feat: add backend resource fetch api

2026-07-08 20:18:38 +09:00
parent 1a2097b10d
commit 57e96d3be8
16 changed files with 859 additions and 41 deletions
@@ -0,0 +1,231 @@
+use async_trait::async_trait;
+use chrono::{Duration, Utc};
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use uuid::Uuid;
+use worker_runtime::identity::{RuntimeId, WorkerId};
+use worker_runtime::profile_archive::ProfileSourceArchive;
+use worker_runtime::resource::{
+    BackendResourceClient, BackendResourceError, BackendResourceFetchRequest,
+    BackendResourceFetchResponse, BackendResourceHandle, BackendResourceKind,
+    BackendResourceOperation, DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES,
+    PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE, ResourceRedactionPolicy,
+};
+
+#[derive(Clone, Default)]
+pub struct BackendResourceBroker {
+    resources: Arc<Mutex<HashMap<String, StoredResource>>>,
+}
+
+#[derive(Clone)]
+struct StoredResource {
+    workspace_id: String,
+    runtime_id: Option<String>,
+    worker_id: Option<String>,
+    handle: BackendResourceHandle,
+    archive: ProfileSourceArchive,
+}
+
+impl BackendResourceBroker {
+    pub fn issue_profile_source_archive_handle(
+        &self,
+        workspace_id: impl Into<String>,
+        runtime_id: Option<&RuntimeId>,
+        worker_id: Option<&WorkerId>,
+        archive: ProfileSourceArchive,
+    ) -> BackendResourceHandle {
+        let workspace_id = workspace_id.into();
+        let nonce = Uuid::now_v7().to_string();
+        let audit_correlation_id = format!("resource-fetch-{nonce}");
+        let expires_at = Utc::now() + Duration::minutes(15);
+        let handle = BackendResourceHandle {
+            kind: BackendResourceKind::ProfileSourceArchive,
+            workspace_id: workspace_id.clone(),
+            scope_id: Some("workspace-profile-source".to_string()),
+            runtime_id: runtime_id.map(|id| id.as_str().to_string()),
+            worker_id: worker_id.map(|id| id.as_str().to_string()),
+            resource_id: archive.reference.id.clone(),
+            digest: archive.reference.digest.clone(),
+            operation: BackendResourceOperation::FetchArchive,
+            expires_at_unix_seconds: expires_at.timestamp(),
+            nonce: nonce.clone(),
+            revision: archive.reference.digest.clone(),
+            generation: None,
+            max_bytes: DEFAULT_PROFILE_SOURCE_ARCHIVE_MAX_BYTES,
+            content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
+            redaction: ResourceRedactionPolicy::RuntimeInternalOnly,
+            audit_correlation_id,
+            profile_source_graph: Some(archive.reference.source_graph.clone()),
+        };
+        let stored = StoredResource {
+            workspace_id,
+            runtime_id: runtime_id.map(|id| id.as_str().to_string()),
+            worker_id: worker_id.map(|id| id.as_str().to_string()),
+            handle: handle.clone(),
+            archive,
+        };
+        if let Ok(mut resources) = self.resources.lock() {
+            resources.insert(nonce, stored);
+        }
+        handle
+    }
+
+    pub fn fetch_profile_source_archive(
+        &self,
+        request: BackendResourceFetchRequest,
+    ) -> Result<BackendResourceFetchResponse, BackendResourceError> {
+        verify_handle_shape(&request.handle)?;
+        if request.handle.expires_at_unix_seconds < Utc::now().timestamp() {
+            return Err(BackendResourceError::Expired);
+        }
+        let stored = self
+            .resources
+            .lock()
+            .map_err(|_| BackendResourceError::Transport {
+                message: "resource broker lock poisoned".to_string(),
+            })?
