@rakay-technology/kraft 0.7.4

package/dist/server/lua/pipe_stream.lua

@@ -0,0 +1,103 @@
+-- pipe_stream.lua
+-- content_by_lua: SSE endpoint for real-time request log streaming.
+-- GET /logs/stream?domain=example.com
+-- Internal only - 127.0.0.1:9145
+--
+-- Reads the SAME ring buffer site_logger.lua writes (rlog:{domain}:seq +
+-- rlog:{domain}:{slot}), by a PER-CONNECTION cursor. Nothing is consumed: N
+-- concurrent watchers each walk the ring independently and none steals another's
+-- frames. This is what replaced the old single-subscriber log_pipe:q queue —
+-- a containerized edge tails this over `docker exec curl`, and a curl that
+-- outlives its client (the daemon buffers its stdout, so no EPIPE) can no longer
+-- drain the queue out from under the next reader.
+
+local sh = ngx.shared.request_data
+if not sh then
+    ngx.status = 503
+    ngx.say("shared dict unavailable")
+    return ngx.exit(503)
+end
+
+local domain = ngx.var.arg_domain
+if not domain or domain == "" then
+    ngx.status = 400
+    ngx.say("missing ?domain= parameter")
+    return ngx.exit(400)
+end
+
+domain = domain:lower()
+if domain:sub(1, 4) == "www." then domain = domain:sub(5) end
+
+-- MUST match site_logger.lua's RING — same slot arithmetic on both ends.
+local RING    = 1000
+local SEQ_KEY = "rlog:" .. domain .. ":seq"
+local slot_key = function(seq) return "rlog:" .. domain .. ":" .. (seq % RING) end
+
+ngx.header["Content-Type"]      = "text/event-stream"
+ngx.header["Cache-Control"]     = "no-cache, no-store"
+ngx.header["Connection"]        = "keep-alive"
+ngx.header["X-Accel-Buffering"] = "no"
+
+-- Send initial SSE comment so the first flush has data.
+-- Without this, ngx.flush on an empty buffer sends chunked-EOF (0\r\n\r\n)
+-- and terminates the response immediately.
+ngx.print(": connected\n\n")
+if not ngx.flush(true) then return end
+
+-- Start at the current head: stream only requests that arrive AFTER connect.
+-- History up to this point is served separately by /logs/recent, and the client
+-- dedups the two by the deterministic `{host}:{seq}` id, so a row seen by both
+-- collapses to one.
+local cursor  = tonumber(sh:get(SEQ_KEY)) or 0
+local started = ngx.now()
+local last_hb = started
+
+while true do
+    -- Max 1 hour per connection.
+    if ngx.now() - started > 3600 then return end
+
+    local head = tonumber(sh:get(SEQ_KEY)) or 0
+
+    -- If we've fallen more than a full ring behind, the oldest unread slots have
+    -- already been overwritten. Jump to the oldest slot still holding its own
+    -- entry (head-RING maps to head's slot, so head-RING+1 is the oldest live one)
+    -- and skip the lost range — same bound the old 2000-entry queue had.
+    if cursor < head - RING then cursor = head - RING end
+
+    local sent = 0
+    while cursor < head and sent < 100 do
+        local next_seq = cursor + 1
+        local entry = sh:get(slot_key(next_seq))
+        if entry then
+            ngx.print("event: request\ndata: ", entry, "\n\n")
+            sent = sent + 1
+            cursor = next_seq
+        elseif next_seq < head then
+            -- A later seq already exists, so this can't be the incr(seq)→set(slot)
+            -- write window: the slot is genuinely lost (expired or wrapped). Skip it.
+            cursor = next_seq
+        else
+            -- next_seq == head: the newest entry's slot may not be written yet
+            -- (the microsecond window between incr(seq) and set(slot)). Retry it
+            -- next cycle without advancing.
+            break
+        end
+    end
+
+    if sent > 0 then
+        if not ngx.flush(true) then return end
+    end
+
+    local now = ngx.now()
+
+    -- Heartbeat every 15s. Its flush is also how a dead client is detected: once
+    -- the reader (a `docker exec curl`) goes away and its socket closes, this
+    -- flush fails and the connection tears down here.
