contrast-agent 6.9.0 → 6.11.0

data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb

@@ -1,6 +1,9 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/reporting/settings/assess_rule'
+require 'contrast/agent/reporting/settings/protect_rule'
+
 module Contrast
   module Agent
     module Reporting
@@ -8,46 +11,9 @@ module Contrast
       module ResponseExtractor
         private
 
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_assess response_data, res
-          assessments = response_data[:settings][:assessment]
-          return unless assessments
-
-          res.application_settings.assess.disabled_rules = assessments[:disabledRules]
-          res.application_settings.assess.session_id = assessments[:session_id]
-        end
-
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_protect response_data, res
-          protect = response_data[:settings][:defend]
-          return unless protect
-
-          res.application_settings.protect.protection_rules = protect[:protectionRules]
-          res.application_settings.protect.virtual_patches = protect[:virtualPatches]
-        end
-
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_exclusions response_data, res
-          exclusions = response_data[:settings][:exceptions]
-          return unless exclusions
-
-          res.application_settings.exclusions.code_exclusions = exclusions[:codeExceptions]
-          res.application_settings.exclusions.input_exclusions = exclusions[:inputExceptions]
-          res.application_settings.exclusions.url_exclusions = exclusions[:urlExceptions]
-        end
-
-        # The responses we receive for feature and settings from TS have different
-        # place to store these reactions: body.reactions vs body.settings.reactions.
-        #
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_reactions response_data, res
-          res.reactions = response_data[:settings][:reactions] if response_data[:settings]
-          res.reactions = response_data[:reactions] if response_data[:features]
-        end
+        ##########################################
+        #         Server Settings Parsing        #
+        ##########################################
 
         # This method is universal and used for both ng endpoing of feature settings and the new
         # Server settings endpoint. Used in both build_feature_settings and build_server_settings.
@@ -56,13 +22,12 @@ module Contrast
         #
         # @param response_data [Hash]
         # @param res [Contrast::Agent::Reporting::Response]
-        # @param ng_ [Boolean]
-        def extract_assess_settings response_data, res, ng_: true
-          assess = ng_ ? response_data[:features][:assessment] : response_data[:assess]
+        def extract_assess_server_settings response_data, res
+          assess = response_data[:assess]
           return unless assess
 
-          res.server_features.assess.enabled = ng_ ? assess[:enabled] : assess[:enable]
-          res.server_features.assess.report_stacktraces = assess[:report_stacktraces] unless ng_
+          res.server_features.assess.enabled = assess[:enable]
+          res.server_features.assess.report_stacktraces = assess[:report_stacktraces]
           res.server_features.assess.sampling = assess[:sampling]
           res.server_features.assess.sanitizers = assess[:sanitizers]
           res.server_features.assess.validators = assess[:validators]
@@ -70,58 +35,14 @@ module Contrast
 
         # @param response_data [Hash]
         # @param res [Contrast::Agent::Reporting::Response]
-        def extract_protect_server_features response_data, res
-          protect = response_data[:features][:defend]
-          return unless protect
-
-          res.server_features.protect.enabled = protect[:enabled]
-          res.server_features.protect.bot_blocker.enable = protect[:'bot-blocker']
-          res.server_features.protect.bot_blocker.bots = protect[:botBlockers]
-          extract_syslog(response_data, res)
-        end
-
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_syslog response_data, res
-          return unless (syslog = response_data[:features][:defend][:syslog])
-
-          res.server_features.protect.syslog.assign_array(syslog, ng_: true)
-        end
-
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_protect_lists response_data, res
-          protect = response_data[:features][:defend]
+        def extract_protect_server_settings response_data, res
+          protect = response_data[:protect]
           return unless protect
 
