Nail/sless
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shared-sqs: Этап 4 — изоляция очередей по тенанту

Browse Source
This commit is contained in:
Naeel
2026-04-09 12:53:10 +03:00
parent f4352a17b1
commit 08053ca8e5
16 changed files with 1243 additions and 882 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shared-sqs/app/auth/auth_middleware.go
+114
View File
@@ -0,0 +1,114 @@
// Изменено: 2026-04-09
// Auth middleware для shared-sqs: извлекает AccessKeyId из AWS Authorization header
// и помещает найденного тенанта в context запроса.
package auth
import (
"context"
"encoding/xml"
"net/http"
"strings"
"shared-sqs/app/tenant"
)
// TenantContextKey — ключ для хранения тенанта в request context.
// Тип contextKey предотвращает конфликты с другими пакетами.
type contextKey string
const TenantContextKey contextKey = "tenant"
// AuthMiddleware — middleware: ищет тенанта по AccessKeyId из AWS Authorization header.
// Пропускает /health и /admin/** без tenant-аутентификации.
// Ловушка #4: не ставим короткий таймаут — ReceiveMessage с long polling держит соединение до 20 сек.
func AuthMiddleware(store *tenant.TenantStore) func(http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// /health — без auth
if r.URL.Path == "/health" {
next.ServeHTTP(w, r)
return
}
// /admin/** — отдельная auth (bearer token, см. admin_handlers.go)
if strings.HasPrefix(r.URL.Path, "/admin/") {
next.ServeHTTP(w, r)
return
}
accessKeyID := extractAccessKeyID(r)
if accessKeyID == "" {
writeSQSAuthError(w, "MissingAuthenticationToken", "Request must contain either AccessKeyId or X-Amz-Credential")
return
}
t, ok := store.GetByAccessKey(accessKeyID)
if !ok || !t.Active {
writeSQSAuthError(w, "InvalidClientTokenId", "The security token included in the request is invalid")
return
}
ctx := context.WithValue(r.Context(), TenantContextKey, t)
next.ServeHTTP(w, r.WithContext(ctx))
})
}
}
// extractAccessKeyID — извлекает AWS AccessKeyId из запроса.
// Поддерживает оба варианта: Authorization header (Signature V4) и X-Amz-Credential query param (presigned URLs).
// Ловушка #3: AWS CLI ВСЕГДА отправляет Signature V4 — нужно парсить, даже не проверяя подпись.
// Ловушка #5: X-Amz-Security-Token (STS) — игнорируем.
func extractAccessKeyID(r *http.Request) string {
// Вариант 1: Authorization header
// Формат: "AWS4-HMAC-SHA256 Credential={AccessKeyId}/{date}/{region}/sqs/aws4_request, ..."
auth := r.Header.Get("Authorization")
if strings.HasPrefix(auth, "AWS4-HMAC-SHA256") {
idx := strings.Index(auth, "Credential=")
if idx >= 0 {
rest := auth[idx+len("Credential="):]
slashIdx := strings.Index(rest, "/")
if slashIdx > 0 {
return rest[:slashIdx]
}
}
}
// Вариант 2: Query parameter (presigned URLs)
// Формат: X-Amz-Credential={AccessKeyId}/{date}/{region}/sqs/aws4_request
if cred := r.URL.Query().Get("X-Amz-Credential"); cred != "" {
parts := strings.SplitN(cred, "/", 2)
if len(parts) > 0 && parts[0] != "" {
return parts[0]
}
}
return ""
}
// sqsAuthError — AWS-совместимый XML ответ об ошибке аутентификации.
type sqsAuthError struct {
XMLName xml.Name `xml:"ErrorResponse"`
Error sqsErrorBody `xml:"Error"`
RequestID string `xml:"RequestId"`
}
type sqsErrorBody struct {
Type string `xml:"Type"`
Code string `xml:"Code"`
Message string `xml:"Message"`
}
// writeSQSAuthError — отвечает AWS-совместимым XML с кодом 403.
func writeSQSAuthError(w http.ResponseWriter, code, message string) {
w.Header().Set("Content-Type", "application/xml")
w.WriteHeader(http.StatusForbidden)
resp := sqsAuthError{
Error: sqsErrorBody{
Type: "Sender",
Code: code,
Message: message,
},
RequestID: "00000000-0000-0000-0000-000000000000",
}
data, _ := xml.Marshal(resp)
w.Write(data)
}
shared-sqs/app/gosqs/change_message_visibility.go
+13 -7
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// ChangeMessageVisibilityV1 — меняет visibility timeout сообщения в очереди тенанта.
package gosqs
import (
@@ -20,8 +22,12 @@ func ChangeMessageVisibilityV1(req *http.Request) (int, interfaces.AbstractRespo
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
vars := mux.Vars(req)
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
vars := mux.Vars(req)
queueUrl := requestBody.QueueUrl
queueName := ""
if queueUrl == "" {
@@ -31,24 +37,25 @@ func ChangeMessageVisibilityV1(req *http.Request) (int, interfaces.AbstractRespo
queueName = uriSegments[len(uriSegments)-1]
}
key := tenantQueueKey(t.AccessKey, queueName)
receiptHandle := requestBody.ReceiptHandle
visibilityTimeout := requestBody.VisibilityTimeout
if visibilityTimeout > 43200 {
return utils.CreateErrorResponseV1("ValidationError", true)
}
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
if _, ok := models.SyncQueues.Queues[key]; !ok {
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
models.SyncQueues.Lock()
messageFound := false
for i := 0; i < len(models.SyncQueues.Queues[queueName].Messages); i++ {
queue := models.SyncQueues.Queues[queueName]
for i := 0; i < len(models.SyncQueues.Queues[key].Messages); i++ {
queue := models.SyncQueues.Queues[key]
msgs := queue.Messages
if msgs[i].ReceiptHandle == receiptHandle {
timeout := models.SyncQueues.Queues[queueName].VisibilityTimeout
timeout := models.SyncQueues.Queues[key].VisibilityTimeout
if visibilityTimeout == 0 {
msgs[i].ReceiptTime = time.Now().UTC()
msgs[i].ReceiptHandle = ""
@@ -76,6 +83,5 @@ func ChangeMessageVisibilityV1(req *http.Request) (int, interfaces.AbstractRespo
Xmlns: models.BaseXmlns,
Metadata: models.BaseResponseMetadata,
}
return http.StatusOK, &respStruct
}
shared-sqs/app/gosqs/create_queue.go
+23 -12
View File
@@ -1,3 +1,6 @@
// Изменено: 2026-04-09
// CreateQueueV1 — создаёт очередь для тенанта из request context.