+    if now - last_hb > 15 then
+        ngx.print(": ping\n\n")
+        if not ngx.flush(true) then return end
+        last_hb = now
+    end
+
+    ngx.sleep(0.05)
+end

package/dist/server/lua/rules_guard.lua

@@ -0,0 +1,132 @@
+-- rules_guard.lua
+-- access_by_lua driver: enforce per-route rules (method · IP/CIDR allow-deny ·
+-- country allow/ban · bad user-agent · hotlink · rate-limit) for the request's
+-- host. Rules are pushed reload-free by mgmt_api `POST /rules`; the DB
+-- `route_rule` table is the source of truth. All parsing/compiling/matching
+-- lives in kraft.rules_lib (loaded ONCE per worker) — this file is re-run
+-- every request so it stays minimal. See rules_lib.lua for the compiled shape.
+--
+-- Enforcement uses the connecting peer (ngx.var.remote_addr); front a real_ip
+-- config if behind a trusted proxy. No user-supplied value is ever used as a
+-- Lua pattern or written into a response header.
+
+local rules = ngx.shared.rules
+if not rules then return end
+
+-- Rate-limit counters live in their OWN dict so a high-cardinality flood (a new
+-- rl: key per source IP per second) can't LRU-evict the rulesets and silently
+-- disable enforcement. Fall back to `rules` on a box whose config predates the
+-- separate dict (still works, just shares the zone until the next reload).
+local counters = ngx.shared.rl_counters or rules
+
+local host = ngx.var.host
+if not host then return end
+
+local raw = rules:get(host)
+if not raw then return end          -- fast path: nothing configured for this host
+
+local lib = require "kraft.rules_lib"
+local entries = lib.get(host, raw)
+local n = #entries
+if n == 0 then return end
+
+-- ── Longest matching pathPrefix wins ──
+local uri = ngx.var.uri or "/"
+local chosen, chosen_len = nil, -1
+for i = 1, n do
+    local e = entries[i]
+    local p = e.pathPrefix
+    if p == nil or p == "" or p == "/" then
+        if chosen_len < 0 then chosen, chosen_len = e, 0 end
+    elseif uri == p or string.sub(uri, 1, #p) == p then
+        if #p > chosen_len then chosen, chosen_len = e, #p end
+    end
+end
+if not chosen then return end
+
+local spec = chosen.spec
+local deny_status = spec.blockStatus or 403
+
+local ips = ngx.var.remote_addr or "0.0.0.0"
+local ipi = lib.ipv4_to_int(ips)
+
+-- Country resolved at most once per request (only when a country rule exists).
+local country_cache
+local function country_of()
+    if country_cache == nil then
+        local ok, geo = pcall(require, "kraft.geo_country")
+        country_cache = (ok and geo and geo.get_country_code(ips)) or false
+    end
+    return country_cache or nil
+end
+
+-- ── 1. Access: method allow-list, IP allow/deny, country allow-list ──
+local access = spec.access
+if access then
+    if access.methods and not access.methods[ngx.req.get_method()] then
+        return ngx.exit(deny_status)
+    end
+    if lib.match_compiled(access.deny, ipi, ips) then return ngx.exit(deny_status) end
+    if access.allow and not lib.match_compiled(access.allow, ipi, ips) then
+        return ngx.exit(deny_status)
+    end
+    -- Allow-list: an unresolved country is not on the list → blocked (default-deny).
+    if access.allowCountries and not access.allowCountries[country_of() or ""] then
+        return ngx.exit(deny_status)
+    end
+end
+
+-- ── 2. Ban: IP/CIDR, country, user-agent ──
+local ban = spec.ban
+if ban then
+    if lib.match_compiled(ban.ips, ipi, ips) or lib.match_compiled(ban.cidrs, ipi, ips) then
+        return ngx.exit(deny_status)
+    end
+    if ban.countries then
+        local cc = country_of()
+        -- Fail CLOSED (matches the allow-list above): if geo is unavailable we
+        -- cannot prove the client is NOT from a banned country, so block rather
+        -- than silently letting banned traffic through. A blocked host is a loud
+        -- signal to fix geo; fail-open would be a silent security hole.
