修复全量审查问题;设置接口PATCH化;回传指纹加固

internal/oci/logrelay.go

@@ -2,8 +2,6 @@ package oci
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/hex"
 	"fmt"
 	"strings"
 	"time"
@@ -14,14 +12,11 @@ import (
 	"github.com/oracle/oci-go-sdk/v65/sch"
 )
 
-// 日志回传链路(方案A)在租户侧的固定资源命名,按名幂等查找与创建;
+// 日志回传链路(方案A)在租户侧的资源命名与描述由 logrelay_names.go 集中派生;
 // 资源建在凭据默认区域,Audit 日志组含子 compartment。
 // Topic 删除后名称有保留期(同名重建长时间 409 Conflict),故 Topic 用
 // 前缀+随机后缀命名、按前缀幂等查找,销毁重建不受保留期阻塞。
 const (
-	relayTopicPrefix   = "ociportal-logs"
-	relayPolicyName    = "ociportal-logs-sch"
-	relayConnectorName = "ociportal-logs"
 	relayAuditLogGroup = "_Audit_Include_Subcompartment"
 	relayTopicPages    = 5 // 按前缀查找 Topic 的翻页上限
 )
@@ -83,24 +78,36 @@ func (c *RealClient) schClient(cred Credentials) (sch.ServiceConnectorClient, er
 	return sc, nil
 }
 
-// EnsureRelayTopic 实现 Client:按前缀返回既有 Topic 或以随机后缀新建。
+// EnsureRelayTopic 实现 Client:按新命名前缀返回既有 Topic,fallback 到 legacy 前缀;
+// 未命中则以新前缀 + 随机后缀新建。命中旧命名时顺手把描述刷新为中性文案。
 func (c *RealClient) EnsureRelayTopic(ctx context.Context, cred Credentials) (RelayResource, error) {
 	cp, err := c.onsControlClient(cred)
 	if err != nil {
 		return RelayResource{}, err
 	}
-	if res, ok, err := findRelayTopic(ctx, cp, cred.TenancyOCID); err != nil || ok {
-		return res, err
+	names := relayResourceNames(cred.TenancyOCID)
+	res, ok, err := findRelayTopic(ctx, cp, cred.TenancyOCID, names.TopicPrefix, legacyRelayTopicPrefix)
+	if err != nil {
+		return RelayResource{}, err
 	}
-	name, err := relayTopicNewName()
+	if ok {
+		refreshRelayTopicDesc(ctx, cp, res.ID)
+		return res, nil
+	}
+	return createRelayTopic(ctx, cp, cred.TenancyOCID, names.TopicPrefix)
+}
+
+// createRelayTopic 以指定前缀 + 4 字节随机后缀新建 ONS Topic,描述使用中性文案。
+func createRelayTopic(ctx context.Context, cp ons.NotificationControlPlaneClient, tenancy, prefix string) (RelayResource, error) {
+	name, err := relayTopicNewName(prefix)
 	if err != nil {
 		return RelayResource{}, err
 	}
 	created, err := cp.CreateTopic(ctx, ons.CreateTopicRequest{
 		CreateTopicDetails: ons.CreateTopicDetails{
 			Name:          &name,
-			CompartmentId: &cred.TenancyOCID,
-			Description:   common.String("oci-portal 日志回传:关键审计事件经 Connector 投递到面板"),
+			CompartmentId: &tenancy,
+			Description:   common.String(relayTopicDescNew),
 		},
 	})
 	if err != nil {
@@ -109,28 +116,17 @@ func (c *RealClient) EnsureRelayTopic(ctx context.Context, cred Credentials) (Re
 	return RelayResource{ID: deref(created.TopicId), State: string(created.LifecycleState), Created: true}, nil
 }
 
