Как разработать веб-приложение уровня Enterprise Application с нуля. Часть 2

			git checkout -b release/1.0.0 master # зафиксировали версию первой статьи
git checkout -b develop master
git checkout -b feature/article-2 develop # будем разрабатывать вторую статью в отдельной ветке
		

			productService := productsrcimpl.NewProductService()
userService := usersrvimpl.NewUserService()
userProductService := usersrvimpl.NewUserProductService(userService, productService)
err := server.Register(grpc.Descriptor{
    Server:               userapp.NewServer(userService, userProductService),
    GRPCRegistrar:        pbv1.RegisterUserServiceServer,
    GRPCGatewayRegistrar: pbv1.RegisterUserServiceHandlerFromEndpoint,
})
if err != nil {
    l.Fatal(err)
}
		

			type Application struct {
    ctx     context.Context
    cancel  context.CancelFunc
    fxApp   *fx.App
    logger  log.Logger
    options []fx.Option
}

func New(providers ...interface{}) *Application {
    ctx, cancel := context.WithCancel(context.Background())

            app := &Application{
            options: []fx.Option{
            fx.NopLogger,
        },
        ctx:    ctx,
        cancel: cancel,
    }

    for _, provider := range providers {
        switch p := provider.(type) {
        case fx.Option:
            app.options = append(app.options, p)
        default:
            app.options = append(app.options, fx.Provide(p))
        }
    }

    return app
}

func (a *Application) Run(invoker interface{}) {
    var args Arguments
    _, err := flags.Parse(&args)
    if err != nil {
        panic(err)
    }

    a.options = append(
        a.options,
        fx.Provide(func() context.Context {
            return a.ctx
        }),
        fx.Provide(func() Arguments {
            return args
        }),
        fx.Invoke(invoker),
        fx.Populate(&a.logger),
    )
    a.fxApp = fx.New(a.options...)

    go a.listenSignals()

    startCtx, cancel := context.WithTimeout(a.ctx, fx.DefaultTimeout)
    defer cancel()

    if err = a.fxApp.Start(startCtx); err != nil {
        if a.logger == nil {
            panic(err)
        }

        a.logger.Fatal(err)
    }
}

func (a *Application) Demonize(invoker interface{}) {
    a.Run(invoker)
    <-a.ctx.Done()
}

func (a *Application) Stop() {
    stopCtx, cancel := context.WithTimeout(a.ctx, fx.DefaultTimeout)
    defer cancel()
    err := a.fxApp.Stop(stopCtx)
    if err != nil {
        a.logger.Fatal(err)
    }
    a.fxApp = nil
}

func (a *Application) listenSignals() {
    signals := make(chan os.Signal, 1)
    signal.Notify(signals, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
    for sig := range signals {
        a.logger.Infof("income signal %s", sig)
        a.Stop()
        a.cancel()
        return
    }
}
		

			var Constructors = fx.Provide(
    usersrvimpl.NewFxUserService,
    usersrvimpl.NewFxUserProductService,
)
		

			app := application.New(
    commonadap.Constructors,
    productsadap.Constructors,
    useradap.Constructors,
    orderadap.Constructors,
    productapp.NewFxProductServiceServer,
)
app.Demonize(func(
    server grpc.Server,
    descriptor grpc.Descriptor,
) error {
    err := server.Register(descriptor)
    if err != nil {
        return err
    }

    err = server.Start()
    if err != nil {
        return err
    }

    return nil
})
		

			type Provider interface {
    Populate(target interface{}) error
    PopulateByKey(key string, target interface{}) error
}

func NewFxProvider(args Arguments) (Provider, error) {
    return NewProviderByOptions(config.File(args.ConfigFilename))
}

func NewProviderByOptions(options ...config.YAMLOption) (Provider, error) {
    dotenvFile, _ := godotenv.Read(".env")
    configProvider, err := config.NewYAML(append(
        []config.YAMLOption{
            config.Expand(expandFunc(dotenvFile)),
        },
        options...,
    )...)
    if err != nil {
        return nil, err
    }

