Actual providers implementation

This defines the provider implementations in such a way that we can instantiate them and check if a rule type is able to accomodate for those. This is done through a new `ProviderBuidler` implementation which is in charge of instantiating the provider type that's needed at a given time. Note that we still use the GitHub provider for HTTP calls since it has a lot of handy features (such as rate limiting handling) that we could leverage.
mindersec · Sep 25, 2023 · 0478927 · 0478927
1 parent a5a5476
commit 0478927
Show file tree

Hide file tree

Showing 31 changed files with 922 additions and 404 deletions.
diff --git a/Makefile b/Makefile
@@ -144,4 +144,4 @@ dbschema:	## generate database schema with schema spy, monitor file until doc is
 
 mock:
 	mockgen -package mockdb -destination database/mock/store.go github.com/stacklok/mediator/internal/db Store
-	mockgen -package mockgh -destination internal/providers/github/mock/github.go -source internal/providers/github/github.go RestAPI
+	mockgen -package mockgh -destination internal/providers/github/mock/github.go -source pkg/providers/v1/providers.go GitHub 
diff --git a/cmd/dev/app/rule_type/rule_type.go b/cmd/dev/app/rule_type/rule_type.go
@@ -30,10 +30,11 @@ import (
 	"google.golang.org/protobuf/reflect/protoreflect"
 
 	"github.com/stacklok/mediator/cmd/dev/app"
+	"github.com/stacklok/mediator/internal/db"
 	"github.com/stacklok/mediator/internal/engine"
 	"github.com/stacklok/mediator/internal/engine/eval/rego"
 	"github.com/stacklok/mediator/internal/entities"
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
+	"github.com/stacklok/mediator/internal/providers"
 	"github.com/stacklok/mediator/internal/util"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
 )
@@ -105,12 +106,19 @@ func testCmdRun(cmd *cobra.Command, _ []string) error {
 		return fmt.Errorf("error getting relevant fragment: %w", err)
 	}
 
-	client, err := getProviderClient(context.Background(), rt, token)
-	if err != nil {
-		return fmt.Errorf("error getting provider client: %w", err)
-	}
-
-	eng, err := engine.NewRuleTypeEngine(rt, client, token)
+	// TODO: Read this from a providers file instead so we can make it pluggable
+	eng, err := engine.NewRuleTypeEngine(rt, providers.NewProviderBuilder(
+		&db.Provider{
+			Name: "test",
+			Implements: []db.ProviderType{
+				"rest",
+				"git",
+				"github",
+			},
+		},
+		db.ProviderAccessToken{},
+		token,
+	))
 	if err != nil {
 		return fmt.Errorf("error creating rule type engine: %w", err)
 	}
@@ -201,18 +209,3 @@ func readEntityFromFile(fpath string, entType pb.Entity) (protoreflect.ProtoMess
 
 	return out, nil
 }
-
-// getProviderClient returns a client for the provider specified in the rule type
-// definition.
-// TODO: This should be moved to a provider package and we should have some
-// generic interface for clients.
-func getProviderClient(ctx context.Context, rt *pb.RuleType, token string) (ghclient.RestAPI, error) {
-	switch rt.Context.Provider {
-	case ghclient.Github:
-		return ghclient.NewRestClient(ctx, ghclient.GitHubConfig{
-			Token: token,
-		}, "")
-	default:
-		return nil, fmt.Errorf("unknown provider: %s", rt.Context.Provider)
-	}
-}
diff --git a/internal/container/container.go b/internal/container/container.go
@@ -44,9 +44,9 @@ import (
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
 	"github.com/stacklok/mediator/internal/util"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
+	provifv1 "github.com/stacklok/mediator/pkg/providers/v1"
 )
 
