itsi-scheduler 0.1.11 → 0.1.12

data/ext/itsi_server/src/server/middleware_stack/middlewares/error_response.rs

@@ -0,0 +1,127 @@
+use crate::server::static_file_server::ROOT_STATIC_FILE_SERVER;
+use crate::server::types::RequestExt;
+use crate::server::{
+    itsi_service::RequestContext,
+    types::{HttpRequest, HttpResponse},
+};
+
+use bytes::Bytes;
+use either::Either;
+use http::Response;
+use http_body_util::{combinators::BoxBody, Full};
+use itsi_error::ItsiError;
+use serde::Deserialize;
+use std::path::{Path, PathBuf};
+
+#[derive(Debug, Clone, Deserialize)]
+/// Filters can each have a customizable error response.
+/// They can:
+/// * Return Plain-text
+/// * Return HTML
+/// * Return JSON
+pub struct ErrorResponse {
+    code: u16,
+    plaintext: Option<String>,
+    html: Option<PathBuf>,
+    json: Option<serde_json::Value>,
+    default: ErrorFormat,
+}
+
+#[derive(Debug, Clone, Deserialize, Default)]
+enum ErrorFormat {
+    #[default]
+    #[serde(rename(deserialize = "plaintext"))]
+    Plaintext,
+    #[serde(rename(deserialize = "html"))]
+    Html,
+    #[serde(rename(deserialize = "json"))]
+    Json,
+}
+
+impl Default for ErrorResponse {
+    fn default() -> Self {
+        ErrorResponse {
+            code: 500,
+            plaintext: Some("Error".to_owned()),
+            html: None,
+            json: None,
+            default: ErrorFormat::Plaintext,
+        }
+    }
+}
+
+impl ErrorResponse {
+    pub(crate) async fn to_http_response(&self, request: &HttpRequest) -> HttpResponse {
+        let accept = request.accept();
+        let body = match accept {
+            Some(accept) if accept.contains("text/plain") => BoxBody::new(Full::new(Bytes::from(
+                self.plaintext.clone().unwrap_or_else(|| "Error".to_owned()),
+            ))),
+            Some(accept) if accept.contains("text/html") => {
+                if let Some(path) = &self.html {
+                    let path = path.to_str().unwrap();
+                    let response = ROOT_STATIC_FILE_SERVER.serve_single(path).await;
+
+                    if response.status().is_success() {
+                        response.into_body()
+                    } else {
+                        BoxBody::new(Full::new(Bytes::from("Error")))
+                    }
+                } else {
+                    BoxBody::new(Full::new(Bytes::from("Error")))
+                }
+            }
+            Some(accept) if accept.contains("application/json") => {
+                BoxBody::new(Full::new(Bytes::from(
+                    self.json
+                        .as_ref()
+                        .map(|json| json.to_string())
+                        .unwrap_or_else(|| "Error".to_owned()),
+                )))
+            }
+            _ => match self.default {
+                ErrorFormat::Plaintext => BoxBody::new(Full::new(Bytes::from(
+                    self.plaintext.clone().unwrap_or_else(|| "Error".to_owned()),
+                ))),
+                ErrorFormat::Html => {
+                    if let Some(path) = &self.html {
+                        let path = path.to_str().unwrap();
+                        let response = ROOT_STATIC_FILE_SERVER.serve_single(path).await;
+
+                        if response.status().is_success() {
+                            response.into_body()
+                        } else {
+                            BoxBody::new(Full::new(Bytes::from("Error")))
+                        }
+                    } else {
+                        BoxBody::new(Full::new(Bytes::from("Error")))
+                    }
+                }
+                ErrorFormat::Json => BoxBody::new(Full::new(Bytes::from(
+                    self.json
+                        .as_ref()
+                        .map(|json| json.to_string())