-          res.server_features.protect.ip_allowlist = protect[:ipAllowlist]
-          res.server_features.protect.ip_denylist = protect[:ipDenylist]
-          res.server_features.protect.log_enhancers = protect[:logEnhancers]
-          res.server_features.protect.rule_definition_list = protect[:ruleDefinitionList]
-        end
-
-        # Here we extract the rules and state for the sensitive data masking policy
-        # received from TS.
-        #
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_sensitive_data_policy response_data, res
-          return unless (sensitive_data = response_data[:settings][:sensitive_data_masking_policy])
-
-          res.application_settings.sensitive_data_masking.mask_http_body = sensitive_data[:mask_http_body]
-          res.application_settings.sensitive_data_masking.mask_attack_vector = sensitive_data[:mask_attack_vector]
-          res.application_settings.sensitive_data_masking.build_rules_form_settings(sensitive_data[:rules])
-        end
-
-        # Here we extract the log settings received from TS.
-        #
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_log_settings response_data, res
-          return unless (log_level = response_data[:logLevel])
-
-          res.server_features.log_level = log_level
-          res.server_features.log_file = response_data[:logFile] if response_data[:logFile]
+          res.server_features.protect.enabled = protect[:enable]
+          res.server_features.protect.observability = protect[:observability]
+          res.server_features.protect.log_enhancers = protect[:log_enhancers]
+          update_protect_rules(protect, res)
         end
 
         # This method is used with ServerSettings as we expect to have data for
@@ -147,18 +68,6 @@ module Contrast
           res.server_features.security_logger.syslog.assign_array(response_data[:security_logger][:syslog], ng_: false)
         end
 
-        # @param response_data [Hash]
-        # @param res [Contrast::Agent::Reporting::Response]
-        def extract_protect_server_settings response_data, res
-          protect = response_data[:protect]
-          return unless protect
-
-          res.server_features.protect.enabled = protect[:enable]
-          res.server_features.protect.observability = protect[:observability]
-          res.server_features.protect.log_enhancers = protect[:log_enhancers]
-          update_protect_rules(protect, res)
-        end
-
         # @param protect [Hash] response data
         # @param res [Contrast::Agent::Reporting::Response]
         def update_protect_rules protect, res
@@ -170,6 +79,90 @@ module Contrast
           res.server_features.protect.bot_blocker.bots = rules[:bot_blocker][:bots]
           res.server_features.protect.rules_to_definition_list(rules)
         end
+
+        ##########################################
+        #      Application Settings Parsing      #
+        ##########################################
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_assess_application_settings response_data, res
+          assess = response_data[:assess]
+          return unless assess
+
+          assess.each_pair do |rule_id, value|
+            rule_setting =
+              Contrast::Agent::Reporting::Settings::AssessRule.new.tap { |setting| setting.enable = value[:enable] }
+            res.application_settings.assess.rule_settings[rule_id.to_s] = rule_setting
+          end
+
+          # This endpoint can never give us session_id, so we dont need to set it here
+          # res.application_settings.assess.session_id
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_application_settings response_data, res
+          protect = response_data[:protect]
+          return unless protect
+
+          rules = protect[:rules]
+          rules&.each_pair do |rule_id, value|
+            rule_setting =
+              Contrast::Agent::Reporting::Settings::ProtectRule.new.tap { |setting| setting.mode = value[:mode] }
+            res.application_settings.protect.rule_settings[rule_id.to_s] = rule_setting
+          end
+          protect[:'virtual-patches']&.each do |patch_json|
+            res.application_settings.protect.virtual_patches <<
+                Contrast::Agent::Reporting::Settings::VirtualPatch.new(patch_json)
+          end
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_exclusions response_data, res
+          exclusions = response_data[:exclusions]
+          return unless exclusions
+
+          res.application_settings.exclusions.code_exclusions = exclusions[:code]
+          res.application_settings.exclusions.url_exclusions = exclusions[:url]
+          extract_input_exclusions(response_data[:exclusions], res)
+        end
+
+        # Input exclusions between NG and non-NG are different, so need to be cast separately.
+        #
+        # @param exclusions [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_input_exclusions exclusions, res
+          res.application_settings.exclusions.input_exclusions = []
+          exclusions[:input].each do |exclusion_details|
+            input_exclusion = Contrast::Agent::Reporting::Settings::InputExclusion.new
+            input_exclusion.name = exclusion_details[:name]
+            input_exclusion.modes = exclusion_details[:modes]
+            input_exclusion.assess_rules = exclusion_details[:assess_rules]
+            input_exclusion.protect_rules = exclusion_details[:protect_rules]
+            input_exclusion.input_name = exclusion_details[:name]
+            input_exclusion.input_type = exclusion_details[:type]
+            input_exclusion.urls = exclusion_details[:urls]
+            res.application_settings.exclusions.input_exclusions << exclusion
+          end
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_sensitive_data_policy response_data, res
+          return unless (sensitive_data = response_data[:sensitive_data_masking_policy])
+
+          res.application_settings.sensitive_data_masking.mask_http_body = sensitive_data[:mask_http_body]
+          res.application_settings.sensitive_data_masking.mask_attack_vector = sensitive_data[:mask_attack_vector]
+          res.application_settings.sensitive_data_masking.build_rules_form_settings(sensitive_data[:rules])
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_reactions response_data, res
+          res.reactions = response_data[:reactions]
+        end
       end
     end
   end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb

@@ -14,6 +14,7 @@ module Contrast
       class ResponseHandler
         include Contrast::Components::Logger::InstanceMethods
         include Contrast::Agent::Reporting::ResponseHandlerUtils
+
         # 15 min
         TIMEOUT = 900.cs__freeze
 
@@ -23,7 +24,7 @@ module Contrast
         # @param event [Contrast::Agent::Reporting::ReportingEvent] The event sent to TeamServer.
         # @return response [Net::HTTP::Response, nil]
         def process response, event
-          logger.debug('Reporter Received a response')
+          logger.debug('[Reporter] Received a response')
           return unless analyze_response?(response)
 
           # Handle the response body and obtain server_features or app_settings
@@ -100,7 +101,7 @@ module Contrast
         # @param error_message [String, nil] Error message if any received.
         def suspend_reporting message, timeout, error_message
           @_timeout = timeout || Contrast::Agent::Reporting::ResponseHandler::TIMEOUT
-          log_debug_msg(message, timeout: @_timeout, error_message: error_message || 'none')
+          log_error_msg(message, timeout: @_timeout, error_message: error_message || 'none')
           @_sleep = true
         end
 
@@ -108,8 +109,8 @@ module Contrast
         #
         # @param message [String] Message to log
         # @param info_hash [Hash] information about the context to log.
-        def log_debug_msg message, info_hash
-          logger.debug(message, info_hash)
+        def log_error_msg message, info_hash
+          logger.error(message, info_hash)
         end
       end
     end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_utils.rb

@@ -1,6 +1,7 @@
 # Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/reporting/reporting_utilities/ng_response_extractor'
 require 'contrast/agent/reporting/reporting_utilities/response_extractor'
 require 'contrast/agent/disable_reaction'
 
@@ -9,6 +10,7 @@ module Contrast
     module Reporting
       # This module holds utilities required by the reporting service response handler
       module ResponseHandlerUtils
+        include Contrast::Agent::Reporting::NgResponseExtractor
         include Contrast::Agent::Reporting::ResponseExtractor
 
         ANALYZE_WHEN = %w[200 204].cs__freeze
@@ -20,14 +22,14 @@ module Contrast
             unprocessable_entity: '422',
             too_many_requests: '429'
         }.cs__freeze
-        APP_NON_EXISTENT_MSG = 'Application does not exist! Either it has not been created or has '\
-                               'been deleted or archived. '\
+        APP_NON_EXISTENT_MSG = 'Application does not exist! Either it has not been created or has ' \
+                               'been deleted or archived. ' \
                                'Disabling permanently.'
         SUSPEND_MSG = 'Reporter is temporarily suspended.'
         UNSUCCESSFULLY_RECEIVED_MSG = 'The Reporter was unable to send message.'
-        FORBIDDEN_MSG = 'Access was forbidden for current Report because the request authentication '\
+        FORBIDDEN_MSG = 'Access was forbidden for current Report because the request authentication ' \
                         'information was not provided'
-        FORBIDDEN_NO_ACTION_MSG = 'Report access was forbidden because the supplied credentials failed '\
+        FORBIDDEN_NO_ACTION_MSG = 'Report access was forbidden because the supplied credentials failed ' \
                                   'to authenticate the Agent'
         UNPROCESSABLE_ENTITY_MSG = 'Reporter received Unprocessable Entity response. Disabling permanently.'
         RETRY_AFTER_MSG = "There are too many requests of this type being sent by this Agent. #{ SUSPEND_MSG }"
@@ -115,7 +117,7 @@ module Contrast
           ready_after, error_message, auth_error = extract_response_info(response)
           # log, suspend, disable:
           if mode == @_mode.running
-            log_debug_msg(message,
+            log_error_msg(message,
                           response: response.__id__,
                           request: Contrast::Agent::REQUEST_TRACKER.current&.request&.type,
                           error_message: error_message || 'none',
@@ -151,9 +153,9 @@ module Contrast
         # @return last_modified[integer, nil] Time since last server update
         def extract_response_last_modified response
           return unless response.cs__is_a?(Net::HTTPResponse)
+          return unless (header = response['last-modified'])
 