    return &provider{configProvider}, nil
}

func expandFunc(extraEnv map[string]string) func(key string) (val string, ok bool) {
    return func(key string) (val string, ok bool) {
        val, ok = os.LookupEnv(key)
        if !ok {
            val, ok = extraEnv[key]
            if !ok {
                val = ""
                ok = true
            }
        }
        return val, ok
    }
}

type provider struct {
    provider config.Provider
}

func (p *provider) Populate(target interface{}) error {
    return p.PopulateByKey("", target)
}

func (p *provider) PopulateByKey(key string, target interface{}) error {
    return p.provider.Get(key).Populate(target)
}
		

			type Config struct {
    A         A
    Partition int
}

type A struct {
    B string
    C struct {
        D bool
        F int
    }
}

func TestConfigProviderSuite(t *testing.T) {
    suite.Run(t, new(ConfigProviderSuite))
}

type ConfigProviderSuite struct {
    suite.Suite
}

func (s *ConfigProviderSuite) TestPopulate() {
    reader := strings.NewReader("a: {b: bar, c: {d: true, f: 12}}")

    provider, err := application.NewProviderByOptions(config.Source(reader))
    s.Nil(err)

    var a A
    s.Nil(provider.PopulateByKey("a", &a))
    s.Equal("bar", a.B)
    s.Equal(true, a.C.D)
    s.Equal(12, a.C.F)

    var f int
    s.Nil(provider.PopulateByKey("a.c.f", &f))
    s.Equal(12, f)

    var cfg Config
    s.Nil(provider.Populate(&cfg))
    s.Equal(cfg.A, a)
    s.Equal(cfg.A.B, a.B)
}

func (s *ConfigProviderSuite) TestExpand() {
    var a int
    var b string
    var c string
    varB := "hello world"
    err := os.Setenv("VAR_B", varB)
    if err != nil {
        s.Error(err)
    }

    reader := strings.NewReader(`
a: 1
b: "$VAR_B"
c: "$VAR_C"
`)

    provider, err := application.NewProviderByOptions(config.Source(reader))
    s.Nil(err)

    s.Nil(provider.PopulateByKey("a", &a))
    s.Equal(1, a)

    s.Nil(provider.PopulateByKey("b", &b))
    s.Equal(varB, b)

    s.Nil(provider.PopulateByKey("b", &b))
    s.Equal("", c)
}
		

			var Constructors = fx.Provide(
    application.NewFxProvider,
    …
)
		

			server:
  http_port: 8080
  grpc_port: 8181
  max_send_message_length: 2147483647
  max_receive_message_length: 63554432
		

			func NewFxServer(
    in FxServerIn,
) (Server, error) {
    var cfg Config
    err := in.ConfigProvider.PopulateByKey("server", &cfg)
    if err != nil {
        return nil, err
    }
    …
}
		

			CMD ${PROJECT_DIR}/bin/app -c ${PROJECT_DIR}/configs/config.yml
		

			type Middleware struct {
    Priority   int
    GrpcOption grpc.UnaryServerInterceptor
    MuxOption  runtime.ServeMuxOption
}
		

			type MiddlewareOut struct {
    fx.Out
    GrpcMiddleware Middleware `group:"grpc_middleware"`
    MuxMiddleware  Middleware `group:"mux_middleware"`
}
		

			type FxServerIn struct {
    fx.In
    …
    GrpcMiddlewares []Middleware `group:"grpc_middleware"`
    MuxMiddlewares  []Middleware `group:"mux_middleware"`
}
		

			type ByPriority []Middleware

func (b ByPriority) Len() int {
    return len(b)
}

func (b ByPriority) Swap(i, j int) {
    b[i], b[j] = b[j], b[i]
}

func (b ByPriority) Less(i, j int) bool {
    return b[i].Priority > b[j].Priority
}
		

