213 lines
8.7 KiB
Go
213 lines
8.7 KiB
Go
package app
|
||
|
||
import (
|
||
"context"
|
||
"database/sql"
|
||
"errors"
|
||
"fmt"
|
||
"strings"
|
||
"time"
|
||
|
||
"git.pcux.cn/xuans/Scert/backend/internal/certificate"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/deployment"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/domain"
|
||
"git.pcux.cn/xuans/Scert/backend/internal/repository"
|
||
)
|
||
|
||
type certificateTaskWorkflow struct {
|
||
workflow *CertificateWorkflow
|
||
tasks repository.TaskRepository
|
||
audit repository.AuditRepository
|
||
logError func(error)
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) Issue(ctx context.Context, id string) (certificate.IssueResult, error) {
|
||
return w.workflow.Issue(ctx, id)
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) Renew(ctx context.Context, id string, urgent bool, policy certificate.RenewalPolicy) error {
|
||
attempts := 1
|
||
if urgent && policy.MaxRetries > 1 {
|
||
attempts = policy.MaxRetries
|
||
}
|
||
_, err := w.run(ctx, id, "renewal_run", "certificate_issue", attempts, policy.RetryInterval, w.workflow.IssueWithReport)
|
||
return err
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) DeployCurrent(ctx context.Context, id string) (CertificateWorkflowResult, error) {
|
||
return w.run(ctx, id, "certificate_deploy", "certificate_deploy", 1, 0, w.workflow.DeployCurrent)
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) Import(ctx context.Context, request certificate.ImportRequest) (CertificateWorkflowResult, error) {
|
||
return w.run(ctx, request.DomainID, "certificate_import", "certificate_import", 1, 0, func(ctx context.Context, _ string) (CertificateWorkflowResult, error) {
|
||
return w.workflow.Import(ctx, request)
|
||
})
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) Restore(ctx context.Context, domainID, version string) (CertificateWorkflowResult, error) {
|
||
return w.run(ctx, domainID, "certificate_restore", "certificate_restore", 1, 0, func(ctx context.Context, id string) (CertificateWorkflowResult, error) {
|
||
result, err := w.workflow.RestoreVersion(ctx, id, version)
|
||
return CertificateWorkflowResult{Certificate: result}, err
|
||
})
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) Validate(ctx context.Context, domainID string) (certificate.IssueResult, certificate.ValidationResult, error) {
|
||
var validation certificate.ValidationResult
|
||
result, err := w.run(ctx, domainID, "certificate_validate", "certificate_validate", 1, 0, func(ctx context.Context, id string) (CertificateWorkflowResult, error) {
|
||
certificateResult, validationResult, err := w.workflow.ValidateCurrent(ctx, id)
|
||
validation = validationResult
|
||
return CertificateWorkflowResult{Certificate: certificateResult}, err
|
||
})
|
||
return result.Certificate, validation, err
|
||
}
|
||
|
||
func (w *certificateTaskWorkflow) run(ctx context.Context, id, taskType, stage string, attempts int, interval time.Duration, execute func(context.Context, string) (CertificateWorkflowResult, error)) (result CertificateWorkflowResult, resultErr error) {
|
||
if w == nil || w.tasks == nil || w.audit == nil {
|
||
return result, errors.New("证书任务记录服务未初始化")
|
||
}
|
||
if strings.TrimSpace(id) == "" {
|
||
return result, errors.New("证书任务域名 ID 不能为空")
|
||
}
|
||
if strings.TrimSpace(taskType) == "" || strings.TrimSpace(stage) == "" {
|
||
return result, errors.New("证书任务类型和阶段不能为空")
|
||
}
|
||
if attempts < 1 {
|
||
return result, errors.New("证书任务至少执行一次")
|
||
}
|
||
if execute == nil {
|
||
return result, errors.New("证书任务执行器未配置")
|
||
}
|
||
if active, err := w.tasks.FindActiveTaskByDomain(ctx, id, taskType); err == nil {
|
||
return result, fmt.Errorf("%w：%s", repository.ErrTaskAlreadyRunning, active.ID)
|
||
} else if !errors.Is(err, sql.ErrNoRows) {
|
||
return result, fmt.Errorf("检查活动证书任务失败：%w", err)
|
||
}
|
||
started := time.Now().UTC()
|
||
task := repository.Task{
|
||
ID: domain.NewID(), DomainID: id, TaskType: taskType,
|
||
Status: "running", Stage: stage, Message: "正在执行证书工作流",
|
||
OperatorID: repository.TaskOperatorFromContext(ctx),
|
||
StartedAt: &started, CreatedAt: started,
|
||
}
|
||
if err := w.tasks.CreateTask(ctx, task); err != nil {
|
||
return result, err
|
||
}
|
||
taskCtx, taskCancel := context.WithCancel(ctx)
|
||
if hooks, ok := repository.TaskCancellationHooksFromContext(ctx); ok {
|
||
hooks.Register(task.ID, taskCancel)
|
||
defer hooks.Unregister(task.ID)
|
||
}
|
||
defer taskCancel()
|
||
taskCtx = certificate.WithProgressReporter(taskCtx, func(progressCtx context.Context, progressStage, progressMessage string) error {
|
||
