Janady13/missionmatch / cmd/alert-sweep/main.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / cmd/alert-sweep/main.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	1e9249840a4302ec82e123b9c9cb6f75badea3e4
Branch	master
Path or archive member	cmd/alert-sweep/main.go
Original SHA-256	edfe298969ba1a4d8723684f63ccd116d6a40b642797ea105a5288f2cb2fc093
Git blob SHA	36c81e7b1ac9103e3db3a2825d225eb7acf61d49
Reading-copy SHA-256	edfe298969ba1a4d8723684f63ccd116d6a40b642797ea105a5288f2cb2fc093

Original source ↗

Every recorded occurrence

These 9 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / cmd/alert-sweep/main.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / cmd/alert-sweep/main.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓155 lines · 5.6 KB

// Command alert-sweep runs the proactive alert engine, the watch loop, across every organization. For each
// org it runs the three triggers (a clearance about to expire, a winnable recompete that just dropped and
// fits the org's interest, an open gap the bench now structurally covers) and UPSERTs one typed, persisted,
// UI surfaceable alert per detected event, idempotently (a re sweep refreshes rather than duplicates). It is
// the scheduled job behind the host timer (the same pattern as mm-opp-sync), pure Go and FIPS clean, and safe
// to rerun.
//
// It lists organizations through the migrator role (which sees every org) and does the per org sweep through
// the NOBYPASSRLS app role under RLS, so one tenant's sweep can never read or write another's. One org failing
// does not abort the rest. Output is per type COUNTS only, never PII: no candidate id, no agency value, just
// counts. Pass -org to limit the run to a single organization.
//
// Env (server side only): MM_DATABASE_URL (the app DSN, NOBYPASSRLS, required), MM_MIGRATOR_DATABASE_URL (the
// migrator DSN, for listing orgs; falls back to MM_DATABASE_URL).
//
// Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run with GODEBUG=fips140=on.
package main

import (
	"context"
	"crypto/fips140"
	"crypto/pbkdf2"
	"crypto/sha256"
	"flag"
	"log"
	"os"
	"strings"
	"time"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5/pgxpool"

	"github.com/missionworkforce/missionmatch/internal/modules/alerts"
	"github.com/missionworkforce/missionmatch/internal/platform/audit"
	"github.com/missionworkforce/missionmatch/internal/platform/config"
	"github.com/missionworkforce/missionmatch/internal/platform/database"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

func main() {
	orgFlag := flag.String("org", "", "limit the sweep to a single organization id (default: all orgs)")
	flag.Parse()

	// FIPS self test: derive one PBKDF2 key under the active crypto module and fail closed if it errors, so a
	// build that dropped the validated module is caught at boot, the same in build FIPS gate the api and the
	// fairness-snapshot binaries use.
	if err := fipsSelfTest(); err != nil {
		log.Fatalf("alert-sweep: FIPS self test (PBKDF2 HMAC SHA 256) failed: %v", err)
	}
	log.Printf("alert-sweep: fips_enabled=%v module=%s", fips140.Enabled(), fips140.Version())

	cfg, err := config.Load()
	if err != nil {
		log.Fatalf("alert-sweep: config: %v", err)
	}
	if cfg.AppDatabaseURL == "" {
		log.Fatal("alert-sweep: MM_DATABASE_URL (the app DSN) is required")
	}
	migDSN := firstNonEmpty(os.Getenv("MM_MIGRATOR_DATABASE_URL"), cfg.AppDatabaseURL)

	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
	defer cancel()

	appPool, err := database.NewPool(ctx, cfg.AppDatabaseURL)
	if err != nil {
		log.Fatalf("alert-sweep: app pool: %v", err)
	}
	defer appPool.Close()
	// Fail closed unless this is the NOBYPASSRLS app role, so the sweep can never bypass tenant RLS.
	if err := database.AssertRole(ctx, appPool, "missionmatch_app"); err != nil {
		log.Fatalf("alert-sweep: app pool role check: %v", err)
	}
	appDB := tenant.New(appPool)

	svc := alerts.NewService(appDB, audit.New(appDB))

	orgIDs, err := listOrgs(ctx, migDSN, *orgFlag)
	if err != nil {
		log.Fatalf("alert-sweep: list orgs: %v", err)
	}
	if len(orgIDs) == 0 {
		log.Print("alert-sweep: no organizations to sweep")
		return
	}

	var swept int
	var totClearance, totRecompete, totGap, totCollision int
	for _, orgID := range orgIDs {
		orgCtx := tenant.WithOrg(ctx, orgID.String())
		sum, serr := svc.SweepOrg(orgCtx)
		if serr != nil {
			// One org failing must not abort the schedule for the rest. Log the org id (not PII) and move on.
			log.Printf("alert-sweep: org %s sweep failed: %v", orgID, serr)
			continue
		}
		swept++
		totClearance += sum.ClearanceExpiring
		totRecompete += sum.RecompeteWinnable
		totGap += sum.GapFillable
		totCollision += sum.Collision
		log.Printf("alert-sweep: org %s swept, clearance_expiring=%d recompete_winnable=%d gap_fillable=%d collision=%d total=%d",
			orgID, sum.ClearanceExpiring, sum.RecompeteWinnable, sum.GapFillable, sum.Collision, sum.Total())
	}
	log.Printf("alert-sweep: done, %d of %d org(s) swept, clearance_expiring=%d recompete_winnable=%d gap_fillable=%d collision=%d",
		swept, len(orgIDs), totClearance, totRecompete, totGap, totCollision)
}

// listOrgs returns the organization ids to sweep. It uses the migrator role, which sees every org, so a single
// sweep run can cover the cluster; the per org work then runs under the app role and RLS. A passed -org limits
// the run to one organization.
func listOrgs(ctx context.Context, migDSN, only string) ([]uuid.UUID, error) {
	if only != "" {
		id, err := uuid.Parse(strings.TrimSpace(only))
		if err != nil {
			return nil, err
		}
		return []uuid.UUID{id}, nil
	}
	pool, err := pgxpool.New(ctx, migDSN)
	if err != nil {
		return nil, err
	}
	defer pool.Close()
	rows, err := pool.Query(ctx, "SELECT id FROM organizations ORDER BY id")
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []uuid.UUID
	for rows.Next() {
		var id uuid.UUID
		if err := rows.Scan(&id); err != nil {
			return nil, err
		}
		out = append(out, id)
	}
	return out, rows.Err()
}

func firstNonEmpty(vals ...string) string {
	for _, v := range vals {
		if s := strings.TrimSpace(v); s != "" {
			return s
		}
	}
	return ""
}

// fipsSelfTest derives one PBKDF2 HMAC SHA 256 key at a representative cost under the active crypto module. It
// fails closed if the module is absent or errors, so a non FIPS build is caught at boot.
func fipsSelfTest() error {
	_, err := pbkdf2.Key(sha256.New, "alert-sweep-self-test", []byte("alert-sweep-salt"), 600000, 32)
	return err
}