			func NewFxServer(
    in FxServerIn,
) (Server, error) {
    …

    sort.Sort(ByPriority(in.MuxMiddlewares))
    sort.Sort(ByPriority(in.GrpcMiddlewares))

    interceptors := make([]grpc.UnaryServerInterceptor, len(in.GrpcMiddlewares))
    for i, middleware := range in.GrpcMiddlewares {
        interceptors[i] = middleware.GrpcOption
    }

    serverMuxOptions := make([]runtime.ServeMuxOption, len(in.MuxMiddlewares))
    for i, middleware := range in.MuxMiddlewares {
        serverMuxOptions[i] = middleware.MuxOption
    }

    srv := &server{
        …
        grpcServer: grpc.NewServer(
            grpc.MaxRecvMsgSize(cfg.MaxReceiveMessageLength),
            grpc.MaxSendMsgSize(cfg.MaxSendMessageLength),
            grpc.ChainUnaryInterceptor(interceptors...),
        ),
        mux: runtime.NewServeMux(
            serverMuxOptions...,
        ),
        …
    }

    return srv, nil
}
		

			openssl req -newkey rsa -x509 -sha256 -days 3650 -nodes -out ./configs/ssl/crt.pem -keyout ./configs/ssl/private.key.pem
openssl rsa -in ./configs/ssl/private.key.pem -outform PEM -pubout -out ./configs/ssl/public.key.pem
		

			option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
    …
    security_definitions: {
        security: {
            key: "Bearer"
            value: {
                type: TYPE_API_KEY;
                in: IN_HEADER;
                name: "Authorization"
            }
        };
    };
    …
};
		

			type SessionClaims struct {
    jwt.StandardClaims
    pbv1.Session
}

func (c SessionClaims) Valid() error {
    err := c.StandardClaims.Valid()
    if err != nil {
        return err
    }

    if len(c.Uuid) == 0 {
        return errors.New("uuid is invalid")
    }

    if _, ok := pbv1.UserGroup_name[int32(c.Group)]; !ok {
        return errors.New("group is invalid")
    }

    return nil
}
		

			type Claims interface {
    jwt.Claims
}

type JWTHelper interface {
    Parse(token string, claims Claims) error
    CreateToken(claims Claims) (string, error)
}

func NewFxJWTHelper(
    provider application.Provider,
) (JWTHelper, error) {
    var cfg SslConfig
    err := provider.PopulateByKey("ssl", &cfg)
    if err != nil {
        return nil, err
    }

    buf, err := ioutil.ReadFile(cfg.PrivateKeyFile)
    if err != nil {
        return nil, err
    }

    privateKey, err := jwt.ParseRSAPrivateKeyFromPEM(buf)
    if err != nil {
        return nil, err
    }

    buf, err = ioutil.ReadFile(cfg.PublicKeyFile)
    if err != nil {
        return nil, err
    }

    publicKey, err := jwt.ParseRSAPublicKeyFromPEM(buf)
    if err != nil {
        return nil, err
    }

    return &jwtHelper{
        publicKey:  publicKey,
        privateKey: privateKey,
    }, nil
}

type jwtHelper struct {
    publicKey  *rsa.PublicKey
    privateKey *rsa.PrivateKey
}

func (h *jwtHelper) Parse(token string, claims Claims) error {
    _, err := jwt.ParseWithClaims(token, claims, func(token *jwt.Token) (interface{}, error) {
        return h.publicKey, nil
    })
    if err != nil {
        return err
    }

    return claims.Valid()
}

func (h *jwtHelper) CreateToken(claims Claims) (string, error) {
    token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
    return token.SignedString(h.privateKey)
}
		

			func NewFxSessionManager(
    provider application.Provider,
    logger log.Logger,
    jwtHelper JWTHelper,
) (SessionManager, error) {
    var cfg SessionConfig
    err := provider.PopulateByKey("session", &cfg)
    if err != nil {
        return nil, err
    }

