ms/blueprintsprocessor/modules/inbounds/selfservice-api/src/main/kotlin/org/onap/ccsdk/cds/blueprintsprocessor/selfservice/api/KafkaPublishAuditService.kt

   1 /*
   2  * Copyright © 2020 Bell Canada
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 package org.onap.ccsdk.cds.blueprintsprocessor.selfservice.api
  18
  19 import com.fasterxml.jackson.databind.JsonNode
  20 import com.fasterxml.jackson.databind.node.ArrayNode
  21 import com.fasterxml.jackson.databind.node.ObjectNode
  22 import org.onap.ccsdk.cds.blueprintsprocessor.core.api.data.ExecutionServiceInput
  23 import org.onap.ccsdk.cds.blueprintsprocessor.core.api.data.ExecutionServiceOutput
  24 import org.onap.ccsdk.cds.blueprintsprocessor.functions.resource.resolution.ResourceResolutionConstants
  25 import org.onap.ccsdk.cds.blueprintsprocessor.message.service.BluePrintMessageLibPropertyService
  26 import org.onap.ccsdk.cds.blueprintsprocessor.message.service.BlueprintMessageProducerService
  27 import org.onap.ccsdk.cds.controllerblueprints.core.BluePrintConstants
  28 import org.onap.ccsdk.cds.controllerblueprints.core.asJsonPrimitive
  29 import org.onap.ccsdk.cds.controllerblueprints.core.common.ApplicationConstants
  30 import org.onap.ccsdk.cds.controllerblueprints.core.interfaces.BluePrintCatalogService
  31 import org.onap.ccsdk.cds.controllerblueprints.core.service.BluePrintContext
  32 import org.onap.ccsdk.cds.controllerblueprints.core.service.BluePrintRuntimeService
  33 import org.onap.ccsdk.cds.controllerblueprints.core.service.PropertyAssignmentService
  34 import org.onap.ccsdk.cds.controllerblueprints.core.utils.BluePrintMetadataUtils
  35 import org.onap.ccsdk.cds.controllerblueprints.core.utils.JacksonUtils
  36 import org.onap.ccsdk.cds.controllerblueprints.core.utils.PropertyDefinitionUtils
  37 import org.onap.ccsdk.cds.controllerblueprints.resource.dict.ResourceAssignment
  38 import org.slf4j.LoggerFactory
  39 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
  40 import org.springframework.stereotype.Service
  41 import javax.annotation.PostConstruct
  42
  43 /**
  44  * Audit service used to produce execution service input and output message
  45  * sent into dedicated kafka topics.
  46  *
  47  * @param bluePrintMessageLibPropertyService Service used to instantiate audit service producers
  48  * @param blueprintsProcessorCatalogService Service used to get the base path of the current CBA executed
  49  *
  50  * @property inputInstance Request Kakfa Producer instance
  51  * @property outputInstance Response Kakfa Producer instance
  52  * @property log Audit Service logger
  53  */
  54 @ConditionalOnProperty(
  55         name = ["blueprintsprocessor.messageproducer.self-service-api.audit.kafkaEnable"],
  56         havingValue = "true"
  57 )
  58 @Service
  59 class KafkaPublishAuditService(
  60     private val bluePrintMessageLibPropertyService: BluePrintMessageLibPropertyService,
  61     private val blueprintsProcessorCatalogService: BluePrintCatalogService
  62 ) : PublishAuditService {
  63     private var inputInstance: BlueprintMessageProducerService? = null
  64     private var outputInstance: BlueprintMessageProducerService? = null
  65     private val log = LoggerFactory.getLogger(KafkaPublishAuditService::class.toString())
  66
  67     companion object {
  68         const val INPUT_SELECTOR = "self-service-api.audit.request"
  69         const val OUTPUT_SELECTOR = "self-service-api.audit.response"
  70     }
  71
  72     @PostConstruct
  73     private fun init() {
  74         log.info("Kakfa audit service is enabled")
  75     }
  76
  77     /**
  78      * Publish execution input into a kafka topic.
  79      * The correlation UUID is used to link the input to its output.
  80      * Sensitive data within the request are hidden.
  81      * @param executionServiceInput Audited BP request
  82      */
  83     override suspend fun publishExecutionInput(executionServiceInput: ExecutionServiceInput) {
  84         val secureExecutionServiceInput = hideSensitiveData(executionServiceInput)
  85         val key = secureExecutionServiceInput.actionIdentifiers.blueprintName
  86         try {
  87             this.inputInstance = this.getInputInstance(INPUT_SELECTOR)
  88             this.inputInstance!!.sendMessage(key, secureExecutionServiceInput)
  89         } catch (e: Exception) {
  90             var errMsg =
  91                     if (e.message != null) "ERROR : ${e.message}"
  92                     else "ERROR : Failed to send execution request to Kafka."