// Ключ в SyncQueues: "{tenantAccessKey}:{queueName}" для изоляции между тенантами.
package gosqs
import (
@@ -17,18 +20,26 @@ func CreateQueueV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
log.Error("Invalid Request - CreateQueueV1")
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
queueName := requestBody.QueueName
queueUrl := "http://" + models.CurrentEnvironment.Host + ":" + models.CurrentEnvironment.Port +
"/" + models.CurrentEnvironment.AccountID + "/" + queueName
if models.CurrentEnvironment.Region != "" {
queueUrl = "http://" + models.CurrentEnvironment.Region + "." + models.CurrentEnvironment.Host + ":" +
models.CurrentEnvironment.Port + "/" + models.CurrentEnvironment.AccountID + "/" + queueName
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
queueArn := "arn:aws:sqs:" + models.CurrentEnvironment.Region + ":" + models.CurrentEnvironment.AccountID + ":" + queueName
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
log.Infof("Creating Queue: %s", queueName)
// Ловушка #8: передаём queueName (не key) в HasFIFOQueueName — иначе .fifo не определится
queueName := requestBody.QueueName
key := tenantQueueKey(t.AccessKey, queueName)
queueUrl := tenantQueueURL(t, queueName)
queueArn := tenantQueueARN(t, queueName)
models.SyncQueues.Lock()
if _, exists := models.SyncQueues.Queues[key]; !exists {
// Проверка лимита очередей тенанта
if t.MaxQueues > 0 && countTenantQueues(t.AccessKey) >= t.MaxQueues {
models.SyncQueues.Unlock()
return utils.CreateErrorResponseV1("LimitExceeded", true)
}
log.Infof("Creating Queue: %s (tenant: %s)", queueName, t.ID)
queue := &models.Queue{
Name: queueName,
URL: queueUrl,
@@ -38,12 +49,12 @@ func CreateQueueV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
Duplicates: make(map[string]time.Time),
}
if err := setQueueAttributesV1(queue, requestBody.Attributes); err != nil {
models.SyncQueues.Unlock()
return utils.CreateErrorResponseV1(err.Error(), true)
}
models.SyncQueues.Lock()
models.SyncQueues.Queues[queueName] = queue
models.SyncQueues.Unlock()
models.SyncQueues.Queues[key] = queue
}
models.SyncQueues.Unlock()
respStruct := models.CreateQueueResponse{
Xmlns: models.BaseXmlns,
shared-sqs/app/gosqs/delete_message.go
+13 -14
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// DeleteMessageV1 — удаляет сообщение из очереди тенанта по ReceiptHandle.
package gosqs
import (
@@ -19,10 +21,12 @@ func DeleteMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
// Retrieve FormValues required
receiptHandle := requestBody.ReceiptHandle
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
// Retrieve FormValues required
receiptHandle := requestBody.ReceiptHandle
queueUrl := requestBody.QueueUrl
queueName := ""
if queueUrl == "" {
@@ -33,22 +37,17 @@ func DeleteMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
queueName = uriSegments[len(uriSegments)-1]
}
key := tenantQueueKey(t.AccessKey, queueName)
log.Info("Deleting Message, Queue:", queueName, ", ReceiptHandle:", receiptHandle)
// Find queue/message with the receipt handle and delete
models.SyncQueues.Lock()
defer models.SyncQueues.Unlock()
if _, ok := models.SyncQueues.Queues[queueName]; ok {
for i, msg := range models.SyncQueues.Queues[queueName].Messages {
if _, ok := models.SyncQueues.Queues[key]; ok {
for i, msg := range models.SyncQueues.Queues[key].Messages {
if msg.ReceiptHandle == receiptHandle {
// Unlock messages for the group
log.Debugf("FIFO Queue %s unlocking group %s:", queueName, msg.GroupID)
models.SyncQueues.Queues[queueName].UnlockGroup(msg.GroupID)
//Delete message from Q
models.SyncQueues.Queues[queueName].Messages = append(models.SyncQueues.Queues[queueName].Messages[:i], models.SyncQueues.Queues[queueName].Messages[i+1:]...)
delete(models.SyncQueues.Queues[queueName].Duplicates, msg.DeduplicationID)
// Create, encode/xml and send response
models.SyncQueues.Queues[key].UnlockGroup(msg.GroupID)
models.SyncQueues.Queues[key].Messages = append(models.SyncQueues.Queues[key].Messages[:i], models.SyncQueues.Queues[key].Messages[i+1:]...)
delete(models.SyncQueues.Queues[key].Duplicates, msg.DeduplicationID)
respStruct := models.DeleteMessageResponse{
Xmlns: models.BaseXmlns,
Metadata: models.BaseResponseMetadata,
shared-sqs/app/gosqs/delete_message_batch.go
+21 -20
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// DeleteMessageBatchV1 — пакетное удаление сообщений из очереди тенанта.
