arachne::pheidippides::hardened_transport::implementation Struct Reference

Collaboration diagram for arachne::pheidippides::hardened_transport::implementation:

Public Member Functions
	implementation (fs::path artifact_root, const json &configuration)
acquired_artifact_v1	execute (const fetch_request_v1 &original) const
void	complete_flight (const std::string &cache_key, const std::shared_ptr< flight_state > &flight, const acquired_artifact_v1 &result) const
	implementation (fs::path artifact_root, const json &configuration)
acquired_artifact_v1	execute (const fetch_request_v1 &original) const
void	complete_flight (const std::string &cache_key, const std::shared_ptr< flight_state > &flight, const acquired_artifact_v1 &result) const

Public Attributes
fs::path	artifact_root
fs::path	cache_root
transport	byte_transport
std::map< std::string, door_configuration, std::less<> >	doors
std::mutex	flights_mutex
std::map< std::string, std::shared_ptr< flight_state >, std::less<> >	flights

Detailed Description

Definition at line 943 of file hardened_transport.cpp.

Constructor & Destructor Documentation

implementation() [1/2]

arachne::pheidippides::hardened_transport::implementation::implementation ( fs::path artifact_root, const json & configuration )

inline

Definition at line 944 of file hardened_transport.cpp.

        : artifact_root(std::move(artifact_root))
        , byte_transport(this->artifact_root) {
        constexpr std::array root_fields {
            std::string_view { "format_version" },
            std::string_view { "defaults" },
            std::string_view { "doors" },
        };
        reject_unknown_keys(configuration, root_fields, "transport");
        if (configuration.value("format_version", 0) != 1) {
            throw std::invalid_argument("transport.format_version must be 1");
        }
        policy_settings global_policy;
        apply_settings(
            global_policy,
            required_object(configuration, "defaults", "transport"),
            "transport.defaults"
        );
        const auto door_documents = configuration.find("doors");
        if (door_documents == configuration.end() || !door_documents->is_array()
            || door_documents->empty()) {
            throw std::invalid_argument(
                "transport.doors must be a non-empty array"
            );
        }
        for (std::size_t door_index = 0; door_index < door_documents->size();
             ++door_index) {
            const json& document = door_documents->at(door_index);
            const std::string location
                = "transport.doors[" + std::to_string(door_index) + "]";
            constexpr std::array door_fields {
                std::string_view { "door_id" },
                std::string_view { "defaults" },
                std::string_view { "endpoints" },
            };
            reject_unknown_keys(document, door_fields, location);
            door_configuration door;
            door.door_id = required_string(document, "door_id", location);
            if (!safe_token(door.door_id) || doors.contains(door.door_id)) {
                throw std::invalid_argument(
                    location + ".door_id is invalid or duplicated"
                );
            }
            door.policy = global_policy;
            if (const auto defaults = document.find("defaults");
                defaults != document.end()) {
                apply_settings(door.policy, *defaults, location + ".defaults");
            }
            door.admission
                = std::make_shared<admission_gate>(door.policy.admission);
            const auto endpoint_documents = document.find("endpoints");
            if (endpoint_documents == document.end()
                || !endpoint_documents->is_array()
                || endpoint_documents->empty()) {
                throw std::invalid_argument(
                    location + ".endpoints must be a non-empty array"
                );
            }
            for (std::size_t endpoint_index = 0;
                 endpoint_index < endpoint_documents->size();
                 ++endpoint_index) {
                const json& endpoint_document
                    = endpoint_documents->at(endpoint_index);
                const std::string endpoint_location = location + ".endpoints["
                    + std::to_string(endpoint_index) + "]";
                constexpr std::array endpoint_fields {
                    std::string_view { "endpoint_id" },
                    std::string_view { "protocol" },
                    std::string_view { "base_url" },
                    std::string_view { "allowed_methods" },
                    std::string_view { "authentication" },
                    std::string_view { "bulk_capable" },
                    std::string_view { "resumable_download" },
                    std::string_view { "write_enabled" },
                    std::string_view { "idempotency_header" },
                    std::string_view { "allow_insecure_http" },
                    std::string_view { "policy" },
                };
                reject_unknown_keys(
                    endpoint_document, endpoint_fields, endpoint_location
                );
                endpoint_configuration endpoint;
                endpoint.endpoint_id = required_string(
                    endpoint_document, "endpoint_id", endpoint_location
                );
                if (!safe_token(endpoint.endpoint_id)
                    || door.endpoints.contains(endpoint.endpoint_id)) {
                    throw std::invalid_argument(
                        endpoint_location
                        + ".endpoint_id is invalid or duplicated"
                    );
                }
                endpoint.protocol = required_string(
                    endpoint_document, "protocol", endpoint_location
                );
                constexpr std::array protocols {
                    std::string_view { "http_file" },
                    std::string_view { "rest" },
                    std::string_view { "sparql" },
                    std::string_view { "oai_pmh" },
                    std::string_view { "ldes" },
                    std::string_view { "iiif" },
                };
                if (std::ranges::find(protocols, endpoint.protocol)
                    == protocols.end()) {
                    throw std::invalid_argument(
                        endpoint_location + ".protocol is unsupported"
                    );
                }
                endpoint.base_url = parse_absolute_url(
                    required_string(