+                        .unwrap_or_else(|| "Error".to_owned()),
+                ))),
+            },
+        };
+
+        Response::builder().status(self.code).body(body).unwrap()
+    }
+
+    pub async fn before(
+        &self,
+        req: HttpRequest,
+        _context: &mut RequestContext,
+    ) -> Result<Either<HttpRequest, HttpResponse>, ItsiError> {
+        if let Some(path) = req.uri().path().strip_prefix("/error/") {
+            let path = Path::new(path);
+            if path.exists() {
+                let path = path.to_str().unwrap();
+                let response = ROOT_STATIC_FILE_SERVER.serve_single(path).await;
+                return Ok(Either::Right(response));
+            }
+        }
+        Ok(Either::Left(req))
+    }
+}

data/ext/itsi_server/src/server/middleware_stack/middlewares/etag.rs

@@ -0,0 +1,191 @@
+use super::{FromValue, MiddlewareLayer};
+use crate::server::{itsi_service::RequestContext, types::HttpResponse};
+use async_trait::async_trait;
+use base64::{engine::general_purpose, Engine as _};
+use bytes::{Bytes, BytesMut};
+use either::Either;
+use futures::TryStreamExt;
+use http::{header, HeaderValue, Response, StatusCode};
+use http_body_util::{combinators::BoxBody, BodyExt, Empty, Full};
+use hyper::body::Body;
+use magnus::error::Result;
+use serde::Deserialize;
+use sha2::{Digest, Sha256};
+
+#[derive(Debug, Clone, Copy, Deserialize, Default)]
+pub enum ETagType {
+    #[serde(rename = "strong")]
+    #[default]
+    Strong,
+    #[serde(rename = "weak")]
+    Weak,
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, Default)]
+pub enum HashAlgorithm {
+    #[serde(rename = "sha256")]
+    #[default]
+    Sha256,
+    #[serde(rename = "md5")]
+    Md5,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ETag {
+    #[serde(default)]
+    pub r#type: ETagType,
+    #[serde(default)]
+    pub algorithm: HashAlgorithm,
+    #[serde(default)]
+    pub min_body_size: usize,
+    #[serde(default = "default_true")]
+    pub handle_if_none_match: bool,
+}
+
+fn default_true() -> bool {
+    true
+}
+
+#[async_trait]
+impl MiddlewareLayer for ETag {
+    async fn before(
+        &self,
+        req: crate::server::types::HttpRequest,
+        context: &mut RequestContext,
+    ) -> Result<Either<crate::server::types::HttpRequest, HttpResponse>> {
+        // Store if-none-match header in context if present for later use in after hook
+        if self.handle_if_none_match {
+            if let Some(if_none_match) = req.headers().get(header::IF_NONE_MATCH) {
+                if let Ok(etag_value) = if_none_match.to_str() {
+                    context.set_if_none_match(Some(etag_value.to_string()));
+                }
+            }
+        }
+        Ok(Either::Left(req))
+    }
+
+    async fn after(&self, resp: HttpResponse, context: &mut RequestContext) -> HttpResponse {
+        // Skip for error responses or responses that shouldn't have ETags
+        match resp.status() {
+            StatusCode::OK
+            | StatusCode::CREATED
+            | StatusCode::ACCEPTED
+            | StatusCode::NON_AUTHORITATIVE_INFORMATION
+            | StatusCode::NO_CONTENT
+            | StatusCode::PARTIAL_CONTENT => {}
+            _ => return resp,
+        }
+
+        // Skip if already has an ETag
+        if resp.headers().contains_key(header::ETAG) {
+            return resp;
+        }
+
+        // Skip if Cache-Control: no-store is present
+        if let Some(cache_control) = resp.headers().get(header::CACHE_CONTROL) {
+            if let Ok(cache_control_str) = cache_control.to_str() {
+                if cache_control_str.contains("no-store") {
+                    return resp;
+                }
+            }
+        }
+
+        // Check if body is a stream or fixed size using size_hint (similar to compression.rs)
+        let body_size = resp.size_hint().exact();
