Module: ZeroClick::Sellers::Stateful::Dispatch

Defined in:
lib/zeroclick/sellers/stateful/dispatch.rb

Overview

Route, verify, validate, and dispatch stateful seller requests.

Defined Under Namespace

Classes: Prepared

Class Method Summary collapse

Class Method Details

.handle_access_request(request, on_write:, on_mint:, base_path:, remint_policy:, signing_secrets: nil, resolve_signing_secret: nil, max_skew_seconds: Verify::ACCESS_SKEW_SECONDS, clock: -> { Time.now.to_i }, on_handler_error: nil) ⇒ Object

Handle one stateful request, or return nil when the route is not ours.

nil means "not a stateful route" — serve it normally. Every MATCHED route always yields a response: a handler failure becomes the 503 ZeroClick retries, rather than an exception escaping into the seller's request path.



196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 196

def handle_access_request(request, on_write:, on_mint:, base_path:, remint_policy:,
                          signing_secrets: nil, resolve_signing_secret: nil,
                          max_skew_seconds: Verify::ACCESS_SKEW_SECONDS,
                          clock: -> { Time.now.to_i }, on_handler_error: nil)
  prepared = prepare(
    request, base_path: base_path, signing_secrets: signing_secrets,
             resolve_signing_secret: resolve_signing_secret, max_skew_seconds: max_skew_seconds,
             clock: clock, on_handler_error: on_handler_error
  )
  return prepared if prepared.nil? || prepared.is_a?(Response)

  begin
    if prepared.operation == "write"
      write_response(on_write.call(prepared.write))
    else
      mint_result_response(on_mint.call(prepared.mint), remint_policy)
    end
  rescue Error => e
    # A handler that returned something malformed is the seller's bug,
    # not an outage — but it still must not escape into their stack.
    raise e if e.operation == "handle_access_request"

    unavailable(e, prepared.operation, on_handler_error)
  rescue StandardError => e
    unavailable(e, prepared.operation, on_handler_error)
  end
end

.match_operation(method, path_and_query, base_path) ⇒ Object

Two routes only: POST writes an entitlement, POST

/:accessId/keys mints a key. The purpose that goes into the signature is chosen HERE, from the matched route — never from anything the caller sent. 


44
45
46
47
48
49
50
51
52
53
54
55
56
57
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 44

def match_operation(method, path_and_query, base_path)
  pathname = path_and_query.split("?", 2).first.to_s
  request = segments(pathname)
  base = segments(base_path)
  return nil if request.length < base.length || request[0, base.length] != base

  tail = request[base.length..]
  verb = method.upcase

  return ["write", nil] if verb == "POST" && tail.empty?
  return ["mint", URI.decode_www_form_component(tail[0])] if verb == "POST" && tail.length == 2 && tail[1] == "keys"

  nil
end

.mint_result_response(result, remint_policy) ⇒ Object 



164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 164

def mint_result_response(result, remint_policy)
  case result
  when MintUnknown
    # No body: there is nothing to say about an account we do not have.
    Response.new(status: 404, body: "", headers: {})
  when MintConflict
    Response.json({ "error" => result.code }, status: 409)
  when MintNotProvisioned
    hint = result.retry_after_seconds
    headers = hint.nil? || hint <= 0 ? {} : { "retry-after" => hint.to_s }
    Response.json({ "error" => "not_provisioned" }, status: 409, headers: headers)
  when MintKey
    expires = result.key_expires_at
    expires = expires.iso8601 if expires.respond_to?(:iso8601)
    Responses.mint_response(
      api_key: result.api_key,
      # A rotating policy holds exactly one live key, so say so.
      max_keys: remint_policy == "rotating" ? 1 : nil,
      key_expires_at: expires
    )
  else
    raise Error.new("malformed_input", operation: "handle_access_request",
                                       message: "on_mint must return a MintResult")
  end
end

.prepare(request, base_path:, signing_secrets:, resolve_signing_secret:, max_skew_seconds:, clock:, on_handler_error:) ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 73

def prepare(request, base_path:, signing_secrets:, resolve_signing_secret:,
            max_skew_seconds:, clock:, on_handler_error:)
  unless request.is_a?(Request)
    raise Error.new("malformed_input", operation: "handle_access_request",
                                       message: "request must be a ZeroClick::Sellers::Request")
  end
  if signing_secrets.nil? == resolve_signing_secret.nil?
    raise Error.new("malformed_input", operation: "handle_access_request",
                                       message: "Provide exactly one of signing_secrets or resolve_signing_secret")
  end

  matched = match_operation(request.method, request.path_and_query, base_path)
  return nil if matched.nil?