                        endpoint_document, "base_url", endpoint_location
                    ),
                    endpoint_location + ".base_url"
                );
                endpoint.allow_insecure_http = optional_boolean(
                    endpoint_document, "allow_insecure_http", false,
                    endpoint_location
                );
                if (endpoint.base_url.scheme != "https"
                    && !endpoint.allow_insecure_http) {
                    throw std::invalid_argument(
                        endpoint_location
                        + " uses HTTP without explicit test/development "
                          "permission"
                    );
                }
                const auto methods = endpoint_document.find("allowed_methods");
                if (methods == endpoint_document.end() || !methods->is_array()
                    || methods->empty()) {
                    throw std::invalid_argument(
                        endpoint_location
                        + ".allowed_methods must be a non-empty array"
                    );
                }
                for (const auto& method : *methods) {
                    if (!method.is_string()) {
                        throw std::invalid_argument(
                            endpoint_location
                            + ".allowed_methods contains a non-string"
                        );
                    }
                    const std::string value = method.get<std::string>();
                    if (value == "GET") {
                        endpoint.allowed_methods.insert(http_method::get);
                    } else if (value == "POST") {
                        endpoint.allowed_methods.insert(http_method::post);
                    } else {
                        throw std::invalid_argument(
                            endpoint_location
                            + ".allowed_methods contains an unsupported method"
                        );
                    }
                }
                endpoint.authentication = parse_authentication(
                    required_object(
                        endpoint_document, "authentication", endpoint_location
                    ),
                    endpoint_location + ".authentication"
                );
                endpoint.bulk_capable = optional_boolean(
                    endpoint_document, "bulk_capable", false, endpoint_location
                );
                endpoint.resumable_download = optional_boolean(
                    endpoint_document, "resumable_download", false,
                    endpoint_location
                );
                endpoint.write_enabled = optional_boolean(
                    endpoint_document, "write_enabled", false, endpoint_location
                );
                if (endpoint_document.contains("idempotency_header")) {
                    endpoint.idempotency_header = required_string(
                        endpoint_document, "idempotency_header",
                        endpoint_location
                    );
                    const std::string lowered
                        = ascii_lower(endpoint.idempotency_header);
                    if (!endpoint.write_enabled || lowered == "host"
                        || sensitive_header(endpoint.idempotency_header)
                        || !safe_http_header_name(
                            endpoint.idempotency_header
                        )) {
                        throw std::invalid_argument(
                            endpoint_location
                            + ".idempotency_header is unsafe or declared for a "
                              "read-only endpoint"
                        );
                    }
                }
                endpoint.policy = door.policy;
                if (const auto overrides = endpoint_document.find("policy");
                    overrides != endpoint_document.end()) {
                    apply_settings(
                        endpoint.policy, *overrides,
                        endpoint_location + ".policy"
                    );
                }
                if (endpoint.policy.redirects.allowed_hosts.empty()) {
                    endpoint.policy.redirects.allowed_hosts
                        = { configured_authority(endpoint.base_url) };
                }
                endpoint.admission = std::make_shared<admission_gate>(
                    endpoint.policy.admission
                );
                door.endpoints.emplace(
                    endpoint.endpoint_id, std::move(endpoint)
                );
            }
            doors.emplace(door.door_id, std::move(door));
        }
 
        std::error_code error;
        const auto root_state = fs::symlink_status(this->artifact_root, error);
        if (error == std::errc::no_such_file_or_directory) {
            error.clear();
            fs::create_directories(this->artifact_root, error);
        } else if (
            !error
            && (fs::is_symlink(root_state) || !fs::is_directory(root_state))
        ) {
            throw std::invalid_argument(
                "artifact root must be a real directory"
            );
        }
        if (error) {
            throw std::invalid_argument(
                "cannot create artifact root: " + error.message()
            );
        }
        cache_root = this->artifact_root / ".pheidippides-cache";
        const auto cache_state = fs::symlink_status(cache_root, error);
        if (error == std::errc::no_such_file_or_directory) {
            error.clear();
            fs::create_directory(cache_root, error);
        } else if (
            !error
            && (fs::is_symlink(cache_state) || !fs::is_directory(cache_state))
        ) {
            throw std::invalid_argument(
                "transport cache root must be a real directory"
            );
        }
        if (error) {
            throw std::invalid_argument(
                "cannot create transport cache root: " + error.message()
            );
        }
    }

References arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::allow_insecure_http, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::ascii_lower(), arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::base_url, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::configured_authority(), arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::endpoint_id, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::idempotency_header, implementation(), and arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::parsed_url::scheme.