+
+        // Skip streaming bodies
+        if body_size.is_none() {
+            return resp;
+        }
+
+        // Skip if body is too small
+        if body_size.unwrap_or(0) < self.min_body_size as u64 {
+            return resp;
+        }
+
+        let (mut parts, mut body) = resp.into_parts();
+        let etag_value = if let Some(existing_etag) = parts.headers.get(header::ETAG) {
+            existing_etag.to_str().unwrap_or("").to_string()
+        } else {
+            // Get the full bytes from the body
+            let full_bytes: Bytes = match body
+                .into_data_stream()
+                .try_fold(BytesMut::new(), |mut acc, chunk| async move {
+                    acc.extend_from_slice(&chunk);
+                    Ok(acc)
+                })
+                .await
+            {
+                Ok(bytes_mut) => bytes_mut.freeze(),
+                Err(_) => return Response::from_parts(parts, BoxBody::new(Empty::new())),
+            };
+
+            let computed_etag = match self.algorithm {
+                HashAlgorithm::Sha256 => {
+                    let mut hasher = Sha256::new();
+                    hasher.update(&full_bytes);
+                    let result = hasher.finalize();
+                    general_purpose::STANDARD.encode(result)
+                }
+                HashAlgorithm::Md5 => {
+                    let digest = md5::compute(&full_bytes);
+                    format!("{:x}", digest)
+                }
+            };
+
+            let formatted_etag = match self.r#type {
+                ETagType::Strong => format!("\"{}\"", computed_etag),
+                ETagType::Weak => format!("W/\"{}\"", computed_etag),
+            };
+
+            if let Ok(value) = HeaderValue::from_str(&formatted_etag) {
+                parts.headers.insert(header::ETAG, value);
+            }
+
+            body = Full::new(full_bytes).boxed();
+            formatted_etag
+        };
+
+        // Handle 304 Not Modified if we have an If-None-Match header and it matches
+        if self.handle_if_none_match {
+            if let Some(if_none_match) = context.get_if_none_match() {
+                if if_none_match == etag_value || if_none_match == "*" {
+                    // Return 304 Not Modified without the body
+                    let mut not_modified = Response::new(BoxBody::new(Empty::new()));
+                    *not_modified.status_mut() = StatusCode::NOT_MODIFIED;
+                    // Copy headers we want to preserve
+                    for (name, value) in parts.headers.iter() {
+                        if matches!(
+                            name,
+                            &header::CACHE_CONTROL
+                                | &header::CONTENT_LOCATION
+                                | &header::DATE
+                                | &header::ETAG
+                                | &header::EXPIRES
+                                | &header::VARY
+                        ) {
+                            not_modified.headers_mut().insert(name, value.clone());
+                        }
+                    }
+                    return not_modified;
+                }
+            }
+        }
+
+        // Recreate response with the original body and the ETag header
+        Response::from_parts(parts, body)
+    }
+}
+
+impl Default for ETag {
+    fn default() -> Self {
+        Self {
+            r#type: ETagType::Strong,
+            algorithm: HashAlgorithm::Sha256,
+            min_body_size: 0,
+            handle_if_none_match: true,
+        }
+    }
+}
+
+impl FromValue for ETag {}

data/ext/itsi_server/src/server/middleware_stack/middlewares/grpc_service.rs

@@ -0,0 +1,72 @@
+use super::MiddlewareLayer;
+use crate::{
+    ruby_types::itsi_grpc_request::ItsiGrpcRequest,
+    server::{