package gosqs
import (
@@ -19,8 +21,12 @@ func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBo
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
queueUrl := requestBody.QueueUrl
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
queueUrl := requestBody.QueueUrl
queueName := ""
if queueUrl == "" {
vars := mux.Vars(req)
@@ -30,7 +36,9 @@ func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBo
queueName = uriSegments[len(uriSegments)-1]
}
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
@@ -53,7 +61,6 @@ func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBo
models.SyncQueues.Lock()
defer models.SyncQueues.Unlock()
// create deleteMessageMap
deleteMessageMap := make(map[string]*deleteEntry)
for _, entry := range requestBody.Entries {
deleteMessageMap[entry.ReceiptHandle] = &deleteEntry{
@@ -64,33 +71,28 @@ func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBo
}
deletedEntries := make([]models.DeleteMessageBatchResultEntry, 0)
// create a slice to hold messages that are not deleted
remainingMessages := make([]models.SqsMessage, 0, len(models.SyncQueues.Queues[queueName].Messages))
remainingMessages := make([]models.SqsMessage, 0, len(models.SyncQueues.Queues[key].Messages))
// delete message from queue
for _, message := range models.SyncQueues.Queues[queueName].Messages {
if deleteEntry, found := deleteMessageMap[message.ReceiptHandle]; found {
// Unlock messages for the group
for _, message := range models.SyncQueues.Queues[key].Messages {
if de, found := deleteMessageMap[message.ReceiptHandle]; found {
log.Debugf("FIFO Queue %s unlocking group %s:", queueName, message.GroupID)
models.SyncQueues.Queues[queueName].UnlockGroup(message.GroupID)
delete(models.SyncQueues.Queues[queueName].Duplicates, message.DeduplicationID)
deleteEntry.Deleted = true
deletedEntries = append(deletedEntries, models.DeleteMessageBatchResultEntry{Id: deleteEntry.Id})
models.SyncQueues.Queues[key].UnlockGroup(message.GroupID)
delete(models.SyncQueues.Queues[key].Duplicates, message.DeduplicationID)
de.Deleted = true
deletedEntries = append(deletedEntries, models.DeleteMessageBatchResultEntry{Id: de.Id})
} else {
remainingMessages = append(remainingMessages, message)
}
}
// Update the queue with the remaining mesages
models.SyncQueues.Queues[queueName].Messages = remainingMessages
models.SyncQueues.Queues[key].Messages = remainingMessages
// Process not found entries
notFoundEntries := make([]models.BatchResultErrorEntry, 0)
for _, deleteEntry := range deleteMessageMap {
if !deleteEntry.Deleted {
for _, de := range deleteMessageMap {
if !de.Deleted {
notFoundEntries = append(notFoundEntries, models.BatchResultErrorEntry{
Code: "1",
Id: deleteEntry.Id,
Id: de.Id,
Message: "Message not found",
SenderFault: true,
})
@@ -107,7 +109,6 @@ func DeleteMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBo
}
return http.StatusOK, respStruct
}
type deleteEntry struct {
shared-sqs/app/gosqs/delete_queue.go
+10 -4
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// DeleteQueueV1 — удаляет очередь тенанта по tenant-scoped ключу.
package gosqs
import (
@@ -5,10 +7,8 @@ import (
"strings"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
)
@@ -20,13 +20,19 @@ func DeleteQueueV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
uriSegments := strings.Split(requestBody.QueueUrl, "/")
queueName := uriSegments[len(uriSegments)-1]
key := tenantQueueKey(t.AccessKey, queueName)
log.Infof("Deleting Queue: %s", queueName)
log.Infof("Deleting Queue: %s (tenant: %s)", queueName, t.ID)
models.SyncQueues.Lock()
delete(models.SyncQueues.Queues, queueName)
delete(models.SyncQueues.Queues, key)
models.SyncQueues.Unlock()
respStruct := models.DeleteQueueResponse{
shared-sqs/app/gosqs/get_queue_attributes.go
+30 -47
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// GetQueueAttributesV1 — возвращает атрибуты очереди тенанта.
package gosqs
import (
@@ -6,12 +8,10 @@ import (
"strconv"
"strings"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
"github.com/mitchellh/copystructure"
"shared-sqs/app/interfaces"
log "github.com/sirupsen/logrus"
)
@@ -27,6 +27,11 @@ func GetQueueAttributesV1(req *http.Request) (int, interfaces.AbstractResponseBo
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
requestedAttributes := func() map[string]bool {
attrs := map[string]bool{}
if len(requestBody.AttributeNames) == 0 {
@@ -45,9 +50,8 @@ func GetQueueAttributesV1(req *http.Request) (int, interfaces.AbstractResponseBo
includedAttributes, _ := dupe.(map[string]bool)
_, ok = requestedAttributes["All"]
if !ok {
for attr, _ := range includedAttributes {
_, ok := requestedAttributes[attr]
if !ok {
for attr := range includedAttributes {
if _, ok := requestedAttributes[attr]; !ok {
delete(includedAttributes, attr)
}
}
@@ -55,75 +59,54 @@ func GetQueueAttributesV1(req *http.Request) (int, interfaces.AbstractResponseBo
uriSegments := strings.Split(requestBody.QueueUrl, "/")
queueName := uriSegments[len(uriSegments)-1]
key := tenantQueueKey(t.AccessKey, queueName)
log.Infof("Get Queue QueueAttributes: %s", queueName)
queueAttributes := make([]models.Attribute, 0, 0)
log.Infof("Get Queue Attributes: %s (tenant: %s)", queueName, t.ID)
queueAttributes := make([]models.Attribute, 0)
models.SyncQueues.RLock()
defer models.SyncQueues.RUnlock()
queue, ok := models.SyncQueues.Queues[queueName]
queue, ok := models.SyncQueues.Queues[key]
if !ok {
log.Errorf("Get Queue URL: %s queue does not exist!!!", queueName)
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
log.Errorf("Get Queue Attributes: %s queue does not exist for tenant %s", queueName, t.ID)
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
if _, ok := includedAttributes["DelaySeconds"]; ok {
attr := models.Attribute{Name: "DelaySeconds", Value: strconv.Itoa(queue.DelaySeconds)}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "DelaySeconds", Value: strconv.Itoa(queue.DelaySeconds)})
}
if _, ok := includedAttributes["MaximumMessageSize"]; ok {
attr := models.Attribute{Name: "MaximumMessageSize", Value: strconv.Itoa(queue.MaximumMessageSize)}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "MaximumMessageSize", Value: strconv.Itoa(queue.MaximumMessageSize)})