Referenced by implementation().

Here is the call graph for this function:

Here is the caller graph for this function:

implementation() [2/2]

arachne::pheidippides::hardened_transport::implementation::implementation ( fs::path artifact_root, const json & configuration )

inline

Definition at line 944 of file hardened_transport.cpp.

        : artifact_root(std::move(artifact_root))
        , byte_transport(this->artifact_root) {
        constexpr std::array root_fields {
            std::string_view { "format_version" },
            std::string_view { "defaults" },
            std::string_view { "doors" },
        };
        reject_unknown_keys(configuration, root_fields, "transport");
        if (configuration.value("format_version", 0) != 1) {
            throw std::invalid_argument("transport.format_version must be 1");
        }
        policy_settings global_policy;
        apply_settings(
            global_policy,
            required_object(configuration, "defaults", "transport"),
            "transport.defaults"
        );
        const auto door_documents = configuration.find("doors");
        if (door_documents == configuration.end() || !door_documents->is_array()
            || door_documents->empty()) {
            throw std::invalid_argument(
                "transport.doors must be a non-empty array"
            );
        }
        for (std::size_t door_index = 0; door_index < door_documents->size();
             ++door_index) {
            const json& document = door_documents->at(door_index);
            const std::string location
                = "transport.doors[" + std::to_string(door_index) + "]";
            constexpr std::array door_fields {
                std::string_view { "door_id" },
                std::string_view { "defaults" },
                std::string_view { "endpoints" },
            };
            reject_unknown_keys(document, door_fields, location);
            door_configuration door;
            door.door_id = required_string(document, "door_id", location);
            if (!safe_token(door.door_id) || doors.contains(door.door_id)) {
                throw std::invalid_argument(
                    location + ".door_id is invalid or duplicated"
                );
            }
            door.policy = global_policy;
            if (const auto defaults = document.find("defaults");
                defaults != document.end()) {
                apply_settings(door.policy, *defaults, location + ".defaults");
            }
            door.admission
                = std::make_shared<admission_gate>(door.policy.admission);
            const auto endpoint_documents = document.find("endpoints");
            if (endpoint_documents == document.end()
                || !endpoint_documents->is_array()
                || endpoint_documents->empty()) {
                throw std::invalid_argument(
                    location + ".endpoints must be a non-empty array"
                );
            }
            for (std::size_t endpoint_index = 0;
                 endpoint_index < endpoint_documents->size();
                 ++endpoint_index) {
                const json& endpoint_document
                    = endpoint_documents->at(endpoint_index);
                const std::string endpoint_location = location + ".endpoints["
                    + std::to_string(endpoint_index) + "]";
                constexpr std::array endpoint_fields {
                    std::string_view { "endpoint_id" },
                    std::string_view { "protocol" },
                    std::string_view { "base_url" },
                    std::string_view { "allowed_methods" },
                    std::string_view { "authentication" },
                    std::string_view { "bulk_capable" },
                    std::string_view { "resumable_download" },
                    std::string_view { "write_enabled" },
                    std::string_view { "idempotency_header" },
                    std::string_view { "allow_insecure_http" },
                    std::string_view { "policy" },
                };
                reject_unknown_keys(
                    endpoint_document, endpoint_fields, endpoint_location
                );
                endpoint_configuration endpoint;
                endpoint.endpoint_id = required_string(
                    endpoint_document, "endpoint_id", endpoint_location
                );
                if (!safe_token(endpoint.endpoint_id)
                    || door.endpoints.contains(endpoint.endpoint_id)) {
                    throw std::invalid_argument(
                        endpoint_location
                        + ".endpoint_id is invalid or duplicated"
                    );
                }
                endpoint.protocol = required_string(
                    endpoint_document, "protocol", endpoint_location
                );
                constexpr std::array protocols {
                    std::string_view { "http_file" },
                    std::string_view { "rest" },
                    std::string_view { "sparql" },
                    std::string_view { "oai_pmh" },
                    std::string_view { "ldes" },
                    std::string_view { "iiif" },
                };
                if (std::ranges::find(protocols, endpoint.protocol)
                    == protocols.end()) {
                    throw std::invalid_argument(
                        endpoint_location + ".protocol is unsupported"
                    );
                }
                endpoint.base_url = parse_absolute_url(
                    required_string(
                        endpoint_document, "base_url", endpoint_location
                    ),
                    endpoint_location + ".base_url"
                );
                endpoint.allow_insecure_http = optional_boolean(
                    endpoint_document, "allow_insecure_http", false,
                    endpoint_location
                );
                if (endpoint.base_url.scheme != "https"
                    && !endpoint.allow_insecure_http) {
                    throw std::invalid_argument(
                        endpoint_location
                        + " uses HTTP without explicit test/development "
                          "permission"
                    );
                }
                const auto methods = endpoint_document.find("allowed_methods");
                if (methods == endpoint_document.end() || !methods->is_array()
                    || methods->empty()) {
                    throw std::invalid_argument(
                        endpoint_location
                        + ".allowed_methods must be a non-empty array"
                    );
                }
                for (const auto& method : *methods) {
                    if (!method.is_string()) {
                        throw std::invalid_argument(
                            endpoint_location
                            + ".allowed_methods contains a non-string"
                        );
                    }
                    const std::string value = method.get<std::string>();
                    if (value == "GET") {
                        endpoint.allowed_methods.insert(http_method::get);
                    } else if (value == "POST") {
                        endpoint.allowed_methods.insert(http_method::post);
                    } else {
                        throw std::invalid_argument(
                            endpoint_location
                            + ".allowed_methods contains an unsupported method"
                        );
                    }
                }
                endpoint.authentication = parse_authentication(
                    required_object(
                        endpoint_document, "authentication", endpoint_location
                    ),
                    endpoint_location + ".authentication"
                );
                endpoint.bulk_capable = optional_boolean(
                    endpoint_document, "bulk_capable", false, endpoint_location
                );
                endpoint.resumable_download = optional_boolean(
                    endpoint_document, "resumable_download", false,
                    endpoint_location
                );
                endpoint.write_enabled = optional_boolean(
                    endpoint_document, "write_enabled", false, endpoint_location
                );
                if (endpoint_document.contains("idempotency_header")) {
                    endpoint.idempotency_header = required_string(
                        endpoint_document, "idempotency_header",
                        endpoint_location
                    );
                    const std::string lowered
                        = ascii_lower(endpoint.idempotency_header);
                    if (!endpoint.write_enabled || lowered == "host"
                        || sensitive_header(endpoint.idempotency_header)
                        || !safe_http_header_name(
                            endpoint.idempotency_header
                        )) {
                        throw std::invalid_argument(
                            endpoint_location
                            + ".idempotency_header is unsafe or declared for a "
                              "read-only endpoint"
                        );
                    }
                }
                endpoint.policy = door.policy;
                if (const auto overrides = endpoint_document.find("policy");
                    overrides != endpoint_document.end()) {
                    apply_settings(
                        endpoint.policy, *overrides,
                        endpoint_location + ".policy"
                    );
                }
                if (endpoint.policy.redirects.allowed_hosts.empty()) {
                    endpoint.policy.redirects.allowed_hosts
                        = { configured_authority(endpoint.base_url) };
                }
                endpoint.admission = std::make_shared<admission_gate>(
                    endpoint.policy.admission
                );
                door.endpoints.emplace(
                    endpoint.endpoint_id, std::move(endpoint)
                );
            }
            doors.emplace(door.door_id, std::move(door));
        }
 