 // REGISTRY is the default registry
@@ -80,7 +80,7 @@ var (
 // GetArtifactSignatureAndWorkflowInfo returns the signature and workflow information as raw JSON for a given artifact
 func GetArtifactSignatureAndWorkflowInfo(
 	ctx context.Context,
-	cli ghclient.RestAPI,
+	cli provifv1.Provider,
 	ownerLogin, artifactName, versionName string,
 ) (sigInfo json.RawMessage, workflowInfo json.RawMessage, err error) {
 	imageRef := artifactImageRef("", ownerLogin, artifactName, versionName)

diff --git a/internal/controlplane/handlers_githubwebhooks.go b/internal/controlplane/handlers_githubwebhooks.go
@@ -49,9 +49,9 @@ import (
 	"github.com/stacklok/mediator/internal/db"
 	"github.com/stacklok/mediator/internal/engine"
 	"github.com/stacklok/mediator/internal/providers"
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
 	"github.com/stacklok/mediator/internal/util"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
+	provifv1 "github.com/stacklok/mediator/pkg/providers/v1"
 )
 
 // CONTAINER_TYPE is the type for container artifacts
@@ -134,7 +134,7 @@ func (s *Server) HandleGitHubWebHook() http.HandlerFunc {
 		// TODO: extract sender and event time from payload portably
 		m := message.NewMessage(uuid.New().String(), nil)
 		m.Metadata.Set("id", github.DeliveryID(r))
-		m.Metadata.Set("provider", ghclient.Github)
+		m.Metadata.Set("provider", string(db.ProviderTypeGithub))
 		m.Metadata.Set("source", "https://api.github.com/") // TODO: handle other sources
 
 		m.Metadata.Set("type", github.WebHookType(r))
@@ -374,11 +374,23 @@ func (s *Server) parseArtifactPublishedEvent(
 		return fmt.Errorf("error getting provider: %w", err)
 	}
 
-	cli, err := providers.BuildClient(ctx, dbrepo.Provider, g, s.store, s.cryptoEngine)
+	p, err := providers.GetProviderBuilder(ctx, prov, g, s.store, s.cryptoEngine)
 	if err != nil {
 		return fmt.Errorf("error building client: %w", err)
 	}
 
+	// NOTE(jaosorior): this webhook is very specific to github
+	if !p.Implements(db.ProviderTypeGithub) {
+		log.Printf("provider %s is not supported for github webhook", p.GetName())
+		return nil
+	}
+
+	cli, err := p.GetGitHub(ctx)
+	if err != nil {
+		log.Printf("error creating github provider: %v", err)
+		return nil
+	}
+
 	versionedArtifact, err := gatherVersionedArtifact(ctx, cli, s.store, whPayload)
 	if err != nil {
 		return fmt.Errorf("error gathering versioned artifact: %w", err)
@@ -419,11 +431,23 @@ func (s *Server) parsePullRequestModEvent(
 		return fmt.Errorf("error getting provider: %w", err)
 	}
 
-	cli, err := providers.BuildClient(ctx, prov.Name, g, s.store, s.cryptoEngine)
+	p, err := providers.GetProviderBuilder(ctx, prov, g, s.store, s.cryptoEngine)
 	if err != nil {
 		return fmt.Errorf("error building client: %w", err)
 	}
 
+	// NOTE(jaosorior): this webhook is very specific to github
+	if !p.Implements(db.ProviderTypeGithub) {
+		log.Printf("provider %s is not supported for github webhook", p.GetName())
+		return nil
+	}
+
+	cli, err := p.GetGitHub(ctx)
+	if err != nil {
+		log.Printf("error creating github provider: %v", err)
+		return nil
+	}
+
 	prEvalInfo, err := getPullRequestInfoFromPayload(ctx, whPayload)
 	if err != nil {
 		return fmt.Errorf("error getting pull request information from payload: %w", err)
@@ -502,7 +526,7 @@ func extractArtifactVersionFromPayload(ctx context.Context, payload map[string]a
 
 func gatherArtifactInfo(
 	ctx context.Context,
-	client ghclient.RestAPI,
+	client provifv1.GitHub,
 	payload map[string]any,
 ) (*pb.Artifact, error) {
 	artifact, err := extractArtifactFromPayload(ctx, payload)
@@ -561,7 +585,7 @@ func lookUpVersionBySignature(
 
 func gatherArtifactVersionInfo(
 	ctx context.Context,
-	cli ghclient.RestAPI,
+	cli provifv1.GitHub,
 	payload map[string]any,
 	artifactOwnerLogin, artifactName string,
 ) (*pb.ArtifactVersion, error) {
@@ -582,7 +606,7 @@ func gatherArtifactVersionInfo(
 
