ziti/controller/internal/policy/api_session_enforcer.go

/*
	Copyright NetFoundry Inc.

	Licensed under the Apache License, Version 2.0 (the "License");
	you may not use this file except in compliance with the License.
	You may obtain a copy of the License at

	https://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
*/

package policy

import (
	"fmt"
	"time"

	"github.com/michaelquigley/pfxlog"
	"github.com/openziti/metrics"
	"github.com/openziti/ziti/v2/common/runner"
	"github.com/openziti/ziti/v2/controller/change"
	"github.com/openziti/ziti/v2/controller/env"
	"github.com/openziti/ziti/v2/controller/model"
	"github.com/sirupsen/logrus"
)

const (
	maxIterations         = 1000
	maxDeletePerIteration = 500

	ApiSessionEnforcerRun    = "api.session.enforcer.run"
	ApiSessionEnforcerDelete = "api.session.enforcer.delete"
)

type ApiSessionEnforcer struct {
	appEnv         model.Env
	sessionTimeout time.Duration
	// Resolved once and held. A Meter lookup takes a reference on every call and only Dispose releases
	// one, so looking one up per run accumulates references and leaves the meter sampling after the
	// registry is disposed. Timer is not reference counted, and is held here so the two read alike.
	runTimer    metrics.Timer
	deleteMeter metrics.Meter
	*runner.BaseOperation
}

func NewSessionEnforcer(appEnv *env.AppEnv, frequency time.Duration, sessionTimeout time.Duration) *ApiSessionEnforcer {
	if sessionTimeout < 60*time.Second {
		pfxlog.Logger().Panic("sessionTimeout can not be less than 60 seconds")
	}

	pfxlog.Logger().
		WithField("sessionTimeout", sessionTimeout.String()).
		WithField("frequency", frequency.String()).
		Info("session enforcer configured")

	return &ApiSessionEnforcer{
		appEnv:         appEnv,
		sessionTimeout: sessionTimeout,
		runTimer:       appEnv.GetMetricsRegistry().Timer(ApiSessionEnforcerRun),
		deleteMeter:    appEnv.GetMetricsRegistry().Meter(ApiSessionEnforcerDelete),
		BaseOperation:  runner.NewBaseOperation("ApiSessionEnforcer", frequency),
	}
}

func (s *ApiSessionEnforcer) Run() error {
	startTime := time.Now()

	defer func() {
		s.runTimer.UpdateSince(startTime)
	}()

	oldest := time.Now().Add(s.sessionTimeout * -1)
	query := fmt.Sprintf("lastActivityAt < datetime(%s) limit %d", oldest.UTC().Format(time.RFC3339), maxDeletePerIteration)

	log := pfxlog.Logger()
	for i := 0; i < maxIterations; i++ {
		ids := make([]string, 0, maxDeletePerIteration)

		//iterate over API Sessions that do not have a recent enough lastAccessedAt
		err := s.appEnv.GetManagers().ApiSession.StreamIds(query, func(id string, err error) error {
			if lastActivityAt, ok := s.appEnv.GetManagers().ApiSession.HeartbeatCollector.LastAccessedAt(id); ok && lastActivityAt != nil {
				log.Tracef("during API session enforcement lastAccessedAt check, API Session [%s] was found in the cache with time [%s]", id, lastActivityAt.String())
				if lastActivityAt.Before(oldest) {
					ids = append(ids, id)
				}
			} else {
				log.Tracef("during API session enforcement lastAccessedAt check, API Session [%s] was not in the cache, using lastAccessedAt from db", id)
				ids = append(ids, id)
			}

			return nil
		})

		if err != nil {
			pfxlog.Logger().Errorf("encountered error querying for API sessions to remove: %v", err)
			break
		}

		if len(ids) == 0 {
			break
		}

		logrus.Debugf("found %v expired api-sessions to remove", len(ids))

		ctx := change.New().SetSourceType("api-session.enforcer").SetChangeAuthorType(change.AuthorTypeController)
		deleted := int64(len(ids))
		if err = s.appEnv.GetManagers().ApiSession.DeleteBatch(ids, ctx); err != nil {
			logrus.WithError(err).Error("failure while batch deleting expired api sessions")

			deleted = 0
			for _, id := range ids {
				if err = s.appEnv.GetManagers().ApiSession.Delete(id, ctx); err != nil {
					logrus.WithError(err).Errorf("failure while deleting expired api session: %v", id)
				} else {
					deleted++
				}
			}
		}
		s.deleteMeter.Mark(deleted)
	}

	return nil
}