+        if not cc then
+            ngx.log(ngx.WARN, "rules_guard: country ban active but geo unavailable — blocking (fail-closed)")
+            return ngx.exit(deny_status)
+        end
+        if ban.countries[cc] then return ngx.exit(deny_status) end
+    end
+    if ban.emptyUA or ban.uas then
+        local ua = ngx.var.http_user_agent
+        if ban.emptyUA and (ua == nil or ua == "") then return ngx.exit(deny_status) end
+        if ban.uas and ua and ua ~= "" then
+            local ual = string.lower(ua)
+            for i = 1, #ban.uas do
+                if string.find(ual, ban.uas[i], 1, true) then return ngx.exit(deny_status) end
+            end
+        end
+    end
+end
+
+-- ── 3. Hotlink: only listed referer hosts (empty referer per allowEmpty) ──
+local hot = spec.hotlink
+if hot then
+    local ref = ngx.var.http_referer
+    if ref == nil or ref == "" then
+        if not hot.allowEmpty then return ngx.exit(deny_status) end
+    else
+        local rhost = string.match(ref, "^%w+://([^/]+)")          -- authority
+        if rhost then rhost = string.lower(string.match(rhost, "^([^:]+)") or rhost) end -- strip :port
+        if not (rhost and hot.referers[rhost]) then return ngx.exit(deny_status) end
+    end
+end
+
+-- ── 4. Rate limit — fixed 1s window per (host, path, ip) ──
+local rl = spec.rl
+if rl then
+    local key = "rl:" .. host .. ":" .. (chosen.pathPrefix or "/") .. ":" .. ips
+        .. ":" .. math.floor(ngx.now())
+    local c = counters:incr(key, 1, 0, 2)  -- init 0, 2s TTL → self-expiring buckets
+    if c and c > rl.limit then
+        ngx.header["Retry-After"] = "1"
+        return ngx.exit(rl.status)
+    end
+end

package/dist/server/lua/rules_lib.lua

@@ -0,0 +1,176 @@
+-- rules_lib.lua
+-- Per-worker helpers + parsed-rule cache for rules_guard.lua (access phase).
+-- Loaded ONCE per worker via require("kraft.rules_lib"). The access file is
+-- re-executed on every request, so all parsing/compiling/matching lives here to
+-- avoid re-creating closures and re-decoding JSON on the hot path.
+--
+-- Shared-dict value `rules[host]` = JSON array of { pathPrefix, spec } where
+-- spec matches @repo/core RouteRuleSpec. parse() decodes + precompiles CIDRs to
+-- integers, lowercases UA/referer needles, and builds O(1) sets for
+-- countries/methods ONCE; the compiled result is LRU-cached per host and reused
+-- until the raw string changes (rule edits are rare, requests are hot).
+--
+-- SECURITY: nothing here turns a rule value into Lua code or a Lua pattern.
+-- Strings are compared with `==`/set-lookups; user-agent matching is
+-- string.find(hay, needle, 1, true) — PLAIN, never a regex.
+
+local cjson = require "cjson.safe"
+local lrucache = require "resty.lrucache"
+
+local M = {}
+
+local cache = lrucache.new(1024) -- compiled rules, per worker, ~1024 hosts
+
+-- ── IPv4 helpers ──
+local function ipv4_to_int(s)
+    local a, b, c, d = string.match(s, "^(%d+)%.(%d+)%.(%d+)%.(%d+)$")
+    if not a then return nil end
+    a, b, c, d = tonumber(a), tonumber(b), tonumber(c), tonumber(d)
+    if a > 255 or b > 255 or c > 255 or d > 255 then return nil end
+    return a * 16777216 + b * 65536 + c * 256 + d
+end
+M.ipv4_to_int = ipv4_to_int
+
+-- Precompile a CIDR / bare-IP string into a cheap match descriptor.