 func gatherVersionedArtifact(
 	ctx context.Context,
-	cli ghclient.RestAPI,
+	cli provifv1.GitHub,
 	store db.Store,
 	payload map[string]any,
 ) (*pb.VersionedArtifact, error) {
@@ -623,7 +647,7 @@ func gatherVersionedArtifact(
 
 func storeSignatureAndWorkflowInVersion(
 	ctx context.Context,
-	client ghclient.RestAPI,
+	client provifv1.GitHub,
 	artifactOwnerLogin, artifactName, packageVersionName string,
 	version *pb.ArtifactVersion,
 ) error {
@@ -651,7 +675,7 @@ func storeSignatureAndWorkflowInVersion(
 
 func updateArtifactVersionFromRegistry(
 	ctx context.Context,
-	client ghclient.RestAPI,
+	client provifv1.GitHub,
 	payload map[string]any,
 	artifactOwnerLogin, artifactName string,
 	version *pb.ArtifactVersion,
@@ -828,7 +852,7 @@ func getPullRequestInfoFromPayload(
 
 func updatePullRequestInfoFromProvider(
 	ctx context.Context,
-	cli ghclient.RestAPI,
+	cli provifv1.GitHub,
 	dbrepo db.Repository,
 	prEvalInfo *pb.PullRequest,
 ) error {

diff --git a/internal/engine/eval/eval.go b/internal/engine/eval/eval.go
@@ -24,12 +24,12 @@ import (
 	"github.com/stacklok/mediator/internal/engine/eval/rego"
 	"github.com/stacklok/mediator/internal/engine/eval/vulncheck"
 	engif "github.com/stacklok/mediator/internal/engine/interfaces"
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
+	"github.com/stacklok/mediator/internal/providers"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
 )
 
 // NewRuleEvaluator creates a new rule data evaluator
-func NewRuleEvaluator(rt *pb.RuleType, cli ghclient.RestAPI) (engif.Evaluator, error) {
+func NewRuleEvaluator(rt *pb.RuleType, cli *providers.ProviderBuilder) (engif.Evaluator, error) {
 	e := rt.Def.GetEval()
 	if e == nil {
 		return nil, fmt.Errorf("rule type missing eval configuration")

diff --git a/internal/engine/eval/vulncheck/actions.go b/internal/engine/eval/vulncheck/actions.go
@@ -21,8 +21,8 @@ import (
 
 	"github.com/google/go-github/v53/github"
 
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
+	provifv1 "github.com/stacklok/mediator/pkg/providers/v1"
 )
 
 type prStatusHandler interface {
@@ -38,7 +38,7 @@ func newPrStatusHandler(
 	ctx context.Context,
 	action action,
 	pr *pb.PullRequest,
-	client ghclient.RestAPI,
+	client provifv1.GitHub,
 ) (prStatusHandler, error) {
 	switch action {
 	case actionReviewPr:

diff --git a/internal/engine/eval/vulncheck/review.go b/internal/engine/eval/vulncheck/review.go
@@ -27,8 +27,8 @@ import (
 	"github.com/google/go-github/v53/github"
 	"github.com/rs/zerolog"
 
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
+	provifv1 "github.com/stacklok/mediator/pkg/providers/v1"
 )
 
 const (
@@ -100,7 +100,7 @@ func countLeadingWhitespace(line string) int {
 
 func locateDepInPr(
 	_ context.Context,
-	client ghclient.RestAPI,
+	client provifv1.GitHub,
 	dep *pb.PrDependencies_ContextualDependency,
 ) (*reviewLocation, error) {
 	req, err := client.NewRequest("GET", dep.File.PatchUrl, nil)
@@ -138,7 +138,7 @@ func reviewBodyWithSuggestion(comment string) string {
 }
 
 type reviewPrHandler struct {
-	cli ghclient.RestAPI
+	cli provifv1.GitHub
 	pr  *pb.PullRequest
 