+            .get(&request.handle.nonce)
+            .cloned()
+            .ok_or(BackendResourceError::MissingResource)?;
+        if stored.workspace_id != request.handle.workspace_id
+            || stored.runtime_id != request.handle.runtime_id
+            || stored.worker_id != request.handle.worker_id
+            || stored.handle.resource_id != request.handle.resource_id
+            || stored.handle.digest != request.handle.digest
+            || stored.handle.revision != request.handle.revision
+        {
+            return Err(BackendResourceError::Unauthorized {
+                message: "resource handle metadata does not match broker record".to_string(),
+            });
+        }
+        if let Some(expected_runtime_id) = stored.runtime_id.as_deref() {
+            if expected_runtime_id != request.runtime_id {
+                return Err(BackendResourceError::Unauthorized {
+                    message: "runtime id does not match resource handle".to_string(),
+                });
+            }
+        }
+        if let Some(expected_worker_id) = stored.worker_id.as_deref() {
+            if Some(expected_worker_id) != request.worker_id.as_deref() {
+                return Err(BackendResourceError::Unauthorized {
+                    message: "worker id does not match resource handle".to_string(),
+                });
+            }
+        }
+        let actual_bytes = stored.archive.content.len() as u64;
+        if actual_bytes > request.handle.max_bytes {
+            return Err(BackendResourceError::Oversized {
+                max_bytes: request.handle.max_bytes,
+                actual_bytes,
+            });
+        }
+        Ok(BackendResourceFetchResponse {
+            kind: BackendResourceKind::ProfileSourceArchive,
+            resource_id: stored.archive.reference.id,
+            digest: stored.archive.reference.digest,
+            content_type: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
+            bytes: stored.archive.content,
+            audit_correlation_id: request.audit_correlation_id,
+        })
+    }
+}
+
+#[async_trait]
+impl BackendResourceClient for BackendResourceBroker {
+    async fn fetch_resource(
+        &self,
+        request: BackendResourceFetchRequest,
+    ) -> Result<BackendResourceFetchResponse, BackendResourceError> {
+        self.fetch_profile_source_archive(request)
+    }
+}
+
+fn verify_handle_shape(handle: &BackendResourceHandle) -> Result<(), BackendResourceError> {
+    if handle.kind != BackendResourceKind::ProfileSourceArchive {
+        return Err(BackendResourceError::UnsupportedKind);
+    }
+    if handle.operation != BackendResourceOperation::FetchArchive {
+        return Err(BackendResourceError::Unauthorized {
+            message: "resource handle operation is not fetch_archive".to_string(),
+        });
+    }
+    if handle.content_type != PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE {
+        return Err(BackendResourceError::ContentTypeMismatch {
+            expected: PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE.to_string(),
+            actual: handle.content_type.clone(),
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::BTreeMap;
+    use worker_runtime::identity::RuntimeId;
+    use worker_runtime::profile_archive::{
+        ProfileSourceArchive, ProfileSourceArchiveRef, ProfileSourceGraphSummary, sha256_hex,
+    };
+
+    fn archive() -> ProfileSourceArchive {
+        let content = b"archive-content".to_vec();
+        let mut entrypoints = BTreeMap::new();
+        entrypoints.insert("default".to_string(), "profiles/default.dcdl".to_string());
+        ProfileSourceArchive {
+            reference: ProfileSourceArchiveRef {
+                id: "profile-source-archive:test".to_string(),
+                digest: sha256_hex(&content),
+                size_bytes: content.len() as u64,
+                source_graph: ProfileSourceGraphSummary {
+                    entrypoints,
+                    source_count: 1,
+                    import_count: 0,
+                    total_source_bytes: content.len() as u64,
+                },
+            },
+            content,
+        }
+    }
+
+    #[test]
+    fn broker_issues_and_verifies_profile_source_archive_handles() {
+        let broker = BackendResourceBroker::default();
+        let runtime_id = RuntimeId::new("runtime-test").unwrap();
+        let handle = broker.issue_profile_source_archive_handle(
+            "workspace-test",
+            Some(&runtime_id),
+            None,
+            archive(),
+        );
+        let response = broker
+            .fetch_profile_source_archive(BackendResourceFetchRequest {
+                handle: handle.clone(),
+                runtime_id: runtime_id.as_str().to_string(),
+                worker_id: None,
+                audit_correlation_id: handle.audit_correlation_id.clone(),
+            })
+            .expect("fetch succeeds");
+        assert_eq!(response.digest, handle.digest);
+        assert_eq!(response.content_type, PROFILE_SOURCE_ARCHIVE_CONTENT_TYPE);
+    }
+
+    #[test]
+    fn broker_rejects_runtime_mismatch() {
+        let broker = BackendResourceBroker::default();
+        let handle = broker.issue_profile_source_archive_handle(
+            "workspace-test",
+            Some(&RuntimeId::new("runtime-a").unwrap()),
+            None,
+            archive(),
+        );
+        let err = broker
+            .fetch_profile_source_archive(BackendResourceFetchRequest {
+                handle: handle.clone(),
+                runtime_id: RuntimeId::new("runtime-b").unwrap().as_str().to_string(),
+                worker_id: None,
+                audit_correlation_id: handle.audit_correlation_id.clone(),
+            })
+            .unwrap_err();
+        assert!(matches!(err, BackendResourceError::Unauthorized { .. }));
+    }
+}