relay/service.cc

Go to the documentation of this file.

/*
 * Copyright 2006-2009 Savarese Software Research Corporation
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.savarese.com/software/ApacheLicense-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <ssrc/wispers/relay/service.h>
#include <ssrc/wispers/renderer/util.h>
#include <ssrc/wispers/utility/PropertiesToString.h>

#include <boost/filesystem/operations.hpp>

#ifdef WSPR_DEBUG
#  include <ssrc/wispers/utility/print_memusage.h>
#endif

__BEGIN_NS_SSRC_WSPR_RELAY

using namespace NS_SSRC_WSPR_LUA;
using NS_SSRC_WSPR_RENDERER::init_path_pattern;
using NS_SSRC_WSPR_SESSION::SessionData;
using NS_SSRC_WSPR_SESSION::session_ptr;
using NS_SSRC_WSPR_UTILITY::PropertiesToString;

Relay::Relay(caller_type & caller, const RelayInitializer & initializer)
  SSRC_DECL_THROW(LoadError, std::invalid_argument) :
  super(caller, initializer),
  _service_conf_dir(initializer.service_config_dir),
  _to_table(super::_lua_state)
{
  add_service_type(protocol_traits::service_type());
  // WARNING: normalize() is deprecated
  _service_conf_dir.normalize();

  if(!boost::filesystem::is_directory(_service_conf_dir))
    throw std::invalid_argument(initializer.service_config_dir);

  init_path_pattern(_post_path_pattern,
                    initializer.content_dirs,
                    initializer.post_leaf_pattern);

  WISP_SERVICE_REQUEST(MessageClearCaches);
}

inline void Relay::clear_caches() {
  _action_config_cache.clear();
  clear_template_cache();
}

void Relay::process_request(const MessageClearCaches & msg,
                            const MessageInfo &)
{
#ifdef WSPR_DEBUG
  std::cerr << name() << ": Clearing caches." << std::endl;
#endif
  clear_caches();
}

void Relay::process_request(const MessageReloadConfig & msg,
                            const MessageInfo & msginfo)
{
  clear_caches();
  super::process_request(msg, msginfo);
}

namespace {

  inline Relay::action_config_ptr
  action_config(lua_State *state, const string & action_name) {
    Relay::action_config_ptr config(new ActionConfig);

    config->action  = action_name;
    config->one_way = get_field<bool>(false, state, -1, "one_way");
    config->requires_session =
      get_field<bool>(false, state, -1, "requires_session");
    config->verify_session =
      get_field<bool>(config->requires_session, state, -1, "verify_session");
    config->updates_access_time =
      get_field<bool>(true, state, -1, "updates_access_time");
    config->clears_session =
      get_field<bool>(false, state, -1, "clears_session");
    // TODO: Need a more flexible session cookie creation configuration system.
    // Session creator should return cookie configuration info in
    // MessageResponse.
    config->creates_session =
      get_field<unsigned int>(0, state, -1, "creates_session");
    config->creates_secure_session =
      get_field<bool>(false, state, -1, "creates_secure_session");
    config->permits_get = get_field<bool>(false, state, -1, "permits_get");
    config->result_is_event =
      get_field<bool>(false, state, -1, "result_is_event");
    config->target   = get_field<string>(state, -1, "target");
    config->call     = get_field<string>(action_name, state, -1, "call");
    config->redirect = get_field<string>(state, -1, "redirect");
    config->failure_redirect =
      get_field<string>(state, -1, "redirect_on_failure");
    config->result_template = get_field<string>(state, -1, "template");
    config->cache_result_template =
      get_field<bool>(false, state, -1, "cache_template");
    config->failure_template =
      get_field<string>(state, -1, "template_on_failure");

    if(config->result_template.empty()) {
      config->result_template = config->call;
      config->result_template.append(".result");
    }

    return config;
  }

}


// TOOO: Decide whether or not it's better to prefetch all the
// actions from the file and cache them instead of just the
// single action.  For a long-running system, the extra file accesses
// get amortized over many requests.
inline const Relay::action_config_ptr
Relay::get_action(const string & service_name, const string & action_name) {
  const string && key = service_name + "#" + action_name;
  action_config_map::const_iterator it = _action_config_cache.find(key);

  if(it != _action_config_cache.end()) {
    return it->second;
  }

  path && action_path = _service_conf_dir / service_name;
  action_path.replace_extension(".conf");

