benvin
c32fe8bd76
Add the store package (pgx-backed repository) with CRUD for the core resources the compiler needs: fabrics, zones, address groups, portgroups, devices, bindings, rules, policies. Every mutation bumps a global config generation. Wire real JSON CRUD handlers with token auth, source/dest grammar validation on rule create, and the agent status-report endpoint. Migration 0001 verified against Postgres 17.
380 lines
11 KiB
Go
380 lines
11 KiB
Go
// Package store is the Postgres-backed repository for the fleet model. Every
|
|
// mutating method bumps the global config generation so agents can detect drift.
|
|
package store
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"git.unkin.net/unkin/tomswallapi/internal/model"
|
|
)
|
|
|
|
// ErrNotFound is returned when a lookup by key matches no row.
|
|
var ErrNotFound = errors.New("not found")
|
|
|
|
// Store provides CRUD over the fleet model.
|
|
type Store struct {
|
|
pool *pgxpool.Pool
|
|
}
|
|
|
|
// New constructs a Store over the given pool.
|
|
func New(pool *pgxpool.Pool) *Store { return &Store{pool: pool} }
|
|
|
|
// Generation returns the current global config generation.
|
|
func (s *Store) Generation(ctx context.Context) (int64, error) {
|
|
var g int64
|
|
err := s.pool.QueryRow(ctx, `SELECT current FROM generation WHERE id = true`).Scan(&g)
|
|
return g, err
|
|
}
|
|
|
|
// bump increments the generation within tx and returns the new value.
|
|
func bump(ctx context.Context, tx pgx.Tx) error {
|
|
_, err := tx.Exec(ctx, `UPDATE generation SET current = current + 1 WHERE id = true`)
|
|
return err
|
|
}
|
|
|
|
// jsonb marshals a value for a JSONB column, defaulting nil slices to "[]".
|
|
func jsonb(v any) ([]byte, error) {
|
|
if v == nil {
|
|
return []byte("[]"), nil
|
|
}
|
|
return json.Marshal(v)
|
|
}
|
|
|
|
// ---- Fabrics ---------------------------------------------------------------
|
|
|
|
func (s *Store) ListFabrics(ctx context.Context) ([]model.Fabric, error) {
|
|
rows, err := s.pool.Query(ctx, `SELECT name, enforce_on_routers, description FROM fabrics ORDER BY name`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []model.Fabric
|
|
for rows.Next() {
|
|
var f model.Fabric
|
|
if err := rows.Scan(&f.Name, &f.EnforceOnRouters, &f.Description); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, f)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
func (s *Store) GetFabric(ctx context.Context, name string) (model.Fabric, error) {
|
|
var f model.Fabric
|
|
err := s.pool.QueryRow(ctx,
|
|
`SELECT name, enforce_on_routers, description FROM fabrics WHERE name = $1`, name,
|
|
).Scan(&f.Name, &f.EnforceOnRouters, &f.Description)
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return f, ErrNotFound
|
|
}
|
|
return f, err
|
|
}
|
|
|
|
func (s *Store) UpsertFabric(ctx context.Context, f model.Fabric) error {
|
|
return pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
if _, err := tx.Exec(ctx, `
|
|
INSERT INTO fabrics (name, enforce_on_routers, description)
|
|
VALUES ($1, $2, $3)
|
|
ON CONFLICT (name) DO UPDATE SET
|
|
enforce_on_routers = EXCLUDED.enforce_on_routers,
|
|
description = EXCLUDED.description`,
|
|
f.Name, f.EnforceOnRouters, f.Description); err != nil {
|
|
return err
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
}
|
|
|
|
// ---- Zones -----------------------------------------------------------------
|
|
|
|
func (s *Store) ListZones(ctx context.Context) ([]model.Zone, error) {
|
|
rows, err := s.pool.Query(ctx, `SELECT name, type, subnets, COALESCE(parent, '') FROM zones ORDER BY name`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []model.Zone
|
|
for rows.Next() {
|
|
var z model.Zone
|
|
var subnets []byte
|
|
if err := rows.Scan(&z.Name, &z.Type, &subnets, &z.Parent); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(subnets, &z.Subnets); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, z)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
func (s *Store) GetZone(ctx context.Context, name string) (model.Zone, error) {