}
if _, ok := includedAttributes["MessageRetentionPeriod"]; ok {
attr := models.Attribute{Name: "MessageRetentionPeriod", Value: strconv.Itoa(queue.MessageRetentionPeriod)}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "MessageRetentionPeriod", Value: strconv.Itoa(queue.MessageRetentionPeriod)})
}
if _, ok := includedAttributes["ReceiveMessageWaitTimeSeconds"]; ok {
attr := models.Attribute{Name: "ReceiveMessageWaitTimeSeconds", Value: strconv.Itoa(queue.ReceiveMessageWaitTimeSeconds)}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "ReceiveMessageWaitTimeSeconds", Value: strconv.Itoa(queue.ReceiveMessageWaitTimeSeconds)})
}
if _, ok := includedAttributes["VisibilityTimeout"]; ok {
attr := models.Attribute{Name: "VisibilityTimeout", Value: strconv.Itoa(queue.VisibilityTimeout)}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "VisibilityTimeout", Value: strconv.Itoa(queue.VisibilityTimeout)})
}
if _, ok := includedAttributes["ApproximateNumberOfMessages"]; ok {
attr := models.Attribute{Name: "ApproximateNumberOfMessages", Value: strconv.Itoa(len(queue.Messages))}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "ApproximateNumberOfMessages", Value: strconv.Itoa(len(queue.Messages))})
}
// TODO - implement
//if _, ok := includedAttributes["ApproximateNumberOfMessagesDelayed"]; ok {
// attr := models.Attribute{Name: "ApproximateNumberOfMessagesDelayed", Value: strconv.Itoa(len(queue.Messages))}
// queueAttributes = append(queueAttributes, attr)
//}
if _, ok := includedAttributes["ApproximateNumberOfMessagesNotVisible"]; ok {
attr := models.Attribute{Name: "ApproximateNumberOfMessagesNotVisible", Value: strconv.Itoa(numberOfHiddenMessagesInQueue(*queue))}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "ApproximateNumberOfMessagesNotVisible", Value: strconv.Itoa(numberOfHiddenMessagesInQueue(*queue))})
}
if _, ok := includedAttributes["CreatedTimestamp"]; ok {
attr := models.Attribute{Name: "CreatedTimestamp", Value: "0000000000"}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "CreatedTimestamp", Value: "0000000000"})
}
if _, ok := includedAttributes["LastModifiedTimestamp"]; ok {
attr := models.Attribute{Name: "LastModifiedTimestamp", Value: "0000000000"}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "LastModifiedTimestamp", Value: "0000000000"})
}
if _, ok := includedAttributes["QueueArn"]; ok {
attr := models.Attribute{Name: "QueueArn", Value: queue.Arn}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{Name: "QueueArn", Value: queue.Arn})
}
// TODO - implement
//if _, ok := includedAttributes["Policy"]; ok {
// attr := models.Attribute{Name: "Policy", Value: ""}
// queueAttributes = append(queueAttributes, attr)
//}
//if _, ok := includedAttributes["RedriveAllowPolicy"]; ok {
// attr := models.Attribute{Name: "RedriveAllowPolicy", Value: ""}
// queueAttributes = append(queueAttributes, attr)
//}
if _, ok := includedAttributes["RedrivePolicy"]; ok && queue.DeadLetterQueue != nil {
attr := models.Attribute{Name: "RedrivePolicy", Value: fmt.Sprintf(`{"maxReceiveCount":"%d", "deadLetterTargetArn":"%s"}`, queue.MaxReceiveCount, queue.DeadLetterQueue.Arn)}
queueAttributes = append(queueAttributes, attr)
queueAttributes = append(queueAttributes, models.Attribute{
Name: "RedrivePolicy",
Value: fmt.Sprintf(`{"maxReceiveCount":"%d", "deadLetterTargetArn":"%s"}`, queue.MaxReceiveCount, queue.DeadLetterQueue.Arn),
})
}
respStruct := models.GetQueueAttributesResponse{
shared-sqs/app/gosqs/get_queue_url.go
+13 -5
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// GetQueueUrlV1 — возвращает URL очереди тенанта по имени.
package gosqs
import (
@@ -17,19 +19,25 @@ func GetQueueUrlV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
queueName := requestBody.QueueName
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
log.Error("Get Queue URL:", queueName, ", queue does not exist!!!")
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
log.Errorf("Get Queue URL: %s, queue does not exist for tenant %s", queueName, t.ID)
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
queue := models.SyncQueues.Queues[queueName]
queue := models.SyncQueues.Queues[key]
log.Debug("Get Queue URL:", queue.Name)
result := models.GetQueueUrlResult{QueueUrl: queue.URL}
respStruct := models.GetQueueUrlResponse{
Xmlns: models.BaseXmlns,
Result: result,
Result: models.GetQueueUrlResult{QueueUrl: queue.URL},
Metadata: models.BaseResponseMetadata,
}
return http.StatusOK, respStruct
shared-sqs/app/gosqs/list_queues.go
+18 -12
View File
@@ -1,20 +1,18 @@
// Изменено: 2026-04-09
// ListQueuesV1 — возвращает только очереди текущего тенанта.
// Изоляция: фильтруем SyncQueues по префиксу "{tenantAccessKey}:".
package gosqs
import (
"net/http"
"strings"
"shared-sqs/app/utils"
"shared-sqs/app/models"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
)
// TODO - set up MaxResults, NextToken request params
//
// https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueues.html
func ListQueuesV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
requestBody := models.NewListQueuesRequest()
ok := utils.REQUEST_TRANSFORMER(requestBody, req, true)
@@ -23,22 +21,30 @@ func ListQueuesV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
log.Info("Listing Queues")
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
log.Infof("Listing Queues for tenant: %s", t.ID)
queueUrls := make([]string, 0)
prefix := t.AccessKey + ":"
models.SyncQueues.Lock()
for _, queue := range models.SyncQueues.Queues {
for key, queue := range models.SyncQueues.Queues {
// Показываем только очереди этого тенанта
if strings.HasPrefix(key, prefix) {
if strings.HasPrefix(queue.Name, requestBody.QueueNamePrefix) {
queueUrls = append(queueUrls, queue.URL)
}
}
}
models.SyncQueues.Unlock()
respStruct := models.ListQueuesResponse{
Xmlns: models.BaseXmlns,
Metadata: models.BaseResponseMetadata,
Result: models.ListQueuesResult{
QueueUrls: queueUrls,
},
Result: models.ListQueuesResult{QueueUrls: queueUrls},
}
return http.StatusOK, respStruct
shared-sqs/app/gosqs/purge_queue.go
+13 -6
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// PurgeQueueV1 — очищает все сообщения в очереди тенанта.
