usps-support 0.2.45 → 0.2.46

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f333ae8e6b1ebd37bd6ec0aabc4a07db42777ffd2031f4c7b119fb7f71e22392
-  data.tar.gz: 82e6f7a84a0a8eaa2557ece29630965a896f8ce20502bad455bbe06821d5e78d
+  metadata.gz: a1508e9abf6ef884c05e7201b52f3c328a81be47388319938e5a4b3ef8aa5e5a
+  data.tar.gz: '08de17c41c0489f4f0a6994a73ca193a25c8b1917ebc652c6788d6d6c69c72d2'
 SHA512:
-  metadata.gz: 72e0c952b68a7a62e99f61b3815568aba3453c35b28c69ee15a17acc2882df635ddccca0df5e60290bbbeda36b3c3b3205fec16f93f8d211941d4d98d9b66981
-  data.tar.gz: 95defc9a3bf120dba61375e6929f01b0affcfc8ad532ed79e200773fbeb70b9080723bda995097b767b8a1922424c5ecdb9ebdef0257c4fc8368d6f6515a9d97
+  metadata.gz: 54e24451d92bed2cfb93bda006c78d2d311f9e3e5a1a283cebc7f66e3908c4c5977b81a87ce265a1389e16ef6b8759759ca0e7ac5f304ff35a682bb29e2d9a12
+  data.tar.gz: cd741d2ff564082916e9782408762d8117b17d45afae4e8d90e3ddb442c0d1e79e84b3e5beb492387d7f971b5ee15f7db679a9c8e2d2c6753eecfc5adc87ea55

data/app/controllers/usps/support/health_controller.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+require 'net/http'
+
+module Usps::Support
+  # Base controller for external synthetic health probes (see the infrastructure repo's
+  # doc/application_health_probes.md). Unlike Rails' /up (boot-only) and nginx's static
+  # /instance-health-check, this exercises an app's *critical dependencies* and returns the sentinel
+  # "HEALTHCHECK_OK <app>" only when every check passes — a Route 53 HTTPS_STR_MATCH probe asserts
+  # the "HEALTHCHECK_OK" prefix, so a quiet app-level failure flips the Statuspage component even
+  # with no organic traffic.
+  #
+  # Host apps subclass this and override #checks to pick which dependencies to probe, e.g.
+  #
+  #   class HealthController < Usps::Support::HealthController
+  #     private
+  #     def checks = { database: check_database, redis: check_redis }
+  #   end
+  #
+  # and route to it (`get 'health' => 'health#show'`). The check_* primitives below each return a
+  # boolean and never raise, so the action always responds. Apps run only the checks for the
+  # dependencies they actually configure — admin-console has no HQ connection, so it omits
+  # check_hq_database; an iMIS-backed app adds check_imis; a custom downstream is check_http(url).
+  #
+  # Inherits ActionController::Base directly — NOT the host's ApplicationController — to bypass
+  # Devise auth, Pundit authorization, PaperTrail, and especially `allow_browser`, whose
+  # modern-browser gate would 406 Route 53's non-browser prober and fail the probe for the wrong
+  # reason.
+  class HealthController < ActionController::Base # rubocop:disable Rails/ApplicationController
+    SENTINEL_PREFIX = 'HEALTHCHECK_OK'
+
+    def show
+      results = checks
+      healthy = results.values.all?
+
+      body = "#{healthy ? "#{SENTINEL_PREFIX} #{app_name}" : "HEALTHCHECK_FAIL #{app_name}"}\n"
+      results.each { |name, ok| body << "#{name}=#{ok ? 'ok' : 'fail'}\n" }
+
+      response.set_header('Cache-Control', 'no-store')
+      response.set_header('Retry-After', '30') unless healthy
+      render(plain: body, content_type: 'text/plain', status: healthy ? :ok : :service_unavailable)
+    end
+
+  private
+
+    # Dependencies to probe, as { label => boolean }.
+    #
+    # Override per app.
+    #
+    # Default is the primary database only, which presumably every app needs.
+    def checks = { database: check_database }
+
+    # Derives "admin-console" from the host application's module (e.g. AdminConsole), so the sentinel
+    # identifies which app answered without per-app configuration.
+    def app_name = Rails.application.class.module_parent_name.underscore.dasherize
+
+    # --- Check primitives. Each returns true/false and swallows its own errors, so a dead
+    # dependency reads as a failed check rather than a 500. ---
+
+    # Primary application database (RDS).
+    def check_database = check_connection(::ActiveRecord::Base)
+
+    # HQ database (using VHQAB), reached over the HQ VPN — a *different* host than RDS.
+    def check_hq_database = check_connection(Models::Hq::Members::BaseRecord)
+
+    # Redis / Sidekiq's configured connection pool.
+    def check_redis
+      ::Sidekiq.redis { it.call('PING') }
+      true
+    rescue StandardError
+      false
+    end
+
+    # iMIS API liveness — authenticating proves network + credentials + the token endpoint, against
+    # the environment-appropriate iMIS.
+    def check_imis
+      ::Usps::Imis::Api.new.auth_token
+      true
+    rescue StandardError
+      false
+    end
+
+    # Generic downstream HTTP liveness for a custom dependency.
+    def check_http(url)
+      ::Net::HTTP.get_response(URI(url)).is_a?(::Net::HTTPSuccess)
+    rescue StandardError
+      false
+    end
+
+    # Checks out a connection from the given model's pool and runs a trivial query — proves the
+    # connection is live, which a boot-time check skips.
+    def check_connection(model)
+      model.connection.execute('SELECT 1')
+      true
+    rescue StandardError
+      false
+    end
+  end
+end

data/lib/usps/support/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module Support
-    VERSION = '0.2.45'
+    VERSION = '0.2.46'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-support
 version: !ruby/object:Gem::Version
-  version: 0.2.45
+  version: 0.2.46
 platform: ruby
 authors:
 - Julian Fiander
@@ -73,6 +73,7 @@ files:
 - Readme.md
 - app/controllers/concerns/usps/support/admin_menu.rb
 - app/controllers/usps/support/admins_controller.rb
+- app/controllers/usps/support/health_controller.rb
 - app/models/usps/support/policy/admin_context.rb
 - config/routes.rb
 - db/hq/members_schema.rb