-          header = response['Last-Modified'] if response&.to_hash&.keys&.map(&:downcase)&.include?('last-modified')
-          @_last_server_modified = header if header
+          @_last_server_modified = header
         end
 
         # Cease reporting about this application
@@ -162,7 +164,7 @@ module Contrast
         # @param info_hash [Hash] information about the context to log.
         def stop_reporting message, info_hash
           Contrast::Agent.reporter&.stop!
-          log_debug_msg(message, info_hash)
+          log_error_msg(message, info_hash)
           ::Contrast::AGENT.disable!
         end
 
@@ -220,7 +222,16 @@ module Contrast
           end
         end
 
-        # Converts response from Net to Reporting Response object
+        # Converts response from Net to Reporting Response object. Unfortunately, there are four types of responses
+        # that TeamServer can send back to us. The FeatureSet for Servers, which come from Agent Startup and Server
+        # Settings, and the SettingsState for Applications, which come from Application Startup and Application
+        # Settings.
+        #
+        # The Startup messages come from NG and have the nested structure w/ success, message, and features/settings.
+        # The Settings messages come from v1 and have the flat structure.
+        # Neither have uniform keys, for instance assessment in startup vs assess in settings.
+        #
+        # This method works to extract away these differences.
         #
         # @param response [Net::HTTP::Response, nil]
         # @param event [Contrast::Agent::Reporting::ReportingEvent] The event sent to TeamServer.
@@ -248,70 +259,95 @@ module Contrast
         # this is used to check the expected response type for this event.
         # @return response [Contrast::Agent::Reporting::Response, nil]
         def populate_response response_data, event
-          return unless (success, messages = extract_success(response_data, event))
-
-          # check if response contains application settings or Feature settings
-          if response_data[:settings]
-            # the response contains ApplicationSettings
-            response = Contrast::Agent::Reporting::Response.build_application_response
-            response.success = success
-            response.messages = messages
-            app_settings = build_application_settings(response_data, response)
-            logger.trace('Agent: Received updated application settings', raw: response_data, processed: app_settings)
-            app_settings
+          # Responses fall into one of two types - those for Servers or those for Applications
+          response = case event
+                       # Server feature based events
+                     when Contrast::Agent::Reporting::AgentStartup, Contrast::Agent::Reporting::ServerSettings
+                       Contrast::Agent::Reporting::Response.build_server_response
+                       # Application settings based events
+                     when Contrast::Agent::Reporting::ApplicationStartup,
+                       Contrast::Agent::Reporting::ApplicationSettings
+
+                       Contrast::Agent::Reporting::Response.build_application_response
+                     end
+          return unless response
+
+          return unless (success, messages = extract_success(response_data))
+
+          response.success = success
+          response.messages = messages
+          # Features & Settings have to be parsed from the response based on the event type sent
+          case event
+          when Contrast::Agent::Reporting::AgentStartup
+            extract_agent_startup(response_data, response)
+          when Contrast::Agent::Reporting::ApplicationStartup
+            extract_application_startup(response_data, response)
+          when Contrast::Agent::Reporting::ServerSettings
+            extract_server_settings(response_data, response)
+          when Contrast::Agent::Reporting::ApplicationSettings
+            extract_application_settings(response_data, response)
           else
-            # the response contains FeatureSettings. The ng endpoint data feature
-            response = Contrast::Agent::Reporting::Response.build_server_response
-            response.success = success
-            response.messages = messages
-            server_features = if event.cs__is_a?(Contrast::Agent::Reporting::ServerSettings)
-                                # do the new extraction.
-                                build_server_settings(response_data, response)
-                              else
-                                build_feature_settings(response_data, response)
-                              end
-            logger.trace('Agent: Received updated feature settings', raw: response_data, processed: server_features)
-            server_features
+            return
           end
+          logger.trace('Agent: Received updated features or settings',
+                       event: event.cs__class,
+                       raw: response_data,
+                       processed: response)
+          response
         end
 