-// relayTopicNewName 生成带随机后缀的 Topic 名,规避删除名称保留期。
-func relayTopicNewName() (string, error) {
-	buf := make([]byte, 4)
-	if _, err := rand.Read(buf); err != nil {
-		return "", fmt.Errorf("topic name suffix: %w", err)
-	}
-	return relayTopicPrefix + "-" + hex.EncodeToString(buf), nil
-}
-
-// findRelayTopic 按名称前缀查找存活 Topic;未找到时 ok 为 false。
-func findRelayTopic(ctx context.Context, cp ons.NotificationControlPlaneClient, tenancy string) (RelayResource, bool, error) {
+// findRelayTopic 依次按传入的前缀列表在租户范围内查找存活 Topic;第一个命中即返回。
+// 支持传入新命名前缀与 legacy 前缀,实现向后兼容存量资源。
+func findRelayTopic(ctx context.Context, cp ons.NotificationControlPlaneClient, tenancy string, prefixes ...string) (RelayResource, bool, error) {
 	req := ons.ListTopicsRequest{CompartmentId: &tenancy}
 	for page := 0; page < relayTopicPages; page++ {
 		list, err := cp.ListTopics(ctx, req)
 		if err != nil {
 			return RelayResource{}, false, fmt.Errorf("list ons topics: %w", err)
 		}
-		for _, t := range list.Items {
-			if strings.HasPrefix(deref(t.Name), relayTopicPrefix) &&
-				t.LifecycleState == ons.NotificationTopicSummaryLifecycleStateActive {
-				return RelayResource{ID: deref(t.TopicId), State: string(t.LifecycleState)}, true, nil
-			}
+		if res, ok := matchRelayTopic(list.Items, prefixes); ok {
+			return res, true, nil
 		}
 		if list.OpcNextPage == nil {
 			break
@@ -140,6 +136,35 @@ func findRelayTopic(ctx context.Context, cp ons.NotificationControlPlaneClient,
 	return RelayResource{}, false, nil
 }
 
+// matchRelayTopic 在一页 Topic 中挑出第一个命名前缀命中且处于 ACTIVE 的资源。
+func matchRelayTopic(items []ons.NotificationTopicSummary, prefixes []string) (RelayResource, bool) {
+	for _, t := range items {
+		if t.LifecycleState != ons.NotificationTopicSummaryLifecycleStateActive {
+			continue
+		}
+		name := deref(t.Name)
+		for _, p := range prefixes {
+			if strings.HasPrefix(name, p) {
+				return RelayResource{ID: deref(t.TopicId), State: string(t.LifecycleState)}, true
+			}
+		}
+	}
+	return RelayResource{}, false
+}
+
+// refreshRelayTopicDesc 尽力把 Topic 描述改为中性文案;失败不阻塞主流程(权限不足等场景直接忽略)。
+func refreshRelayTopicDesc(ctx context.Context, cp ons.NotificationControlPlaneClient, topicID string) {
+	if topicID == "" {
+		return
+	}
+	_, _ = cp.UpdateTopic(ctx, ons.UpdateTopicRequest{
+		TopicId: &topicID,
+		TopicAttributesDetails: ons.TopicAttributesDetails{
+			Description: common.String(relayTopicDescNew),
+		},
+	})
+}
+
 // EnsureRelaySubscription 实现 Client:按 endpoint 返回既有 CUSTOM_HTTPS 订阅或新建;
 // 新建订阅处于 PENDING,待 ONS 向 endpoint 投递确认消息、面板回访后转 ACTIVE。
 func (c *RealClient) EnsureRelaySubscription(ctx context.Context, cred Credentials, topicID, endpoint string) (RelayResource, error) {
@@ -196,28 +221,50 @@ func (c *RealClient) GetRelaySubscription(ctx context.Context, cred Credentials,
 	return RelayResource{ID: deref(resp.Id), State: string(resp.LifecycleState)}, nil
 }
 
