Merge pull request #4 from LumeWeb/feat/tls-get-certificate-throttle

feat: add tls_get_certificate event with throttled status webhooks

Author: pcfreak30

config.go

@@ -2,18 +2,21 @@ package certwebhook
 
 import (
 	"os"
+	"time"
 )
 
 const (
 	GatewaySecretHeader = "X-Gateway-Secret"
 
-	EnvGatewaySecret = "GATEWAY_SECRET"
-	EnvPortalURL     = "PORTAL_URL"
+	EnvGatewaySecret    = "GATEWAY_SECRET"
+	EnvPortalURL        = "PORTAL_URL"
+	EnvThrottleInterval = "THROTTLE_INTERVAL"
 )
 
 type Config struct {
-	PortalURL     string
-	GatewaySecret string
+	PortalURL        string
+	GatewaySecret    string
+	ThrottleInterval string
 }
 
 func (c *Config) Provision() {
@@ -23,6 +26,23 @@ func (c *Config) Provision() {
 	if c.GatewaySecret == "" {
 		c.GatewaySecret = os.Getenv(EnvGatewaySecret)
 	}
+	if c.ThrottleInterval == "" {
+		c.ThrottleInterval = os.Getenv(EnvThrottleInterval)
+	}
+}
+
+func (c *Config) throttleInterval() time.Duration {
+	if c.ThrottleInterval == "" {
+		return defaultThrottleInterval
+	}
+	d, err := time.ParseDuration(c.ThrottleInterval)
+	if err != nil {
+		return defaultThrottleInterval
+	}
+	if d <= 0 {
+		return defaultThrottleInterval
+	}
+	return d
 }
 
 func (c *Config) Validate() error {

config_test.go

@@ -0,0 +1,54 @@
+package certwebhook
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConfigThrottleInterval_Default(t *testing.T) {
+	c := &Config{}
+	assert.Equal(t, defaultThrottleInterval, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_ValidDuration(t *testing.T) {
+	c := &Config{ThrottleInterval: "10m"}
+	assert.Equal(t, 10*time.Minute, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_Seconds(t *testing.T) {
+	c := &Config{ThrottleInterval: "30s"}
+	assert.Equal(t, 30*time.Second, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_InvalidString(t *testing.T) {
+	c := &Config{ThrottleInterval: "not a duration"}
+	assert.Equal(t, defaultThrottleInterval, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_Zero(t *testing.T) {
+	c := &Config{ThrottleInterval: "0"}
+	assert.Equal(t, defaultThrottleInterval, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_Negative(t *testing.T) {
+	c := &Config{ThrottleInterval: "-5m"}
+	assert.Equal(t, defaultThrottleInterval, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_EnvFallback(t *testing.T) {
+	t.Setenv(EnvThrottleInterval, "15m")
+	c := &Config{}
+	c.Provision()
+	assert.Equal(t, "15m", c.ThrottleInterval)
+	assert.Equal(t, 15*time.Minute, c.throttleInterval())
+}
+
+func TestConfigThrottleInterval_ExplicitOverEnv(t *testing.T) {
+	t.Setenv(EnvThrottleInterval, "15m")
+	c := &Config{ThrottleInterval: "2m"}
+	c.Provision()
+	assert.Equal(t, "2m", c.ThrottleInterval)
+	assert.Equal(t, 2*time.Minute, c.throttleInterval())
+}

events.go

@@ -11,54 +11,44 @@ import (
 	"go.uber.org/zap"
 )
 
-// Caddy event names for certificate lifecycle
 const (
-	// EventCertObtained is fired when a certificate is first obtained
 	EventCertObtained = "cert_obtained"
 
-	// EventCertRenewed is fired when a certificate is renewed
 	EventCertRenewed = "cert_renewed"
 
-	// EventCertExpired is fired when a certificate expires
 	EventCertExpired = "cert_expired"
+
+	EventTLSGetCertificate = "tls_get_certificate"
 )
 
