ms/blueprintsprocessor/modules/inbounds/selfservice-api/src/main/kotlin/org/onap/ccsdk/cds/blueprintsprocessor/selfservice/api/KafkaPublishAuditService.kt

   1 /*
   2  * Copyright © 2021 Bell Canada
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 package org.onap.ccsdk.cds.blueprintsprocessor.selfservice.api
  18
  19 import com.fasterxml.jackson.databind.JsonNode
  20 import com.fasterxml.jackson.databind.node.ArrayNode
  21 import com.fasterxml.jackson.databind.node.ObjectNode
  22 import org.onap.ccsdk.cds.blueprintsprocessor.core.api.data.ExecutionServiceInput
  23 import org.onap.ccsdk.cds.blueprintsprocessor.core.api.data.ExecutionServiceOutput
  24 import org.onap.ccsdk.cds.blueprintsprocessor.functions.resource.resolution.ResourceResolutionConstants
  25 import org.onap.ccsdk.cds.blueprintsprocessor.message.service.BlueprintMessageLibPropertyService
  26 import org.onap.ccsdk.cds.blueprintsprocessor.message.service.BlueprintMessageProducerService
  27 import org.onap.ccsdk.cds.controllerblueprints.core.BlueprintConstants
  28 import org.onap.ccsdk.cds.controllerblueprints.core.asJsonPrimitive
  29 import org.onap.ccsdk.cds.controllerblueprints.core.common.ApplicationConstants
  30 import org.onap.ccsdk.cds.controllerblueprints.core.interfaces.BlueprintCatalogService
  31 import org.onap.ccsdk.cds.controllerblueprints.core.service.BlueprintContext
  32 import org.onap.ccsdk.cds.controllerblueprints.core.service.BlueprintRuntimeService
  33 import org.onap.ccsdk.cds.controllerblueprints.core.service.PropertyAssignmentService
  34 import org.onap.ccsdk.cds.controllerblueprints.core.utils.BlueprintMetadataUtils
  35 import org.onap.ccsdk.cds.controllerblueprints.core.utils.JacksonUtils
  36 import org.onap.ccsdk.cds.controllerblueprints.core.utils.PropertyDefinitionUtils
  37 import org.onap.ccsdk.cds.controllerblueprints.resource.dict.ResourceAssignment
  38 import org.slf4j.LoggerFactory
  39 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
  40 import org.springframework.stereotype.Service
  41 import javax.annotation.PostConstruct
  42
  43 /**
  44  * Audit service used to produce execution service input and output message
  45  * sent into dedicated kafka topics.
  46  *
  47  * @param bluePrintMessageLibPropertyService Service used to instantiate audit service producers
  48  * @param blueprintsProcessorCatalogService Service used to get the base path of the current CBA executed
  49  *
  50  * @property inputInstance Request Kakfa Producer instance
  51  * @property outputInstance Response Kakfa Producer instance
  52  * @property log Audit Service logger
  53  */
  54 @ConditionalOnProperty(
  55     name = ["blueprintsprocessor.messageproducer.self-service-api.audit.kafkaEnable"],
  56     havingValue = "true"
  57 )
  58 @Service
  59 class KafkaPublishAuditService(
  60     private val bluePrintMessageLibPropertyService: BlueprintMessageLibPropertyService,
  61     private val blueprintsProcessorCatalogService: BlueprintCatalogService
  62 ) : PublishAuditService {
  63
  64     private var inputInstance: BlueprintMessageProducerService? = null
  65     private var outputInstance: BlueprintMessageProducerService? = null
  66     private val log = LoggerFactory.getLogger(KafkaPublishAuditService::class.toString())
  67
  68     companion object {
  69
  70         const val INPUT_SELECTOR = "self-service-api.audit.request"
  71         const val OUTPUT_SELECTOR = "self-service-api.audit.response"
  72     }
  73
  74     @PostConstruct
  75     private fun init() {
  76         log.info("Kakfa audit service is enabled")
  77     }
  78
  79     /**
  80      * Publish execution input into a kafka topic.
  81      * The correlation UUID is used to link the input to its output.
  82      * Sensitive data within the request are hidden.
  83      * @param executionServiceInput Audited BP request
  84      */
  85     override suspend fun publishExecutionInput(executionServiceInput: ExecutionServiceInput) {
  86         val secureExecutionServiceInput = hideSensitiveData(executionServiceInput)
  87         val key = secureExecutionServiceInput.actionIdentifiers.blueprintName
  88         try {
  89             this.inputInstance = this.getInputInstance(INPUT_SELECTOR)
  90             this.inputInstance!!.sendMessage(key, secureExecutionServiceInput)
  91         } catch (ex: Exception) {
  92             log.error("Failed to publish execution request to Kafka.", ex)
  93         }
  94     }
  95
  96     /**
  97      * Publish execution output into a kafka topic.