+        itsi_service::RequestContext,
+        types::{HttpRequest, HttpResponse},
+    },
+};
+use async_trait::async_trait;
+use derive_more::Debug;
+use either::Either;
+use http::StatusCode;
+use itsi_rb_helpers::{HeapVal, HeapValue};
+use magnus::{block::Proc, error::Result, value::ReprValue, Symbol, Value};
+use std::sync::Arc;
+
+#[derive(Debug)]
+pub struct GrpcService {
+    service: Arc<HeapValue<Proc>>,
+    adapter: Value, // Ruby CustomGrpcAdapter object
+}
+
+impl GrpcService {
+    pub fn from_value(params: HeapVal) -> magnus::error::Result<Self> {
+        let service = params.funcall::<_, _, Proc>(Symbol::new("[]"), ("service_proc",))?;
+        let adapter = params.funcall::<_, _, Value>(Symbol::new("[]"), ("adapter",))?;
+        Ok(GrpcService {
+            service: Arc::new(service.into()),
+            adapter,
+        })
+    }
+}
+
+#[async_trait]
+impl MiddlewareLayer for GrpcService {
+    async fn before(
+        &self,
+        req: HttpRequest,
+        context: &mut RequestContext,
+    ) -> Result<Either<HttpRequest, HttpResponse>> {
+        // Extract gRPC method and service names from the path
+        let path = req.uri().path();
+        let parts: Vec<&str> = path.split('/').filter(|s| !s.is_empty()).collect();
+        
+        if parts.len() < 2 {
+            return Ok(Either::Right(HttpResponse::new(StatusCode::BAD_REQUEST)));
+        }
+
+        let service_name = parts[0].to_string();
+        let method_name = parts[1].to_string();
+
+        // Get RPC descriptor from the adapter
+        let rpc_desc = self.adapter.funcall::<_, _, Option<Value>>(
+            "get_rpc_desc",
+            (service_name.clone(), method_name.clone()),
+        )?;
+
+        // Create gRPC request and process it
+        let (grpc_req, _) = ItsiGrpcRequest::new(
+            req,
+            context,
+            method_name,
+            service_name,
+            rpc_desc,
+        ).await;
+
+        grpc_req
+            .process(context.ruby(), self.service.clone())
+            .map_err(|e| e.into())
+            .map(|_| Either::Right(HttpResponse::new(StatusCode::OK)))
+    }
+} 

data/ext/itsi_server/src/server/middleware_stack/middlewares/header_interpretation.rs

@@ -0,0 +1,85 @@
+use http::{header::GetAll, HeaderValue};
+
+/// Given a list of header values (which may be comma-separated and may have quality parameters)
+/// and a list of supported items (each supported item is a full value or a prefix ending with '*'),
+/// return Some(supported_item) for the first supported item that matches any header value, or None.
+pub fn find_first_supported<'a, I>(
+    header_values: &http::header::GetAll<http::HeaderValue>,
+    supported: I,
+) -> Option<&'a str>
+where
+    I: IntoIterator<Item = &'a str> + Clone,
+{
+    // best candidate: (quality, supported_index, candidate)
+    let mut best: Option<(f32, usize, &'a str)> = None;
+
+    for value in header_values.iter() {
+        if let Ok(s) = value.to_str() {
+            for token in s.split(',') {
+                let token = token.trim();
+                if token.is_empty() {
+                    continue;
+                }
+                let mut parts = token.split(';');
+                let enc = parts.next()?.trim();
+                if enc.is_empty() {
+                    continue;
+                }
+                let quality = parts
+                    .find_map(|p| {
+                        let p = p.trim();
+                        if let Some(q_str) = p.strip_prefix("q=") {
+                            q_str.parse::<f32>().ok()
+                        } else {
+                            None
+                        }
+                    })
+                    .unwrap_or(1.0);
+
+                // For each supported encoding, iterate over a clone of the iterable.