        std::error_code error;
        const auto root_state = fs::symlink_status(this->artifact_root, error);
        if (error == std::errc::no_such_file_or_directory) {
            error.clear();
            fs::create_directories(this->artifact_root, error);
        } else if (
            !error
            && (fs::is_symlink(root_state) || !fs::is_directory(root_state))
        ) {
            throw std::invalid_argument(
                "artifact root must be a real directory"
            );
        }
        if (error) {
            throw std::invalid_argument(
                "cannot create artifact root: " + error.message()
            );
        }
        cache_root = this->artifact_root / ".pheidippides-cache";
        const auto cache_state = fs::symlink_status(cache_root, error);
        if (error == std::errc::no_such_file_or_directory) {
            error.clear();
            fs::create_directory(cache_root, error);
        } else if (
            !error
            && (fs::is_symlink(cache_state) || !fs::is_directory(cache_state))
        ) {
            throw std::invalid_argument(
                "transport cache root must be a real directory"
            );
        }
        if (error) {
            throw std::invalid_argument(
                "cannot create transport cache root: " + error.message()
            );
        }
    }

Member Function Documentation

complete_flight() [1/2]

void arachne::pheidippides::hardened_transport::implementation::complete_flight ( const std::string & cache_key, const std::shared_ptr< flight_state > & flight, const acquired_artifact_v1 & result ) const

inline

Definition at line 1452 of file hardened_transport.cpp.

            {
        if (!flight) {
            return;
        }
        {
            std::lock_guard lock(flights_mutex);
            flight->result = result;
            flight->complete = true;
            flights.erase(cache_key);
        }
        flight->condition.notify_all();
    }

Referenced by execute().

Here is the caller graph for this function:

complete_flight() [2/2]

void arachne::pheidippides::hardened_transport::implementation::complete_flight ( const std::string & cache_key, const std::shared_ptr< flight_state > & flight, const acquired_artifact_v1 & result ) const

inline

Definition at line 1452 of file hardened_transport.cpp.