+local function compile_cidr(s)
+    local base, bits = string.match(s, "^([^/]+)/(%d+)$")
+    if base then
+        bits = tonumber(bits)
+        local basei = ipv4_to_int(base)
+        if not basei or bits < 0 or bits > 32 then return { exact = s } end
+        if bits == 0 then return { all = true } end
+        local div = 2 ^ (32 - bits) -- compare the top `bits` bits
+        return { net = math.floor(basei / div), div = div }
+    end
+    local i = ipv4_to_int(s)
+    if i then return { ip = i } end
+    return { exact = s } -- IPv6 / unparseable → literal string compare
+end
+
+local function compile_list(list)
+    if type(list) ~= "table" then return nil end
+    local out, n = {}, 0
+    for _, s in ipairs(list) do
+        if type(s) == "string" and s ~= "" then
+            n = n + 1
+            out[n] = compile_cidr(s)
+        end
+    end
+    return n > 0 and out or nil
+end
+
+-- Match a client (int form `ipi`, may be nil for non-IPv4; raw `ips`) against a
+-- compiled CIDR/IP list.
+local function match_compiled(compiled, ipi, ips)
+    if not compiled then return false end
+    for i = 1, #compiled do
+        local c = compiled[i]
+        if c.all then
+            return true
+        elseif c.ip then
+            if ipi and ipi == c.ip then return true end
+        elseif c.net then
+            if ipi and math.floor(ipi / c.div) == c.net then return true end
+        elseif c.exact == ips then
+            return true
+        end
+    end
+    return false
+end
+M.match_compiled = match_compiled
+
+local function lower_list(list)
+    if type(list) ~= "table" then return nil end
+    local out, n = {}, 0
+    for _, s in ipairs(list) do
+        if type(s) == "string" and s ~= "" then
+            n = n + 1
+            out[n] = string.lower(s)
+        end
+    end
+    return n > 0 and out or nil
+end
+
+-- Build an O(1) lookup set from a string list (optionally lowercased).
+local function to_set(list, lower)
+    if type(list) ~= "table" then return nil end
+    local set, any = {}, false
+    for _, s in ipairs(list) do
+        if type(s) == "string" and s ~= "" then
+            set[lower and string.lower(s) or s] = true
+            any = true
+        end
+    end
+    return any and set or nil
+end
+
+-- Compile one RouteRuleSpec into a fast-match shape.
+local function compile_spec(spec)
+    if type(spec) ~= "table" then return { blockStatus = 403 } end
+    local out = {}
+
+    local rl = spec.rateLimit
+    local rps = rl and tonumber(rl.rps)
+    if rps and rps > 0 then
+        out.rl = {
+            limit = math.floor(rps) + math.floor(tonumber(rl.burst) or 0),
+            status = tonumber(rl.status) or 429,
+        }
+    end
+
+    local ban = spec.ban
+    if type(ban) == "table" then
+        out.ban = {
+            ips = compile_list(ban.ips),
+            cidrs = compile_list(ban.cidrs),
+            countries = to_set(ban.countries),
+            uas = lower_list(ban.userAgents),
+            emptyUA = ban.emptyUserAgent == true,
+        }
+    end
+
+    local acc = spec.access
+    if type(acc) == "table" then
+        out.access = {
+            allow = compile_list(acc.allowCidrs),
+            deny = compile_list(acc.denyCidrs),
+            allowCountries = to_set(acc.allowCountries),
+            methods = to_set(acc.methods),
+        }
+    end
+
+    local hot = spec.hotlink
+    if type(hot) == "table" then
+        local refs = to_set(hot.allowReferers, true)
+        if refs then
+            out.hotlink = { referers = refs, allowEmpty = hot.allowEmpty ~= false }
+        end
+    end
+
+    out.blockStatus = (type(spec.block) == "table" and tonumber(spec.block.status)) or 403
+    return out
+end
+
+local function parse(raw)
+    local entries = cjson.decode(raw)
+    if type(entries) ~= "table" then return {} end
+    local out, n = {}, 0
+    for _, e in ipairs(entries) do
+        if type(e) == "table" then
+            n = n + 1
+            out[n] = { pathPrefix = e.pathPrefix, spec = compile_spec(e.spec) }
+        end
+    end
+    return out
+end
+
+-- LRU-cached parse: reuse the compiled form until the raw dict string changes.
+function M.get(host, raw)
+    local hit = cache:get(host)
+    if hit and hit.raw == raw then return hit.parsed end
+    local parsed = parse(raw)
+    cache:set(host, { raw = raw, parsed = parsed })
+    return parsed
+end
+
+return M