a3411899cf
Follow-up to #1359. Addresses a set of correctness and security gaps in the initial docreader auth implementation. - docker-compose: inject GRPC_TLS_*/GRPC_TLS_SERVER_NAME/GRPC_AUTH_TOKEN into the WeKnora-app service. Without this the Go client never saw the knobs, so enabling token auth on the server broke every RPC. - client: bind tokenAuth.RequireTransportSecurity() to TLSEnabled so a bearer token cannot be sent over an insecure channel once TLS is on. - server: load_tls_credentials now raises TLSConfigError on misconfig (cert/key missing, file unreadable, mTLS without CA); main.py exits 1 instead of silently downgrading to insecure. - server: replace endswith("/Check"|"/Watch") health bypass with exact match against /grpc.health.v1.Health/{Check,Watch}. - server: compare tokens with hmac.compare_digest, warn on tokens < 16B. - server: AuthInterceptor now returns an abort handler matching the original RPC kind (unary/stream) and uses context.abort, so streaming RPCs surface UNAUTHENTICATED instead of INTERNAL. - internal/infrastructure/docparser/grpc_parser.go: drop the duplicated TLS/tokenAuth block and reuse docreader/client.LoadAuthConfigFromEnv + BuildDialOptions. Single source of truth for client-side auth. - Add GRPC_TLS_SERVER_NAME (client SNI override) and GRPC_MTLS_REQUIRE_CLIENT_CERT (server explicit mTLS toggle); document the differing CA semantics between client and server in .env*.example. - Reject half-configured client mTLS (cert XOR key) loudly. - Fix missing trailing newline in .env.lite.example. Verified locally: go build ./... and go vet ./... clean; auth.py fail-fast / token paths smoke-tested.
181 lines
4.4 KiB
Go
181 lines
4.4 KiB
Go
package docparser
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
"strconv"
|
|
"sync"
|
|
"time"
|
|
|
|
docclient "github.com/Tencent/WeKnora/docreader/client"
|
|
"github.com/Tencent/WeKnora/docreader/proto"
|
|
"github.com/Tencent/WeKnora/internal/logger"
|
|
"github.com/Tencent/WeKnora/internal/types"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/resolver"
|
|
)
|
|
|
|
func getMaxMessageSize() int {
|
|
if sizeStr := os.Getenv("MAX_FILE_SIZE_MB"); sizeStr != "" {
|
|
if size, err := strconv.Atoi(sizeStr); err == nil && size > 0 {
|
|
return size * 1024 * 1024
|
|
}
|
|
}
|
|
return 50 * 1024 * 1024
|
|
}
|
|
|
|
// GRPCDocumentReader implements DocumentReader over gRPC.
|
|
type GRPCDocumentReader struct {
|
|
mu sync.RWMutex
|
|
conn *grpc.ClientConn
|
|
client proto.DocReaderClient
|
|
addr string
|
|
}
|
|
|
|
func NewGRPCDocumentReader(addr string) (*GRPCDocumentReader, error) {
|
|
p := &GRPCDocumentReader{}
|
|
if addr != "" {
|
|
if err := p.connect(addr); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
return p, nil
|
|
}
|
|
|
|
func (p *GRPCDocumentReader) connect(addr string) error {
|
|
authConfig := docclient.LoadAuthConfigFromEnv()
|
|
opts, err := authConfig.BuildDialOptions(getMaxMessageSize())
|
|
if err != nil {
|
|
return fmt.Errorf("failed to build docreader dial options: %w", err)
|
|
}
|
|
if authConfig.TLSEnabled {
|
|
logger.Infof(context.Background(), "TLS enabled for docreader gRPC client")
|
|
}
|
|
if authConfig.AuthToken != "" {
|
|
logger.Infof(context.Background(),
|
|
"Token authentication enabled for docreader gRPC client (TLS=%v)",