-// EnsureRelayPolicy 实现 Client:按名返回既有 IAM policy 或新建;
-// 写操作必须发往 home region,授权 Service Connector 发布消息到 Topic。
+// EnsureRelayPolicy 实现 Client:按新命名返回既有 IAM policy,fallback 到 legacy 命名;
+// 未命中则以新命名创建。写操作必须发往 home region,授权 Service Connector 发布消息到 Topic。
 func (c *RealClient) EnsureRelayPolicy(ctx context.Context, cred Credentials, homeRegion string) (RelayResource, error) {
 	ic, err := c.identityClientAt(cred, homeRegion)
 	if err != nil {
 		return RelayResource{}, err
 	}
-	list, err := ic.ListPolicies(ctx, identity.ListPoliciesRequest{
-		CompartmentId: &cred.TenancyOCID, Name: common.String(relayPolicyName),
-	})
+	names := relayResourceNames(cred.TenancyOCID)
+	res, ok, err := findRelayPolicy(ctx, ic, cred.TenancyOCID, names.PolicyName, legacyRelayPolicyName)
 	if err != nil {
-		return RelayResource{}, fmt.Errorf("list policies: %w", err)
+		return RelayResource{}, err
 	}
-	if len(list.Items) > 0 {
-		return RelayResource{ID: deref(list.Items[0].Id), State: string(list.Items[0].LifecycleState)}, nil
+	if ok {
+		refreshRelayPolicyDesc(ctx, ic, res.ID)
+		return res, nil
 	}
-	stmt := fmt.Sprintf("Allow any-user to use ons-topics in tenancy where all {request.principal.type='serviceconnector', request.principal.compartment.id='%s'}", cred.TenancyOCID)
+	return createRelayPolicy(ctx, ic, cred.TenancyOCID, names.PolicyName)
+}
+
+// findRelayPolicy 依次按传入的名称列表在租户范围内查找 IAM Policy;第一个命中即返回。
+func findRelayPolicy(ctx context.Context, ic identity.IdentityClient, tenancy string, names ...string) (RelayResource, bool, error) {
+	for _, name := range names {
+		list, err := ic.ListPolicies(ctx, identity.ListPoliciesRequest{
+			CompartmentId: &tenancy, Name: common.String(name),
+		})
+		if err != nil {
+			return RelayResource{}, false, fmt.Errorf("list policies: %w", err)
+		}
+		if len(list.Items) > 0 {
+			it := list.Items[0]
+			return RelayResource{ID: deref(it.Id), State: string(it.LifecycleState)}, true, nil
+		}
+	}
+	return RelayResource{}, false, nil
+}
+
+// createRelayPolicy 以中性描述与派生名称新建 Policy,statement 允许 Service Connector 发布消息到租户内 Topic。
+func createRelayPolicy(ctx context.Context, ic identity.IdentityClient, tenancy, name string) (RelayResource, error) {
+	stmt := fmt.Sprintf("Allow any-user to use ons-topics in tenancy where all {request.principal.type='serviceconnector', request.principal.compartment.id='%s'}", tenancy)
 	created, err := ic.CreatePolicy(ctx, identity.CreatePolicyRequest{
 		CreatePolicyDetails: identity.CreatePolicyDetails{
-			CompartmentId: &cred.TenancyOCID,
-			Name:          common.String(relayPolicyName),
-			Description:   common.String("oci-portal 日志回传:允许 Service Connector 发布到 ONS Topic"),
+			CompartmentId: &tenancy,
+			Name:          common.String(name),
+			Description:   common.String(relayPolicyDescNew),
 			Statements:    []string{stmt},
 		},
 	})
@@ -227,25 +274,45 @@ func (c *RealClient) EnsureRelayPolicy(ctx context.Context, cred Credentials, ho
 	return RelayResource{ID: deref(created.Id), State: string(created.LifecycleState), Created: true}, nil
 }
 