  if(boost::filesystem::is_regular_file(action_path)) {
    // For now, action file returns a table whose keys are action names
    if(luaL_dofile(_lua_state, action_path.string().c_str())) {
#ifdef WSPR_DEBUG
      std::cerr << "ActionConfig load error: " << key << " : "
                << lua_tostring(_lua_state, -1) << std::endl;
#endif
      lua_pop(_lua_state, 1);
      return action_config_ptr();
    }

    lua_getfield(_lua_state, -1, action_name.c_str());

    if(!lua_istable(_lua_state, -1)) {
      lua_pop(_lua_state, 2);
      return action_config_ptr();
    }

    const action_config_ptr && action = action_config(_lua_state, action_name);

    lua_pop(_lua_state, 2);

    if(action->invalid())
      return action_config_ptr();

    std::pair<action_config_map::iterator,bool> result =
      _action_config_cache.insert(action_config_map::value_type(key, action));

    if(result.second) {
      return action;
    }
  }

  return action_config_ptr();
}

// Find leaf or request URL and see if it matches something
// acceptable.  Render error on anything unexpected (factor out error
// rendering from Renderer into a separate method).  Read service
// config file, defining the action mappings.  Next examine query string
// and convert to a WebServiceRequest.  Send request
// using future.  Complete request with continuation.
void Relay::http_post(const request_ptr & request, response_ptr & response,
                      parameter_map && parameters)
{
  using namespace NS_SSRC_WSPR_FCGI;

  const HTTPRequestMethod request_method = request->http_request_method();
  const boost::regex & path_pattern = (request_method == MethodPost ?
                                       _post_path_pattern : _get_path_pattern);
  HTTPStatusCode status = StatusBadRequest;

  const path script_name = request->script_name();
  path && document_path = request->document_root() / script_name;
  path && parent_path = _template_dir / script_name;

  // WARNING: normalize() is deprecated
  document_path.normalize();
  parent_path.normalize();

#ifdef WSPR_DEBUG
  std::cerr << "DOCUMENT PATH: " << document_path.string()
            << "\nSCRIPT NAME: " << script_name.string()
            << "\nQUERY STRING: " << request->query_string()
            << "\nPATTERN: " << path_pattern << std::endl;
#endif

  do {
    if(!boost::regex_match(document_path.string(), path_pattern))
      break;

    parameter_map::const_iterator it = parameters.find("action");

    if(it == parameters.end())
      break;

    const action_config_ptr action_ptr =
      get_action(parent_path.filename().string(), it->second);

    if(!action_ptr || (request_method == MethodGet && !action_ptr->permits_get))
      break;

    FinishPostContext context(request_method, request, response,
                              parent_path, action_ptr,
                              std::forward<parameter_map>(parameters));
    const ActionConfig & action = *action_ptr;

    if(action.requires_session) {
      const sid_type & sid = response->session_id();

      status = StatusForbidden;

      if(sid.empty())
        break;

      // TODO: Should we always fetch the session whether or not the
      // action requires a session?  At the very least, we should
      // probably touch it.  So we need an UpdateAccessTime one way
      // call.
      _caller.future_callp<CallGetSession>(
                      boost::bind(&Relay::continue_post, this, context, _1),
                                           SessionProtocol::service_group(),
                                           sid,
                                           action.updates_access_time);
      response->suspend();
    } else if(action.creates_session) {
      // Login cross-site request forgery protection via HTTP header insertion.
      // We disallow non-JavaScript form submission to create sessions.
      const char *xsrf =
        context.request->fcgx_get_param("HTTP_WISPERS_XSRF_LOGIN");

      if(xsrf == 0 || *xsrf != '1')
        break;

      if(!action.one_way && !action.clears_session) {
        _caller.future_callp<CallCreateSession>(
                         boost::bind(&Relay::continue_post, this, context, _1),
                         SessionProtocol::service_group(),
                         response->session_id());
        response->suspend();
      }
    }

    if(action.clears_session)
      response->clear_session_id();

    if(!response->suspended())
      continue_post(context, MessageSingleQueryResult());
  
    status = StatusOK;
  } while(0);

  if(status != StatusOK) {
    send_error(status, request, response, find_error_template(parent_path));
  }
}

void Relay::continue_post(FinishPostContext & context,
                          const MessageSingleQueryResult & session_result)
{
  using namespace NS_SSRC_WSPR_FCGI;