|
|
authConfig.TLSEnabled,
|
|
)
|
|
}
|
|
|
|
resolver.SetDefaultScheme("dns")
|
|
|
|
start := time.Now()
|
|
conn, err := grpc.Dial("dns:///"+addr, opts...)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to connect to docreader: %w", err)
|
|
}
|
|
logger.Infof(context.Background(), "Connected to docreader in %v", time.Since(start))
|
|
|
|
p.conn = conn
|
|
p.client = proto.NewDocReaderClient(conn)
|
|
p.addr = addr
|
|
return nil
|
|
}
|
|
|
|
func (p *GRPCDocumentReader) Reconnect(addr string) error {
|
|
p.mu.Lock()
|
|
defer p.mu.Unlock()
|
|
|
|
if p.conn != nil {
|
|
_ = p.conn.Close()
|
|
p.conn = nil
|
|
p.client = nil
|
|
p.addr = ""
|
|
}
|
|
return p.connect(addr)
|
|
}
|
|
|
|
func (p *GRPCDocumentReader) IsConnected() bool {
|
|
p.mu.RLock()
|
|
defer p.mu.RUnlock()
|
|
return p.conn != nil
|
|
}
|
|
|
|
func (p *GRPCDocumentReader) Close() error {
|
|
p.mu.Lock()
|
|
defer p.mu.Unlock()
|
|
if p.conn != nil {
|
|
return p.conn.Close()
|
|
}
|
|
return nil
|
|
}
|
|
|
|
var errNotConnected = fmt.Errorf("docreader service not connected")
|
|
|
|
func (p *GRPCDocumentReader) Read(ctx context.Context, req *types.ReadRequest) (*types.ReadResult, error) {
|
|
p.mu.RLock()
|
|
client := p.client
|
|
p.mu.RUnlock()
|
|
if client == nil {
|
|
return nil, errNotConnected
|
|
}
|
|
|
|
protoReq := &proto.ReadRequest{
|
|
FileContent: req.FileContent,
|
|
FileName: req.FileName,
|
|
FileType: req.FileType,
|
|
Url: req.URL,
|
|
Title: req.Title,
|
|
RequestId: req.RequestID,
|
|
Config: &proto.ReadConfig{
|
|
ParserEngine: req.ParserEngine,
|
|
ParserEngineOverrides: req.ParserEngineOverrides,
|
|
},
|
|
}
|
|
|
|
resp, err := client.Read(ctx, protoReq)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("gRPC Read failed: %w", err)
|
|
}
|
|
return fromProtoReadResponse(resp), nil
|
|
}
|
|
|
|
func (p *GRPCDocumentReader) ListEngines(ctx context.Context, overrides map[string]string) ([]types.ParserEngineInfo, error) {
|
|
p.mu.RLock()
|
|
client := p.client
|
|
p.mu.RUnlock()
|
|
if client == nil {
|
|
return nil, errNotConnected
|
|
}
|
|
|
|
resp, err := client.ListEngines(ctx, &proto.ListEnginesRequest{ConfigOverrides: overrides})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("gRPC ListEngines failed: %w", err)
|
|
}
|
|
|
|
result := make([]types.ParserEngineInfo, 0, len(resp.GetEngines()))
|
|
for _, e := range resp.GetEngines() {
|
|
result = append(result, types.ParserEngineInfo{
|
|
Name: e.GetName(),
|
|
Description: e.GetDescription(),
|
|
FileTypes: e.GetFileTypes(),
|
|
Available: e.GetAvailable(),
|
|
UnavailableReason: e.GetUnavailableReason(),
|
|
})
|
|
}
|
|
return result, nil
|
|
}
|
|
|
|
func fromProtoReadResponse(resp *proto.ReadResponse) *types.ReadResult {
|
|
result := &types.ReadResult{
|
|
MarkdownContent: resp.GetMarkdownContent(),
|
|
ImageDirPath: resp.GetImageDirPath(),
|
|
Metadata: resp.GetMetadata(),
|
|
Error: resp.GetError(),
|
|
}
|
|
|
|
for _, ref := range resp.GetImageRefs() {
|
|
result.ImageRefs = append(result.ImageRefs, types.ImageRef{
|
|
Filename: ref.GetFilename(),
|
|
OriginalRef: ref.GetOriginalRef(),
|
|
MimeType: ref.GetMimeType(),
|
|
StorageKey: ref.GetStorageKey(),
|
|
ImageData: ref.GetImageData(),
|
|
})
|
|
}
|
|
|
|
return result
|
|
}
|