 	mediatorReview *github.PullRequestReview
@@ -163,7 +163,7 @@ func withVulnsFoundReviewStatus(status *string) reviewPrHandlerOption {
 func newReviewPrHandler(
 	ctx context.Context,
 	pr *pb.PullRequest,
-	cli ghclient.RestAPI,
+	cli provifv1.GitHub,
 	opts ...reviewPrHandlerOption,
 ) (*reviewPrHandler, error) {
 	if pr == nil {
@@ -352,7 +352,7 @@ type commitStatusPrHandler struct {
 func newCommitStatusPrHandler(
 	ctx context.Context,
 	pr *pb.PullRequest,
-	client ghclient.RestAPI,
+	client provifv1.GitHub,
 ) (prStatusHandler, error) {
 	// create a reviewPrHandler and embed it in the commitStatusPrHandler
 	rph, err := newReviewPrHandler(

diff --git a/internal/engine/eval/vulncheck/review_test.go b/internal/engine/eval/vulncheck/review_test.go
@@ -45,7 +45,7 @@ func TestReviewPrHandlerNoVulnerabilities(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockClient := mock_ghclient.NewMockRestAPI(ctrl)
+	mockClient := mock_ghclient.NewMockGitHub(ctrl)
 	pr := &pb.PullRequest{
 		Url:       "https://api.github.com/repos/jakubtestorg/bad-npm/pulls/43",
 		CommitSha: commitSHA,
@@ -86,7 +86,7 @@ func TestReviewPrHandlerVulnerabilitiesDifferentIdentities(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockClient := mock_ghclient.NewMockRestAPI(ctrl)
+	mockClient := mock_ghclient.NewMockGitHub(ctrl)
 	pr := &pb.PullRequest{
 		Url:       "https://api.github.com/repos/jakubtestorg/bad-npm/pulls/43",
 		CommitSha: commitSHA,
@@ -173,7 +173,7 @@ func TestReviewPrHandlerVulnerabilitiesDismissReview(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockClient := mock_ghclient.NewMockRestAPI(ctrl)
+	mockClient := mock_ghclient.NewMockGitHub(ctrl)
 	pr := &pb.PullRequest{
 		Url:       "https://api.github.com/repos/jakubtestorg/bad-npm/pulls/43",
 		CommitSha: commitSHA,
@@ -225,7 +225,7 @@ func TestCommitStatusHandlerNoVulnerabilities(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockClient := mock_ghclient.NewMockRestAPI(ctrl)
+	mockClient := mock_ghclient.NewMockGitHub(ctrl)
 	pr := &pb.PullRequest{
 		Url:       "https://api.github.com/repos/jakubtestorg/bad-npm/pulls/43",
 		CommitSha: commitSHA,
@@ -273,7 +273,7 @@ func TestCommitStatusPrHandlerWithVulnerabilities(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()
 
-	mockClient := mock_ghclient.NewMockRestAPI(ctrl)
+	mockClient := mock_ghclient.NewMockGitHub(ctrl)
 	pr := &pb.PullRequest{
 		Url:       "https://api.github.com/repos/jakubtestorg/bad-npm/pulls/43",
 		CommitSha: commitSHA,

diff --git a/internal/engine/eval/vulncheck/vulncheck.go b/internal/engine/eval/vulncheck/vulncheck.go
@@ -20,8 +20,9 @@ import (
 	"fmt"
 
 	engif "github.com/stacklok/mediator/internal/engine/interfaces"
-	ghclient "github.com/stacklok/mediator/internal/providers/github"
+	"github.com/stacklok/mediator/internal/providers"
 	pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
+	provifv1 "github.com/stacklok/mediator/pkg/providers/v1"
 )
 
 const (
@@ -31,13 +32,22 @@ const (
 
 // Evaluator is the vulncheck evaluator
 type Evaluator struct {
-	cli ghclient.RestAPI
+	cli provifv1.GitHub
 }
 
 // NewVulncheckEvaluator creates a new vulncheck evaluator
-func NewVulncheckEvaluator(_ *pb.RuleType_Definition_Eval_Vulncheck, cli ghclient.RestAPI) (*Evaluator, error) {
+func NewVulncheckEvaluator(_ *pb.RuleType_Definition_Eval_Vulncheck, pbuild *providers.ProviderBuilder) (*Evaluator, error) {
+	if pbuild == nil {
+		return nil, fmt.Errorf("provider builder is nil")
+	}
+
+	ghcli, err := pbuild.GetGitHub(context.Background())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get github client: %w", err)
+	}
+
 	return &Evaluator{
-		cli: cli,
+		cli: ghcli,
 	}, nil
 }