package gosqs
import (
@@ -8,7 +10,6 @@ import (
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
)
@@ -20,19 +21,25 @@ func PurgeQueueV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
uriSegments := strings.Split(requestBody.QueueUrl, "/")
queueName := uriSegments[len(uriSegments)-1]
key := tenantQueueKey(t.AccessKey, queueName)
models.SyncQueues.Lock()
defer models.SyncQueues.Unlock()
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
log.Errorf("Purge Queue: %s, queue does not exist!!!", queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
log.Errorf("Purge Queue: %s, queue does not exist for tenant %s", queueName, t.ID)
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
log.Infof("Purging Queue: %s", queueName)
models.SyncQueues.Queues[queueName].Messages = nil
models.SyncQueues.Queues[queueName].Duplicates = make(map[string]time.Time)
log.Infof("Purging Queue: %s (tenant: %s)", queueName, t.ID)
models.SyncQueues.Queues[key].Messages = nil
models.SyncQueues.Queues[key].Duplicates = make(map[string]time.Time)
respStruct := models.PurgeQueueResponse{
Xmlns: models.BaseXmlns,
shared-sqs/app/gosqs/receive_message.go
+33 -29
View File
@@ -1,3 +1,6 @@
// Изменено: 2026-04-09
// ReceiveMessageV1 — получает сообщения из очереди тенанта с поддержкой long polling.
// Ловушка #4: long polling держит соединение до 20 сек — не прерываем принудительно.
package gosqs
import (
@@ -15,9 +18,6 @@ import (
log "github.com/sirupsen/logrus"
)
// TODO - Admiral-Piett - could we refactor the way we hide messages? Change data structure to a queue
// organized by "reveal time" or a map with the key being a timestamp of when it could be shown?
// Ordered Map - https://github.com/elliotchance/orderedmap
func ReceiveMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
requestBody := models.NewReceiveMessageRequest()
ok := utils.REQUEST_TRANSFORMER(requestBody, req, false)
@@ -26,6 +26,11 @@ func ReceiveMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody)
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
maxNumberOfMessages := requestBody.MaxNumberOfMessages
if maxNumberOfMessages == 0 {
maxNumberOfMessages = 1
@@ -40,7 +45,9 @@ func ReceiveMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody)
queueName = uriSegments[len(uriSegments)-1]
}
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
@@ -50,19 +57,20 @@ func ReceiveMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody)
waitTimeSeconds := requestBody.WaitTimeSeconds
if waitTimeSeconds == 0 {
models.SyncQueues.RLock()
waitTimeSeconds = models.SyncQueues.Queues[queueName].ReceiveMessageWaitTimeSeconds
waitTimeSeconds = models.SyncQueues.Queues[key].ReceiveMessageWaitTimeSeconds
models.SyncQueues.RUnlock()
}
// Long polling: ждём появления сообщения до waitTimeSeconds*10 итераций по 100ms
loops := waitTimeSeconds * 10
for loops > 0 {
models.SyncQueues.RLock()
_, queueFound := models.SyncQueues.Queues[queueName]
_, queueFound := models.SyncQueues.Queues[key]
if !queueFound {
models.SyncQueues.RUnlock()
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
messageFound := len(models.SyncQueues.Queues[queueName].Messages)-numberOfHiddenMessagesInQueue(*models.SyncQueues.Queues[queueName]) != 0
messageFound := len(models.SyncQueues.Queues[key].Messages)-numberOfHiddenMessagesInQueue(*models.SyncQueues.Queues[key]) != 0
models.SyncQueues.RUnlock()
if !messageFound {
continueTimer := time.NewTimer(100 * time.Millisecond)
@@ -81,37 +89,34 @@ func ReceiveMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody)
} else {
break
}
}
log.Debugf("Getting Message from Queue:%s", queueName)
log.Debugf("Getting Message from Queue:%s (tenant: %s)", queueName, t.ID)
models.SyncQueues.Lock() // Lock the Queues
defer models.SyncQueues.Unlock() // Unlock the Queues
models.SyncQueues.Lock()
defer models.SyncQueues.Unlock()
if len(models.SyncQueues.Queues[queueName].Messages) > 0 {
if len(models.SyncQueues.Queues[key].Messages) > 0 {
numMsg := 0
messages = make([]*models.ResultMessage, 0)
for i := range models.SyncQueues.Queues[queueName].Messages {
for i := range models.SyncQueues.Queues[key].Messages {
if numMsg >= maxNumberOfMessages {
break
}
if models.SyncQueues.Queues[queueName].Messages[i].ReceiptHandle != "" {
if models.SyncQueues.Queues[key].Messages[i].ReceiptHandle != "" {
continue
}
msg := &models.SyncQueues.Queues[queueName].Messages[i]
msg := &models.SyncQueues.Queues[key].Messages[i]
if !msg.IsReadyForReceipt() {
continue
}
if models.SyncQueues.Queues[queueName].IsFIFO {
// If we got messages here it means we have not processed it yet, so get next
if models.SyncQueues.Queues[queueName].IsLocked(msg.GroupID) {
if models.SyncQueues.Queues[key].IsFIFO {
if models.SyncQueues.Queues[key].IsLocked(msg.GroupID) {
continue
}
// Otherwise lock messages for group ID
models.SyncQueues.Queues[queueName].LockGroup(msg.GroupID)
models.SyncQueues.Queues[key].LockGroup(msg.GroupID)
}
randomId := uuid.NewString()
@@ -121,26 +126,25 @@ func ReceiveMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody)
if requestBody.VisibilityTimeout != 0 {
msg.VisibilityTimeout = time.Now().Add(time.Duration(requestBody.VisibilityTimeout) * time.Second)
} else {
msg.VisibilityTimeout = time.Now().Add(time.Duration(models.SyncQueues.Queues[queueName].VisibilityTimeout) * time.Second)
msg.VisibilityTimeout = time.Now().Add(time.Duration(models.SyncQueues.Queues[key].VisibilityTimeout) * time.Second)
}
messages = append(messages, buildResultMessage(msg))
numMsg++
}
respStruct = models.ReceiveMessageResponse{
"http://queue.amazonaws.com/doc/2012-11-05/",
models.ReceiveMessageResult{
Messages: messages,
},
models.ResponseMetadata{
RequestId: "00000000-0000-0000-0000-000000000000",
},
models.ReceiveMessageResult{Messages: messages},
models.ResponseMetadata{RequestId: "00000000-0000-0000-0000-000000000000"},
}
} else {
log.Warning("No messages in Queue:", queueName)
respStruct = models.ReceiveMessageResponse{Xmlns: "http://queue.amazonaws.com/doc/2012-11-05/", Result: models.ReceiveMessageResult{}, Metadata: models.ResponseMetadata{RequestId: "00000000-0000-0000-0000-000000000000"}}
respStruct = models.ReceiveMessageResponse{
Xmlns: "http://queue.amazonaws.com/doc/2012-11-05/",
Result: models.ReceiveMessageResult{},
Metadata: models.ResponseMetadata{RequestId: "00000000-0000-0000-0000-000000000000"},
}
}
return http.StatusOK, respStruct
shared-sqs/app/gosqs/send_message.go
+24 -16
View File
@@ -1,3 +1,7 @@
// Изменено: 2026-04-09
// SendMessageV1 — добавляет сообщение в очередь тенанта.