  98      * The correlation UUID is used to link the output to its input.
  99      * A correlation UUID is added to link the input to its output.
 100      * @param correlationUUID UUID used to link the audited response to its audited request
 101      * @param executionServiceOutput Audited BP response
 102      */
 103     override suspend fun publishExecutionOutput(correlationUUID: String, executionServiceOutput: ExecutionServiceOutput) {
 104         executionServiceOutput.correlationUUID = correlationUUID
 105         val key = executionServiceOutput.actionIdentifiers.blueprintName
 106         try {
 107             this.outputInstance = this.getOutputInstance(OUTPUT_SELECTOR)
 108             this.outputInstance!!.sendMessage(key, executionServiceOutput)
 109         } catch (ex: Exception) {
 110             log.error("Failed to publish execution response to Kafka.", ex)
 111         }
 112     }
 113
 114     /**
 115      * Return the input kafka producer instance using a [selector] if not already instantiated.
 116      * @param selector Selector to retrieve request kafka producer configuration
 117      */
 118     private fun getInputInstance(selector: String): BlueprintMessageProducerService = inputInstance ?: createInstance(selector)
 119
 120     /**
 121      * Return the output kafka producer instance using a [selector] if not already instantiated.
 122      * @param selector Selector to retrieve response kafka producer configuration
 123      */
 124     private fun getOutputInstance(selector: String): BlueprintMessageProducerService = outputInstance ?: createInstance(selector)
 125
 126     /**
 127      * Create a kafka producer instance using a [selector].
 128      * @param selector Selector to retrieve kafka producer configuration
 129      */
 130     private fun createInstance(selector: String): BlueprintMessageProducerService {
 131         log.info("Setting up message producer($selector)...")
 132         return bluePrintMessageLibPropertyService.blueprintMessageProducerService(selector)
 133     }
 134
 135     /**
 136      * Hide sensitive data in the [executionServiceInput].
 137      * Sensitive data are declared in the resource resolution mapping using
 138      * the property metadata "log-protect" set to true.
 139      * @param executionServiceInput BP Execution Request where data needs to be hidden
 140      */
 141     private suspend fun hideSensitiveData(
 142         executionServiceInput: ExecutionServiceInput
 143     ): ExecutionServiceInput {
 144
 145         var clonedExecutionServiceInput = ExecutionServiceInput().apply {
 146             correlationUUID = executionServiceInput.correlationUUID
 147             commonHeader = executionServiceInput.commonHeader
 148             actionIdentifiers = executionServiceInput.actionIdentifiers
 149             payload = executionServiceInput.payload.deepCopy()
 150             stepData = executionServiceInput.stepData
 151         }
 152
 153         val blueprintName = clonedExecutionServiceInput.actionIdentifiers.blueprintName
 154         val workflowName = clonedExecutionServiceInput.actionIdentifiers.actionName
 155
 156         if (blueprintName == "default") return clonedExecutionServiceInput
 157
 158         try {
 159             if (clonedExecutionServiceInput.payload
 160                 .path("$workflowName-request").has("$workflowName-properties")
 161             ) {
 162
 163                 /** Retrieving sensitive input parameters */
 164                 val requestId = clonedExecutionServiceInput.commonHeader.requestId
 165                 val blueprintVersion = clonedExecutionServiceInput.actionIdentifiers.blueprintVersion
 166
 167                 val basePath = blueprintsProcessorCatalogService.getFromDatabase(blueprintName, blueprintVersion)
 168
 169                 val blueprintRuntimeService = BlueprintMetadataUtils.getBlueprintRuntime(requestId, basePath.toString())
 170                 val blueprintContext = blueprintRuntimeService.bluePrintContext()
 171
 172                 val workflowSteps = blueprintContext.workflowByName(workflowName).steps
 173                 checkNotNull(workflowSteps) { "Failed to get step(s) for workflow($workflowName)" }
 174                 workflowSteps.forEach { step ->
 175                     val nodeTemplateName = step.value.target
 176                     checkNotNull(nodeTemplateName) { "Failed to get node template target for workflow($workflowName), step($step)" }
 177                     val nodeTemplate = blueprintContext.nodeTemplateByName(nodeTemplateName)
 178
 179                     /** We need to check in his Node Template Dependencies is case of a Node Template DG */
 180                     if (nodeTemplate.type == BlueprintConstants.NODE_TEMPLATE_TYPE_DG) {
 181                         val dependencyNodeTemplate =
 182                             nodeTemplate.properties?.get(BlueprintConstants.PROPERTY_DG_DEPENDENCY_NODE_TEMPLATE) as ArrayNode
 183                         dependencyNodeTemplate.forEach { dependencyNodeTemplateName ->
 184                             clonedExecutionServiceInput = hideSensitiveDataFromResourceResolution(
 185                                 blueprintRuntimeService,
 186                                 blueprintContext,
 187                                 clonedExecutionServiceInput,
 188                                 workflowName,
 189                                 dependencyNodeTemplateName.asText()
 190                             )
 191                         }
 192                     } else {
 193                         clonedExecutionServiceInput = hideSensitiveDataFromResourceResolution(
 194                             blueprintRuntimeService,
 195                             blueprintContext,
 196                             clonedExecutionServiceInput,
 197                             workflowName,
 198                             nodeTemplateName
 199                         )
 200                     }
 201                 }
 202             }
 203         } catch (ex: Exception) {
 204             val errMsg = "Couldn't hide sensitive data in the execution request."