  operation, matched_access_id = matched

  request_id = request.header("zc-request-id")
  agent_id = request.header("zc-agent-id")
  return Responses.auth_error_response("missing_or_malformed_signature") if request_id.to_s.empty? || agent_id.to_s.empty?

  begin
    verification = Verify.verify_access_signature(
      signature_header: request.header("zc-signature"),
      method: request.method, path_and_query: request.path_and_query, body: request.body,
      request_id: request_id, agent_id: agent_id,
      purpose: operation == "write" ? "access.write" : "access.mint",
      signing_secrets: signing_secrets, resolve_signing_secret: resolve_signing_secret,
      max_skew_seconds: max_skew_seconds, clock: clock
    )
  rescue StandardError => e
    return unavailable(e, operation, on_handler_error)
  end
  return Responses.auth_error_response(verification.code) unless verification.ok?

  # The unsigned mirror of the body's signed buyer. On disagreement we
  # refuse rather than pick a side — trusting either one would let the
  # unsigned header decide who is billed.
  header_buyer_id = request.header("zc-buyer-id")

  begin
    body = request.body.to_s.empty? ? nil : JSON.parse(request.body)

    return prepare_write(body, request, request_id, agent_id, header_buyer_id, verification) if operation == "write"

    mint_request = Contracts.parse_mint_key_request(body)
    if mint_request.nil? || mint_request.agent_id != agent_id
      return Response.json({ "error" => "agent_mismatch" }, status: 400)
    end
    return Response.json({ "error" => "buyer_mismatch" }, status: 400) if header_buyer_id != mint_request.buyer_id

    Prepared.new(
      operation: "mint",
      mint: MintInput.new(
        access_id: matched_access_id, request_id: request_id,
        dedupe_key: "mint:#{request_id}", agent_id: agent_id,
        buyer_id: mint_request.buyer_id, kid: verification.kid
      )
    )
  rescue StandardError => e
    unavailable(e, operation, on_handler_error)
  end
end

.prepare_write(body, request, request_id, agent_id, header_buyer_id, verification) ⇒ Object 



136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 136

def prepare_write(body, request, request_id, agent_id, header_buyer_id, verification)
  parsed = Entitlement.parse(body)
  return Response.json({ "error" => "invalid_entitlement" }, status: 400) unless parsed.ok?

  entitlement = parsed.entitlement
  # Identity cross-checks. The signature proves the request came from
  # ZeroClick; these prove it is about the caller it claims.
  return Response.json({ "error" => "agent_mismatch" }, status: 400) if entitlement.agent_id != agent_id
  return Response.json({ "error" => "buyer_mismatch" }, status: 400) if header_buyer_id != entitlement.buyer_id
  if request.header("zc-buyer-email") != entitlement.buyer_email
    return Response.json({ "error" => "buyer_email_mismatch" }, status: 400)
  end

  Prepared.new(
    operation: "write",
    write: WriteInput.new(
      access_id: entitlement.access_id, entitlement: entitlement,
      request_id: request_id, dedupe_key: "write:#{request_id}",
      agent_id: agent_id, buyer_id: entitlement.buyer_id,
      buyer_email: entitlement.buyer_email, kid: verification.kid
    )
  )
end

.segments(path) ⇒ Object 



36
37
38
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 36

def segments(path)
  path.split("/").reject(&:empty?)
end

.unavailable(error, operation, on_handler_error) ⇒ Object 



59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 59

def unavailable(error, operation, on_handler_error)
  if on_handler_error
    # Observability must not change retry semantics: a callback that
    # raises cannot turn a 503 into an exception.
    begin
      on_handler_error.call(error, operation)
    rescue StandardError # rubocop:disable Lint/SuppressedException
    end
  end
  Responses.seller_unavailable_response
end

.write_response(result) ⇒ Object 



160
161
162
 
# File 'lib/zeroclick/sellers/stateful/dispatch.rb', line 160

def write_response(result)
  Responses.upsert_response(lifecycle: result.lifecycle, retry_after_seconds: result.retry_after_seconds)
end