// Ловушка #6: queueName извлекается как ПОСЛЕДНИЙ сегмент URL — при URL вида
// http://host/tenantID/queueName последний сегмент = queueName (правильно).
package gosqs
import (
@@ -9,7 +13,6 @@ import (
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
log "github.com/sirupsen/logrus"
@@ -24,39 +27,44 @@ func SendMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
log.Error("Invalid Request - SendMessageV1")
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
messageBody := requestBody.MessageBody
messageGroupID := requestBody.MessageGroupId
messageDeduplicationID := requestBody.MessageDeduplicationId
queueUrl := getQueueFromPath(requestBody.QueueUrl, req.URL.String())
queueName := ""
if queueUrl == "" {
// TODO: Remove this query param logic if it's not still valid or something
vars := mux.Vars(req)
queueName = vars["queueName"]
} else {
// Ловушка #6: берём последний сегмент — это queueName, не tenantID
uriSegments := strings.Split(queueUrl, "/")
queueName = uriSegments[len(uriSegments)-1]
}
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
// Queue does not exist
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
if models.SyncQueues.Queues[queueName].MaximumMessageSize > 0 &&
len(messageBody) > models.SyncQueues.Queues[queueName].MaximumMessageSize {
// Message size is too big
if models.SyncQueues.Queues[key].MaximumMessageSize > 0 &&
len(messageBody) > models.SyncQueues.Queues[key].MaximumMessageSize {
return utils.CreateErrorResponseV1("MessageTooBig", true)
}
delaySecs := models.SyncQueues.Queues[queueName].DelaySeconds
delaySecs := models.SyncQueues.Queues[key].DelaySeconds
if requestBody.DelaySeconds != 0 {
delaySecs = requestBody.DelaySeconds
}
log.Debugf("Putting Message in Queue: [%s]", queueName)
log.Debugf("Putting Message in Queue: [%s] tenant: [%s]", queueName, t.ID)
msg := models.SqsMessage{MessageBody: messageBody}
if len(requestBody.MessageAttributes) > 0 {
msg.MessageAttributes = requestBody.MessageAttributes
@@ -71,17 +79,17 @@ func SendMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
models.SyncQueues.Lock()
fifoSeqNumber := ""
if models.SyncQueues.Queues[queueName].IsFIFO {
fifoSeqNumber = models.SyncQueues.Queues[queueName].NextSequenceNumber(messageGroupID)
if models.SyncQueues.Queues[key].IsFIFO {
fifoSeqNumber = models.SyncQueues.Queues[key].NextSequenceNumber(messageGroupID)
}
if !models.SyncQueues.Queues[queueName].IsDuplicate(messageDeduplicationID) {
models.SyncQueues.Queues[queueName].Messages = append(models.SyncQueues.Queues[queueName].Messages, msg)
if !models.SyncQueues.Queues[key].IsDuplicate(messageDeduplicationID) {
models.SyncQueues.Queues[key].Messages = append(models.SyncQueues.Queues[key].Messages, msg)
} else {
log.Debugf("Message with deduplicationId [%s] in queue [%s] is duplicate ", messageDeduplicationID, queueName)
log.Debugf("Duplicate message deduplicationId [%s] in queue [%s]", messageDeduplicationID, queueName)
}
models.SyncQueues.Queues[queueName].InitDuplicatation(messageDeduplicationID)
models.SyncQueues.Queues[key].InitDuplicatation(messageDeduplicationID)
models.SyncQueues.Unlock()
log.Infof("%s: Queue: %s, Message: %s\n", time.Now().Format("2006-01-02 15:04:05"), queueName, msg.MessageBody)
shared-sqs/app/gosqs/send_message_batch.go
+22 -18
View File
@@ -1,3 +1,5 @@
// Изменено: 2026-04-09
// SendMessageBatchV1 — пакетная отправка сообщений в очередь тенанта.
