.ScannerScanCompleted, tenant, correlationId),
|
||||
CorrelationId = correlationId,
|
||||
TraceId = traceId,
|
||||
SpanId = spanId,
|
||||
Scope = scope,
|
||||
Attributes = attributes,
|
||||
Payload = BuildScanCompletedPayload(request, preview, document, envelope, links, correlationId)
|
||||
};
|
||||
|
||||
await PublishSafelyAsync(scanCompletedEvent, document.ReportId, cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
|
||||
private async Task PublishSafelyAsync(OrchestratorEvent @event, string reportId, CancellationToken cancellationToken)
|
||||
{
|
||||
try
|
||||
{
|
||||
await _publisher.PublishAsync(@event, cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
|
||||
{
|
||||
throw;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogError(
|
||||
ex,
|
||||
"Failed to publish orchestrator event {EventKind} for report {ReportId}.",
|
||||
@event.Kind,
|
||||
reportId);
|
||||
}
|
||||
}
|
||||
|
||||
private static string ResolveTenant(HttpContext context)
|
||||
{
|
||||
var tenant = context.User?.FindFirstValue(StellaOpsClaimTypes.Tenant);
|
||||
if (!string.IsNullOrWhiteSpace(tenant))
|
||||
{
|
||||
return tenant.Trim();
|
||||
}
|
||||
|
||||
if (context.Request.Headers.TryGetValue("X-Stella-Tenant", out var headerTenant))
|
||||
{
|
||||
var headerValue = headerTenant.ToString();
|
||||
if (!string.IsNullOrWhiteSpace(headerValue))
|
||||
{
|
||||
return headerValue.Trim();
|
||||
}
|
||||
}
|
||||
|
||||
return DefaultTenant;
|
||||
}
|
||||
|
||||
private static OrchestratorEventScope BuildScope(ReportRequestDto request, ReportDocumentDto document)
|
||||
{
|
||||
var repository = ResolveRepository(request);
|
||||
var (ns, repo) = SplitRepository(repository);
|
||||
|
||||
var digest = string.IsNullOrWhiteSpace(document.ImageDigest)
|
||||
? request.ImageDigest ?? string.Empty
|
||||
: document.ImageDigest;
|
||||
|
||||
return new OrchestratorEventScope
|
||||
{
|
||||
Namespace = ns,
|
||||
Repo = string.IsNullOrWhiteSpace(repo) ? "(unknown)" : repo,
|
||||
Digest = string.IsNullOrWhiteSpace(digest) ? "(unknown)" : digest
|
||||
};
|
||||
}
|
||||
|
||||
private static ImmutableSortedDictionary<string, string> BuildAttributes(ReportDocumentDto document)
|
||||
{
|
||||
var builder = ImmutableSortedDictionary.CreateBuilder<string, string>(StringComparer.Ordinal);
|
||||
builder["reportId"] = document.ReportId;
|
||||
builder["verdict"] = document.Verdict;
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(document.Policy.RevisionId))
|
||||
{
|
||||
builder["policyRevisionId"] = document.Policy.RevisionId!;
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(document.Policy.Digest))
|
||||
{
|
||||
builder["policyDigest"] = document.Policy.Digest!;
|
||||
}
|
||||
|
||||
return builder.ToImmutable();
|
||||
}
|
||||
|
||||
private static ReportReadyEventPayload BuildReportReadyPayload(
|
||||
ReportRequestDto request,
|
||||
PolicyPreviewResponse preview,
|
||||
ReportDocumentDto document,
|
||||
DsseEnvelopeDto? envelope,
|
||||
ReportLinksPayload links,
|
||||
string correlationId)
|
||||
{
|
||||
return new ReportReadyEventPayload
|
||||
{
|
||||
ReportId = document.ReportId,
|
||||
ScanId = correlationId,
|
||||
ImageDigest = document.ImageDigest,
|
||||
GeneratedAt = document.GeneratedAt,
|
||||
Verdict = MapVerdict(document.Verdict),
|
||||
Summary = document.Summary,
|
||||
Delta = BuildDelta(preview, request),
|
||||
QuietedFindingCount = document.Summary.Quieted,
|
||||
Policy = document.Policy,
|
||||
Links = links,
|
||||
Dsse = envelope,
|
||||
Report = document
|