|
|
var z model.Zone
|
|
var subnets []byte
|
|
err := s.pool.QueryRow(ctx,
|
|
`SELECT name, type, subnets, COALESCE(parent, '') FROM zones WHERE name = $1`, name,
|
|
).Scan(&z.Name, &z.Type, &subnets, &z.Parent)
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return z, ErrNotFound
|
|
}
|
|
if err != nil {
|
|
return z, err
|
|
}
|
|
return z, json.Unmarshal(subnets, &z.Subnets)
|
|
}
|
|
|
|
func (s *Store) UpsertZone(ctx context.Context, z model.Zone) error {
|
|
subnets, err := jsonb(z.Subnets)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if z.Type == "" {
|
|
z.Type = "ip"
|
|
}
|
|
var parent any
|
|
if z.Parent != "" {
|
|
parent = z.Parent
|
|
}
|
|
return pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
if _, err := tx.Exec(ctx, `
|
|
INSERT INTO zones (name, type, subnets, parent)
|
|
VALUES ($1, $2, $3, $4)
|
|
ON CONFLICT (name) DO UPDATE SET
|
|
type = EXCLUDED.type, subnets = EXCLUDED.subnets, parent = EXCLUDED.parent`,
|
|
z.Name, z.Type, subnets, parent); err != nil {
|
|
return err
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
}
|
|
|
|
// ---- Address groups --------------------------------------------------------
|
|
|
|
func (s *Store) ListAddressGroups(ctx context.Context) ([]model.AddressGroup, error) {
|
|
rows, err := s.pool.Query(ctx,
|
|
`SELECT name, type, members, refresh, description FROM address_groups ORDER BY name`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []model.AddressGroup
|
|
for rows.Next() {
|
|
var g model.AddressGroup
|
|
var members []byte
|
|
if err := rows.Scan(&g.Name, &g.Type, &members, &g.Refresh, &g.Description); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(members, &g.Members); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, g)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
func (s *Store) UpsertAddressGroup(ctx context.Context, g model.AddressGroup) error {
|
|
members, err := jsonb(g.Members)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
if _, err := tx.Exec(ctx, `
|
|
INSERT INTO address_groups (name, type, members, refresh, description)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
ON CONFLICT (name) DO UPDATE SET
|
|
type = EXCLUDED.type, members = EXCLUDED.members,
|
|
refresh = EXCLUDED.refresh, description = EXCLUDED.description`,
|
|
g.Name, g.Type, members, g.Refresh, g.Description); err != nil {
|
|
return err
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
}
|
|
|
|
// ---- Devices ---------------------------------------------------------------
|
|
|
|
func (s *Store) ListDevices(ctx context.Context) ([]model.Device, error) {
|
|
rows, err := s.pool.Query(ctx,
|
|
`SELECT name, class, COALESCE(fabric, ''), resolver FROM devices ORDER BY name`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []model.Device
|
|
for rows.Next() {
|
|
var d model.Device
|
|
var resolver []byte
|
|
if err := rows.Scan(&d.Name, &d.Class, &d.Fabric, &resolver); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(resolver, &d.Resolver); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, d)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
func (s *Store) UpsertDevice(ctx context.Context, d model.Device) error {
|
|
resolver, err := jsonb(d.Resolver)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
settings, err := jsonb(d.Settings)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
var fabric any
|
|
if d.Fabric != "" {
|
|
fabric = d.Fabric
|
|
}
|
|
return pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
if _, err := tx.Exec(ctx, `
|
|
INSERT INTO devices (name, class, fabric, resolver, settings)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
ON CONFLICT (name) DO UPDATE SET
|
|
class = EXCLUDED.class, fabric = EXCLUDED.fabric,
|
|
resolver = EXCLUDED.resolver, settings = EXCLUDED.settings`,
|
|
d.Name, d.Class, fabric, resolver, settings); err != nil {
|
|
return err
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
}
|
|
|
|
// RecordDeviceStatus stores the generation an agent reports as applied.