package gosqs
import (
@@ -22,9 +24,12 @@ func SendMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
queueUrl := requestBody.QueueUrl
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
// TODO: Remove this query param logic if it's not still valid or something
queueUrl := requestBody.QueueUrl
queueName := ""
if queueUrl == "" {
vars := mux.Vars(req)
@@ -34,7 +39,9 @@ func SendMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody
queueName = uriSegments[len(uriSegments)-1]
}
if _, ok := models.SyncQueues.Queues[queueName]; !ok {
key := tenantQueueKey(t.AccessKey, queueName)
if _, ok := models.SyncQueues.Queues[key]; !ok {
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
@@ -56,7 +63,7 @@ func SendMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody
}
sentEntries := make([]models.SendMessageBatchResultEntry, 0)
log.Debug("Putting Message in Queue:", queueName)
log.Debugf("Batch sending to Queue: %s (tenant: %s)", queueName, t.ID)
for _, sendEntry := range sendEntries {
msg := models.SqsMessage{MessageBody: sendEntry.MessageBody}
if len(sendEntry.MessageAttributes) > 0 {
@@ -68,30 +75,28 @@ func SendMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody
msg.DeduplicationID = sendEntry.MessageDeduplicationId
msg.Uuid = uuid.NewString()
msg.SentTime = time.Now()
models.SyncQueues.Lock()
fifoSeqNumber := ""
if models.SyncQueues.Queues[queueName].IsFIFO {
fifoSeqNumber = models.SyncQueues.Queues[queueName].NextSequenceNumber(sendEntry.MessageGroupId)
if models.SyncQueues.Queues[key].IsFIFO {
fifoSeqNumber = models.SyncQueues.Queues[key].NextSequenceNumber(sendEntry.MessageGroupId)
}
if !models.SyncQueues.Queues[queueName].IsDuplicate(sendEntry.MessageDeduplicationId) {
models.SyncQueues.Queues[queueName].Messages = append(models.SyncQueues.Queues[queueName].Messages, msg)
if !models.SyncQueues.Queues[key].IsDuplicate(sendEntry.MessageDeduplicationId) {
models.SyncQueues.Queues[key].Messages = append(models.SyncQueues.Queues[key].Messages, msg)
} else {
log.Debugf("Message with deduplicationId [%s] in queue [%s] is duplicate ", sendEntry.MessageDeduplicationId, queueName)
log.Debugf("Duplicate deduplicationId [%s] in queue [%s]", sendEntry.MessageDeduplicationId, queueName)
}
models.SyncQueues.Queues[queueName].InitDuplicatation(sendEntry.MessageDeduplicationId)
models.SyncQueues.Queues[key].InitDuplicatation(sendEntry.MessageDeduplicationId)
models.SyncQueues.Unlock()
se := models.SendMessageBatchResultEntry{
sentEntries = append(sentEntries, models.SendMessageBatchResultEntry{
Id: sendEntry.Id,
MessageId: msg.Uuid,
MD5OfMessageBody: msg.MD5OfMessageBody,
MD5OfMessageAttributes: msg.MD5OfMessageAttributes,
SequenceNumber: fifoSeqNumber,
}
sentEntries = append(sentEntries, se)
log.Infof("%s: Queue: %s, Message: %s\n", time.Now().Format("2006-01-02 15:04:05"), queueName, msg.MessageBody)
})
log.Infof("%s: Queue: %s, Message: %s", time.Now().Format("2006-01-02 15:04:05"), queueName, msg.MessageBody)
}
respStruct := models.SendMessageBatchResponse{
@@ -101,5 +106,4 @@ func SendMessageBatchV1(req *http.Request) (int, interfaces.AbstractResponseBody
}
return http.StatusOK, respStruct
}
shared-sqs/app/gosqs/set_queue_attributes.go
+15 -9
View File
@@ -1,13 +1,15 @@
// Изменено: 2026-04-09
// SetQueueAttributesV1 — устанавливает атрибуты очереди тенанта.
// Ловушка #9: при RedrivePolicy парсим ARN DLQ и DLQ тоже должна принадлежать тому же тенанту.
package gosqs
import (
"net/http"
"strings"
"shared-sqs/app/interfaces"
"shared-sqs/app/models"
"shared-sqs/app/utils"
"shared-sqs/app/interfaces"
log "github.com/sirupsen/logrus"
)
@@ -15,25 +17,29 @@ func SetQueueAttributesV1(req *http.Request) (int, interfaces.AbstractResponseBo
requestBody := models.NewSetQueueAttributesRequest()
ok := utils.REQUEST_TRANSFORMER(requestBody, req, false)
if !ok {
log.Error("Invalid Request - GetQueueAttributesV1")
log.Error("Invalid Request - SetQueueAttributesV1")
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
if requestBody.QueueUrl == "" {
log.Error("Missing QueueUrl - GetQueueAttributesV1")
log.Error("Missing QueueUrl - SetQueueAttributesV1")
return utils.CreateErrorResponseV1("InvalidParameterValue", true)
}
// NOTE: I tore out the handling for devining the url from a param. I can't find documentation that
// that is valid any longer.
t := getTenantFromContext(req)
if t == nil {
return utils.CreateErrorResponseV1("InvalidClientTokenId", true)
}
uriSegments := strings.Split(requestBody.QueueUrl, "/")
queueName := uriSegments[len(uriSegments)-1]
key := tenantQueueKey(t.AccessKey, queueName)
log.Infof("Set Queue QueueAttributes: %s", queueName)
log.Infof("Set Queue Attributes: %s (tenant: %s)", queueName, t.ID)
models.SyncQueues.Lock()
defer models.SyncQueues.Unlock()
queue, ok := models.SyncQueues.Queues[queueName]
queue, ok := models.SyncQueues.Queues[key]
if !ok {
log.Warningf("Get Queue URL: %s, queue does not exist!!!", queueName)
log.Warningf("Set Queue Attributes: %s, queue does not exist for tenant %s", queueName, t.ID)
return utils.CreateErrorResponseV1("QueueNotFound", true)
}
if err := setQueueAttributesV1(queue, requestBody.Attributes); err != nil {
shared-sqs/app/gosqs/tenant_helpers.go
+56
View File
@@ -0,0 +1,56 @@
// Изменено: 2026-04-09
// Helper-функции для tenant-scoped операций с очередями.
// Используются всеми SQS handlers для изоляции очередей между тенантами.
package gosqs
import (
"net/http"
"shared-sqs/app/auth"
"shared-sqs/app/models"
"shared-sqs/app/tenant"
)
// tenantQueueKey — внутренний ключ очереди в SyncQueues в формате "{accessKey}:{queueName}".
// Такой формат гарантирует изоляцию: тенант видит только очереди с префиксом своего accessKey.
func tenantQueueKey(tenantAccessKey, queueName string) string {
return tenantAccessKey + ":" + queueName
}
// getTenantFromContext — извлекает тенанта из request context.