    return &sessionManager{
        logger:    logger.Named("session_manager"),
        cfg:       cfg,
        jwtHelper: jwtHelper,
    }, nil
}

type sessionManager struct {
    logger    log.Logger
    cfg       SessionConfig
    jwtHelper JWTHelper
}

func (s *sessionManager) CreateTokenBySession(ctx context.Context, session pbv1.Session) (string, error) {
    claims := &SessionClaims{
        StandardClaims: jwt.StandardClaims{
            Audience:  s.cfg.Audience,
            Issuer:    s.cfg.Issuer,
            IssuedAt:  time.Now().Unix(),
            ExpiresAt: time.Now().Add(s.cfg.Duration).Unix(),
        },
        Session: session,
    }

    return s.jwtHelper.CreateToken(claims)
}

func (s *sessionManager) CreateToken(ctx context.Context, userUUID string, group pbv1.UserGroup) (string, error) {
    return s.CreateTokenBySession(
        ctx,
        pbv1.Session{
            Uuid:  userUUID,
            Group: group,
        },
    )
}

func (s *sessionManager) GetSessionByToken(ctx context.Context, token string) (pbv1.Session, error) {
    logger := s.logger.WithCtx(ctx)
    if len(token) == 0 {
        logger.Debug("guest session")
        return pbv1.Session{
            Group: pbv1.UserGroupGuest,
        }, nil
    }

    claims := new(SessionClaims)
    err := s.jwtHelper.Parse(token, claims)
    if err != nil {
        logger.Error(err)
        return pbv1.Session{}, grpc.ErrUnauthenticated(grpc.ErrSessionNotFound)
    }

    logger.Debugf("b2c session=%s with group=%s", claims.Session.Uuid, claims.Session.Group)
    return claims.Session, nil
}
		

			func NewFxAuthOption(
    logger log.Logger,
    sessionManager auth.SessionManager,
) grpc.MiddlewareOut {
    return grpc.MiddlewareOut{
        GrpcMiddleware: grpc.Middleware{
            Priority: 99,
            GrpcOption: func(ctx context.Context, req interface{}, info *gRPC.UnaryServerInfo, handler gRPC.UnaryHandler) (resp interface{}, err error) {
                logger := logger.WithCtx(ctx, "middleware", "auth")
                token, err := grpc_auth.AuthFromMD(ctx, "bearer")
                if err != nil {
                    logger.Error(err)
                }

                session, err := sessionManager.GetSessionByToken(ctx, token)
                if err != nil {
                    logger.Error(err)
                    return nil, err
                }

                return handler(ctxutil.Set(ctx, ctxutil.Session, session), req)
            },
        },
    }
}
		

			// субъект в терминах RBAC
enum UserGroup {
    USER_STATUS_GUEST = 0 [(go.value) = {
        name: "UserGroupGuest"
    }];
    USER_STATUS_CUSTOMER = 1 [(go.value) = {
        name: "UserGroupCustomer"
    }];
}
		

			// роль в терминах RBAC
enum Role {
    ROLE_UNSPECIFIED = 0 [(go.value) = {
        name: "RoleUnspecified"
    }];
    ROLE_USER = 1 [(go.value) = {
        name: "RoleUser"
    }];
    ROLE_PRODUCT = 2 [(go.value) = {
        name: "RoleProduct"
    }];
    ROLE_ORDER = 3 [(go.value) = {
        name: "RoleOrder"
    }];
    ROLE_USER_PRODUCT = 4 [(go.value) = {
        name: "RoleUserProduct"
    }];
}