-// Log message constants
 const (
 	LogMsgEventsAppNotAvailable      = "events app not available"
 	LogMsgEventsAppNotExpectedType   = "events app is not of expected type"
 	LogMsgSubscribedToCertObtained   = "subscribed to cert_obtained event"
 	LogMsgSubscribedToCertRenewed    = "subscribed to cert_renewed event"
 	LogMsgSubscribedToCertExpired    = "subscribed to cert_expired event"
+	LogMsgSubscribedToTLSGetCert     = "subscribed to tls_get_certificate event"
 	LogMsgUnknownEventType          = "unknown event type"
 	LogMsgFailedToExtractEventData   = "failed to extract event data"
 	LogMsgFailedToMapEventToStatus   = "failed to map event to status"
 	LogMsgCertificateEventProcessed = "certificate event processed"
+	LogMsgTLSGetCertThrottled       = "tls_get_certificate event throttled"
+	LogMsgTLSGetCertProcessed       = "tls_get_certificate event processed"
 )
 
-// EventData represents certificate event data from Caddy
 type EventData struct {
-	// Domain is the certificate domain name
 	Domain string `json:"domain"`
 
-	// Timestamp is when the event occurred (ISO 8601 format)
 	Timestamp string `json:"timestamp"`
 
-	// Error is any error that occurred during certificate operation
 	Error string `json:"error,omitempty"`
 
-	// Raw is the raw event data for debugging
 	Raw map[string]any `json:"-"`
 
-	// EventType is the type of event (cert_obtained, cert_renewed, cert_expired)
 	EventType string `json:"event_type"`
 }
 
-// Event handlers for certificate lifecycle events
-
-// subscribeToEvents registers handlers for certificate events
 func (h *CertWebhookApp) subscribeToEvents(ctx caddy.Context) error {
-	// Get the events app from context
 	eventsAppIface, err := ctx.App("events")
 	if err != nil {
 		h.logger.Warn(LogMsgEventsAppNotAvailable, zap.Error(err))
@@ -71,10 +61,8 @@ func (h *CertWebhookApp) subscribeToEvents(ctx caddy.Context) error {
 		return nil
 	}
 
-	// Store reference for cleanup
 	h.eventsApp = eventsApp
 
-	// Subscribe to cert_obtained event
 	if err := eventsApp.On(EventCertObtained, h); err != nil {
 		return fmt.Errorf("failed to subscribe to cert_obtained event: %w", err)
 	}
@@ -90,23 +78,28 @@ func (h *CertWebhookApp) subscribeToEvents(ctx caddy.Context) error {
 	}
 	h.logger.Info(LogMsgSubscribedToCertExpired)
 
+	if err := eventsApp.On(EventTLSGetCertificate, h); err != nil {
+		return fmt.Errorf("failed to subscribe to tls_get_certificate event: %w", err)
+	}
+	h.logger.Info(LogMsgSubscribedToTLSGetCert)
+
 	return nil
 }
 
-// Handle implements caddyevents.Handler interface to process certificate events
 func (h *CertWebhookApp) Handle(ctx context.Context, data caddy.Event) error {
 	eventName := data.Name()
 
 	switch eventName {
 	case EventCertObtained, EventCertRenewed, EventCertExpired:
 		return h.handleCertEvent(eventName, data)
+	case EventTLSGetCertificate:
+		return h.handleTLSGetCertificateEvent(data)
 	default:
 		h.logger.Warn(LogMsgUnknownEventType, zap.String("event", eventName))
 		return nil
 	}
 }
 
-// handleCertEvent processes certificate lifecycle events (obtained, renewed, expired)
 func (h *CertWebhookApp) handleCertEvent(eventType string, data caddy.Event) error {
 	h.logger.Debug("handling cert event", zap.String("event_type", eventType))
 
