tasker-engine 1.0.0

data/app/controllers/tasker/application_controller.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+# typed: false
+
+module Tasker
+  class ApplicationController < ActionController::API
+    include Tasker::Concerns::Authenticatable
+    include Tasker::Concerns::ControllerAuthorizable
+
+    # Handle authentication errors with proper HTTP status codes
+    rescue_from Tasker::Authentication::AuthenticationError do |exception|
+      render json: { error: 'Unauthorized', message: exception.message }, status: :unauthorized
+    end
+
+    rescue_from Tasker::Authentication::ConfigurationError do |exception|
+      render json: { error: 'Authentication Configuration Error', message: exception.message },
+             status: :internal_server_error
+    end
+
+    rescue_from Tasker::Authentication::InterfaceError do |exception|
+      render json: { error: 'Authentication Interface Error', message: exception.message },
+             status: :internal_server_error
+    end
+
+    # Handle authorization errors with proper HTTP status codes
+    rescue_from Tasker::Authorization::UnauthorizedError do |exception|
+      render json: { error: 'Forbidden', message: exception.message }, status: :forbidden
+    end
+
+    rescue_from Tasker::Authorization::ConfigurationError do |exception|
+      render json: { error: 'Authorization Configuration Error', message: exception.message },
+             status: :internal_server_error
+    end
+
+    # Handle interface errors where coordinators don't implement required methods
+    rescue_from NoMethodError do |exception|
+      raise exception unless exception.message.include?('authorize!')
+
+      render json: {
+        error: 'Authorization Interface Error',
+        message: 'Coordinator does not implement required authorize! method'
+      }, status: :internal_server_error
+    end
+  end
+end

data/app/controllers/tasker/graphql_controller.rb

@@ -0,0 +1,193 @@
+# typed: false
+# frozen_string_literal: true
+
+require_dependency 'tasker/application_controller'
+
+module Tasker
+  class GraphqlController < ApplicationController
+    # If accessing from outside this domain, nullify the session
+    # This allows for outside API access while preventing CSRF attacks,
+    # but you'll have to authenticate your user separately
+    # protect_from_forgery with: :null_session
+
+    # Skip the standard controller authorization - we handle GraphQL authorization manually
+    skip_before_action :authorize_tasker_action!, if: :authorization_enabled?
+
+    def execute
+      variables = prepare_variables(params[:variables])
+      query = params[:query]
+      operation_name = params[:operationName]
+
+      # Authorize GraphQL operations before execution
+      authorize_graphql_operations!(query, operation_name) if authorization_enabled?
+
+      context = {
+        # Query context goes here, for example:
+        current_user: current_tasker_user,
+        authenticated: tasker_user_authenticated?
+      }
+      result = Tasker::TaskerRailsSchema.execute(query, variables: variables, context: context,
+                                                        operation_name: operation_name)
+      render(json: result)
+    rescue StandardError => e
+      raise(e) unless Rails.env.development?
+
+      handle_error_in_development(e)
+    end
+
+    private
+
+    # Handle variables in form data, JSON body, or a blank value
+    def prepare_variables(variables_param)
+      case variables_param
+      when String
+        if variables_param.present?
+          JSON.parse(variables_param) || {}
+        else
+          {}
+        end
+      when Hash
+        variables_param
+      when ActionController::Parameters
+        variables_param.to_unsafe_hash # GraphQL-Ruby will validate name and type of incoming variables.
+      when nil
+        {}
+      else
+        raise(ArgumentError, "Unexpected parameter: #{variables_param}")
+      end
+    end
+
+    def handle_error_in_development(error)
+      logger.error(error.message)
+      logger.error(error.backtrace.join("\n"))
+
+      render(json: { errors: [{ message: error.message, backtrace: error.backtrace }], data: {} },
+             status: :internal_server_error)
+    end
+
+    # Authorization methods for GraphQL operations
+
+    def authorization_enabled?
+      Tasker.configuration.auth.authorization_enabled
+    end
+
+    def authorize_graphql_operations!(query_string, operation_name)
+      return if query_string.blank?
+
+      # Parse the GraphQL query to extract operations
+      operations = extract_graphql_operations(query_string, operation_name)
+
+      # Check authorization for each operation
+      operations.each do |operation|
+        resource, action = map_graphql_operation_to_permission(operation)
+        next unless resource && action
+
+        authorization_coordinator.authorize!(resource, action, graphql_authorization_context(operation))
+      end
+    end
+
+    def extract_graphql_operations(query_string, _operation_name)
+      # Simple regex-based extraction of GraphQL operations for Tasker's current use case.