         # This method is used with the ng endpoint.
         #
-        # @param response_data [Hash]
-        # @return res [Contrast::Agent::Reporting::Response]
-        def build_application_settings response_data, response
-          extract_assess(response_data, response)
-          extract_protect(response_data, response)
-          extract_exclusions(response_data, response)
-          extract_reactions(response_data, response)
-          extract_sensitive_data_policy(response_data, response)
-          response
+        # @param response_data [Hash] JSON of the response body from a Contrast::Agent::Reporting::ApplicationStartup
+        #   event
+        # @param response [Contrast::Agent::Reporting::Response] the object to populate with the body data
+        def extract_application_startup response_data, response
+          return unless response_data[:settings]
+
+          ng_extract_assess(response_data, response)
+          ng_extract_protect(response_data, response)
+          ng_extract_exclusions(response_data, response)
+          ng_extract_reactions(response_data, response)
+          ng_extract_sensitive_data_policy(response_data, response)
         end
 
         # This method is used with the ng startup endpoint.
         #
-        # @param response_data [Hash]
-        # @return res [Contrast::Agent::Reporting::Response]
-        def build_feature_settings response_data, response
-          extract_reactions(response_data, response)
-          extract_assess_settings(response_data, response)
-          extract_protect_server_features(response_data, response)
-          extract_protect_lists(response_data, response)
-          extract_log_settings(response_data, response)
+        # @param response_data [Hash] JSON of the response body from a Contrast::Agent::Reporting::AgentStartup event
+        # @param response [Contrast::Agent::Reporting::Response] the object to populate with the body data
+        def extract_agent_startup response_data, response
+          ng_extract_log_settings(response_data, response)
           response.server_features.telemetry = response_data[:telemetry]
-          response
+          return unless response_data[:features]
+
+          ng_extract_reactions(response_data, response)
+          ng_extract_assess_features(response_data, response)
+          ng_extract_protect_features(response_data, response)
+          ng_extract_protect_lists(response_data, response)
         end
 
         # This method is used with the server settings endpoint.
         #
-        # @param response_data [Hash]
-        # @return res [Contrast::Agent::Reporting::Response]
-        def build_server_settings response_data, response
+        # @param response_data [Hash] JSON of the response body from a Contrast::Agent::Reporting::ServerSettings event
+        # @param response [Contrast::Agent::Reporting::Response] the object to populate with the body data
+        def extract_server_settings response_data, response
           extract_loggers(response_data, response)
           extract_protect_server_settings(response_data, response)
-          extract_assess_settings(response_data, response, ng_: false)
+          extract_assess_server_settings(response_data, response)
           response.server_features.telemetry = response_data[:telemetry][:enable]
-          response
+        end
+
+        # This method is used with the ng startup endpoint.
+        #
+        # @param response_data [Hash] JSON of the response body from a Contrast::Agent::Reporting::ApplicationSettings
+        #   event
+        # @param response [Contrast::Agent::Reporting::Response] the object to populate with the body data
+        def extract_application_settings response_data, response
+          extract_assess_application_settings(response_data, response)
+          extract_protect_application_settings(response_data, response)
+          extract_exclusions(response_data, response)
+          extract_sensitive_data_policy(response_data, response)
+          extract_reactions(response_data, response)
         end
 
         # This method with check the success and messages field of the response.
@@ -320,20 +356,18 @@ module Contrast
         # @param response_data [Hash]
         # @return [Array, nil] Returns the success status or nil if request
         # was not processed by TS.
-        def extract_success response_data, event
-          if event.cs__is_a?(Contrast::Agent::Reporting::ServerSettings)
-            # we don't those in the body but we can count on the response code.
-            success = @_last_response_code == '200' ? true : nil
-            messages = @_last_response_code == '200' ? ['success'] : nil
-          else
-            success = response_data[:success]
-            messages = response_data[:messages]
-          end
+        def extract_success response_data
+          # If we are here we have receive 200 or 204 response code. We'll try and
+          # extract the success and messages received,but not all of the responses
+          # we receive will have success field or messages. All of the new non-ng
+          # endpoints won't have messages or success. The way we'll be sure that
+          # a response is successful is by checking the response code.
+          #
+          # To extract response we need only 200 response code.
+          success = @_last_response_code == '200'
+          messages = response_data[:messages] || []
           return [success, messages] if success
 
