main.go

// bomhort-bridge is a PoC webhook bridge between Harbor and BOMHort.
//
// Flow: Harbor fires a SCANNING_COMPLETED webhook after an SBOM scan ->
// the bridge reads sbom_repository/sbom_digest from the payload, pulls the
// SBOM accessory blob from Harbor's registry API, and drops the SBOM JSON
// into the directory BOMHort's ingestion-watcher polls (SBOM_DIR).
//
// Files are named <project>__<repo>@<artifact-digest>.spdx.json so a re-scan
// of the same artifact digest overwrites instead of duplicating, and written
// with a "_" prefix first (BOMHort's watcher ignore-prefix) then renamed, so
// the watcher never sees a half-written file. Before writing, the SBOM is
// normalized: the per-run scan metadata (creationInfo.created,
// documentNamespace, annotationDate) is pinned to fixed values, so re-scans
// of an unchanged artifact produce identical bytes and downstream
// content-hash dedup works without tracking any previous version.
package main

import (
	"bytes"
	"context"
	"crypto/tls"
	"encoding/json"
	"fmt"
	"io"
	"log"
	"net/http"
	"net/url"
	"os"
	"path/filepath"
	"strings"
	"time"
)

const scanningCompleted = "SCANNING_COMPLETED"

// maxSBOMSize caps blob downloads; SPDX SBOMs for large images run a few MB.
const maxSBOMSize = 100 << 20

type config struct {
	listenAddr  string
	harborURL   string // e.g. http://localhost:8090
	username    string // robot account or admin
	password    string
	sbomDir     string // BOMHort's watched directory
	webhookAuth string // optional: must match the webhook's Authorization header
	insecure    bool   // skip TLS verify for self-signed Harbor
}

func loadConfig() (*config, error) {
	cfg := &config{
		listenAddr:  envOr("LISTEN_ADDR", ":9099"),
		harborURL:   strings.TrimRight(os.Getenv("HARBOR_URL"), "/"),
		username:    os.Getenv("HARBOR_USERNAME"),
		password:    os.Getenv("HARBOR_PASSWORD"),
		sbomDir:     envOr("SBOM_DIR", "./sboms"),
		webhookAuth: os.Getenv("WEBHOOK_AUTH"),
		insecure:    os.Getenv("INSECURE_SKIP_VERIFY") == "true",
	}
	if cfg.harborURL == "" {
		return nil, fmt.Errorf("HARBOR_URL is required")
	}
	if cfg.username == "" || cfg.password == "" {
		return nil, fmt.Errorf("HARBOR_USERNAME and HARBOR_PASSWORD are required")
	}
	return cfg, nil
}

func envOr(key, def string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return def
}

// --- Harbor webhook payload (subset we need) ---

type webhookPayload struct {
	Type      string `json:"type"`
	EventData struct {
		Resources []struct {
			Digest       string         `json:"digest"`
			Tag          string         `json:"tag"`
			SBOMOverview map[string]any `json:"sbom_overview"`
		} `json:"resources"`
		Repository struct {
			RepoFullName string `json:"repo_full_name"`
		} `json:"repository"`
	} `json:"event_data"`
}

// --- OCI manifest (subset we need) ---

type ociManifest struct {
	Layers []struct {
		MediaType string `json:"mediaType"`
		Digest    string `json:"digest"`
	} `json:"layers"`
}

type bridge struct {
	cfg    *config
	client *http.Client
}

func main() {
	cfg, err := loadConfig()
	if err != nil {
		log.Fatalf("config: %v", err)
	}
	if err := os.MkdirAll(cfg.sbomDir, 0o755); err != nil {
		log.Fatalf("creating SBOM_DIR %s: %v", cfg.sbomDir, err)
	}

	b := &bridge{cfg: cfg, client: newHTTPClient(cfg.insecure)}

	mux := http.NewServeMux()
	mux.HandleFunc("POST /webhook", b.handleWebhook)
	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusOK)
	})

	log.Printf("bomhort-bridge listening on %s, dropping SBOMs into %s", cfg.listenAddr, cfg.sbomDir)
	log.Fatal(http.ListenAndServe(cfg.listenAddr, mux))
}

func newHTTPClient(insecure bool) *http.Client {
	tr := http.DefaultTransport.(*http.Transport).Clone()
	if insecure {
		tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
	}
	return &http.Client{Timeout: 60 * time.Second, Transport: tr}
}

func (b *bridge) handleWebhook(w http.ResponseWriter, r *http.Request) {
	if b.cfg.webhookAuth != "" && r.Header.Get("Authorization") != b.cfg.webhookAuth {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}