+      # This approach is sufficient for Tasker's limited, well-defined operations without aliases,
+      # fragments, or complex nesting. Consider upgrading to GraphQL-Ruby's parser if you add:
+      # - Field aliases (e.g., { taskList: tasks { ... } })
+      # - GraphQL fragments (e.g., { ...TaskFields })
+      # - Multiple operations in a single query
+      # - Operations with comments or complex string literals
+      operations = []
+
+      # Clean the query string
+      query_string = query_string.strip
+
+      # Determine if this is a query or mutation
+      field_matches = query_string.scan(/{\s*(\w+)(?:\s*\([^)]*\))?\s*{/)
+      if /^\s*mutation/i.match?(query_string)
+        # Extract mutation fields
+        # Pattern: mutation { mutationName(args) { ... } }
+        field_matches.flatten.each do |field|
+          operations << { type: :mutation, name: field.strip }
+        end
+      else
+        # Default to query - extract query fields
+        # Pattern: query { fieldName(args) { ... } } or { fieldName(args) { ... } }
+        field_matches.flatten.each do |field|
+          operations << { type: :query, name: field.strip }
+        end
+      end
+
+      # Debug logging
+      Rails.logger.debug { "GraphQL Query: #{query_string}" }
+      Rails.logger.debug { "Extracted Operations: #{operations.inspect}" }
+
+      operations
+    end
+
+    def map_graphql_operation_to_permission(operation)
+      case operation[:type]
+      when :query
+        map_query_to_permission(operation[:name])
+      when :mutation
+        map_mutation_to_permission(operation[:name])
+      else
+        [nil, nil]
+      end
+    end
+
+    def map_query_to_permission(query_name)
+      case query_name
+      when 'tasks', 'tasksByStatus', 'tasksByAnnotation'
+        ['tasker.task', :index]
+      when 'task'
+        ['tasker.task', :show]
+      when 'step'
+        ['tasker.workflow_step', :show]
+      when 'annotationTypes'
+        # This might be a system-level query that doesn't need authorization
+        [nil, nil]
+      else
+        # Unknown query - deny by default
+        ['unknown.resource', :unknown]
+      end
+    end
+
+    def map_mutation_to_permission(mutation_name)
+      case mutation_name
+      when 'createTask'
+        ['tasker.task', :create]
+      when 'updateTask'
+        ['tasker.task', :update]
+      when 'cancelTask'
+        ['tasker.task', :cancel]
+      when 'updateStep'
+        ['tasker.workflow_step', :update]
+      when 'cancelStep'
+        ['tasker.workflow_step', :cancel]
+      else
+        # Unknown mutation - deny by default
+        ['unknown.resource', :unknown]
+      end
+    end
+
+    def authorization_coordinator
+      @authorization_coordinator ||= build_authorization_coordinator
+    end
+
+    def build_authorization_coordinator
+      coordinator_class = Tasker.configuration.auth.authorization_coordinator_class.constantize
+      coordinator_class.new(current_tasker_user)
+    rescue NameError => e
+      coordinator_class_name = Tasker.configuration.auth.authorization_coordinator_class
+      raise Tasker::Authorization::ConfigurationError,
+            "Authorization coordinator class '#{coordinator_class_name}' not found: #{e.message}"
+    end
+
+    def graphql_authorization_context(operation)
+      {
+        controller: self,
+        params: params,
+        graphql_operation: operation,
+        user: current_tasker_user
+      }
+    end
+  end
+end

data/app/controllers/tasker/handlers_controller.rb

@@ -0,0 +1,217 @@
+# typed: false
+# frozen_string_literal: true
+
+require_relative 'application_controller'
+
+module Tasker
+  class HandlersController < ApplicationController
+    before_action :set_handler_factory
+    before_action :set_intelligent_cache
+
+    # GET /handlers - List all namespaces with intelligent caching
+    def index
+      cache_key = "tasker:handlers:namespaces:#{handler_registry_version}"
+
+      cached_data = @intelligent_cache.intelligent_fetch(cache_key, base_ttl: 2.minutes) do
+        {
+          namespaces: @handler_factory.registered_namespaces.map do |namespace|
+            {
+              name: namespace.to_s,
+              handler_count: count_handlers_in_namespace(namespace)
+            }
+          end,
+          total_namespaces: @handler_factory.registered_namespaces.size,
+          generated_at: Time.current
+        }
+      end
+
+      render json: cached_data, status: :ok
+    end
+
+    # GET /handlers/:namespace - List handlers in a specific namespace
+    def show_namespace
+      namespace_name = params[:namespace]
+
+      unless @handler_factory.registered_namespaces.include?(namespace_name.to_sym)