            {
        if (!flight) {
            return;
        }
        {
            std::lock_guard lock(flights_mutex);
            flight->result = result;
            flight->complete = true;
            flights.erase(cache_key);
        }
        flight->condition.notify_all();
    }

execute() [1/2]

acquired_artifact_v1 arachne::pheidippides::hardened_transport::implementation::execute ( const fetch_request_v1 & original ) const

inlinenodiscard

Definition at line 1194 of file hardened_transport.cpp.

                                                    {
        if (original.target_artifact_ref == ".pheidippides-cache"
            || original.target_artifact_ref.starts_with(
                ".pheidippides-cache/"
            )) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request output_ref targets reserved transport metadata"
            );
        }
        const auto door_iterator = doors.find(original.door_id);
        if (door_iterator == doors.end()) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request names an unknown door_id"
            );
        }
        const door_configuration& door = door_iterator->second;
        const auto endpoint_iterator
            = door.endpoints.find(original.endpoint_id);
        if (endpoint_iterator == door.endpoints.end()) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request names an unknown endpoint_id for its door"
            );
        }
        const endpoint_configuration& endpoint = endpoint_iterator->second;
        if (!endpoint.allowed_methods.contains(original.method)) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request method is disabled for this endpoint"
            );
        }
        if (original.operation == transport_operation::bulk_snapshot
            && !endpoint.bulk_capable) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "endpoint is not declared bulk-capable"
            );
        }
        if (original.operation == transport_operation::resume_download
            && !endpoint.resumable_download) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "endpoint is not declared resumable"
            );
        }
        if (original.operation == transport_operation::external_write
            && !endpoint.write_enabled) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "external writes are disabled for this endpoint"
            );
        }
        if (original.operation == transport_operation::external_write
            && !original.idempotency_key.empty()
            && !safe_header_value(original.idempotency_key, 512U)) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "the external-write idempotency key is not a safe header value"
            );
        }
        parsed_url request_url;
        try {
            request_url = parse_absolute_url(original.url, "request locator");
        } catch (const std::exception& error) {
            return policy_failure(
                original, transport_status::door_policy_rejected, error.what()
            );
        }
        if (!within_base_url(request_url, endpoint.base_url)) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request locator is outside the endpoint base URL"
            );
        }
        for (const auto& header : original.headers) {
            if (sensitive_header(header.name)) {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "sensitive request headers must come from a runtime secret "
                    "reference"
                );
            }
            if (original.operation == transport_operation::external_write
                && !endpoint.idempotency_header.empty()
                && ascii_lower(header.name)
                    == ascii_lower(endpoint.idempotency_header)) {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "the configured idempotency header is managed by the "
                    "transport"
                );
            }
        }
 
        fetch_request_v1 request = original;
        request.timeout
            = std::min(request.timeout, endpoint.policy.timeouts.total);
        request.connect_timeout = std::min(
            request.connect_timeout, endpoint.policy.timeouts.connect
        );
        request.read_timeout
            = std::min(request.read_timeout, endpoint.policy.timeouts.read);
        request.write_timeout
            = std::min(request.write_timeout, endpoint.policy.timeouts.write);
        request.max_bytes = std::min(
            request.max_bytes, endpoint.policy.maximum_artifact_bytes
        );
        request.maximum_attempts = std::min(
            request.maximum_attempts, endpoint.policy.retry.maximum_attempts
        );
        request.initial_retry_delay = endpoint.policy.retry.initial_delay;
        request.maximum_retry_delay = endpoint.policy.retry.maximum_delay;
        request.total_retry_delay_budget
            = endpoint.policy.retry.total_delay_budget;
        request.respect_retry_after = endpoint.policy.retry.respect_retry_after;
        request.redirects.follow = endpoint.policy.redirects.follow;
        request.redirects.maximum_redirects
            = endpoint.policy.redirects.maximum_redirects;
        request.redirects.allow_https_to_http
            = endpoint.policy.redirects.allow_https_to_http;
        request.redirects.allowed_hosts
            = endpoint.policy.redirects.allowed_hosts;
        if (request.operation == transport_operation::external_write) {
            if (request.idempotency_key.empty()
                || endpoint.idempotency_header.empty()) {
                request.maximum_attempts = 1U;
            } else {
                request.headers.push_back(
                    { endpoint.idempotency_header, request.idempotency_key }
                );
            }
        }
 
        if (endpoint.authentication.mode != authentication_mode::none) {
            const char* raw
                = std::getenv(endpoint.authentication.secret_name.c_str());
            if (raw == nullptr || *raw == '\0') {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "required runtime secret is unavailable"
                );
            }
            if (!safe_header_value(raw, 16U * 1024U)) {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "required runtime secret is not a safe header value"
                );
            }
            const std::string value = endpoint.authentication.mode
                    == authentication_mode::bearer_environment
                ? "Bearer " + std::string(raw)
                : std::string(raw);
            request.headers.push_back(
                { endpoint.authentication.header_name, value }
            );
        }
 