||||
};
|
||||
}
|
||||
|
||||
private static ScanCompletedEventPayload BuildScanCompletedPayload(
|
||||
ReportRequestDto request,
|
||||
PolicyPreviewResponse preview,
|
||||
ReportDocumentDto document,
|
||||
DsseEnvelopeDto? envelope,
|
||||
ReportLinksPayload links,
|
||||
string correlationId)
|
||||
{
|
||||
return new ScanCompletedEventPayload
|
||||
{
|
||||
ReportId = document.ReportId,
|
||||
ScanId = correlationId,
|
||||
ImageDigest = document.ImageDigest,
|
||||
Verdict = MapVerdict(document.Verdict),
|
||||
Summary = document.Summary,
|
||||
Delta = BuildDelta(preview, request),
|
||||
Policy = document.Policy,
|
||||
Findings = BuildFindingSummaries(request),
|
||||
Links = links,
|
||||
Dsse = envelope,
|
||||
Report = document
|
||||
};
|
||||
}
|
||||
|
||||
private ReportLinksPayload BuildLinks(HttpContext context, ReportDocumentDto document, DsseEnvelopeDto? envelope)
|
||||
{
|
||||
if (!context.Request.Host.HasValue)
|
||||
{
|
||||
return new ReportLinksPayload();
|
||||
}
|
||||
|
||||
var uiLink = BuildAbsoluteUri(context, "ui", "reports", document.ReportId);
|
||||
var reportLink = BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _reportsSegment, document.ReportId));
|
||||
var policyLink = string.IsNullOrWhiteSpace(document.Policy.RevisionId)
|
||||
? null
|
||||
: BuildAbsoluteUri(context, ConcatSegments(_apiBaseSegments, _policySegment, "revisions", document.Policy.RevisionId));
|
||||
var attestationLink = envelope is null
|
||||
? null
|
||||
: BuildAbsoluteUri(context, "ui", "attestations", document.ReportId);
|
||||
|
||||
return new ReportLinksPayload
|
||||
{
|
||||
Ui = uiLink,
|
||||
Report = reportLink,
|
||||
Policy = policyLink,
|
||||
Attestation = attestationLink
|
||||
};
|
||||
}
|
||||
|
||||
private static ReportDeltaPayload? BuildDelta(PolicyPreviewResponse preview, ReportRequestDto request)
|
||||
{
|
||||
if (preview.Diffs.IsDefaultOrEmpty)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
var findings = BuildFindingsIndex(request.Findings);
|
||||
var kevIds = new SortedSet<string>(StringComparer.OrdinalIgnoreCase);
|
||||
var newCritical = 0;
|
||||
var newHigh = 0;
|
||||
|
||||
foreach (var diff in preview.Diffs)
|
||||
{
|
||||
var projected = diff.Projected;
|
||||
if (projected is null || string.IsNullOrWhiteSpace(projected.FindingId))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
findings.TryGetValue(projected.FindingId, out var finding);
|
||||
|
||||
if (IsNewlyImportant(diff))
|
||||
{
|
||||
var severity = finding?.Severity;
|
||||
if (string.Equals(severity, "Critical", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
newCritical++;
|
||||
}
|
||||
else if (string.Equals(severity, "High", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
newHigh++;
|
||||
}
|
||||
|
||||
var kevId = ResolveKevIdentifier(finding);
|
||||
if (!string.IsNullOrWhiteSpace(kevId))
|
||||
{
|
||||
kevIds.Add(kevId);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (newCritical == 0 && newHigh == 0 && kevIds.Count == 0)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
return new ReportDeltaPayload
|
||||
{
|
||||
NewCritical = newCritical > 0 ? newCritical : null,
|
||||
NewHigh = newHigh > 0 ? newHigh : null,
|
||||
Kev = kevIds.Count > 0 ? kevIds.ToArray() : null
|
||||
};
|
||||
}
|
||||
|
||||
private static string BuildAbsoluteUri(HttpContext context, params string[] segments)
|
||||
=> BuildAbsoluteUri(context, segments.AsEnumerable());
|
||||
|
||||
private static string BuildAbsoluteUri(HttpContext context, IEnumerable<string> segments)
|
||||