-          logger.error('Unable to connect to Contrast UI') if messages.nil?
-          logger.error('Failure on Contrast UI processing request', reasons: messages.join(', ')) if messages
-
           nil
         end
       end

data/lib/contrast/agent/reporting/reporting_workers/application_server_worker.rb

@@ -0,0 +1,46 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/worker_thread'
+require 'contrast/agent/reporting/report'
+
+module Contrast
+  module Agent
+    module ReportingWorkers
+      # The ApplicationServerWorker will send request on interval, to make sure the Agent gets the settings it
+      # need to operate, from TS. This Thead should be started after the ApplicationStartup is complete.
+      class ApplicationServerWorker < WorkerThread
+        RESEND_INTERVAL_MS = 30_000.cs__freeze
+
+        def start_thread!
+          return if running?
+
+          @_thread = Contrast::Agent::Thread.new do
+            logger.info('[ApplicationSettingsWorker] Starting thread.', sending_interval: application_server_ms)
+            loop do
+              logger.info('[ApplicationSettingsWorker] Fetching Settings', sending_interval: application_server_ms)
+              Contrast::Agent.reporter&.send_event(application_settings_message)
+              sleep(application_server_ms / 1000)
+            end
+          end
+        end
+
+        private
+
+        # This method will generate the reporting event for the application settings
+        #
+        # @return [Contrast::Agent::Reporting::ReportingEvent]
+        def application_settings_message
+          @_application_settings_message ||= Contrast::Agent::Reporting::ApplicationSettings.new
+        end
+
+        # Get the value from settings or use the default one.
+        #
+        # @return resend_ms [Integer] time to resend the message
+        def application_server_ms
+          @_application_server_ms ||= Contrast::AGENT.polling.app_settings_ms&.to_i || RESEND_INTERVAL_MS
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_workers/reporter_heartbeat.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/worker_thread'
+require 'contrast/agent/reporting/report'
+require 'contrast/agent/inventory/dependency_usage_analysis'
+require 'contrast/agent/reporting/reporting_events/poll'
+
+module Contrast
+  module Agent
+    module ReportingWorkers
+      # The ReporterHeartbeat will make sure that the process remains marked alive by TeamServer and that we
+      # periodically reach out to get the latest settings for this application. It also sends out those
+      # messages which do not need to be associated directly with a request,
+      # such as Server Activity and Library Observation.
+      class ReporterHeartbeat < WorkerThread
+        # TeamServer will mark an application offline after 5 minutes. Sending this every one should be more than enough
+        # to satisfy our goals.
+        REFRESH_INTERVAL_SEC = 60
+
+        def start_thread!
+          return if running?
+
+          @_thread = Contrast::Agent::Thread.new do
+            logger.info('[Heartbeat] Starting thread.')
+            loop do
+              polling_events.each do |event|
+                Contrast::Agent.reporter&.send_event(event)
+              end
+              clean_properties
+              sleep(REFRESH_INTERVAL_SEC)
+            end
+          end
+        end
+
+        private
+
+        def poll_message
+          @_poll_message ||= Contrast::Agent::Reporting::Poll.new
+        end
+
+        # Those events which should be sent periodically, rather than on event or request.
+        #
+        # @return [Array<Contrast::Agent::Reporting::ReportingEvent>]
+        def polling_events
+          [Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage, poll_message].compact
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_workers/reporting_workers.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # This module will include all the worker that we have, which are not part of the regular thread reporters
+    module ReportingWorkers
+    end
+  end
+end
+
+require 'contrast/agent/reporting/reporting_workers/reporter_heartbeat'
+require 'contrast/agent/reporting/reporting_workers/server_settings_worker'
+require 'contrast/agent/reporting/reporting_workers/application_server_worker'