// разрешение в терминах RBAC
enum Permission {
    PERMISSION_UNSPECIFIED = 0 [(go.value) = {
        name: "PermissionUnspecified"
    }];
    PERMISSION_READ = 1 [(go.value) = {
        name: "PermissionRead"
    }];
    PERMISSION_WRITE = 2 [(go.value) = {
        name: "PermissionWrite"
    }];
}
		

			type RoleEnforcer interface {
    Enforce(session pbv1.Session, role pbv1.Role, permission pbv1.Permission) (bool, error)
}

type roleEnforcer struct {
    enforcer *casbin.Enforcer
    logger   log.Logger
}

func NewFxRoleEnforcer(
    logger log.Logger,
    configProvider application.Provider,
) (RoleEnforcer, error) {
    var cfg Config
    err := configProvider.PopulateByKey("enforcer", &cfg)
    if err != nil {
        return nil, err
    }

    casbinEnforcer, err := casbin.NewEnforcer(cfg.ModelFile, cfg.PolicyFile)
    if err != nil {
        return nil, err
    }

    return &roleEnforcer{
        enforcer: casbinEnforcer,
        logger:   logger.Named("role_enforcer"),
    }, nil
}

func (e *roleEnforcer) Enforce(session pbv1.Session, role pbv1.Role, permission pbv1.Permission) (bool, error) {
    return e.enforcer.Enforce(                              strings.ReplaceAll(pbv1.UserGroup_name[int32(session.Group)], "USER_GROUP_", ""),
        pbv1.Role_name[int32(role)],
        pbv1.Permission_name[int32(permission)],
    )
}
		

			[request_definition]
r = group, role, act

[policy_definition]
p = group, role, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.group, p.group) \
    && r.role == p.role \
    && r.act == p.act
		

			p, USER_GROUP_GUEST, ROLE_USER, PERMISSION_WRITE
p, USER_GROUP_GUEST, ROLE_PRODUCT, PERMISSION_READ

p, USER_GROUP_CUSTOMER, ROLE_USER, PERMISSION_READ
p, USER_GROUP_CUSTOMER, ROLE_ORDER, PERMISSION_READ
p, USER_GROUP_CUSTOMER, ROLE_ORDER, PERMISSION_WRITE
p, USER_GROUP_CUSTOMER, ROLE_USER_PRODUCT, PERMISSION_READ
p, USER_GROUP_CUSTOMER, ROLE_USER_PRODUCT, PERMISSION_WRITE

g, GUEST, USER_GROUP_GUEST
g, CUSTOMER, USER_GROUP_GUEST
g, CUSTOMER, USER_GROUP_CUSTOMER
		

			func NewFxUserServiceServer(
    userService usersrv.UserService,
    userProductService usersrv.UserProductService,
) grpc.Descriptor {
    return grpc.Descriptor{
        Server: &server{
            userService:        userService,
            userProductService: userProductService,
        },
        GRPCRegistrar:        pbv1.RegisterUserServiceServer,
        GRPCGatewayRegistrar: pbv1.RegisterUserServiceHandlerFromEndpoint,
        MethodDescriptors: []grpc.MethodDescriptor{
            {
                Method:     (*server).Register,
                Role:       pbv1.RoleUser,
                Permission: pbv1.PermissionRead,
            },
            {
                Method:     (*server).GetByUUID,
                Role:       pbv1.RoleUser,
                Permission: pbv1.PermissionRead,
            },
            …
        },
    }
}
		

			type RightsEnforcer interface {
    Enforce(ctx context.Context, session pbv1.Session, value protoreflect.Value) (context.Context, error)
}

type RightsEnforcerDescriptorOut struct {
    fx.Out
    Descriptor RightsEnforcerDescriptor `group:"rights_enforcer"`
}

type RightsEnforcerDescriptor struct {
    Name           string
    RightsEnforcer RightsEnforcer
}
		

			func NewFxUserRightsEnforcer(
    userService usersrv.UserService,
) auth.RightsEnforcerDescriptorOut {
    return auth.RightsEnforcerDescriptorOut{
        Descriptor: auth.RightsEnforcerDescriptor{
            Name:           "user_uuid",
            RightsEnforcer: NewUserRightsEnforcer(userService),
        },
    }
}

func NewUserRightsEnforcer(
    userService usersrv.UserService,
) auth.RightsEnforcer {
    return &userRightsEnforcer{
        userService: userService,
    }
}