return w.tasks.UpdateTask(progressCtx, task.ID, "running", progressStage, progressMessage, &started, nil)
|
||
})
|
||
defer func() {
|
||
finishCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
|
||
defer cancel()
|
||
finished := time.Now().UTC()
|
||
status, message := certificateTaskOutcome(result, resultErr)
|
||
auditErr := w.audit.CreateAuditLog(finishCtx, repository.AuditLog{
|
||
TaskID: task.ID,
|
||
Action: taskType, ResourceType: "domain", ResourceID: id,
|
||
OperatorID: task.OperatorID,
|
||
Status: status, Message: message,
|
||
})
|
||
if auditErr != nil {
|
||
status, message = certificateTaskOutcome(result, auditErr)
|
||
stage = "record"
|
||
}
|
||
taskErr := w.tasks.UpdateTask(finishCtx, task.ID, status, stage, message, &started, &finished)
|
||
resultErr = errors.Join(resultErr, taskErr, auditErr)
|
||
if resultErr != nil && w.logError != nil {
|
||
w.logError(resultErr)
|
||
}
|
||
}()
|
||
if err := w.audit.CreateAuditLog(taskCtx, repository.AuditLog{
|
||
TaskID: task.ID,
|
||
Action: taskType, ResourceType: "domain", ResourceID: id,
|
||
OperatorID: task.OperatorID,
|
||
Status: "running", Message: "开始执行证书工作流",
|
||
}); err != nil {
|
||
return result, err
|
||
}
|
||
for number := 1; number <= attempts; number++ {
|
||
if err := taskCtx.Err(); err != nil {
|
||
return result, err
|
||
}
|
||
if err := w.tasks.UpdateTask(taskCtx, task.ID, "running", stage, "正在执行证书工作流", &started, nil); err != nil {
|
||
return result, err
|
||
}
|
||
attemptStarted := time.Now().UTC()
|
||
attempt := repository.TaskAttempt{
|
||
ID: domain.NewID(), TaskID: task.ID, AttemptNumber: number,
|
||
Stage: stage, Status: "running", Message: "正在执行证书工作流",
|
||
StartedAt: &attemptStarted, CreatedAt: attemptStarted,
|
||
}
|
||
if err := w.tasks.CreateAttempt(taskCtx, attempt); err != nil {
|
||
return result, err
|
||
}
|
||
issueCtx, cancel := context.WithTimeout(taskCtx, 30*time.Minute)
|
||
issueCtx = deployment.WithTransactionContext(issueCtx, deployment.TransactionContext{
|
||
TaskID: task.ID, AttemptID: attempt.ID, AttemptNumber: attempt.AttemptNumber,
|
||
})
|
||
result, resultErr = execute(issueCtx, id)
|
||
cancel()
|
||
if recordErr := w.tasks.RecordTaskDeploymentResults(taskCtx, task.ID, attempt.ID, number, taskDeploymentResults(result.Deployment)); recordErr != nil {
|
||
resultErr = errors.Join(resultErr, recordErr)
|
||
}
|
||
finishCtx, finishCancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
|
||
finished := time.Now().UTC()
|
||
status, message := certificateTaskOutcome(result, resultErr)
|
||
recordErr := w.tasks.FinishAttempt(finishCtx, attempt.ID, status, message, &finished)
|
||
finishCancel()
|
||
if recordErr != nil {
|
||
return result, errors.Join(resultErr, recordErr)
|
||
}
|
||
if resultErr == nil || number == attempts || result.Certificate.Saved.CertificatePath != "" || errors.Is(resultErr, context.Canceled) || errors.Is(resultErr, context.DeadlineExceeded) {
|
||
return result, resultErr
|
||
}
|
||
if err := w.tasks.UpdateTask(taskCtx, task.ID, "retry_wait", "retry_wait", "证书申请失败，等待重试", &started, nil); err != nil {
|
||
return result, errors.Join(resultErr, err)
|
||
}
|
||
if err := waitForManagementRetry(taskCtx, interval); err != nil {
|
||
return result, errors.Join(resultErr, err)
|
||
}
|
||
}
|
||
return result, resultErr
|
||
}
|
||
|
||
func taskDeploymentResults(report deployment.Report) []repository.TaskDeploymentResult {
|
||
if len(report.Results) == 0 {
|
||
return nil
|
||
}
|
||
items := make([]repository.TaskDeploymentResult, 0, len(report.Results))
|
||
for index, item := range report.Results {
|
||
item = deployment.PublicResult(item)
|
||
items = append(items, repository.TaskDeploymentResult{
|
||
ResultIndex: index,
|
||
ServerID: item.ServerID,
|
||
Server: item.Server,
|
||
Status: item.Status,
|
||
Message: item.Message,
|
||
BackupID: item.BackupID,
|
||
})
|
||
}
|
||
return items
|
||
}
|
||
|
||
func certificateTaskOutcome(result CertificateWorkflowResult, err error) (string, string) {
|
||
if errors.Is(err, context.Canceled) {
|
||
return "cancelled", "\u8bc1\u4e66\u5de5\u4f5c\u6d41\u5df2\u53d6\u6d88"
|
||
}
|
||
if result.Deployment.Status == "partial" {
|
||
return "partial_success", "\u8bc1\u4e66\u5de5\u4f5c\u6d41\u5df2\u5b8c\u6210\u90e8\u5206\u90e8\u7f72"
|
||
}
|
||
if err != nil {
|
||
return "failed", "\u8bc1\u4e66\u5de5\u4f5c\u6d41\u672a\u5b8c\u6210\uff0c\u8bf7\u68c0\u67e5\u53d7\u4fdd\u62a4\u7684\u670d\u52a1\u65e5\u5fd7"
|
||
}
|
||
return "success", "\u8bc1\u4e66\u5de5\u4f5c\u6d41\u6267\u884c\u5b8c\u6210"
|
||
}
|
||
|
||
var _ certificate.CertificateIssuer = (*certificateTaskWorkflow)(nil)
|
||
var _ certificate.RenewalExecutor = (*certificateTaskWorkflow)(nil)
|