-// EnsureRelayConnector 实现 Client:按名返回既有 Connector 或新建(_Audit 含子区间 → Topic,
-// 按 condition 过滤);新建后轮询至 ACTIVE,超时返回错误但保留 Created 供上层回滚。
+// refreshRelayPolicyDesc 尽力把 Policy 描述改为中性文案;失败不阻塞主流程。
+func refreshRelayPolicyDesc(ctx context.Context, ic identity.IdentityClient, id string) {
+	if id == "" {
+		return
+	}
+	_, _ = ic.UpdatePolicy(ctx, identity.UpdatePolicyRequest{
+		PolicyId: &id,
+		UpdatePolicyDetails: identity.UpdatePolicyDetails{
+			Description: common.String(relayPolicyDescNew),
+		},
+	})
+}
+
+// EnsureRelayConnector 实现 Client:按新命名返回既有 Connector,fallback 到 legacy DisplayName;
+// 命中时对齐 Log Filter 条件,未命中则以新命名新建并轮询至 ACTIVE。
 func (c *RealClient) EnsureRelayConnector(ctx context.Context, cred Credentials, topicID, condition string) (RelayResource, error) {
 	sc, err := c.schClient(cred)
 	if err != nil {
 		return RelayResource{}, err
 	}
-	res, ok, err := findRelayConnector(ctx, sc, cred.TenancyOCID)
+	names := relayResourceNames(cred.TenancyOCID)
+	res, ok, err := findRelayConnector(ctx, sc, cred.TenancyOCID, names.ConnectorName, legacyRelayConnectorName)
 	if err != nil {
 		return RelayResource{}, err
 	}
 	if ok {
 		return res, reconcileRelayCondition(ctx, sc, res.ID, condition)
 	}
+	return createRelayConnector(ctx, sc, cred.TenancyOCID, names.ConnectorName, topicID, condition)
+}
+
+// createRelayConnector 以派生名称新建 Service Connector(_Audit 含子区间 → Topic,按 condition 过滤),
+// 新建后轮询至 ACTIVE,超时返回错误但保留 Created 供上层回滚。Connector 不设 Description,避免恒定文案指纹。
+func createRelayConnector(ctx context.Context, sc sch.ServiceConnectorClient, tenancy, name, topicID, condition string) (RelayResource, error) {
 	details := sch.CreateServiceConnectorDetails{
-		DisplayName:   common.String(relayConnectorName),
-		CompartmentId: &cred.TenancyOCID,
+		DisplayName:   common.String(name),
+		CompartmentId: &tenancy,
 		Source: sch.LoggingSourceDetails{LogSources: []sch.LogSource{{
-			CompartmentId: &cred.TenancyOCID,
+			CompartmentId: &tenancy,
 			LogGroupId:    common.String(relayAuditLogGroup),
 		}}},
 		Target: sch.NotificationsTargetDetails{TopicId: &topicID},
@@ -258,7 +325,7 @@ func (c *RealClient) EnsureRelayConnector(ctx context.Context, cred Credentials,
 	}); err != nil {
 		return RelayResource{}, fmt.Errorf("create service connector: %w", err)
 	}
-	return waitRelayConnector(ctx, sc, cred.TenancyOCID)
+	return waitRelayConnector(ctx, sc, tenancy, name)
 }
 
 // reconcileRelayCondition 对齐存量 Connector 的过滤条件:关键事件清单变更
@@ -300,24 +367,27 @@ func relayConditionDiffers(tasks []sch.TaskDetailsResponse, want string) bool {
 	return *rule.Condition != want
 }
 
-// findRelayConnector 按名查找存活 Connector。
-func findRelayConnector(ctx context.Context, sc sch.ServiceConnectorClient, tenancy string) (RelayResource, bool, error) {
-	list, err := sc.ListServiceConnectors(ctx, sch.ListServiceConnectorsRequest{
-		CompartmentId: &tenancy, DisplayName: common.String(relayConnectorName),
-	})
-	if err != nil {
-		return RelayResource{}, false, fmt.Errorf("list service connectors: %w", err)
-	}
-	for _, item := range list.Items {
-		if item.LifecycleState != sch.LifecycleStateDeleted && item.LifecycleState != sch.LifecycleStateDeleting {
-			return RelayResource{ID: deref(item.Id), State: string(item.LifecycleState)}, true, nil
+// findRelayConnector 依次按传入的 DisplayName 列表在租户范围内查找存活 Connector;第一个命中即返回。
+func findRelayConnector(ctx context.Context, sc sch.ServiceConnectorClient, tenancy string, names ...string) (RelayResource, bool, error) {
+	for _, name := range names {
+		list, err := sc.ListServiceConnectors(ctx, sch.ListServiceConnectorsRequest{
+			CompartmentId: &tenancy, DisplayName: common.String(name),
+		})
+		if err != nil {
+			return RelayResource{}, false, fmt.Errorf("list service connectors: %w", err)
+		}
+		for _, item := range list.Items {
+			if item.LifecycleState != sch.LifecycleStateDeleted && item.LifecycleState != sch.LifecycleStateDeleting {
+				return RelayResource{ID: deref(item.Id), State: string(item.LifecycleState)}, true, nil
+			}
 		}
 	}
 	return RelayResource{}, false, nil
 }
 