  93             log.error(errMsg)
  94         }
  95     }
  96
  97     /**
  98      * Publish execution output into a kafka topic.
  99      * The correlation UUID is used to link the output to its input.
 100      * A correlation UUID is added to link the input to its output.
 101      * @param correlationUUID UUID used to link the audited response to its audited request
 102      * @param executionServiceOutput Audited BP response
 103      */
 104     override suspend fun publishExecutionOutput(correlationUUID: String, executionServiceOutput: ExecutionServiceOutput) {
 105         executionServiceOutput.correlationUUID = correlationUUID
 106         val key = executionServiceOutput.actionIdentifiers.blueprintName
 107         try {
 108             this.outputInstance = this.getOutputInstance(OUTPUT_SELECTOR)
 109             this.outputInstance!!.sendMessage(key, executionServiceOutput)
 110         } catch (e: Exception) {
 111             var errMsg =
 112                     if (e.message != null) "ERROR : $e"
 113                     else "ERROR : Failed to send execution request to Kafka."
 114             log.error(errMsg)
 115         }
 116     }
 117
 118     /**
 119      * Return the input kafka producer instance using a [selector] if not already instantiated.
 120      * @param selector Selector to retrieve request kafka producer configuration
 121      */
 122     private fun getInputInstance(selector: String): BlueprintMessageProducerService = inputInstance ?: createInstance(selector)
 123
 124     /**
 125      * Return the output kafka producer instance using a [selector] if not already instantiated.
 126      * @param selector Selector to retrieve response kafka producer configuration
 127      */
 128     private fun getOutputInstance(selector: String): BlueprintMessageProducerService = outputInstance ?: createInstance(selector)
 129
 130     /**
 131      * Create a kafka producer instance using a [selector].
 132      * @param selector Selector to retrieve kafka producer configuration
 133      */
 134     private fun createInstance(selector: String): BlueprintMessageProducerService {
 135         log.info("Setting up message producer($selector)...")
 136         return bluePrintMessageLibPropertyService.blueprintMessageProducerService(selector)
 137     }
 138
 139     /**
 140      * Hide sensitive data in the [executionServiceInput].
 141      * Sensitive data are declared in the resource resolution mapping using
 142      * the property metadata "log-protect" set to true.
 143      * @param executionServiceInput BP Execution Request where data needs to be hidden
 144      */
 145     private suspend fun hideSensitiveData(
 146         executionServiceInput: ExecutionServiceInput
 147     ): ExecutionServiceInput {
 148
 149         var clonedExecutionServiceInput = ExecutionServiceInput().apply {
 150             correlationUUID = executionServiceInput.correlationUUID
 151             commonHeader = executionServiceInput.commonHeader
 152             actionIdentifiers = executionServiceInput.actionIdentifiers
 153             payload = executionServiceInput.payload.deepCopy()
 154             stepData = executionServiceInput.stepData
 155         }
 156
 157         val blueprintName = clonedExecutionServiceInput.actionIdentifiers.blueprintName
 158         val workflowName = clonedExecutionServiceInput.actionIdentifiers.actionName
 159
 160         if (blueprintName == "default") return clonedExecutionServiceInput
 161
 162         try {
 163             if (clonedExecutionServiceInput.payload
 164                             .path("$workflowName-request").has("$workflowName-properties")) {
 165
 166                 /** Retrieving sensitive input parameters */
 167                 val requestId = clonedExecutionServiceInput.commonHeader.requestId
 168                 val blueprintVersion = clonedExecutionServiceInput.actionIdentifiers.blueprintVersion
 169
 170                 val basePath = blueprintsProcessorCatalogService.getFromDatabase(blueprintName, blueprintVersion)
 171
 172                 val blueprintRuntimeService = BluePrintMetadataUtils.getBluePrintRuntime(requestId, basePath.toString())
 173                 val blueprintContext = blueprintRuntimeService.bluePrintContext()
 174
 175                 val workflowSteps = blueprintContext.workflowByName(workflowName).steps
 176                 checkNotNull(workflowSteps) { "Failed to get step(s) for workflow($workflowName)" }
 177                 workflowSteps.forEach { step ->
 178                     val nodeTemplateName = step.value.target
 179                     checkNotNull(nodeTemplateName) { "Failed to get node template target for workflow($workflowName), step($step)" }
 180                     val nodeTemplate = blueprintContext.nodeTemplateByName(nodeTemplateName)
 181
 182                     /** We need to check in his Node Template Dependencies is case of a Node Template DG */
 183                     if (nodeTemplate.type == BluePrintConstants.NODE_TEMPLATE_TYPE_DG) {
 184                         val dependencyNodeTemplate = nodeTemplate.properties?.get(BluePrintConstants.PROPERTY_DG_DEPENDENCY_NODE_TEMPLATE) as ArrayNode
 185                         dependencyNodeTemplate.forEach { dependencyNodeTemplateName ->
 186                             clonedExecutionServiceInput = hideSensitiveDataFromResourceResolution(
 187                                     blueprintRuntimeService,
 188                                     blueprintContext,
 189                                     clonedExecutionServiceInput,
 190                                     workflowName,
 191                                     dependencyNodeTemplateName.asText()
 192                             )
 193                         }
 194                     } else {
 195                         clonedExecutionServiceInput = hideSensitiveDataFromResourceResolution(
 196                                 blueprintRuntimeService,
 197                                 blueprintContext,
 198                                 clonedExecutionServiceInput,
 199                                 workflowName,
 200                                 nodeTemplateName
 201                         )
 202                     }
 203                 }
 204             }
 205         } catch (e: Exception) {
 206             val errMsg = "ERROR : Couldn't hide sensitive data in the execution request."