|
|
func (s *Store) RecordDeviceStatus(ctx context.Context, name string, generation int64) error {
|
|
tag, err := s.pool.Exec(ctx,
|
|
`UPDATE devices SET reported_generation = $2, last_seen = now() WHERE name = $1`,
|
|
name, generation)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if tag.RowsAffected() == 0 {
|
|
return ErrNotFound
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ---- Bindings --------------------------------------------------------------
|
|
|
|
func (s *Store) ListBindings(ctx context.Context, device string) ([]model.Binding, error) {
|
|
rows, err := s.pool.Query(ctx,
|
|
`SELECT device, zone, interfaces FROM bindings WHERE device = $1 ORDER BY zone`, device)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []model.Binding
|
|
for rows.Next() {
|
|
var b model.Binding
|
|
var ifaces []byte
|
|
if err := rows.Scan(&b.Device, &b.Zone, &ifaces); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(ifaces, &b.Interfaces); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, b)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
func (s *Store) UpsertBinding(ctx context.Context, b model.Binding) error {
|
|
ifaces, err := jsonb(b.Interfaces)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
if _, err := tx.Exec(ctx, `
|
|
INSERT INTO bindings (device, zone, interfaces)
|
|
VALUES ($1, $2, $3)
|
|
ON CONFLICT (device, zone) DO UPDATE SET interfaces = EXCLUDED.interfaces`,
|
|
b.Device, b.Zone, ifaces); err != nil {
|
|
return err
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
}
|
|
|
|
// ---- Rules -----------------------------------------------------------------
|
|
|
|
func (s *Store) ListRules(ctx context.Context) ([]model.Rule, error) {
|
|
rows, err := s.pool.Query(ctx, `
|
|
SELECT id, priority, action, source, dest, proto, COALESCE(portgroup, ''), ports, log, comment
|
|
FROM rules ORDER BY priority, id`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
var out []model.Rule
|
|
for rows.Next() {
|
|
var r model.Rule
|
|
var source, dest, ports []byte
|
|
if err := rows.Scan(&r.ID, &r.Priority, &r.Action, &source, &dest,
|
|
&r.Proto, &r.PortGroup, &ports, &r.Log, &r.Comment); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(source, &r.Source); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(dest, &r.Dest); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(ports, &r.Ports); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, r)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// CreateRule inserts a rule after validating its source/dest grammar, returning
|
|
// the assigned id.
|
|
func (s *Store) CreateRule(ctx context.Context, r model.Rule) (int64, error) {
|
|
if _, err := model.ParseElements(r.Source); err != nil {
|
|
return 0, fmt.Errorf("source: %w", err)
|
|
}
|
|
if _, err := model.ParseElements(r.Dest); err != nil {
|
|
return 0, fmt.Errorf("dest: %w", err)
|
|
}
|
|
source, _ := jsonb(r.Source)
|
|
dest, _ := jsonb(r.Dest)
|
|
ports, _ := jsonb(r.Ports)
|
|
var portgroup any
|
|
if r.PortGroup != "" {
|
|
portgroup = r.PortGroup
|
|
}
|
|
var id int64
|
|
err := pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
if err := tx.QueryRow(ctx, `
|
|
INSERT INTO rules (priority, action, source, dest, proto, portgroup, ports, log, comment)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) RETURNING id`,
|
|
r.Priority, r.Action, source, dest, r.Proto, portgroup, ports, r.Log, r.Comment,
|
|
).Scan(&id); err != nil {
|
|
return err
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
return id, err
|
|
}
|
|
|
|
func (s *Store) DeleteRule(ctx context.Context, id int64) error {
|
|
return pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
|
|
tag, err := tx.Exec(ctx, `DELETE FROM rules WHERE id = $1`, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if tag.RowsAffected() == 0 {
|
|
return ErrNotFound
|
|
}
|
|
return bump(ctx, tx)
|
|
})
|
|
}
|