        const bool cacheable
            = request.operation != transport_operation::external_write;
        const std::string cache_key
            = cacheable ? request_cache_key(request) : std::string {};
        const auto cached = cacheable
            ? read_cache_entry(artifact_root, cache_root, cache_key)
            : std::nullopt;
        if (cached) {
            const auto now
                = std::chrono::duration_cast<std::chrono::seconds>(
                      std::chrono::system_clock::now().time_since_epoch()
                )
                      .count();
            const bool fresh = now >= cached->stored_unix
                && now - cached->stored_unix
                    <= endpoint.policy.cache.ttl.count();
            if (request.freshness == freshness_policy::offline_only) {
                return cached_receipt(request, *cached, delivery_mode::offline);
            }
            if (request.freshness == freshness_policy::cache_allowed && fresh) {
                return cached_receipt(
                    request, *cached, delivery_mode::cache_validated
                );
            }
            if (request.freshness == freshness_policy::stale_allowed) {
                return cached_receipt(
                    request, *cached,
                    fresh ? delivery_mode::cache_validated
                          : delivery_mode::stale
                );
            }
        }
        if (request.freshness == freshness_policy::offline_only) {
            return policy_failure(
                request, transport_status::cache_miss,
                "offline_only request has no valid cached artifact"
            );
        }
 
        const auto admission_deadline
            = std::chrono::steady_clock::now() + endpoint.policy.timeouts.pool;
        std::shared_ptr<flight_state> flight;
        if (cacheable) {
            std::unique_lock lock(flights_mutex);
            if (const auto existing = flights.find(cache_key);
                existing != flights.end()) {
                flight = existing->second;
                if (!flight->condition.wait_until(
                        lock, admission_deadline,
                        [&] { return flight->complete; }
                    )) {
                    return policy_failure(
                        request, transport_status::admission_timeout,
                        "equivalent-read single-flight wait timed out"
                    );
                }
                acquired_artifact_v1 result = flight->result;
                result.artifact_id = "artifact-" + request.request_id;
                result.request_id = request.request_id;
                result.door_id = request.door_id;
                result.operation = request.operation;
                result.source_url = request.url;
                if (result.delivered()) {
                    result.delivered_via = delivery_mode::cache_validated;
                    result.attempts = 0U;
                }
                return result;
            }
            flight = std::make_shared<flight_state>();
            flights.emplace(cache_key, flight);
        }
        if (!door.admission->acquire(admission_deadline)) {
            acquired_artifact_v1 result = policy_failure(
                request, transport_status::admission_timeout,
                "door concurrency or pacing admission timed out"
            );
            complete_flight(cache_key, flight, result);
            return result;
        }
        admission_lease door_lease(door.admission);
        if (!endpoint.admission->acquire(admission_deadline)) {
            acquired_artifact_v1 result = policy_failure(
                request, transport_status::admission_timeout,
                "endpoint concurrency or pacing admission timed out"
            );
            complete_flight(cache_key, flight, result);
            return result;
        }
        admission_lease endpoint_lease(endpoint.admission);
 
        acquired_artifact_v1 result = byte_transport.execute(request);
        if (result.delivered() && cacheable && result.http_status >= 200
            && result.http_status < 300) {
            write_cache_entry(cache_root, cache_key, result);
        }
        complete_flight(cache_key, flight, result);
        return result;
    }

References arachne::pheidippides::admission_timeout, arachne::pheidippides::acquired_artifact_v1::artifact_id, arachne::pheidippides::acquired_artifact_v1::attempts, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::authentication, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::base_url, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::bearer_environment, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::bulk_capable, arachne::pheidippides::bulk_snapshot, arachne::pheidippides::cache_allowed, arachne::pheidippides::cache_miss, arachne::pheidippides::cache_validated, complete_flight(), arachne::pheidippides::acquired_artifact_v1::delivered(), arachne::pheidippides::acquired_artifact_v1::delivered_via, arachne::pheidippides::acquired_artifact_v1::door_id, arachne::pheidippides::fetch_request_v1::door_id, arachne::pheidippides::door_policy_rejected, arachne::pheidippides::fetch_request_v1::endpoint_id, arachne::pheidippides::external_write, arachne::pheidippides::fetch_request_v1::freshness, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::authentication_settings::header_name, arachne::pheidippides::acquired_artifact_v1::http_status, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::idempotency_header, arachne::pheidippides::fetch_request_v1::idempotency_key, arachne::pheidippides::fetch_request_v1::max_bytes, arachne::pheidippides::fetch_request_v1::maximum_attempts, arachne::pheidippides::fetch_request_v1::method, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::authentication_settings::mode, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::none, arachne::pheidippides::offline, arachne::pheidippides::offline_only, arachne::pheidippides::acquired_artifact_v1::operation, arachne::pheidippides::fetch_request_v1::operation, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::request_cache_key(), arachne::pheidippides::acquired_artifact_v1::request_id, arachne::pheidippides::fetch_request_v1::request_id, arachne::pheidippides::fetch_request_v1::respect_retry_after, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::resumable_download, arachne::pheidippides::resume_download, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::authentication_settings::secret_name, arachne::pheidippides::acquired_artifact_v1::source_url, arachne::pheidippides::stale, arachne::pheidippides::stale_allowed, arachne::pheidippides::fetch_request_v1::target_artifact_ref, arachne::pheidippides::fetch_request_v1::url, arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::within_base_url(), and arachne::pheidippides::anonymous_namespace{hardened_transport.cpp}::endpoint_configuration::write_enabled.

