149 lines
4.4 KiB
Go
149 lines
4.4 KiB
Go
package api
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"net/url"
|
|
"time"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"oci-portal/internal/service"
|
|
)
|
|
|
|
// ONS 消息头(方案A §2.2/§2.3,官方 X-OCI-NS-* 字段)。
|
|
const (
|
|
onsHeaderMessageType = "X-OCI-NS-MessageType"
|
|
onsHeaderMessageID = "X-OCI-NS-MessageId"
|
|
onsHeaderTimestamp = "X-OCI-NS-Timestamp"
|
|
onsHeaderConfirmURL = "X-OCI-NS-ConfirmationURL"
|
|
)
|
|
|
|
// webhook 同步路径的防御参数:body 上限高于 ONS 链路 128KB 留余量,
|
|
// 时间戳偏差超窗拒收防重放。
|
|
const (
|
|
webhookBodyLimit = 256 << 10
|
|
webhookMaxTimeSkew = 5 * time.Minute
|
|
msgTypeSubscription = "SubscriptionConfirmation"
|
|
msgTypeUnsubscribe = "UnsubscribeConfirmation"
|
|
)
|
|
|
|
// webhookEvents 是 webhook 端点对回传服务的依赖切面,测试以假实现替换。
|
|
type webhookEvents interface {
|
|
ResolveSecret(ctx context.Context, secret string) (uint, bool)
|
|
ConfirmAsync(confirmURL string)
|
|
Ingest(ctx context.Context, cfgID uint, messageID string, payload []byte, truncated bool) error
|
|
}
|
|
|
|
// webhookHandler 处理 OCI Notifications 的 HTTPS 订阅投递(JWT 组之外,靠 secret 鉴权)。
|
|
type webhookHandler struct {
|
|
events webhookEvents
|
|
}
|
|
|
|
// handle 是 webhook 入口:secret 反查租户后按消息类型分派;
|
|
// 同步路径只做 secret→分派→读body→幂等入库,5 秒投递预算内返回(方案A §2.4)。
|
|
func (h *webhookHandler) handle(c *gin.Context) {
|
|
cfgID, ok := h.events.ResolveSecret(c.Request.Context(), c.Param("secret"))
|
|
if !ok {
|
|
c.Status(http.StatusNotFound) // 不暴露端点存在性,响应无 body
|
|
return
|
|
}
|
|
switch c.GetHeader(onsHeaderMessageType) {
|
|
case msgTypeSubscription:
|
|
h.confirmSubscription(c)
|
|
case msgTypeUnsubscribe:
|
|
log.Printf("ons unsubscribe confirmation received: cfg %d", cfgID)
|
|
c.Status(http.StatusOK)
|
|
default:
|
|
h.ingest(c, cfgID)
|
|
}
|
|
}
|
|
|
|
// confirmSubscription 校验确认链接域名白名单后异步 GET 激活订阅,立即 200。
|
|
func (h *webhookHandler) confirmSubscription(c *gin.Context) {
|
|
confirmURL := c.GetHeader(onsHeaderConfirmURL)
|
|
parsed, err := url.Parse(confirmURL)
|
|
if err != nil || parsed.Scheme != "https" || !service.IsOracleHost(parsed.Host) {
|
|
log.Printf("ons confirmation url rejected: host not in oracle domain")
|
|
c.Status(http.StatusBadRequest)
|
|
return
|
|
}
|
|
h.events.ConfirmAsync(confirmURL)
|
|
c.Status(http.StatusOK)
|
|
}
|
|
|
|
// ingest 校验时间戳与消息 ID 后读 body 入库;重复投递靠唯一索引幂等。
|
|
func (h *webhookHandler) ingest(c *gin.Context, cfgID uint) {
|
|
if !timestampFresh(c.GetHeader(onsHeaderTimestamp)) {
|
|
c.Status(http.StatusForbidden)
|
|
return
|
|
}
|
|
messageID := c.GetHeader(onsHeaderMessageID)
|
|
if messageID == "" {
|
|
c.Status(http.StatusBadRequest)
|
|
return
|
|
}
|
|
if err := verifySignature(c.Request.Header); err != nil {
|
|
c.Status(http.StatusForbidden)
|
|
return
|
|
}
|
|
body, err := io.ReadAll(io.LimitReader(c.Request.Body, webhookBodyLimit+1))
|
|
if err != nil {
|
|
c.Status(http.StatusBadRequest)
|
|
return
|
|
}
|
|
truncated := len(body) > webhookBodyLimit
|
|
if truncated {
|
|
body = body[:webhookBodyLimit]
|
|
}
|
|
if err := h.events.Ingest(c.Request.Context(), cfgID, messageID, body, truncated); err != nil {
|
|
log.Printf("webhook ingest: %v", err)
|
|
c.Status(http.StatusInternalServerError)
|
|
return
|
|
}
|
|
c.Status(http.StatusOK)
|
|
}
|
|
|
|
// timestampFresh 校验消息时间戳与本地时钟偏差在防重放窗口内;
|
|
// 头缺失时放行——ONS 是否恒带此头待验签 spike 确认(方案A §2.3),先不误杀。
|
|
func timestampFresh(value string) bool {
|
|
if value == "" {
|
|
return true
|
|
}
|
|
ts, ok := parseOnsTime(value)
|
|
if !ok {
|
|
return false
|
|
}
|
|
skew := time.Since(ts)
|
|
if skew < 0 {
|
|
skew = -skew
|
|
}
|
|
return skew <= webhookMaxTimeSkew
|
|
}
|
|
|
|
// onsTimestampLayouts 覆盖 ONS 实测时间戳格式与标准 RFC3339:
|
|
// 2026-07-07 spike 抓包为 2026-07-07T05:30:34.779+0000(时区无冒号,严格 RFC3339 解析失败)。
|
|
var onsTimestampLayouts = []string{
|
|
time.RFC3339,
|
|
"2006-01-02T15:04:05.999Z0700",
|
|
}
|
|
|
|
// parseOnsTime 按已知格式解析 ONS 时间戳。
|
|
func parseOnsTime(value string) (time.Time, bool) {
|
|
for _, layout := range onsTimestampLayouts {
|
|
if ts, err := time.Parse(layout, value); err == nil {
|
|
return ts, true
|
|
}
|
|
}
|
|
return time.Time{}, false
|
|
}
|
|
|
|
// verifySignature 校验 ONS 消息签名。
|
|
// TODO(方案A §2.3 spike):官方未公开签名 canonical form,待 test-server 抓取
|
|
// 真实消息确认输入格式后实现;当前按方案约定以 secret+时间戳+幂等先行。
|
|
func verifySignature(http.Header) error {
|
|
return nil
|
|
}
|