	var payload webhookPayload
	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<20)).Decode(&payload); err != nil {
		http.Error(w, "bad payload", http.StatusBadRequest)
		return
	}

	if payload.Type != scanningCompleted {
		log.Printf("ignoring event type %q", payload.Type)
		w.WriteHeader(http.StatusOK)
		return
	}

	repoFullName := payload.EventData.Repository.RepoFullName
	processed := 0
	for _, res := range payload.EventData.Resources {
		sbomRepo, _ := res.SBOMOverview["sbom_repository"].(string)
		sbomDigest, _ := res.SBOMOverview["sbom_digest"].(string)
		if sbomRepo == "" || sbomDigest == "" {
			// Vulnerability-scan completion events have no sbom_overview.
			log.Printf("resource %s@%s: no sbom_overview, skipping", repoFullName, res.Digest)
			continue
		}

		ctx, cancel := context.WithTimeout(r.Context(), 45*time.Second)
		err := b.fetchAndDrop(ctx, sbomRepo, sbomDigest, repoFullName, res.Digest)
		cancel()
		if err != nil {
			log.Printf("ERROR: %s@%s: %v", repoFullName, res.Digest, err)
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		processed++
	}

	log.Printf("event %s: handled %d SBOM resource(s)", payload.Type, processed)
	w.WriteHeader(http.StatusOK)
}

// fetchAndDrop pulls the SBOM accessory (an OCI manifest whose single layer
// blob is the raw SBOM JSON) and writes it atomically into SBOM_DIR.
func (b *bridge) fetchAndDrop(ctx context.Context, sbomRepo, sbomDigest, repoFullName, artifactDigest string) error {
	manifestURL := fmt.Sprintf("%s/v2/%s/manifests/%s", b.cfg.harborURL, sbomRepo, sbomDigest)
	manifestBytes, err := b.registryGet(ctx, manifestURL, sbomRepo, "application/vnd.oci.image.manifest.v1+json")
	if err != nil {
		return fmt.Errorf("fetching accessory manifest: %w", err)
	}

	var manifest ociManifest
	if err := json.Unmarshal(manifestBytes, &manifest); err != nil {
		return fmt.Errorf("parsing accessory manifest: %w", err)
	}
	if len(manifest.Layers) == 0 {
		return fmt.Errorf("accessory manifest %s has no layers", sbomDigest)
	}

	blobURL := fmt.Sprintf("%s/v2/%s/blobs/%s", b.cfg.harborURL, sbomRepo, manifest.Layers[0].Digest)
	sbomBytes, err := b.registryGet(ctx, blobURL, sbomRepo, "")
	if err != nil {
		return fmt.Errorf("fetching SBOM blob: %w", err)
	}

	normalized, err := normalizeSBOM(sbomBytes, artifactDigest)
	if err != nil {
		return fmt.Errorf("normalizing SBOM: %w", err)
	}

	name := sbomFileName(repoFullName, artifactDigest)
	if existing, err := os.ReadFile(filepath.Join(b.cfg.sbomDir, name)); err == nil && bytes.Equal(existing, normalized) {
		log.Printf("skipped %s (no change after normalization)", name)
		return nil
	}
	if err := writeAtomic(b.cfg.sbomDir, name, normalized); err != nil {
		return fmt.Errorf("writing %s: %w", name, err)
	}
	log.Printf("dropped %s (%d bytes)", name, len(normalized))
	return nil
}

// scannerRunEpoch replaces the per-run timestamps the scanner stamps into
// every SBOM. SPDX requires these fields to exist, so they are pinned to a
// fixed value rather than removed.
const scannerRunEpoch = "1970-01-01T00:00:00Z"

// normalizeSBOM pins the fields the scanner regenerates on every run even
// when the artifact is unchanged: creationInfo.created, the random
// documentNamespace UUID, and the annotationDate on every annotation. With
// them pinned, scanning the same artifact digest always produces identical
// bytes, so downstream content-hash dedup (BOMHort's watcher) works without
// the bridge having to remember any previous version. Keys are re-marshalled
// in sorted order, which makes the output deterministic.
func normalizeSBOM(data []byte, artifactDigest string) ([]byte, error) {
	var doc map[string]any
	if err := json.Unmarshal(data, &doc); err != nil {
		return nil, err
	}
	if _, ok := doc["documentNamespace"]; ok {
		doc["documentNamespace"] = "urn:harbor:sbom:" + artifactDigest
	}
	if ci, ok := doc["creationInfo"].(map[string]any); ok {
		ci["created"] = scannerRunEpoch
	}
	pinAnnotationDates(doc)
	return json.Marshal(doc)
}