// Возвращает nil если тенант не найден (не должно быть — auth middleware должен это поймать раньше).
func getTenantFromContext(r *http.Request) *tenant.Tenant {
t, _ := r.Context().Value(auth.TenantContextKey).(*tenant.Tenant)
return t
}
// tenantQueueURL — формирует URL очереди для тенанта.
// Ловушка #10: QueueUrl ОБЯЗАН содержать tenantID в пути, иначе AWS SDK не сможет send/receive.
func tenantQueueURL(t *tenant.Tenant, queueName string) string {
host := models.CurrentEnvironment.Host
port := models.CurrentEnvironment.Port
region := models.CurrentEnvironment.Region
if region != "" {
return "http://" + region + "." + host + ":" + port + "/" + t.ID + "/" + queueName
}
return "http://" + host + ":" + port + "/" + t.ID + "/" + queueName
}
// tenantQueueARN — формирует ARN очереди для тенанта.
func tenantQueueARN(t *tenant.Tenant, queueName string) string {
return "arn:aws:sqs:" + models.CurrentEnvironment.Region + ":" + t.ID + ":" + queueName
}
// countTenantQueues — считает количество очередей тенанта в SyncQueues.
// Используется для проверки лимита MaxQueues.
// Вызывать под SyncQueues.RLock().
func countTenantQueues(tenantAccessKey string) int {
prefix := tenantAccessKey + ":"
count := 0
for key := range models.SyncQueues.Queues {
if len(key) > len(prefix) && key[:len(prefix)] == prefix {
count++
}
}
return count
}
shared-sqs/app/tenant/tenant_store.go
+142
View File
@@ -0,0 +1,142 @@
// Изменено: 2026-04-09
// Tenant model и in-memory хранилище тенантов для shared-sqs.
package tenant
import (
"crypto/rand"
"encoding/hex"
"fmt"
"sync"
"time"
)
// Tenant — модель тенанта shared-sqs.
// AccessKey используется как идентификатор в AWS Authorization header.
type Tenant struct {
ID string // уникальный идентификатор тенанта (t-<hex>)
Name string // человекочитаемое имя
AccessKey string // аналог AWS AccessKeyId (SSAK-<hex>)
SecretKey string // аналог AWS SecretAccessKey (64 hex chars)
MaxQueues int // лимит очередей (0 = безлимит)
CreatedAt time.Time
Active bool
}
// TenantStore — потокобезопасное in-memory хранилище тенантов.
// Два индекса позволяют быстро искать как по ID (admin API), так и по AccessKey (auth middleware).
type TenantStore struct {
mu sync.RWMutex
byID map[string]*Tenant
byAccessKey map[string]*Tenant
}
// NewTenantStore — создаёт пустое хранилище тенантов.
func NewTenantStore() *TenantStore {
return &TenantStore{
byID: make(map[string]*Tenant),
byAccessKey: make(map[string]*Tenant),
}
}
// Create — создаёт нового тенанта, генерирует ключи, сохраняет в оба индекса.
func (s *TenantStore) Create(name string, maxQueues int) (*Tenant, error) {
id, err := generateTenantID()
if err != nil {
return nil, fmt.Errorf("generate tenant id: %w", err)
}
accessKey, err := generateAccessKey()
if err != nil {
return nil, fmt.Errorf("generate access key: %w", err)
}
secretKey, err := generateSecretKey()
if err != nil {
return nil, fmt.Errorf("generate secret key: %w", err)
}
t := &Tenant{
ID: id,
Name: name,
AccessKey: accessKey,
SecretKey: secretKey,
MaxQueues: maxQueues,
CreatedAt: time.Now().UTC(),
Active: true,
}
s.mu.Lock()
s.byID[t.ID] = t
s.byAccessKey[t.AccessKey] = t
s.mu.Unlock()
return t, nil
}
// GetByAccessKey — поиск тенанта по AccessKeyId (используется в auth middleware).
func (s *TenantStore) GetByAccessKey(accessKey string) (*Tenant, bool) {
s.mu.RLock()
t, ok := s.byAccessKey[accessKey]
s.mu.RUnlock()
return t, ok
}
// GetByID — поиск тенанта по ID (используется в admin API).
func (s *TenantStore) GetByID(id string) (*Tenant, bool) {
s.mu.RLock()
t, ok := s.byID[id]
s.mu.RUnlock()
return t, ok
}
// Delete — удаляет тенанта из ОБОИХ индексов.
// Ловушка #2: если удалить только из одного индекса — orphaned данные и memory leak.
func (s *TenantStore) Delete(id string) bool {
s.mu.Lock()
defer s.mu.Unlock()
t, ok := s.byID[id]
if !ok {
return false
}
delete(s.byID, t.ID)
delete(s.byAccessKey, t.AccessKey)
return true
}
// List — список всех тенантов (для admin GET /tenants).
func (s *TenantStore) List() []*Tenant {
s.mu.RLock()
result := make([]*Tenant, 0, len(s.byID))
for _, t := range s.byID {
result = append(result, t)
}
s.mu.RUnlock()
return result
}
// generateTenantID — генерирует уникальный ID тенанта в формате t-<12 hex bytes>.
func generateTenantID() (string, error) {
b := make([]byte, 8)
if _, err := rand.Read(b); err != nil {
return "", err
}
return "t-" + hex.EncodeToString(b), nil
}
// generateAccessKey — генерирует AccessKey в формате SSAK-<12 hex bytes>.
// SSAK = Shared SQS Access Key. Используем crypto/rand (ловушка #1: не math/rand).
func generateAccessKey() (string, error) {
b := make([]byte, 12)
if _, err := rand.Read(b); err != nil {
return "", err
}
return "SSAK-" + hex.EncodeToString(b), nil
}
// generateSecretKey — генерирует SecretKey как 64 hex символа (32 random bytes).
// Используем crypto/rand (ловушка #1).
func generateSecretKey() (string, error) {
b := make([]byte, 32)
if _, err := rand.Read(b); err != nil {
return "", err
}
return hex.EncodeToString(b), nil
}