+                for (i, supp) in supported.clone().into_iter().enumerate() {
+                    let is_match = if supp == "*" {
+                        true
+                    } else if let Some(prefix) = supp.strip_suffix('*') {
+                        enc.starts_with(prefix)
+                    } else {
+                        enc.eq_ignore_ascii_case(supp)
+                    };
+
+                    if is_match {
+                        best = match best {
+                            Some((best_q, best_idx, _))
+                                if quality > best_q || (quality == best_q && i < best_idx) =>
+                            {
+                                Some((quality, i, supp))
+                            }
+                            None => Some((quality, i, supp)),
+                            _ => best,
+                        };
+                    }
+                }
+            }
+        }
+    }
+
+    best.map(|(_, _, candidate)| candidate)
+}
+
+pub fn header_contains(header_values: &GetAll<HeaderValue>, needle: &str) -> bool {
+    if needle == "*" {
+        return true;
+    }
+    let mut headers = header_values
+        .iter()
+        .flat_map(|value| value.to_str().unwrap_or("").split(','))
+        .map(|s| s.trim().split(';').next().unwrap_or(""))
+        .filter(|s| !s.is_empty());
+
+    let needle_lower = needle;
+    if needle.ends_with('*') {
+        let prefix = &needle_lower[..needle_lower.len() - 1];
+        headers.any(|h| h.starts_with(prefix))
+    } else {
+        headers.any(|h| h == needle_lower)
+    }
+}

data/ext/itsi_server/src/server/middleware_stack/middlewares/intrusion_protection.rs

@@ -0,0 +1,195 @@
+use super::{ErrorResponse, FromValue, MiddlewareLayer};
+use crate::server::{
+    itsi_service::RequestContext,
+    rate_limiter::{get_ban_manager, get_rate_limiter, BanManager, RateLimiter, RateLimiterConfig},
+    types::{HttpRequest, HttpResponse, RequestExt},
+};
+use async_trait::async_trait;
+use either::Either;
+use itsi_tracing::*;
+use magnus::error::Result;
+use regex::RegexSet;
+use serde::Deserialize;
+use std::time::Duration;
+use std::{
+    collections::HashMap,
+    sync::{Arc, OnceLock},
+};
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct IntrusionProtection {
+    #[serde(skip_deserializing)]
+    pub banned_url_pattern_matcher: OnceLock<RegexSet>,
+    #[serde(default)]
+    pub banned_url_patterns: Vec<String>,
+    #[serde(skip_deserializing)]
+    pub banned_header_pattern_matchers: OnceLock<HashMap<String, RegexSet>>,
+    #[serde(default)]
+    pub banned_header_patterns: HashMap<String, Vec<String>>,
+    pub banned_time_seconds: u64,
+    #[serde(skip_deserializing)]
+    pub rate_limiter: OnceLock<Arc<dyn RateLimiter>>,
+    #[serde(skip_deserializing)]
+    pub ban_manager: OnceLock<BanManager>,
+    pub store_config: RateLimiterConfig,
+    pub error_response: ErrorResponse,
+}
+
+#[async_trait]
+impl MiddlewareLayer for IntrusionProtection {
+    async fn initialize(&self) -> Result<()> {
+        // Initialize regex matchers for URL patterns
+        if !self.banned_url_patterns.is_empty() {
+            match RegexSet::new(&self.banned_url_patterns) {
+                Ok(regex_set) => {
+                    let _ = self.banned_url_pattern_matcher.set(regex_set);
+                }
+                Err(e) => {
+                    error!("Failed to compile URL regex patterns: {:?}", e);
+                }
+            }
+        }
+
+        // Initialize regex matchers for header patterns
+        if !self.banned_header_patterns.is_empty() {
+            let mut header_matchers = HashMap::new();
+            for (header_name, patterns) in &self.banned_header_patterns {
+                if !patterns.is_empty() {
+                    match RegexSet::new(patterns) {
+                        Ok(regex_set) => {
+                            header_matchers.insert(header_name.clone(), regex_set);
+                        }
+                        Err(e) => {
+                            error!(
+                                "Failed to compile header regex patterns for {}: {:?}",
+                                header_name, e
+                            );
+                        }
+                    }
+                }
+            }
+            let _ = self.banned_header_pattern_matchers.set(header_matchers);
+        }
+
+        // Initialize rate limiter (used for tracking bans)
+        // This will automatically fall back to in-memory if Redis fails
+        if let Ok(limiter) = get_rate_limiter(&self.store_config).await {
+            let _ = self.rate_limiter.set(limiter);
+        }
+
+        // Initialize ban manager
+        // This will automatically fall back to in-memory if Redis fails