// pinAnnotationDates sets every annotationDate at any depth to the fixed value.
func pinAnnotationDates(v any) {
	switch t := v.(type) {
	case map[string]any:
		if _, ok := t["annotationDate"]; ok {
			t["annotationDate"] = scannerRunEpoch
		}
		for _, child := range t {
			pinAnnotationDates(child)
		}
	case []any:
		for _, child := range t {
			pinAnnotationDates(child)
		}
	}
}

// sbomFileName derives a stable, filesystem/S3-safe identity for the SBOM:
// project/repo@sha256:abc -> project__repo@sha256-abc.spdx.json.
// Re-scanning the same artifact digest maps to the same file name.
func sbomFileName(repoFullName, artifactDigest string) string {
	repo := strings.ReplaceAll(repoFullName, "/", "__")
	digest := strings.ReplaceAll(artifactDigest, ":", "-")
	if repo == "" {
		repo = "unknown"
	}
	if digest == "" {
		digest = "unknown"
	}
	return fmt.Sprintf("%s@%s.spdx.json", repo, digest)
}

// writeAtomic writes under a "_"-prefixed temp name (which BOMHort's
// ingestion-watcher skips) and renames into place.
func writeAtomic(dir, name string, data []byte) error {
	tmp := filepath.Join(dir, "_incoming-"+name)
	if err := os.WriteFile(tmp, data, 0o644); err != nil {
		return err
	}
	if err := os.Rename(tmp, filepath.Join(dir, name)); err != nil {
		os.Remove(tmp)
		return err
	}
	return nil
}

// registryGet performs an authenticated GET against Harbor's registry API.
// It tries basic auth first and, on a 401 bearer challenge, fetches a pull
// token from the advertised realm (Harbor's /service/token) and retries.
func (b *bridge) registryGet(ctx context.Context, rawURL, repo, accept string) ([]byte, error) {
	do := func(authHeader string) (*http.Response, error) {
		req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
		if err != nil {
			return nil, err
		}
		if accept != "" {
			req.Header.Set("Accept", accept)
		}
		req.Header.Set("Authorization", authHeader)
		return b.client.Do(req)
	}

	basic := "Basic " + basicAuth(b.cfg.username, b.cfg.password)
	resp, err := do(basic)
	if err != nil {
		return nil, err
	}

	if resp.StatusCode == http.StatusUnauthorized {
		challenge := resp.Header.Get("Www-Authenticate")
		resp.Body.Close()
		token, err := b.fetchBearerToken(ctx, challenge, repo)
		if err != nil {
			return nil, fmt.Errorf("bearer token: %w", err)
		}
		resp, err = do("Bearer " + token)
		if err != nil {
			return nil, err
		}
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
		return nil, fmt.Errorf("GET %s: %s: %s", rawURL, resp.Status, strings.TrimSpace(string(body)))
	}
	return io.ReadAll(io.LimitReader(resp.Body, maxSBOMSize))
}

// fetchBearerToken parses a `Bearer realm="...",service="..."` challenge and
// exchanges basic credentials for a pull-scoped registry token.
func (b *bridge) fetchBearerToken(ctx context.Context, challenge, repo string) (string, error) {
	realm, service := parseBearerChallenge(challenge)
	if realm == "" {
		return "", fmt.Errorf("no bearer realm in challenge %q", challenge)
	}

	q := url.Values{}
	if service != "" {
		q.Set("service", service)
	}
	q.Set("scope", fmt.Sprintf("repository:%s:pull", repo))

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, realm+"?"+q.Encode(), nil)
	if err != nil {
		return "", err
	}
	req.SetBasicAuth(b.cfg.username, b.cfg.password)

	resp, err := b.client.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("token endpoint %s: %s", realm, resp.Status)
	}

	var tok struct {
		Token       string `json:"token"`
		AccessToken string `json:"access_token"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&tok); err != nil {
		return "", err
	}
	if tok.Token != "" {
		return tok.Token, nil
	}
	return tok.AccessToken, nil
}

func parseBearerChallenge(header string) (realm, service string) {
	rest, ok := strings.CutPrefix(header, "Bearer ")
	if !ok {
		return "", ""
	}
	for _, part := range strings.Split(rest, ",") {
		key, val, ok := strings.Cut(strings.TrimSpace(part), "=")
		if !ok {
			continue
		}
		val = strings.Trim(val, `"`)
		switch key {
		case "realm":
			realm = val
		case "service":
			service = val
		}
	}
	return realm, service
}

func basicAuth(user, pass string) string {
	req, _ := http.NewRequest(http.MethodGet, "http://x", nil)
	req.SetBasicAuth(user, pass)
	return strings.TrimPrefix(req.Header.Get("Authorization"), "Basic ")
}