Here is the call graph for this function:

execute() [2/2]

acquired_artifact_v1 arachne::pheidippides::hardened_transport::implementation::execute ( const fetch_request_v1 & original ) const

inlinenodiscard

Definition at line 1194 of file hardened_transport.cpp.

                                                    {
        if (original.target_artifact_ref == ".pheidippides-cache"
            || original.target_artifact_ref.starts_with(
                ".pheidippides-cache/"
            )) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request output_ref targets reserved transport metadata"
            );
        }
        const auto door_iterator = doors.find(original.door_id);
        if (door_iterator == doors.end()) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request names an unknown door_id"
            );
        }
        const door_configuration& door = door_iterator->second;
        const auto endpoint_iterator
            = door.endpoints.find(original.endpoint_id);
        if (endpoint_iterator == door.endpoints.end()) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request names an unknown endpoint_id for its door"
            );
        }
        const endpoint_configuration& endpoint = endpoint_iterator->second;
        if (!endpoint.allowed_methods.contains(original.method)) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request method is disabled for this endpoint"
            );
        }
        if (original.operation == transport_operation::bulk_snapshot
            && !endpoint.bulk_capable) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "endpoint is not declared bulk-capable"
            );
        }
        if (original.operation == transport_operation::resume_download
            && !endpoint.resumable_download) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "endpoint is not declared resumable"
            );
        }
        if (original.operation == transport_operation::external_write
            && !endpoint.write_enabled) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "external writes are disabled for this endpoint"
            );
        }
        if (original.operation == transport_operation::external_write
            && !original.idempotency_key.empty()
            && !safe_header_value(original.idempotency_key, 512U)) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "the external-write idempotency key is not a safe header value"
            );
        }
        parsed_url request_url;
        try {
            request_url = parse_absolute_url(original.url, "request locator");
        } catch (const std::exception& error) {
            return policy_failure(
                original, transport_status::door_policy_rejected, error.what()
            );
        }
        if (!within_base_url(request_url, endpoint.base_url)) {
            return policy_failure(
                original, transport_status::door_policy_rejected,
                "request locator is outside the endpoint base URL"
            );
        }
        for (const auto& header : original.headers) {
            if (sensitive_header(header.name)) {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "sensitive request headers must come from a runtime secret "
                    "reference"
                );
            }
            if (original.operation == transport_operation::external_write
                && !endpoint.idempotency_header.empty()
                && ascii_lower(header.name)
                    == ascii_lower(endpoint.idempotency_header)) {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "the configured idempotency header is managed by the "
                    "transport"
                );
            }
        }
 
        fetch_request_v1 request = original;
        request.timeout
            = std::min(request.timeout, endpoint.policy.timeouts.total);
        request.connect_timeout = std::min(
            request.connect_timeout, endpoint.policy.timeouts.connect
        );
        request.read_timeout
            = std::min(request.read_timeout, endpoint.policy.timeouts.read);
        request.write_timeout
            = std::min(request.write_timeout, endpoint.policy.timeouts.write);
        request.max_bytes = std::min(
            request.max_bytes, endpoint.policy.maximum_artifact_bytes
        );
        request.maximum_attempts = std::min(
            request.maximum_attempts, endpoint.policy.retry.maximum_attempts
        );
        request.initial_retry_delay = endpoint.policy.retry.initial_delay;
        request.maximum_retry_delay = endpoint.policy.retry.maximum_delay;
        request.total_retry_delay_budget
            = endpoint.policy.retry.total_delay_budget;
        request.respect_retry_after = endpoint.policy.retry.respect_retry_after;
        request.redirects.follow = endpoint.policy.redirects.follow;
        request.redirects.maximum_redirects
            = endpoint.policy.redirects.maximum_redirects;
        request.redirects.allow_https_to_http
            = endpoint.policy.redirects.allow_https_to_http;
        request.redirects.allowed_hosts
            = endpoint.policy.redirects.allowed_hosts;
        if (request.operation == transport_operation::external_write) {
            if (request.idempotency_key.empty()
                || endpoint.idempotency_header.empty()) {
                request.maximum_attempts = 1U;
            } else {
                request.headers.push_back(
                    { endpoint.idempotency_header, request.idempotency_key }
                );
            }
        }
 