@@ -126,6 +119,14 @@ func (h *CertWebhookApp) handleCertEvent(eventType string, data caddy.Event) err
 		return err
 	}
 
+	if !h.shouldSend(eventData.Domain, status) {
+		h.logger.Debug("cert event throttled",
+			zap.String("event_type", eventType),
+			zap.String("domain", eventData.Domain),
+			zap.String("status", string(status)))
+		return nil
+	}
+
 	h.logger.Info(LogMsgCertificateEventProcessed,
 		zap.String("event_type", eventType),
 		zap.String("domain", eventData.Domain),
@@ -135,6 +136,55 @@ func (h *CertWebhookApp) handleCertEvent(eventType string, data caddy.Event) err
 	return h.sendWebhook(eventData.Domain, status, eventData.Error, eventData.Timestamp)
 }
 
+func (h *CertWebhookApp) handleTLSGetCertificateEvent(data caddy.Event) error {
+	domain, err := extractDomainFromClientHello(data)
+	if err != nil {
+		h.logger.Debug("failed to extract domain from tls_get_certificate", zap.Error(err))
+		return nil
+	}
+
+	status := h.certStatusFn(domain)
+
+	if !h.shouldSend(domain, status) {
+		h.logger.Debug(LogMsgTLSGetCertThrottled,
+			zap.String("domain", domain),
+			zap.String("status", string(status)))
+		return nil
+	}
+
+	timestamp := time.Now().UTC().Format(time.RFC3339)
+
+	h.logger.Info(LogMsgTLSGetCertProcessed,
+		zap.String("domain", domain),
+		zap.String("status", string(status)),
+		zap.String("timestamp", timestamp))
+
+	return h.sendWebhook(domain, status, "", timestamp)
+}
+
+func extractDomainFromClientHello(event caddy.Event) (string, error) {
+	if len(event.Data) == 0 {
+		return "", fmt.Errorf("event data is empty")
+	}
+
+	raw := make(map[string]any)
+	if err := decodeJSON(event.Data, &raw); err != nil {
+		return "", fmt.Errorf("failed to unmarshal event data: %w", err)
+	}
+
+	clientHello, ok := raw["client_hello"].(map[string]any)
+	if !ok {
+		return "", fmt.Errorf("client_hello not found in event data")
+	}
+
+	serverName, ok := clientHello["ServerName"].(string)
+	if !ok || serverName == "" {
+		return "", fmt.Errorf("ServerName not found in client_hello")
+	}
+
+	return serverName, nil
+}
+
 // extractEventData extracts domain, timestamp, and error information from Caddy event data
 func (h *CertWebhookApp) extractEventData(eventType string, event caddy.Event) (*EventData, error) {
 	data := &EventData{

events_test.go

@@ -0,0 +1,75 @@
+package certwebhook
+
+import (
+	"testing"
+
+	"github.com/caddyserver/caddy/v2"
+)
+
+func TestExtractDomainFromClientHello(t *testing.T) {
+	tests := []struct {
+		name    string
+		data    map[string]any
+		want    string
+		wantErr bool
+	}{
+		{
+			name: "valid client_hello with ServerName",
+			data: map[string]any{
+				"client_hello": map[string]any{
+					"ServerName": "example.com",
+				},
+			},
+			want:    "example.com",
+			wantErr: false,
+		},
+		{
+			name: "empty ServerName",
+			data: map[string]any{
+				"client_hello": map[string]any{
+					"ServerName": "",
+				},
+			},
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "empty event data",
+			data:    map[string]any{},
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name: "client_hello not a map",
+			data: map[string]any{
+				"client_hello": "not a map",
+			},
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name: "ServerName not a string",
+			data: map[string]any{
+				"client_hello": map[string]any{
+					"ServerName": 123,
+				},
+			},
+			want:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			event := caddy.Event{Data: tt.data}
+			got, err := extractDomainFromClientHello(event)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("extractDomainFromClientHello() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("extractDomainFromClientHello() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}