+        if let Ok(manager) = get_ban_manager(&self.store_config).await {
+            let _ = self.ban_manager.set(manager);
+        }
+
+        Ok(())
+    }
+
+    async fn before(
+        &self,
+        req: HttpRequest,
+        context: &mut RequestContext,
+    ) -> Result<Either<HttpRequest, HttpResponse>> {
+        // Get client IP address from context's service
+        let client_ip = &context.addr;
+
+        // Check if the IP is already banned
+        if let Some(ban_manager) = self.ban_manager.get() {
+            match ban_manager.is_banned(client_ip).await {
+                Ok(Some(reason)) => {
+                    info!("Request from banned IP {}: {}", client_ip, reason);
+                    return Ok(Either::Right(
+                        self.error_response.to_http_response(&req).await,
+                    ));
+                }
+                Err(e) => {
+                    error!("Error checking IP ban status: {:?}", e);
+                    // Continue processing - fail open
+                }
+                _ => {
+                    // Not banned, continue with intrusion checks
+                }
+            }
+        } else {
+            warn!("No ban manager available for intrusion protection");
+        }
+
+        // Check for banned URL patterns
+        if let Some(url_matcher) = self.banned_url_pattern_matcher.get() {
+            let path = req.uri().path_and_query().map(|p| p.as_str()).unwrap_or("");
+            info!("Checking URL pattern match for {}", path);
+            if url_matcher.is_match(path) {
+                info!("Intrusion detected: URL pattern match for {}", path);
+
+                // Ban the IP address if possible
+                if let Some(ban_manager) = self.ban_manager.get() {
+                    match ban_manager
+                        .ban_ip(
+                            client_ip,
+                            &format!("Banned URL pattern detected: {}", path),
+                            Duration::from_secs(self.banned_time_seconds),
+                        )
+                        .await
+                    {
+                        Ok(_) => info!(
+                            "Successfully banned IP {} for {} seconds",
+                            client_ip, self.banned_time_seconds
+                        ),
+                        Err(e) => error!("Failed to ban IP {}: {:?}", client_ip, e),
+                    }
+                }
+
+                // Always return the error response even if banning failed
+                return Ok(Either::Right(
+                    self.error_response.to_http_response(&req).await,
+                ));
+            }
+        }
+
+        // Check for banned header patterns
+        if let Some(header_matchers) = self.banned_header_pattern_matchers.get() {
+            for (header_name, pattern_set) in header_matchers {
+                if let Some(header_value) = req.header(header_name) {
+                    if pattern_set.is_match(header_value) {
+                        info!(
+                            "Intrusion detected: Header pattern match for {} in header {}",
+                            header_value, header_name
+                        );
+
+                        // Ban the IP address if possible
+                        if let Some(ban_manager) = self.ban_manager.get() {
+                            match ban_manager
+                                .ban_ip(
+                                    client_ip,
+                                    &format!(
+                                        "Banned header pattern detected: {} in {}",
+                                        header_value, header_name
+                                    ),
+                                    Duration::from_secs(self.banned_time_seconds),
+                                )
+                                .await
+                            {
+                                Ok(_) => info!(
+                                    "Successfully banned IP {} for {} seconds",
+                                    client_ip, self.banned_time_seconds
+                                ),
+                                Err(e) => error!("Failed to ban IP {}: {:?}", client_ip, e),
+                            }
+                        }
+
+                        // Always return the error response even if banning failed
+                        return Ok(Either::Right(
+                            self.error_response.to_http_response(&req).await,
+                        ));
+                    }
+                }
+            }
+        }
+
+        // No intrusion detected
+        Ok(Either::Left(req))
+    }
+}
+
+impl FromValue for IntrusionProtection {}