type userRightsEnforcer struct {
    userService usersrv.UserService
}

func (r userRightsEnforcer) Enforce(ctx context.Context, session pbv1.Session, value protoreflect.Value) (context.Context, error) {
    user, err := r.userService.GetByUUID(ctx, value.String())
    if err != nil {
        return nil, err
    }

    if user.Status != pbv1.UserStatusActive {
        return nil, grpc.ErrSessionHasNotPermissions
    }

    if session.Uuid != user.Uuid {
        return nil, grpc.ErrSessionNotOwnEntity
    }

    return ctxutil.Set(ctx, ctxutil.User, user), nil
}
		

			type EnforcerOptionIn struct {
    fx.In
    Logger                    log.Logger
    RoleEnforcer              auth.RoleEnforcer
    MethodDescriptorMap       grpc.MethodDescriptorMap
    RightsEnforcerDescriptors []auth.RightsEnforcerDescriptor `group:"rights_enforcer"`
}

func NewFxEnforcerOption(in EnforcerOptionIn) grpc.MiddlewareOut {
    rightsEnforcers := protoutil.NewMap[auth.RightsEnforcer]()
    for _, descriptor := range in.RightsEnforcerDescriptors {
        rightsEnforcers.Set(descriptor.Name, descriptor.RightsEnforcer)
    }

    return grpc.MiddlewareOut{
        GrpcMiddleware: grpc.Middleware{
            Priority: 98,
            GrpcOption: func(ctx context.Context, req interface{}, info *gRPC.UnaryServerInfo, handler gRPC.UnaryHandler) (resp interface{}, err error) {
                logger := in.Logger.WithCtx(ctx, "middleware", "enforcer")
                methodNameParts := strings.Split(info.FullMethod, "/")
                methodName := methodNameParts[len(methodNameParts)-1]
                methodDescriptor, ok := in.MethodDescriptorMap[methodName]
                if !ok {
                    return nil, grpc.ErrUnauthenticated(grpc.ErrMethodDescriptorNotFound)
                }

                session, err := ctxutil.Get[pbv1.Session](ctx, ctxutil.Session)
                if err != nil {
                    return nil, grpc.ErrPermissionDenied(grpc.ErrSessionNotFound)
                }

                ok, err = in.RoleEnforcer.Enforce(session, methodDescriptor.Role, methodDescriptor.Permission)
                if !ok {
                    logger.Error(err)
                    return nil, grpc.ErrPermissionDenied(grpc.ErrSessionHasNotPermissions)
                }

                protoMessage, ok := req.(protoreflect.ProtoMessage)
                if ok {
                    message := protoMessage.ProtoReflect()
                    fields := message.Descriptor().Fields()
                    for i := 0; i < fields.Len(); i++ {
                        field := fields.Get(i)
                        rightsEnforcer, err := rightsEnforcers.Get(message, field)
                        if err != nil {
                            logger.Error(err)
                            continue
                        }

                        ctx, err = rightsEnforcer.Enforce(ctx, session, message.Get(field))
                        if err != nil {
                            logger.Error(err)
                            return nil, grpc.ErrPermissionDenied(grpc.ErrSessionNotOwnEntity)
                        }
                    }
                }

                return handler(ctx, req)
            },
        },
    }
}
		

			option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
    …
    schemes: HTTPS;
    …
};
		

			service UserService {
    …
    rpc GetByUUID(GetByUserUUIDRequest) returns (User) {
        option (google.api.http) = {
            get: "/v1/users/{user_uuid}";
        };
        option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
            summary: "Получение пользователя по UUID";
            security: {
                security_requirement: {
                    key: "Bearer"
                    value: {}
                }
            };
        };
    };
    …
}
		

			server {
    listen 443 http2 ssl;
    …
    ssl_certificate     /etc/nginx/ssl/crt.pem;
    ssl_certificate_key /etc/nginx/ssl/private.key.pem;
    …
}
		

			make up