+        render json: { error: 'Namespace not found' }, status: :not_found
+        return
+      end
+
+      namespace_handlers = @handler_factory.list_handlers(namespace: namespace_name)
+
+      handlers_data = namespace_handlers.map do |handler_name, versions|
+        {
+          name: handler_name,
+          namespace: namespace_name,
+          versions: versions.keys.sort,
+          latest_version: versions.keys.max,
+          handler_count: versions.size
+        }
+      end
+
+      render json: {
+        namespace: namespace_name,
+        handlers: handlers_data,
+        total_handlers: handlers_data.size
+      }, status: :ok
+    end
+
+    # GET /handlers/:namespace/:name - Show specific handler with dependency graph (cached)
+    def show
+      namespace_name = params[:namespace]
+      handler_name = params[:name]
+      version = params[:version] || '0.1.0'
+
+      unless @handler_factory.registered_namespaces.include?(namespace_name.to_sym)
+        render json: { error: 'Namespace not found' }, status: :not_found
+        return
+      end
+
+      # Use intelligent caching for expensive handler discovery and dependency graph building
+      cache_key = "tasker:handlers:show:#{namespace_name}:#{handler_name}:#{version}:#{handler_registry_version}"
+
+      cached_result = @intelligent_cache.intelligent_fetch(cache_key, base_ttl: 2.minutes) do
+        handler_data = find_handler_data(namespace_name, handler_name, version)
+
+        if handler_data
+          # Add dependency graph information (expensive operation)
+          handler_data[:dependency_graph] = build_dependency_graph(handler_data[:step_templates])
+          {
+            handler: handler_data,
+            generated_at: Time.current,
+            cache_key: cache_key
+          }
+        else
+          {
+            error: 'Handler not found in namespace',
+            generated_at: Time.current
+          }
+        end
+      end
+
+      if cached_result[:error]
+        render json: { error: cached_result[:error] }, status: :not_found
+      else
+        render json: cached_result, status: :ok
+      end
+    end
+
+    private
+
+    def set_handler_factory
+      @handler_factory = Tasker::HandlerFactory.instance
+    end
+
+    def set_intelligent_cache
+      @intelligent_cache = Tasker::Telemetry::IntelligentCacheManager.new
+    end
+
+    # Generate cache version based on handler registry state
+    #
+    # @return [String] Cache version that changes when handlers are registered/updated
+    def handler_registry_version
+      # Use handler factory statistics for cache invalidation
+      namespace_count = @handler_factory.registered_namespaces.size
+      total_handlers = @handler_factory.registered_namespaces.sum do |namespace|
+        @handler_factory.list_handlers(namespace: namespace).size
+      end
+
+      "v1:#{namespace_count}:#{total_handlers}"
+    end
+
+    def count_handlers_in_namespace(namespace)
+      namespace_handlers = @handler_factory.list_handlers(namespace: namespace)
+      namespace_handlers.size
+    end
+
+    def find_handler_data(namespace_name, handler_name, version)
+      # Get all versions for this handler in the namespace
+      namespace_handlers = @handler_factory.list_handlers(namespace: namespace_name)
+      handler_versions = namespace_handlers[handler_name.to_sym]
+
+      return nil unless handler_versions
+
+      # Determine the actual version to use
+      actual_version = if version == 'latest'
+                         handler_versions.keys.max
+                       elsif version == '0.1.0' && !handler_versions.key?('0.1.0')
+                         # Fall back to lowest available version if 0.1.0 doesn't exist
+                         handler_versions.keys.min
+                       else
+                         version
+                       end
+
+      # Get the handler class for the specific version
+      handler_class = handler_versions[actual_version]
+      return nil unless handler_class
+
+      # Use the HandlerSerializer to get consistent data structure
+      serializer = Tasker::HandlerSerializer.new(
+        handler_class,
+        handler_name: handler_name,
+        namespace: namespace_name,
+        version: actual_version
+      )
+      serializer.serializable_hash
+    end
+
+    def build_dependency_graph(step_templates)
+      return { nodes: [], edges: [] } unless step_templates.is_a?(Array)
+
+      nodes = []
+      edges = []
+
+      step_templates.each do |step|
+        # Add node for this step
+        nodes << {
+          id: step[:name],
+          name: step[:name],
+          type: 'step',
+          handler_class: step[:handler_class],