{
|
||||
var normalized = segments
|
||||
.Where(segment => !string.IsNullOrWhiteSpace(segment))
|
||||
.Select(segment => segment.Trim('/'))
|
||||
.Where(segment => segment.Length > 0)
|
||||
.ToArray();
|
||||
|
||||
if (!context.Request.Host.HasValue || normalized.Length == 0)
|
||||
{
|
||||
return string.Empty;
|
||||
}
|
||||
|
||||
var scheme = string.IsNullOrWhiteSpace(context.Request.Scheme) ? "https" : context.Request.Scheme;
|
||||
var builder = new UriBuilder(scheme, context.Request.Host.Host)
|
||||
{
|
||||
Port = context.Request.Host.Port ?? -1,
|
||||
Path = "/" + string.Join('/', normalized.Select(Uri.EscapeDataString)),
|
||||
Query = string.Empty,
|
||||
Fragment = string.Empty
|
||||
};
|
||||
|
||||
return builder.Uri.ToString();
|
||||
}
|
||||
|
||||
private string[] ConcatSegments(IEnumerable<string> prefix, params string[] suffix)
|
||||
{
|
||||
var segments = new List<string>();
|
||||
foreach (var segment in prefix)
|
||||
{
|
||||
if (!string.IsNullOrWhiteSpace(segment))
|
||||
{
|
||||
segments.Add(segment.Trim('/'));
|
||||
}
|
||||
}
|
||||
|
||||
foreach (var segment in suffix)
|
||||
{
|
||||
if (!string.IsNullOrWhiteSpace(segment))
|
||||
{
|
||||
segments.Add(segment.Trim('/'));
|
||||
}
|
||||
}
|
||||
|
||||
return segments.ToArray();
|
||||
}
|
||||
|
||||
private static string[] SplitSegments(string? path)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(path))
|
||||
{
|
||||
return Array.Empty<string>();
|
||||
}
|
||||
|
||||
return path.Split('/', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
|
||||
}
|
||||
|
||||
private static ImmutableDictionary<string, PolicyPreviewFindingDto> BuildFindingsIndex(
|
||||
IReadOnlyList<PolicyPreviewFindingDto>? findings)
|
||||
{
|
||||
if (findings is null || findings.Count == 0)
|
||||
{
|
||||
return ImmutableDictionary<string, PolicyPreviewFindingDto>.Empty;
|
||||
}
|
||||
|
||||
var builder = ImmutableDictionary.CreateBuilder<string, PolicyPreviewFindingDto>(StringComparer.Ordinal);
|
||||
foreach (var finding in findings)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(finding.Id))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (!builder.ContainsKey(finding.Id))
|
||||
{
|
||||
builder.Add(finding.Id, finding);
|
||||
}
|
||||
}
|
||||
|
||||
return builder.ToImmutable();
|
||||
}
|
||||
|
||||
private static IReadOnlyList<FindingSummaryPayload> BuildFindingSummaries(ReportRequestDto request)
|
||||
{
|
||||
if (request.Findings is not { Count: > 0 })
|
||||
{
|
||||
return Array.Empty<FindingSummaryPayload>();
|
||||
}
|
||||
|
||||
var summaries = new List<FindingSummaryPayload>(request.Findings.Count);
|
||||
foreach (var finding in request.Findings)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(finding.Id))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
summaries.Add(new FindingSummaryPayload
|
||||
{
|
||||
Id = finding.Id,
|
||||
Severity = finding.Severity,
|
||||
Cve = finding.Cve,
|
||||
Purl = finding.Purl,
|
||||
Reachability = ResolveReachability(finding.Tags)
|
||||
});
|
||||
}
|
||||
|
||||
return summaries;
|
||||
}
|
||||
|
||||
private static string ResolveRepository(ReportRequestDto request)
|
||||
{
|
||||
if (request.Findings is { Count: > 0 })
|
||||
{
|
||||
foreach (var finding in request.Findings)
|
||||
{
|
||||
if (!string.IsNullOrWhiteSpace(finding.Repository))
|
||||
{
|
||||
return finding.Repository!.Trim();
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(finding.Image))
|
||||
{
|
||||
return finding.Image!.Trim();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return string.Empty;