 205             log.error(errMsg, ex)
 206             clonedExecutionServiceInput.payload.replace(
 207                 "$workflowName-request",
 208                 "$errMsg $ex".asJsonPrimitive()
 209             )
 210         }
 211         return clonedExecutionServiceInput
 212     }
 213
 214     /**
 215      * Hide sensitive data in [executionServiceInput] if the given [nodeTemplateName] is a
 216      * resource resolution component.
 217      * @param blueprintRuntimeService Current blueprint runtime service
 218      * @param blueprintContext Current blueprint runtime context
 219      * @param executionServiceInput BP Execution Request where data needs to be hidden
 220      * @param workflowName Current workflow being executed
 221      * @param nodeTemplateName Node template to check for sensitive data
 222      * @return [executionServiceInput] with sensitive inputs replaced by a generic string
 223      */
 224     private suspend fun hideSensitiveDataFromResourceResolution(
 225         blueprintRuntimeService: BlueprintRuntimeService<MutableMap<String, JsonNode>>,
 226         blueprintContext: BlueprintContext,
 227         executionServiceInput: ExecutionServiceInput,
 228         workflowName: String,
 229         nodeTemplateName: String
 230     ): ExecutionServiceInput {
 231
 232         val nodeTemplate = blueprintContext.nodeTemplateByName(nodeTemplateName)
 233         if (nodeTemplate.type == BlueprintConstants.NODE_TEMPLATE_TYPE_COMPONENT_RESOURCE_RESOLUTION) {
 234             val interfaceName = blueprintContext.nodeTemplateFirstInterfaceName(nodeTemplateName)
 235             val operationName = blueprintContext.nodeTemplateFirstInterfaceFirstOperationName(nodeTemplateName)
 236
 237             val propertyAssignments: MutableMap<String, JsonNode> =
 238                 blueprintContext.nodeTemplateInterfaceOperationInputs(nodeTemplateName, interfaceName, operationName)
 239                     ?: hashMapOf()
 240
 241             /** Getting values define in artifact-prefix-names */
 242             val input = executionServiceInput.payload.get("$workflowName-request")
 243             blueprintRuntimeService.assignWorkflowInputs(workflowName, input)
 244             val artifactPrefixNamesNode = propertyAssignments[ResourceResolutionConstants.INPUT_ARTIFACT_PREFIX_NAMES]
 245             val propertyAssignmentService = PropertyAssignmentService(blueprintRuntimeService)
 246             val artifactPrefixNamesNodeValue = propertyAssignmentService.resolveAssignmentExpression(
 247                 BlueprintConstants.MODEL_DEFINITION_TYPE_NODE_TEMPLATE,
 248                 nodeTemplateName,
 249                 ResourceResolutionConstants.INPUT_ARTIFACT_PREFIX_NAMES,
 250                 artifactPrefixNamesNode!!
 251             )
 252
 253             val artifactPrefixNames = JacksonUtils.getListFromJsonNode(artifactPrefixNamesNodeValue!!, String::class.java)
 254
 255             /** Storing mapping entries with metadata log-protect set to true */
 256             val sensitiveParameters: List<String> = artifactPrefixNames
 257                 .map { "$it-mapping" }
 258                 .map { blueprintRuntimeService.resolveNodeTemplateArtifact(nodeTemplateName, it) }
 259                 .flatMap { JacksonUtils.getListFromJson(it, ResourceAssignment::class.java) }
 260                 .filter { PropertyDefinitionUtils.hasLogProtect(it.property) }
 261                 .map { it.name }
 262
 263             /** Hiding sensitive input parameters from the request */
 264             var workflowProperties: ObjectNode = executionServiceInput.payload
 265                 .path("$workflowName-request")
 266                 .path("$workflowName-properties") as ObjectNode
 267
 268             sensitiveParameters.forEach { sensitiveParameter ->
 269                 if (workflowProperties.has(sensitiveParameter)) {
 270                     workflowProperties.replace(sensitiveParameter, ApplicationConstants.LOG_REDACTED.asJsonPrimitive())
 271                 }
 272             }
 273         }
 274         return executionServiceInput
 275     }
 276 }