 207             log.error(errMsg, e)
 208             clonedExecutionServiceInput.payload.replace(
 209                     "$workflowName-request",
 210                     "$errMsg $e".asJsonPrimitive())
 211         }
 212         return clonedExecutionServiceInput
 213     }
 214
 215     /**
 216      * Hide sensitive data in [executionServiceInput] if the given [nodeTemplateName] is a
 217      * resource resolution component.
 218      * @param blueprintRuntimeService Current blueprint runtime service
 219      * @param blueprintContext Current blueprint runtime context
 220      * @param executionServiceInput BP Execution Request where data needs to be hidden
 221      * @param workflowName Current workflow being executed
 222      * @param nodeTemplateName Node template to check for sensitive data
 223      * @return [executionServiceInput] with sensitive inputs replaced by a generic string
 224      */
 225     private suspend fun hideSensitiveDataFromResourceResolution(
 226         blueprintRuntimeService: BluePrintRuntimeService<MutableMap<String, JsonNode>>,
 227         blueprintContext: BluePrintContext,
 228         executionServiceInput: ExecutionServiceInput,
 229         workflowName: String,
 230         nodeTemplateName: String
 231     ): ExecutionServiceInput {
 232
 233         val nodeTemplate = blueprintContext.nodeTemplateByName(nodeTemplateName)
 234         if (nodeTemplate.type == BluePrintConstants.NODE_TEMPLATE_TYPE_COMPONENT_RESOURCE_RESOLUTION) {
 235             val interfaceName = blueprintContext.nodeTemplateFirstInterfaceName(nodeTemplateName)
 236             val operationName = blueprintContext.nodeTemplateFirstInterfaceFirstOperationName(nodeTemplateName)
 237
 238             val propertyAssignments: MutableMap<String, JsonNode> =
 239                     blueprintContext.nodeTemplateInterfaceOperationInputs(nodeTemplateName, interfaceName, operationName)
 240                             ?: hashMapOf()
 241
 242             /** Getting values define in artifact-prefix-names */
 243             val input = executionServiceInput.payload.get("$workflowName-request")
 244             blueprintRuntimeService.assignWorkflowInputs(workflowName, input)
 245             val artifactPrefixNamesNode = propertyAssignments[ResourceResolutionConstants.INPUT_ARTIFACT_PREFIX_NAMES]
 246             val propertyAssignmentService = PropertyAssignmentService(blueprintRuntimeService)
 247             val artifactPrefixNamesNodeValue = propertyAssignmentService.resolveAssignmentExpression(
 248                     BluePrintConstants.MODEL_DEFINITION_TYPE_NODE_TEMPLATE,
 249                     nodeTemplateName,
 250                     ResourceResolutionConstants.INPUT_ARTIFACT_PREFIX_NAMES,
 251                     artifactPrefixNamesNode!!)
 252
 253             val artifactPrefixNames = JacksonUtils.getListFromJsonNode(artifactPrefixNamesNodeValue!!, String::class.java)
 254
 255             /** Storing mapping entries with metadata log-protect set to true */
 256             val sensitiveParameters: List<String> = artifactPrefixNames
 257                     .map { "$it-mapping" }
 258                     .map { blueprintRuntimeService.resolveNodeTemplateArtifact(nodeTemplateName, it) }
 259                     .flatMap { JacksonUtils.getListFromJson(it, ResourceAssignment::class.java) }
 260                     .filter { PropertyDefinitionUtils.hasLogProtect(it.property) }
 261                     .map { it.name }
 262
 263             /** Hiding sensitive input parameters from the request */
 264             var workflowProperties: ObjectNode = executionServiceInput.payload
 265                     .path("$workflowName-request")
 266                     .path("$workflowName-properties") as ObjectNode
 267
 268             sensitiveParameters.forEach { sensitiveParameter ->
 269                 if (workflowProperties.has(sensitiveParameter)) {
 270                     workflowProperties.replace(sensitiveParameter, ApplicationConstants.LOG_REDACTED.asJsonPrimitive())
 271                 }
 272             }
 273         }
 274         return executionServiceInput
 275     }
 276 }