  HTTPStatusCode status = StatusBadRequest;
  const ActionConfig & action = *context.action;
  response_type & response = *context.response;

  do {
    response.resume();

    if(action.requires_session && !session_result.found) {
      response.clear_session_id();
      status = StatusForbidden;
      break;
    }

    // Cross-site request forgery protection via double-cookie submission
    // for XMLHttpRequest and via xsrf_token for vanilla form submission.
    // It is the developer's responsibility to never set
    // permits_get = true for actions that modify data or have side-effects.
    //if(sid != request->header_value("Wispers-Verify-Session"))
    if(action.verify_session && context.request_method != MethodGet &&
       session_result.result.sid !=
       context.request->env_value("HTTP_WISPERS_VERIFY_SESSION"))
    {
      parameter_map::const_iterator && it =
        context.parameters.find("wspr_xsrf_token");
      if(it == context.parameters.end() ||
         it->second != session_result.result.xsrf_token)
         break;
    }

    session_ptr session(session_result.found ? 
                        new SessionData(session_result.result) : 0);

    if(action.one_way) {
      _caller.sendp<CallOneWay>(action.target,
                                action.call,
                                context.parameters,
                                session);
      if(!action.redirect.empty())
        response.send_redirect(action.redirect);
    } else {
      _caller.future_callp<CallTwoWay>(
                         boost::bind(&Relay::finish_post, this, context, _1),
                                       action.target,
                                       action.call,
                                       context.parameters,
                                       session);
      response.suspend();
    }

    status = StatusOK;
  } while(0);

  if(status != StatusOK) {
    send_error(status, context.request, context.response,
               find_error_template(context.parent_path));
  } else if(!response.suspended() && !response.completed())
    response.complete();
}


namespace {
  string to_json_event(const Properties *node) {
    std::ostringstream json;

    json << "/*(";

    if(node) {
      PropertiesToString to_json(json, PropertiesToString::ToJSON);
      to_json(*node);
    }

    json << ")*/";
    return json.str();
  }
}

void Relay::finish_post(FinishPostContext & context,
                        const MessageResponse & result)
{
  using namespace NS_SSRC_WSPR_FCGI;

  HTTPStatusCode status = StatusInternalServerError;
  const ActionConfig & action = *context.action;
  response_type & response = *context.response;

  do {
    response.resume();

    lua_rawgeti(_lua_state, LUA_REGISTRYINDEX, _lua_init_global_environment_ref);
    try {
      pcall(_lua_state);
    } catch(const LuaCallError & lce) {
#ifdef WSPR_DEBUG
      std::cerr << "ERROR!  " << lce.what() << std::endl;
#endif
      set_value(_lua_state, lce.what(), "wspr", "message", "debug");
      status = StatusInternalServerError;
      break;
    }

    const string & status_msg = result.status_message();
    if(!status_msg.empty()) {
      set_value(_lua_state, status_msg, "wspr", "message", "status");
    }

    if(!result.error()) {
      // Note: An action that is requires_session and clears_session should
      // still return the session data, so we don't do a
      // !action.clears_session check.

      if(action.requires_session && !result.session) {
        response.clear_session_id();
        status = StatusForbidden;
        break;
      }

      if(action.creates_session && !action.clears_session) {
        if(!result.session)
          response.clear_session_id();
        else if(response.session_id() != result.session->sid)
          response.set_session_id(result.session->sid, action.creates_session,
                                  action.creates_secure_session);
      }

      // TODO: pull this out into a separate execution flow to avoid
      // calling init_global_environment.  Refactor entire function to avoid
      // so many conditional statements.  Also, optimize this to minimize
      // memory allocations.
      if(action.result_is_event) {
        status = StatusOK;
        string && content =
          to_json_event(result.template_data->find("wspr", "event"));
        response.complete(&content[0], content.size(), true);
        break;
      }

      path template_path = action.result_template;
      string redirect = action.redirect;

      if(result.failed()) {
        set_value(_lua_state, true, "wspr", "status", "failure");

        if(!action.failure_template.empty()) {
          template_path = action.failure_template;
          redirect.clear();
        }

        if(!action.failure_redirect.empty())
          redirect = action.failure_redirect;
      }

      if(!redirect.empty()) {
        response.send_redirect(redirect);
        status = StatusOK;
        break;
      }

      // Render result.
      if(template_path.has_root_path())
        template_path = _template_dir / template_path;
      else
        template_path = context.parent_path / template_path.relative_path();

