nexarch/connect/cmd/connect-app/main.go

// Command connect-app is the HTTP entrypoint for the NEXARCH Connect
// module: connector status (API-02), DMS2 import (DMS2-01/02), and
// connector setup (API-01).
package main

import (
	"context"
	"encoding/base64"
	"log"
	"net/http"
	"os"
	"os/signal"
	"syscall"
	"time"

	"github.com/jackc/pgx/v5/pgxpool"

	"gitea.perlbach24.de/scripte/nexarch/common/bearerauth"
	"gitea.perlbach24.de/scripte/nexarch/common/moduleauth"
	"gitea.perlbach24.de/scripte/nexarch/common/policyclient"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/connectorsetupapi"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/credential"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/crypto"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/dms2import"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/dms2importapi"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/fieldmapping"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/killswitch"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/statusapi"
	"gitea.perlbach24.de/scripte/nexarch/connect/internal/syncjob"
)

// fixedKEK is a transitional KEKProvider: a single, operator-provisioned
// key for every tenant, used until API-10/API-12's real Core KMS client
// exists. The key never touches the code, only NEXARCH_CONNECT_APP_KEK.
type fixedKEK struct{ kek []byte }

func (f fixedKEK) TenantKEK(ctx context.Context, tenantSlug string) ([]byte, error) {
	return f.kek, nil
}

// buildPolicyClient liefert nil nur mit NEXARCH_CONNECT_APP_POLICY_DISABLED=1;
// ohne URL und ohne diesen Schalter startet der Dienst nicht.
func buildPolicyClient() *policyclient.Client {
	policyURL := os.Getenv("NEXARCH_CONNECT_APP_POLICY_URL")
	if policyURL == "" {
		if os.Getenv("NEXARCH_CONNECT_APP_POLICY_DISABLED") != "1" {
			log.Fatal("connect-app: NEXARCH_CONNECT_APP_POLICY_URL fehlt (oder NEXARCH_CONNECT_APP_POLICY_DISABLED=1 als Uebergang setzen)")
		}
		log.Print("connect-app: WARNUNG: Rechtepruefung connect.status.read/connect.setup.* deaktiviert (NEXARCH_CONNECT_APP_POLICY_DISABLED=1)")
		return nil
	}
	token := os.Getenv("NEXARCH_CONNECT_APP_POLICY_SERVICE_TOKEN")
	if token == "" {
		log.Fatal("connect-app: NEXARCH_CONNECT_APP_POLICY_SERVICE_TOKEN ist erforderlich, wenn NEXARCH_CONNECT_APP_POLICY_URL gesetzt ist")
	}
	return policyclient.New(policyURL, token)
}

func main() {
	if !killswitch.Enabled() {
		log.Printf("connect-app: deaktiviert (%s=false), kein Start", killswitch.EnvEnabled)
		return
	}

	dsn := os.Getenv("NEXARCH_CONNECT_APP_TENANT_DSN")
	if dsn == "" {
		log.Fatal("connect-app: NEXARCH_CONNECT_APP_TENANT_DSN ist erforderlich")
	}
	addr := os.Getenv("NEXARCH_CONNECT_APP_LISTEN_ADDR")
	if addr == "" {
		addr = "127.0.0.1:9500"
	}
	kekB64 := os.Getenv("NEXARCH_CONNECT_APP_KEK")
	if kekB64 == "" {
		log.Fatal("connect-app: NEXARCH_CONNECT_APP_KEK ist erforderlich (base64, 32 Bytes)")
	}
	kek, err := base64.StdEncoding.DecodeString(kekB64)
	if err != nil || len(kek) != crypto.KEKSize {
		log.Fatalf("connect-app: NEXARCH_CONNECT_APP_KEK ungueltig (erwartet base64-kodierte %d Bytes)", crypto.KEKSize)
	}

	ctx := context.Background()
	pool, err := pgxpool.New(ctx, dsn)
	if err != nil {
		log.Fatalf("connect-app: datenbankverbindung: %v", err)
	}
	defer pool.Close()

	verifier, allowHeaderAuth := buildIdentity()

	mappings := fieldmapping.NewStore(pool)
	credentials := credential.NewStore(pool, crypto.NewService(fixedKEK{kek: kek}))

	policy := buildPolicyClient()

	mux := http.NewServeMux()
	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
	statusapi.NewServer(syncjob.NewStore(pool)).WithPolicy(policy).RegisterRoutes(mux)
	dms2importapi.NewServer(mappings, dms2import.NewStore(pool)).RegisterRoutes(mux)
	connectorsetupapi.NewServer(credentials, mappings).WithPolicy(policy).RegisterRoutes(mux)

	srv := &http.Server{
		Addr:              addr,
		Handler:           bearerauth.Middleware(verifier, allowHeaderAuth, mux),
		ReadHeaderTimeout: 5 * time.Second,
		ReadTimeout:       15 * time.Second,
		WriteTimeout:      15 * time.Second,
		IdleTimeout:       60 * time.Second,
	}

	go func() {
		log.Printf("connect-app: listening on %s", addr)
		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
			log.Fatalf("connect-app: %v", err)
		}
	}()

	stop := make(chan os.Signal, 1)
	signal.Notify(stop, syscall.SIGINT, syscall.SIGTERM)
	<-stop

	shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()
	_ = srv.Shutdown(shutdownCtx)
}

// buildIdentity richtet die Token-Pruefung ein. Ohne NEXARCH_CONNECT_APP_JWKS_URL
// muss der Uebergangsschalter NEXARCH_CONNECT_APP_ALLOW_HEADER_AUTH=1 gesetzt
// sein; sonst startet der Dienst nicht. Die Datenbank gehoert einem Mandanten,
// daher ist NEXARCH_CONNECT_APP_TENANT_SLUG mit JWKS Pflicht.
func buildIdentity() (*moduleauth.Verifier, bool) {
	allowHeader := os.Getenv("NEXARCH_CONNECT_APP_ALLOW_HEADER_AUTH") == "1"
	jwksURL := os.Getenv("NEXARCH_CONNECT_APP_JWKS_URL")
	if allowHeader {
		log.Print("connect-app: WARNUNG: X-User-Id/X-Tenant-Slug ohne Token zugelassen (NEXARCH_CONNECT_APP_ALLOW_HEADER_AUTH=1), nicht authentifiziert")
	}
	if jwksURL == "" {
		if !allowHeader {
			log.Fatal("connect-app: NEXARCH_CONNECT_APP_JWKS_URL fehlt (oder NEXARCH_CONNECT_APP_ALLOW_HEADER_AUTH=1 als Uebergang setzen)")
		}
		return nil, allowHeader
	}
	tenantSlug := os.Getenv("NEXARCH_CONNECT_APP_TENANT_SLUG")
	if tenantSlug == "" {
		log.Fatal("connect-app: NEXARCH_CONNECT_APP_TENANT_SLUG ist mit NEXARCH_CONNECT_APP_JWKS_URL erforderlich")
	}
	audience := os.Getenv("NEXARCH_CONNECT_APP_JWT_AUDIENCE")
	if audience == "" {
		audience = "connect"
	}
	issuer := os.Getenv("NEXARCH_CONNECT_APP_JWT_ISSUER")
	if issuer == "" {
		issuer = "nexarch-core"
	}
	enforce := os.Getenv("NEXARCH_CONNECT_APP_JWT_AUDIENCE_ENFORCE") != "false"
	v := moduleauth.NewVerifier(5*time.Minute, tenantSlug, moduleauth.HTTPKeyFetcher(jwksURL, nil)).Expect(audience, issuer, enforce)
	return v, allowHeader
}