+          configuration: step[:configuration] || step[:handler_config] || {}
+        }
+
+        # Add edge if this step depends on another
+        next unless step[:depends_on_step]
+
+        edges << {
+          from: step[:depends_on_step],
+          to: step[:name],
+          type: 'dependency'
+        }
+      end
+
+      {
+        nodes: nodes,
+        edges: edges,
+        execution_order: calculate_execution_order(step_templates)
+      }
+    end
+
+    def calculate_execution_order(step_templates)
+      # Simple topological sort to determine execution order
+      steps_by_name = step_templates.index_by { |step| step[:name] }
+      visited = Set.new
+      order = []
+
+      def visit_step(step_name, steps_by_name, visited, order)
+        return if visited.include?(step_name)
+
+        step = steps_by_name[step_name]
+        return unless step
+
+        # Visit dependencies first
+        visit_step(step[:depends_on_step], steps_by_name, visited, order) if step[:depends_on_step]
+
+        visited.add(step_name)
+        order << step_name
+      end
+
+      steps_by_name.each_key do |step_name|
+        visit_step(step_name, steps_by_name, visited, order)
+      end
+
+      order
+    end
+  end
+end

data/app/controllers/tasker/health_controller.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require_dependency 'tasker/application_controller'
+
+module Tasker
+  # Health check controller providing endpoints for system health monitoring.
+  #
+  # This controller provides three health check endpoints:
+  # - `/health/ready` - Readiness check (K8s probes, always unauthenticated)
+  # - `/health/live` - Liveness check (K8s probes, always unauthenticated)
+  # - `/health/status` - Detailed status (uses system_status.read authorization)
+  #
+  # The status endpoint uses the authorization system with the `system_status.read` permission.
+  # If authorization is disabled or no authorization coordinator is configured, access is allowed.
+  # If authorization is enabled, users need the `tasker.system_status:read` permission.
+  class HealthController < ApplicationController
+    # Skip authentication and authorization for K8s probe endpoints
+    skip_before_action :authenticate_tasker_user!, only: %i[ready live]
+    skip_before_action :authorize_tasker_action!, only: %i[ready live]
+
+    # Set cache headers to prevent caching of health data (except detailed status)
+    before_action :set_cache_headers, except: [:status]
+
+    # Initialize intelligent cache for expensive status operations
+    before_action :set_intelligent_cache, only: [:status]
+
+    # Readiness check endpoint for Kubernetes probes
+    # Always returns quickly and doesn't require authentication/authorization
+    #
+    # @return [JSON] Simple ready/not ready status
+    def ready
+      result = Tasker::Health::ReadinessChecker.ready?
+
+      if result[:ready]
+        render json: result, status: :ok
+      else
+        render json: result, status: :service_unavailable
+      end
+    rescue StandardError => e
+      render json: {
+        ready: false,
+        error: 'Health check failed',
+        message: e.message,
+        timestamp: Time.current.iso8601
+      }, status: :service_unavailable
+    end
+
+    # Liveness check endpoint for Kubernetes probes
+    # Always returns 200 OK and doesn't require authentication/authorization
+    #
+    # @return [JSON] Simple alive status
+    def live
+      render json: {
+        alive: true,
+        timestamp: Time.current.iso8601,
+        service: 'tasker'
+      }, status: :ok
+    end
+
+    # Detailed status endpoint with comprehensive system metrics (cached)
+    # Uses system_status.read authorization if authorization is enabled
+    # Results are cached using IntelligentCacheManager for performance
+    #
+    # @return [JSON] Detailed system status and metrics
+    def status
+      # Use intelligent caching for expensive system status analysis
+      cache_key = "tasker:health:detailed_status:#{system_status_cache_version}"
+
+      cached_result = @intelligent_cache.intelligent_fetch(cache_key, base_ttl: 60.seconds) do
+        status_result = Tasker::Health::StatusChecker.status
+
+        # Enhance with additional performance analytics
+        enhanced_result = enhance_status_with_analytics(status_result)
+
+        {
+          **enhanced_result,
+          generated_at: Time.current,
+          cache_info: {
+            cached: true,
+            cache_key: cache_key,
+            ttl_base: '5 minutes'
+          }
+        }
+      end
+
+      if cached_result[:healthy]
+        render json: cached_result, status: :ok
+      else