 // waitRelayConnector 轮询新建 Connector 直至 ACTIVE;超时带回已建资源信息。
-func waitRelayConnector(ctx context.Context, sc sch.ServiceConnectorClient, tenancy string) (RelayResource, error) {
+// 只按新命名查找(新建资源用的就是新命名)。
+func waitRelayConnector(ctx context.Context, sc sch.ServiceConnectorClient, tenancy, name string) (RelayResource, error) {
 	last := RelayResource{Created: true}
 	for i := 0; i < relayConnectorPollLimit; i++ {
 		select {
@@ -325,7 +395,7 @@ func waitRelayConnector(ctx context.Context, sc sch.ServiceConnectorClient, tena
 			return last, ctx.Err()
 		case <-time.After(relayConnectorPollTick):
 		}
-		res, ok, err := findRelayConnector(ctx, sc, tenancy)
+		res, ok, err := findRelayConnector(ctx, sc, tenancy, name)
 		if err != nil {
 			return last, err
 		}
@@ -346,7 +416,8 @@ func (c *RealClient) RelayState(ctx context.Context, cred Credentials, endpoint
 	if err != nil {
 		return st, err
 	}
-	if st.Topic, _, err = findRelayTopic(ctx, cp, cred.TenancyOCID); err != nil {
+	names := relayResourceNames(cred.TenancyOCID)
+	if st.Topic, _, err = findRelayTopic(ctx, cp, cred.TenancyOCID, names.TopicPrefix, legacyRelayTopicPrefix); err != nil {
 		return st, err
 	}
 	if st.Topic.ID != "" {
@@ -361,27 +432,22 @@ func (c *RealClient) RelayState(ctx context.Context, cred Credentials, endpoint
 	return c.relayControlState(ctx, cred, st)
 }
 
-// relayControlState 补齐 Connector 与 Policy 两项状态。
+// relayControlState 补齐 Connector 与 Policy 两项状态,双路径兼容 legacy 命名。
 func (c *RealClient) relayControlState(ctx context.Context, cred Credentials, st RelayState) (RelayState, error) {
 	sc, err := c.schClient(cred)
 	if err != nil {
 		return st, err
 	}
-	if st.Connector, _, err = findRelayConnector(ctx, sc, cred.TenancyOCID); err != nil {
+	names := relayResourceNames(cred.TenancyOCID)
+	if st.Connector, _, err = findRelayConnector(ctx, sc, cred.TenancyOCID, names.ConnectorName, legacyRelayConnectorName); err != nil {
 		return st, err
 	}
 	ic, err := c.identityClientAt(cred, "")
 	if err != nil {
 		return st, err
 	}
-	list, err := ic.ListPolicies(ctx, identity.ListPoliciesRequest{
-		CompartmentId: &cred.TenancyOCID, Name: common.String(relayPolicyName),
-	})
-	if err != nil {
-		return st, fmt.Errorf("list policies: %w", err)
-	}
-	if len(list.Items) > 0 {
-		st.Policy = RelayResource{ID: deref(list.Items[0].Id), State: string(list.Items[0].LifecycleState)}
+	if st.Policy, _, err = findRelayPolicy(ctx, ic, cred.TenancyOCID, names.PolicyName, legacyRelayPolicyName); err != nil {
+		return st, err
 	}
 	return st, nil
 }