        if (endpoint.authentication.mode != authentication_mode::none) {
            const char* raw
                = std::getenv(endpoint.authentication.secret_name.c_str());
            if (raw == nullptr || *raw == '\0') {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "required runtime secret is unavailable"
                );
            }
            if (!safe_header_value(raw, 16U * 1024U)) {
                return policy_failure(
                    original, transport_status::door_policy_rejected,
                    "required runtime secret is not a safe header value"
                );
            }
            const std::string value = endpoint.authentication.mode
                    == authentication_mode::bearer_environment
                ? "Bearer " + std::string(raw)
                : std::string(raw);
            request.headers.push_back(
                { endpoint.authentication.header_name, value }
            );
        }
 
        const bool cacheable
            = request.operation != transport_operation::external_write;
        const std::string cache_key
            = cacheable ? request_cache_key(request) : std::string {};
        const auto cached = cacheable
            ? read_cache_entry(artifact_root, cache_root, cache_key)
            : std::nullopt;
        if (cached) {
            const auto now
                = std::chrono::duration_cast<std::chrono::seconds>(
                      std::chrono::system_clock::now().time_since_epoch()
                )
                      .count();
            const bool fresh = now >= cached->stored_unix
                && now - cached->stored_unix
                    <= endpoint.policy.cache.ttl.count();
            if (request.freshness == freshness_policy::offline_only) {
                return cached_receipt(request, *cached, delivery_mode::offline);
            }
            if (request.freshness == freshness_policy::cache_allowed && fresh) {
                return cached_receipt(
                    request, *cached, delivery_mode::cache_validated
                );
            }
            if (request.freshness == freshness_policy::stale_allowed) {
                return cached_receipt(
                    request, *cached,
                    fresh ? delivery_mode::cache_validated
                          : delivery_mode::stale
                );
            }
        }
        if (request.freshness == freshness_policy::offline_only) {
            return policy_failure(
                request, transport_status::cache_miss,
                "offline_only request has no valid cached artifact"
            );
        }
 
        const auto admission_deadline
            = std::chrono::steady_clock::now() + endpoint.policy.timeouts.pool;
        std::shared_ptr<flight_state> flight;
        if (cacheable) {
            std::unique_lock lock(flights_mutex);
            if (const auto existing = flights.find(cache_key);
                existing != flights.end()) {
                flight = existing->second;
                if (!flight->condition.wait_until(
                        lock, admission_deadline,
                        [&] { return flight->complete; }
                    )) {
                    return policy_failure(
                        request, transport_status::admission_timeout,
                        "equivalent-read single-flight wait timed out"
                    );
                }
                acquired_artifact_v1 result = flight->result;
                result.artifact_id = "artifact-" + request.request_id;
                result.request_id = request.request_id;
                result.door_id = request.door_id;
                result.operation = request.operation;
                result.source_url = request.url;
                if (result.delivered()) {
                    result.delivered_via = delivery_mode::cache_validated;
                    result.attempts = 0U;
                }
                return result;
            }
            flight = std::make_shared<flight_state>();
            flights.emplace(cache_key, flight);
        }
        if (!door.admission->acquire(admission_deadline)) {
            acquired_artifact_v1 result = policy_failure(
                request, transport_status::admission_timeout,
                "door concurrency or pacing admission timed out"
            );
            complete_flight(cache_key, flight, result);
            return result;
        }
        admission_lease door_lease(door.admission);
        if (!endpoint.admission->acquire(admission_deadline)) {
            acquired_artifact_v1 result = policy_failure(
                request, transport_status::admission_timeout,
                "endpoint concurrency or pacing admission timed out"
            );
            complete_flight(cache_key, flight, result);
            return result;
        }
        admission_lease endpoint_lease(endpoint.admission);
 
        acquired_artifact_v1 result = byte_transport.execute(request);
        if (result.delivered() && cacheable && result.http_status >= 200
            && result.http_status < 300) {
            write_cache_entry(cache_root, cache_key, result);
        }
        complete_flight(cache_key, flight, result);
        return result;
    }

Member Data Documentation

artifact_root

fs::path arachne::pheidippides::hardened_transport::implementation::artifact_root

Definition at line 1469 of file hardened_transport.cpp.

byte_transport

transport arachne::pheidippides::hardened_transport::implementation::byte_transport

Definition at line 1471 of file hardened_transport.cpp.

cache_root

fs::path arachne::pheidippides::hardened_transport::implementation::cache_root

Definition at line 1470 of file hardened_transport.cpp.

doors

std::map< std::string, door_configuration, std::less<> > arachne::pheidippides::hardened_transport::implementation::doors

Definition at line 1472 of file hardened_transport.cpp.

flights

std::map< std::string, std::shared_ptr< flight_state >, std::less<> > arachne::pheidippides::hardened_transport::implementation::flights

mutable

Definition at line 1475 of file hardened_transport.cpp.

flights_mutex

std::mutex arachne::pheidippides::hardened_transport::implementation::flights_mutex

mutable

Definition at line 1473 of file hardened_transport.cpp.

---

The documentation for this struct was generated from the following file:

• hardened_transport.cpp