+        render json: cached_result, status: :service_unavailable
+      end
+    rescue StandardError => e
+      render json: {
+        healthy: false,
+        error: 'Status check failed',
+        message: e.message,
+        timestamp: Time.current.iso8601
+      }, status: :service_unavailable
+    end
+
+    private
+
+    def set_intelligent_cache
+      @intelligent_cache = Tasker::Telemetry::IntelligentCacheManager.new
+    end
+
+    # Generate cache version based on system state for intelligent cache invalidation
+    #
+    # @return [String] Cache version that changes when system state changes significantly
+    def system_status_cache_version
+      # Use current hour and basic system metrics for cache versioning
+      # This ensures cache invalidation every hour and when major system changes occur
+      current_hour = Time.current.strftime('%Y%m%d%H')
+
+      # Include basic system state indicators using scopes
+      active_tasks = Task.created_since(1.hour.ago).count
+      recent_errors = WorkflowStep.failed_since(1.hour.ago).count
+
+      "v1:#{current_hour}:#{active_tasks}:#{recent_errors}"
+    end
+
+    # Enhance basic status with additional performance analytics
+    #
+    # @param status_result [Hash] Basic status from StatusChecker
+    # @return [Hash] Enhanced status with performance insights
+    def enhance_status_with_analytics(status_result)
+      # Add performance trend analysis
+      performance_trends = calculate_performance_trends
+
+      # Add cache performance metrics
+      cache_performance = @intelligent_cache.export_performance_metrics
+
+      # Enhance the original status with analytics
+      status_result.merge(
+        performance_analytics: {
+          trends: performance_trends,
+          cache_performance: cache_performance,
+          analysis_period: '1 hour',
+          enhanced_at: Time.current
+        }
+      )
+    rescue StandardError => e
+      # If analytics enhancement fails, return original status with error note
+      status_result.merge(
+        performance_analytics: {
+          error: "Analytics enhancement failed: #{e.message}",
+          fallback_mode: true
+        }
+      )
+    end
+
+    # Calculate performance trends for the last hour
+    #
+    # @return [Hash] Performance trend analysis
+    def calculate_performance_trends
+      one_hour_ago = 1.hour.ago
+
+      {
+        task_creation_rate: Task.created_since(one_hour_ago).count,
+        completion_rate: Task.completed_since(one_hour_ago).count,
+        error_rate: Task.failed_since(one_hour_ago).count,
+        avg_step_duration: calculate_average_step_duration(one_hour_ago)
+      }
+    end
+
+    # Calculate average step duration for performance trending
+    #
+    # @param since [Time] Calculate duration since this time
+    # @return [Float] Average duration in seconds
+    def calculate_average_step_duration(since)
+      completed_steps = WorkflowStep.completed_since(since)
+
+      return 0.0 if completed_steps.empty?
+
+      durations = completed_steps.filter_map do |step|
+        next 0.0 unless step.created_at && step.updated_at
+
+        (step.updated_at - step.created_at).to_f
+      end
+
+      durations.empty? ? 0.0 : (durations.sum / durations.size).round(3)
+    end
+
+    # Override the resource name for authorization
+    # Maps status action to health_status resource instead of health resource
+    #
+    # @return [String] The resource name for authorization
+    def tasker_resource_name
+      case action_name
+      when 'status'
+        Tasker::Authorization::ResourceConstants::RESOURCES::HEALTH_STATUS
+      else
+        super
+      end
+    end
+
+    # Override the action name for authorization
+    # Maps status action to index action instead of status action
+    #
+    # @return [Symbol] The action name for authorization
+    def tasker_action_name
+      case action_name
+      when 'status'
+        Tasker::Authorization::ResourceConstants::ACTIONS::INDEX
+      else
+        super
+      end
+    end
+
+    # Override authentication check for status endpoint
+    # Uses health configuration instead of global auth configuration
+    #
+    # @return [Boolean] True if authentication should be skipped
+    def skip_authentication?
+      case action_name
+      when 'status'
+        !Tasker.configuration.health.status_requires_authentication
+      else
+        super
+      end
+    end
+
+    # Set appropriate cache control headers for health endpoints
+    def set_cache_headers
+      response.headers['Cache-Control'] = 'no-cache, no-store, must-revalidate'
+      response.headers['Pragma'] = 'no-cache'
+      response.headers['Expires'] = '0'
+    end
+  end
+end