|
||||
}
|
||||
|
||||
private static (string? Namespace, string Repo) SplitRepository(string repository)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(repository))
|
||||
{
|
||||
return (null, string.Empty);
|
||||
}
|
||||
|
||||
var normalized = repository.Trim();
|
||||
var segments = normalized.Split('/', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
|
||||
if (segments.Length == 0)
|
||||
{
|
||||
return (null, normalized);
|
||||
}
|
||||
|
||||
if (segments.Length == 1)
|
||||
{
|
||||
return (null, segments[0]);
|
||||
}
|
||||
|
||||
var repo = segments[^1];
|
||||
var ns = string.Join('/', segments[..^1]);
|
||||
return (ns, repo);
|
||||
}
|
||||
|
||||
private static bool IsNewlyImportant(PolicyVerdictDiff diff)
|
||||
{
|
||||
var projected = diff.Projected.Status;
|
||||
var baseline = diff.Baseline.Status;
|
||||
|
||||
return projected switch
|
||||
{
|
||||
PolicyVerdictStatus.Blocked or PolicyVerdictStatus.Escalated
|
||||
=> baseline != PolicyVerdictStatus.Blocked && baseline != PolicyVerdictStatus.Escalated,
|
||||
PolicyVerdictStatus.Warned or PolicyVerdictStatus.Deferred or PolicyVerdictStatus.RequiresVex
|
||||
=> baseline != PolicyVerdictStatus.Warned
|
||||
&& baseline != PolicyVerdictStatus.Deferred
|
||||
&& baseline != PolicyVerdictStatus.RequiresVex
|
||||
&& baseline != PolicyVerdictStatus.Blocked
|
||||
&& baseline != PolicyVerdictStatus.Escalated,
|
||||
_ => false
|
||||
};
|
||||
}
|
||||
|
||||
private static string? ResolveKevIdentifier(PolicyPreviewFindingDto? finding)
|
||||
{
|
||||
if (finding is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
var tags = finding.Tags;
|
||||
if (tags is not null)
|
||||
{
|
||||
foreach (var tag in tags)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(tag))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (string.Equals(tag, "kev", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return finding.Cve;
|
||||
}
|
||||
|
||||
if (tag.StartsWith("kev:", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
var value = tag["kev:".Length..];
|
||||
if (!string.IsNullOrWhiteSpace(value))
|
||||
{
|
||||
return value.Trim();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return finding.Cve;
|
||||
}
|
||||
|
||||
private static string? ResolveReachability(IReadOnlyList<string>? tags)
|
||||
{
|
||||
if (tags is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
foreach (var tag in tags)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(tag))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (tag.StartsWith("reachability:", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return tag["reachability:".Length..];
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static string MapVerdict(string verdict)
|
||||
=> verdict.ToLowerInvariant() switch
|
||||
{
|
||||
"blocked" or "fail" => "fail",
|
||||
"escalated" => "fail",
|
||||
"warn" or "warned" or "deferred" or "requiresvex" => "warn",
|
||||
_ => "pass"
|
||||
};
|
||||
|
||||
private static string BuildIdempotencyKey(string kind, string tenant, string identifier)
|
||||
=> $"{kind}:{tenant}:{identifier}".ToLowerInvariant();
|
||||
|
||||
private static (string? TraceId, string? SpanId) ResolveTraceContext()
|
||||
{
|
||||
var activity = Activity.Current;
|
||||
if (activity is null)
|
||||
{
|
||||
return (null, null);
|
||||
}
|
||||
|
||||
var traceId = activity.TraceId.ToString();
|
||||
var spanId = activity.SpanId.ToString();
|
||||
return (traceId, spanId);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user