      // WARNING: normalize() is deprecated
      template_path.normalize();

      // Limit all templates to fall under the template directory.
      // We don't want to allow arbitrary access to the file system.
      // TODO: Make this a reusable function because it's also done in
      // renderer.
#ifdef WSPR_DEBUG
      std::cerr << "PREFIX: " << _template_prefix << std::endl
                << "TEMPLATE PATH: " << template_path.string() << std::endl;
#endif

      if(template_path.string().find(_template_prefix) != 0)
        break;

      lua_getglobal(_lua_state, "wspr");
      if(result.template_data) {
        properties_to_table(_to_table, *result.template_data);
      } else {
        lua_newtable(_lua_state);
      }
      lua_setfield(_lua_state, -2, "response");
      if(result.session) {
        properties_to_table(_to_table, *(result.session->attributes));
        push_value(_lua_state, result.session->xsrf_token);
        lua_setfield(_lua_state, -2, "xsrf_token");
        lua_setfield(_lua_state, -2, "session");
      }
      lua_pop(_lua_state, 1);

      try {
        lua_rawgeti(_lua_state, LUA_REGISTRYINDEX, _lua_render_ref);

        // TODO: Clean this up!
        const bool cache_template =
          (action.cache_result_template && !result.failed());
        const path && ltp_file =
          load_template_args(template_path, cache_template, cache_template);

        try {
          if(result.session) {
            pcall_nopop(5, 2, _lua_state, ltp_file.string(),
                        &context.request, &context.response, &result.session);
          } else {
            pcall_nopop(4, 2, _lua_state, ltp_file.string(),
                        &context.request, &context.response);
          }
        } catch(const LuaCallError & lce) {
#ifdef WSPR_DEBUG
          std::cerr << "LuaCallError: " << lce.what() << std::endl;
#endif
          set_value(_lua_state, lce.what(), "wspr", "message", "debug");
          uncache_template(ltp_file.string());
          break;
        }
      } catch(const LoadError & le) {
#ifdef WSPR_DEBUG
        std::cerr << "LoadError: " << le.what() << std::endl;
#endif
        lua_pop(_lua_state, 1);
        set_value(_lua_state, le.what(), "wspr", "message", "debug");
        status = StatusNotFound;
        break;
      } catch(const LuaCallError & lce) {
#ifdef WSPR_DEBUG
        std::cerr << "LuaCallError: " << lce.what() << std::endl;
#endif
        set_value(_lua_state, lce.what(), "wspr", "message", "debug");
        status = StatusInternalServerError;
        break;
      }

      status = StatusOK;

      if(lua_isstring(_lua_state, -2)) {
        if(!response.suspended() && !response.completed()) {
          response.set_status(StatusOK);

          std::size_t content_length = 0;
          const char *content = lua_tolstring(_lua_state, -2, &content_length);

          // TODO: What about content type???  Define in action.conf???

          response.complete(content, content_length,
                            get_field<bool>(_lua_state, -1, "wspr", "client_cache_disabled"));
        }
      } else {
        send_error(static_cast<HTTPStatusCode>(lua_tointeger(_lua_state, -2)),
                   context.request, context.response,
                   find_error_template(context.parent_path, -1));
      }

      lua_pop(_lua_state, 2);
    }
  } while(0);

  if(status != StatusOK) {
    send_error(status, context.request, context.response,
               find_error_template(context.parent_path));
  }

  lua_rawgeti(_lua_state, LUA_REGISTRYINDEX, _lua_init_global_environment_ref);
  // Ignore errors.
  lua_pcall(_lua_state, 0, 0, 0);

#ifdef WSPR_DEBUG
  std::cerr << "END FINISH POST\nLUA MEMUSE: "
            << (lua_gc(_lua_state, LUA_GCCOUNT, 0)*1024 +
                lua_gc(_lua_state, LUA_GCCOUNTB, 0))
            << std::endl;

  lua_gc(_lua_state, LUA_GCCOLLECT, 0);

  std::cerr << "LUA MEMUSE: " << (lua_gc(_lua_state, LUA_GCCOUNT, 0)*1024 +
                                  lua_gc(_lua_state, LUA_GCCOUNTB, 0))
            << std::endl;
#  if defined(WISPERS_HAVE_GET_MEMUSAGE)
  NS_SSRC_WSPR_UTILITY::print_memusage();
#  endif

#endif
}

__END_NS_SSRC_WSPR_RELAY